Spyware / Malware / Virus Removal

Windows hangs on startup; System Restore won't "take"

18 min read

Looking for the outcome? Ask AI

MudBird Topic Starter

Post #1August 25, 2010, 8:59 PM UTC

This problem has been dragging on for months, and I have almost quit trying to use my computer. When I turn it on, I see "Windows is Starting" but Windows never actually starts. If I reset the same thing happens again, but after two or three resets it will finally start in Safe mode, and offers me the option of doing a System Restore. I've restored it several times now, and after each restore I get one or a few good startups and then it reverts to hanging up as before.

When Windows does open normally, there is an error message that says (roughly) "Security information is missing or has been modified. Program will be terminated". However, there is no mention of WHICH program will be terminated, and I have been unable to figure this out. Sometimes a dialog opens, asking if I want to run a debugger. I tried the Visual Basic debugger a couple of times, but as far as I could tell it couldn't find or open the program that needed debugging.

Side note: among other things, Windows seems to be trying to open Corel Video Studio, an eval version which I uninstalled and removed sometime after this problem started. I think there is still some component or reference to it in the startup routine, but this isn't the primary problem. However, I would like to get rid of it.

Thank you kindly for any help you may offer.

Mrs. E. Ramos

Here is the revised HiJackThis log:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 1:44:00 PM, on 8/25/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Program Files\Kontiki\KService.exe
C:\WINDOWS\system32\lxdccoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Kontiki\KHost.exe
C:\Program Files\YouSendIt\Express\YouSendIt.exe
C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Java\Java Update\jucheck.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HiJackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe"
O4 - HKLM\..\Run: [lxdcmon.exe] "C:\Program Files\Lexmark 1300 Series\lxdcmon.exe"
O4 - HKLM\..\Run: [lxdcamon] "C:\Program Files\Lexmark 1300 Series\lxdcamon.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [YouSendIt.exe] C:\Program Files\YouSendIt\Express\YouSendIt.exe -ui none
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Download Manager.lnk = C:\Program Files\Snocap\Download Manager\NodeStarter.exe
O4 - Global Startup: Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .csm: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .csml: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cub: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .cube: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .dx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .emb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .embl: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .gau: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .jdx: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mol: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .mop: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .pdb: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .rxn: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .scr: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .skc: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .spt: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .tgf: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O12 - Plugin for .xyz: C:\Program Files\Internet Explorer\Plugins\npchime.dll
O15 - Trusted Zone: http://www.bigcountry.co.uk
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1144355937828
O18 - Filter: application/xhtml+xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: application/xhtml+xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: text/xml; charset=iso-8859-1 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O18 - Filter: text/xml; charset=utf-8 - {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CaCCProvSP - Unknown owner - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\ISafe.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe
O23 - Service: LexBce Server (LexBceS) - Unknown owner - C:\WINDOWS\system32\LEXBCES.EXE (file missing)
O23 - Service: lxdcCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe
O23 - Service: lxdc_device - - C:\WINDOWS\system32\lxdccoms.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\VetMsg.exe

–
End of file - 10670 bytes

Satchfan

Post #2August 26, 2010, 8:16 AM UTC

Hello MudBird and welcome to WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem. Please read the following guidelines which will help to make cleaning your machine easier:
• Please do not install/uninstall any programs unless asked to.
• Please do not run any scans other than those requested
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
Please note that I am still in training and my replies need to be checked by an expert in order for you to receive the best possible advice. This may result in a small delay between my posts but I shall try to keep this to a minimum.

I am looking through your log now and will reply as soon as possible.

Satchfan

Satchfan

Post #3August 26, 2010, 4:09 PM UTC

Hello again MudBird

Run OTL

Download OTL to your Desktop

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under the Custom Scan box paste this in: netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%PROGRAMFILES%\Internet Explorer\*.dat
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your next reply.

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.

Extract the contents of the zipped file to desktop.
Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.

[external image: Posted Image]
Click the image to enlarge it
In the right panel, you will see several boxes that have been checked. Uncheck the following …
- IAT/EAT
- All drives/partitions except C:\)
- Show All (don't miss this one)
Then click the Scan button & wait for it to finish.
Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
Save it where you can easily find it, such as your desktop, and attach it in your reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

Logs to include with next post:

OTL.txt
Extras.txt
Gmer.txt

Thanks

Satchfan

MudBird

Post #4August 27, 2010, 3:43 PM UTC

Okay, Satchfan, thank you very much. It took my a while to do the scans but here they are:

OTL logfile created on: 8/26/2010 10:24:24 PM - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\Eman\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 157.00 Mb Available Physical Memory | 31.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.32 Gb Total Space | 25.40 Gb Free Space | 34.18% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GEOLOGIST
Current User Name: Eman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\cavrid.exe (CA, Inc.)
PRC - C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
PRC - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
PRC - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
PRC - C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
PRC - C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
PRC - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\lxdccoms.exe ( )
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
PRC - C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
PRC - C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe (Hewlett-Packard )
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (LexBceS) – C:\WINDOWS\System32\LEXBCES.EXE File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (VETMSGNT) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
SRV - (CaCCProvSP) – C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
SRV - (UleadBurningHelper) – C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (lxdcCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe ()
SRV - (lxdc_device) – C:\WINDOWS\System32\lxdccoms.exe ( )
SRV - (CAISafe) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (VETEFILE) – C:\WINDOWS\System32\drivers\vetefile.sys (Computer Associates International, Inc.)
DRV - (VETEBOOT) – C:\WINDOWS\System32\drivers\veteboot.sys (Computer Associates International, Inc.)
DRV - (VETMONNT) – C:\WINDOWS\System32\drivers\vetmonnt.sys (Computer Associates International, Inc.)
DRV - (VET-FILT) – C:\WINDOWS\System32\drivers\vet-filt.sys (Computer Associates International, Inc.)
DRV - (VETFDDNT) – C:\WINDOWS\System32\drivers\vetfddnt.sys (Computer Associates International, Inc.)
DRV - (VET-REC) – C:\WINDOWS\System32\drivers\vet-rec.sys (Computer Associates International, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/12 22:25:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/25 20:45:24 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/25 20:45:24 | 000,000,000 | —D | M]

[2009/02/12 23:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Extensions
[2010/08/26 14:25:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2010/07/13 07:24:22 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(2)
[2009/02/21 21:58:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\[removed]
[2010/07/13 13:29:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\staged-xpis
[2010/08/26 14:25:47 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2006/03/09 15:16:00 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2008/02/27 17:57:38 | 000,106,496 | —- | M] (British Broadcasting Corporation) – C:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll

O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [lxdcamon] C:\Program Files\Lexmark 1300 Series\lxdcamon.exe ()
O4 - HKLM..\Run: [lxdcmon.exe] C:\Program Files\Lexmark 1300 Series\lxdcmon.exe File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe (Ulead Systems, Inc.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [YouSendIt.exe] C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
O4 - Startup: C:\Documents and Settings\Eman\Start Menu\Programs\Startup\Download Manager.lnk = C:\Program Files\Snocap\Download Manager\NodeStarter.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O12 - Plugin for: .csm - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .csml - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cub - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cube - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .dx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .emb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .embl - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .gau - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .jdx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mol - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mop - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .pdb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .rxn - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .scr - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .skc - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .spt - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .tgf - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .xyz - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O15 - HKCU\..Trusted Domains: bigcountry.co.uk ([www] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1144355937828 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/xhtml+xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/30 19:43:00 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\AutoRun\command - "" = F:\ .exe – File not found
O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\explore\Command - "" = F:\ .exe – File not found
O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\open\Command - "" = F:\ .exe – File not found
O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell - "" = AutoRun
O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619756233228288)

========== Files/Folders - Created Within 90 Days ==========

[2010/08/26 18:51:26 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/08/25 13:01:21 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/08/25 12:59:39 | 000,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Eman\Desktop\HJTInstall.exe
[2010/07/13 14:32:25 | 000,746,216 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:25 | 000,130,280 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/13 12:19:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/07/13 12:11:53 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Ulead Systems
[2010/07/13 12:06:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/07/13 11:53:41 | 000,000,000 | —D | C] – C:\Program Files\Lexmark 1300 Series
[2010/07/13 07:18:39 | 000,000,000 | —D | C] – C:\Program Files\Snocap
[2010/07/13 07:14:34 | 000,000,000 | —D | C] – C:\Program Files\Corel
[2010/07/13 07:13:35 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Toolbar
[2010/07/08 00:14:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/06/21 21:22:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Eman\Desktop\BADGUYS
[2010/06/21 18:22:04 | 000,000,000 | —D | C] – C:\Config.Msi
[2007/07/31 07:16:51 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxdcinpa.dll
[2007/07/31 07:16:51 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXDChcp.dll
[2007/07/31 07:16:50 | 000,999,424 | —- | C] ( ) – C:\WINDOWS\System32\lxdcusb1.dll
[2007/07/31 07:16:50 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxdciesc.dll
[2007/07/31 07:16:49 | 001,232,896 | —- | C] ( ) – C:\WINDOWS\System32\lxdcserv.dll
[2007/07/31 07:16:49 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxdcprox.dll
[2007/07/31 07:16:49 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpplc.dll
[2007/07/31 07:16:48 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpmui.dll
[2007/07/31 07:16:48 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxdclmpm.dll
[2007/07/31 07:16:47 | 000,700,416 | —- | C] ( ) – C:\WINDOWS\System32\lxdchbn3.dll
[2007/07/31 07:16:45 | 000,425,984 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomm.dll
[2007/07/31 07:16:44 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomc.dll
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[12 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 90 Days ==========

[2010/08/26 23:06:29 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/26 22:27:41 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/08/26 22:27:40 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/08/26 21:59:05 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/26 18:51:29 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/08/26 14:14:17 | 000,813,064 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/26 14:14:17 | 000,645,384 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/26 14:14:17 | 000,152,586 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/08/26 14:14:16 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/08/26 14:12:13 | 000,013,732 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/08/26 13:50:02 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/08/26 13:49:52 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/08/26 13:49:48 | 000,282,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/26 13:48:56 | 005,910,528 | —- | M] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/08/26 13:48:37 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Eman\ntuser.ini
[2010/08/26 13:32:26 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/08/25 20:48:37 | 000,000,372 | —- | M] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/08/25 13:42:30 | 000,002,445 | —- | M] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.lnk
[2010/08/25 13:36:45 | 001,402,880 | —- | M] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.msi
[2010/08/25 12:59:41 | 000,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Eman\Desktop\HJTInstall.exe
[2010/08/16 21:48:39 | 004,240,656 | -H– | M] () – C:\Documents and Settings\Eman\Local Settings\Application Data\IconCache.db
[2010/07/13 14:32:06 | 000,746,216 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:06 | 000,130,280 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/01 08:27:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/21 21:51:22 | 000,002,416 | —- | M] () – C:\WINDOWS\System32\LexFiles.ulf
[2010/06/21 21:24:51 | 000,000,118 | —- | M] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd
[3 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[12 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/08/25 20:48:37 | 000,000,372 | —- | C] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/08/25 13:36:42 | 001,402,880 | —- | C] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.msi
[2010/08/25 13:01:23 | 000,002,445 | —- | C] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.lnk
[2010/07/13 15:44:31 | 005,910,528 | —- | C] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/06/21 22:10:10 | 000,000,138 | —- | C] () – C:\Documents and Settings\Eman\Install.log
[2010/06/21 21:24:47 | 000,000,118 | —- | C] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd
[2008/09/30 19:39:32 | 000,209,040 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/09/30 19:39:32 | 000,192,656 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/09/30 19:39:31 | 000,204,944 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/09/30 19:39:31 | 000,024,720 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/05/17 08:32:02 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[2008/05/17 08:32:02 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
[2008/05/17 08:19:52 | 000,165,888 | —- | C] () – C:\WINDOWS\System32\hpgt53.dll
[2008/05/02 16:13:17 | 000,001,590 | —- | C] () – C:\Documents and Settings\Eman\Application Data\Multique.ini
[2008/05/02 16:13:17 | 000,001,403 | —- | C] () – C:\Documents and Settings\Eman\Application Data\MQPreset.ini
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\ColorTable
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Eman\Application Data\Clean Electric Guitar
[2008/04/18 19:16:02 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLdu.DAT
[2007/07/31 07:36:51 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxdcvs.dll
[2007/07/31 07:36:42 | 000,344,064 | —- | C] () – C:\WINDOWS\System32\lxdccoin.dll
[2007/07/31 07:18:07 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxdcrwrd.ini
[2007/07/31 07:16:51 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\LXDCinst.dll
[2007/07/31 07:16:46 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxdcgrd.dll
[2006/11/04 09:58:14 | 000,000,870 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/10/11 23:56:16 | 000,001,337 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\QTSBandwidthCache
[2006/05/23 12:33:44 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/05/09 13:47:21 | 000,051,712 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/30 09:32:23 | 000,000,153 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/04/14 07:49:03 | 000,000,484 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2006/04/05 08:35:13 | 000,000,000 | —- | C] () – C:\WINDOWS\import71.INI
[2006/03/28 10:49:33 | 000,000,100 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/19 01:31:01 | 000,018,138 | —- | C] () – C:\Documents and Settings\Eman\Application Data\wklnhst.dat
[2006/02/19 00:39:27 | 000,000,462 | —- | C] () – C:\WINDOWS\ArcView9x.INI
[2006/02/19 00:31:52 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM21.dll
[2006/02/19 00:31:52 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes21.dll
[2006/02/18 21:57:13 | 000,000,127 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\fusioncache.dat
[2006/02/18 20:53:00 | 000,000,000 | —- | C] () – C:\WINDOWS\frontpg.ini
[2006/02/18 20:49:56 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2006/02/18 20:49:55 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2006/02/18 20:49:39 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2006/02/18 20:49:39 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2006/02/18 20:49:36 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2006/01/25 13:48:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/01/10 12:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2002/03/16 17:00:00 | 000,007,420 | —- | C] () – C:\WINDOWS\UA000106.DLL
[1997/06/25 15:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\RegObj.dll

========== LOP Check ==========

[2006/12/14 20:15:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\CA
[2008/04/18 19:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\EnterNHelp
[2006/02/19 01:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\ESRI
[2010/07/13 12:06:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/08/26 23:31:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Kontiki
[2008/09/30 19:41:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\muvee Technologies
[2008/04/18 19:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Nikon
[2008/04/18 19:16:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Sample Delay
[2010/07/13 12:07:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ulead Systems
[2008/04/18 19:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ultima_T15
[2006/03/26 15:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\ESRI
[2006/09/18 20:13:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\HorizonWimba
[2007/03/17 18:19:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\InterVideo
[2006/05/27 07:26:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Leadertech
[2008/11/09 10:07:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Nikon
[2007/09/06 09:52:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Template
[2010/01/09 09:03:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Ulead Systems
[2007/04/15 19:29:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Walgreens
[2009/11/22 09:46:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\YouSendIt

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2008/09/30 19:43:00 | 000,000,050 | —- | M] () – C:\AUTOEXEC.BAT
[2006/02/18 16:12:02 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2006/04/06 13:58:50 | 000,007,756 | —- | M] () – C:\caavsetup.log
[2007/04/16 09:00:45 | 000,034,332 | —- | M] () – C:\caavsetupLog.txt
[2010/06/15 23:01:34 | 000,292,618 | —- | M] () – C:\caisslog.txt
[2006/02/18 16:19:20 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/02/18 22:57:02 | 000,000,182 | —- | M] () – C:\Guide.log
[2006/02/19 03:24:13 | 535,023,616 | -HS- | M] () – C:\hiberfil.sys
[2006/02/18 16:19:20 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2006/02/18 22:51:30 | 000,000,224 | —- | M] () – C:\LAN.log
[2008/04/02 07:06:49 | 000,000,477 | —- | M] () – C:\LOG1.log
[2008/05/24 15:53:25 | 000,000,477 | —- | M] () – C:\LOG147.log
[2008/04/03 19:42:01 | 000,000,477 | —- | M] () – C:\LOG20.log
[2008/05/05 06:44:48 | 000,000,477 | —- | M] () – C:\LOG3.log
[2008/05/24 08:44:44 | 000,000,477 | —- | M] () – C:\LOG34.log
[2008/03/09 14:30:23 | 000,000,477 | —- | M] () – C:\LOG4C.log
[2008/05/24 11:40:52 | 000,000,477 | —- | M] () – C:\LOG52.log
[2008/03/09 22:34:13 | 000,000,477 | —- | M] () – C:\LOG54.log
[2008/05/26 14:20:36 | 000,000,477 | —- | M] () – C:\LOG77.log
[2008/03/19 07:09:32 | 000,000,477 | —- | M] () – C:\LOGA.log
[2008/03/08 10:16:39 | 000,000,477 | —- | M] () – C:\LOGC.log
[2008/03/10 19:13:54 | 000,000,477 | —- | M] () – C:\LOGD.log
[2009/07/18 08:44:31 | 000,019,110 | —- | M] () – C:\LXDCcomx.log
[2006/02/18 16:19:20 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/09/30 19:43:03 | 000,000,192 | —- | M] () – C:\muvee.log
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/08/26 13:49:37 | 802,430,976 | -HS- | M] () – C:\pagefile.sys
[2006/02/18 22:54:54 | 000,000,167 | —- | M] () – C:\setup.log
[2006/02/18 22:52:37 | 000,000,191 | —- | M] () – C:\syntp.log
[2006/02/18 22:52:04 | 000,000,032 | —- | M] () – C:\ticrdbus.log
[12 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/02/18 16:18:43 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/03/05 10:32:00 | 000,080,896 | —- | M] (Lexmark International) – C:\WINDOWS\system32\spool\prtprocs\w32x86\LXBCPP5C.DLL
[2007/01/18 06:18:54 | 000,103,936 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdcdrpp.dll
[2008/07/06 03:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/02/18 19:50:10 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/02/18 19:50:10 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/02/18 19:50:10 | 000,888,832 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2006/02/18 16:19:30 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2006/02/18 16:26:21 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/02/18 16:26:20 | 000,000,079 | —- | M] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/08/25 12:59:41 | 000,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Eman\Desktop\HJTInstall.exe
[2010/02/09 00:59:54 | 000,918,816 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Eman\Desktop\jxpiinstall.exe
[2010/01/08 22:21:37 | 179,976,872 | —- | M] (Macrovision Corporation) – C:\Documents and Settings\Eman\Desktop\KEYVSPRX2IETBB.exe
[2010/08/26 18:51:29 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2009/11/22 09:44:56 | 003,309,944 | —- | M] (YouSendIt ) – C:\Documents and Settings\Eman\Desktop\YouSendItExpressSetup2_4_0.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-08-26 20:32:49
< End of report >

OTL Extras logfile created on: 8/26/2010 10:24:24 PM - Run 1
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\Eman\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 157.00 Mb Available Physical Memory | 31.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.32 Gb Total Space | 25.40 Gb Free Space | 34.18% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GEOLOGIST
Current User Name: Eman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"135:TCP" = 135:TCP:*:Enabled:TCP Port 135
"5000:TCP" = 5000:TCP:*:Enabled:TCP Port 5000
"5001:TCP" = 5001:TCP:*:Enabled:TCP Port 5001
"5002:TCP" = 5002:TCP:*:Enabled:TCP Port 5002
"5003:TCP" = 5003:TCP:*:Enabled:TCP Port 5003
"5004:TCP" = 5004:TCP:*:Enabled:TCP Port 5004
"5005:TCP" = 5005:TCP:*:Enabled:TCP Port 5005
"5006:TCP" = 5006:TCP:*:Enabled:TCP Port 5006
"5007:TCP" = 5007:TCP:*:Enabled:TCP Port 5007
"5008:TCP" = 5008:TCP:*:Enabled:TCP Port 5008
"5009:TCP" = 5009:TCP:*:Enabled:TCP Port 5009
"5010:TCP" = 5010:TCP:*:Enabled:TCP Port 5010
"5011:TCP" = 5011:TCP:*:Enabled:TCP Port 5011
"5012:TCP" = 5012:TCP:*:Enabled:TCP Port 5012
"5013:TCP" = 5013:TCP:*:Enabled:TCP Port 5013
"5014:TCP" = 5014:TCP:*:Enabled:TCP Port 5014
"5015:TCP" = 5015:TCP:*:Enabled:TCP Port 5015
"5016:TCP" = 5016:TCP:*:Enabled:TCP Port 5016
"5017:TCP" = 5017:TCP:*:Enabled:TCP Port 5017
"5018:TCP" = 5018:TCP:*:Enabled:TCP Port 5018
"5019:TCP" = 5019:TCP:*:Enabled:TCP Port 5019
"5020:TCP" = 5020:TCP:*:Enabled:TCP Port 5020

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Lexmark 1300 Series\app4r.exe" = C:\Program Files\Lexmark 1300 Series\app4r.exe:*:Enabled:Lexmark Imaging Studio – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\WINDOWS\system32\LEXPPS.EXE" = C:\WINDOWS\system32\LEXPPS.EXE:*:Enabled:LEXPPS.EXE – File not found
"C:\Program Files\Lexmark 1300 Series\lxdcamon.exe" = C:\Program Files\Lexmark 1300 Series\lxdcamon.exe:*:Enabled:Lexmark Device Monitor – ()
"C:\Program Files\Lexmark 1300 Series\App4R.exe" = C:\Program Files\Lexmark 1300 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio – ()
"C:\WINDOWS\system32\lxdccoms.exe" = C:\WINDOWS\system32\lxdccoms.exe:*:Enabled:Lexmark Communications System – ( )
"C:\Program Files\Maxima-5.14.0\wxMaxima\wxMaxima.exe" = C:\Program Files\Maxima-5.14.0\wxMaxima\wxMaxima.exe:*:Enabled:wxMaxima – ()
"C:\Program Files\Snocap\Download Manager\active\downloadmgr.exe" = C:\Program Files\Snocap\Download Manager\active\downloadmgr.exe:*:Enabled:MyStore Download Manager – (SNOCAP Inc.)
"C:\Program Files\Kontiki\KService.exe" = C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service – (Kontiki Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe:*:Enabled: – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe:*:Enabled: – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe:*:Enabled: – (Lexmark International, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{053B3DA8-91B5-4682-A130-715412A1A252}" = Paint.NET v3.5.4
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{08C0729E-3E50-11DF-9D81-005056806466}" = Google Earth
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{17B66E83-1BC9-11D5-A54A-0090278A1BB8}" = Microsoft FrontPage Client - English
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{20610409-CA18-41A6-9E21-A93AE82EE7C5}" = Visual Studio .NET Professional 2003 - English
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 18
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{32F66A20-7614-11D4-BD11-00104BD3F987}" = MathPlayer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3DE0053C-FD9A-483E-B7C9-B06E4392206E}" = iTunes
"{40F8FD5F-4701-48D6-A8FC-1F188007DF38}" = ArcGIS Desktop
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{43A6AA2A-74B5-4E1C-91DB-ECB2F99D9ED7}" = HP User Guides 0008
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}" = Apple Mobile Device Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{534AA552-E1F1-4965-B2AA-FBDEB0730D60}" = muvee autoProducer 4.0 - SE
"{5757AE1A-1DB4-4898-9806-09F77FBD5E57}" = MSDN Library for Visual Studio .NET 2003
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{726D5831-C98B-4E06-91A1-ECE85E1099E8}" = Roxio RecordNow
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73109D90-9FAB-4333-A622-449B0A9F6A0C}" = KeyChamp 2.0
"{84F1DE76-C48C-4281-87A0-CC9548D1E7F9}" = Rhapsody Player Engine
"{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}" = Safari
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 5.20 D2
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D466F3D9-510C-4729-B7D4-2E70490E4CDF}" = BBC iPlayer Download Manager
"{D4D24FE5-FAB3-4FE2-AFFC-623955F4DF3A}" = Visual Studio.NET Baseline - English
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{F0FDF9C9-1DDC-401F-B638-36F1CAE8A875}" = VideoStudio
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FF6F491D-BC82-4DCC-A72F-1824957C6466}" = TIxx21
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"BBC iPlayer Download Manager" = BBC iPlayer Download Manager
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"CNXT_AUDIO" = Conexant AC-Link Audio
"CNXT_MODEM_PCI_VEN_1002&DEV;_4378" = Soft Data Fax Modem with SmartCP
"Data Access Objects (DAO) 3.5" = Data Access Objects (DAO) 3.5
"DECCHECK" = Microsoft Windows XP Video Decoder Checkup Utility
"GoldWave v5.24" = GoldWave v5.24
"Google Updater" = Google Updater
"HijackThis" = HijackThis 2.0.2
"HP PrecisionScan" = HP PrecisionScan
"InstallShield_{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"InstallShield_{F0FDF9C9-1DDC-401F-B638-36F1CAE8A875}" = Corel VideoStudio 12
"InstallShield_{FF6F491D-BC82-4DCC-A72F-1824957C6466}" = Texas Instruments PCIxx21/x515 drivers.
"IrfanView" = IrfanView (remove only)
"Lexmark 1300 Series" = Lexmark 1300 Series
"Lexmark Z600 Series" = Lexmark Z600 Series
"MapObjects 2.0" = ESRI MapObjects 2.3
"MapObjects 2.3 Samples" = ESRI MapObjects 2.3 Samples
"MapObjects 2.3a Sample Data" = ESRI MapObjects 2.3a Sample Data
"Maxima-5.14.0_is1" = Maxima 5.14.0
"MDL Chime/Chime Pro for Internet Explorer" = MDL Chime/Chime Pro for Internet Explorer
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Multiquence v2.55" = Multiquence v2.55
"Picasa 3" = Picasa 3
"Python 2.1" = Python 2.1
"Python 2.1 combined Win32 extensions" = Python 2.1 combined Win32 extensions
"RealPlayer 12.0" = RealPlayer
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SNOCAP MyStore Download Manager" = SNOCAP MyStore Download Manager
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VETWIN32Vp5" = CA Anti-Virus
"Visual Studio .NET Professional 2003 - English" = Microsoft Visual Studio .NET Professional 2003 - English
"WGA" = Windows Genuine Advantage Validation Tool
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/26/2010 10:28:25 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 8832, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 7/6/2010 2:59:49 AM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 8832, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 7/6/2010 2:59:49 AM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 7/6/2010 2:59:53 AM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 8832, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 7/13/2010 4:46:00 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 8832, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 7/13/2010 4:46:00 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 7/13/2010 4:46:04 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 8832, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 8/25/2010 3:51:31 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 15924, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 8/25/2010 3:51:31 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 8/25/2010 3:51:38 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 15924, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

[ System Events ]
Error - 8/17/2010 12:48:11 AM | Computer Name = GEOLOGIST | Source = DCOM | ID = 10005
Description = DCOM got error "%1068" attempting to start the service IISADMIN with
arguments "" in order to run the server: {A9E69610-B80D-11D0-B9B9-00A0C922E750}

Error - 8/17/2010 12:48:39 AM | Computer Name = GEOLOGIST | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 8/25/2010 3:46:43 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The LexBce Server service failed to start due to the following error:
%%2

Error - 8/25/2010 3:46:44 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7001
Description = The Print Spooler service depends on the LexBce Server service which
failed to start because of the following error: %%2

Error - 8/25/2010 3:46:45 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdcCATSCustConnectService
service to connect.

Error - 8/25/2010 3:46:46 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The lxdcCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 8/26/2010 4:50:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The LexBce Server service failed to start due to the following error:
%%2

Error - 8/26/2010 4:50:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7001
Description = The Print Spooler service depends on the LexBce Server service which
failed to start because of the following error: %%2

Error - 8/26/2010 4:50:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdcCATSCustConnectService
service to connect.

Error - 8/26/2010 4:50:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The lxdcCATSCustConnectService service failed to start due to the
following error: %%1053

< End of report >

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-27 08:33:17
Windows 5.1.2600 Service Pack 2
Running: gmer.exe; Driver: C:\DOCUME~1\Eman\LOCALS~1\Temp\uwtdapod.sys

—- Kernel code sections - GMER 1.0.15 —-

init C:\WINDOWS\system32\drivers\tifm21.sys entry point in "init" section [0xF7BAEDBF]

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Mozilla Firefox\firefox.exe[1904] ntdll.dll!LdrLoadDll 7C915CBB 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)

—- Devices - GMER 1.0.15 —-

AttachedDevice \FileSystem\Ntfs \Ntfs VET-FILT.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)
AttachedDevice \FileSystem\Ntfs \Ntfs VET-REC.SYS (CA Antivirus File Protection Driver/Computer Associates International, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)

—- EOF - GMER 1.0.15 —-

Thanks again for your help.

E. Ramos

p.s. I'd like to mention that the LexMark printer drivers can be removed completely, though of course they are not malware. I no longer own either of those printers. I tried uninstalling the drivers but don't think it worked right.

Satchfan

Post #5August 29, 2010, 6:52 PM UTC

I apologise for the delay MudBird. I have been very busy and am trying to reply as quiickly as possible. Satchfan

MudBird

Post #6August 29, 2010, 7:06 PM UTC

No worries. Your time and effort are much appreciated. Cheers, E. Ramos

Satchfan

Post #7August 30, 2010, 6:11 PM UTC

Hello MudBird

Windows seems to be trying to open Corel Video Studio

There are files relating to Coral Video and also to Visual Studio. Do you have any Coral-related programs and did you intentionally install Microsoft Visual Studio? Please let me know in your next post.

Check for Java update and remove old versions.

Your version of Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to update Java components and remove older versions.
1. Click Start, Settings and then click Control Panel
2. Double-click on the Java
3. Click on the ‘Update’ tab and then on Update now.
4. Still in the Java Control Panel, click on the General tab
5..Under Temporary Internet Files, click the Settings button.
6. Click on the Delete Files button. There are two options in the window to clear the cache – Leave BOTH of the following checked:
Applications and Applets
Trace and Log Files 7 Click OK on Delete Temporary Files Window
8 Click OK to leave the Temporary Files Window
9 Click OK to leave the Java Control Panel.
Still in the Control Panel, double-click on Add or Remove programs. (it may take time to produce the list of programs, so please be patient). Now remove all earlier versions of Java.

Also uninstall the following programs, if present:

Lexmark 1300 Series
Lexmark Z600 Series
J2SE Runtime Environment 5.0 Update 6

If Coral Video is also in the list of installed programs and it is the evaluation version, remove that also.

Please download SystemLook from one of the links below and save it to your Desktop.

Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:

:file C:\LOG147.log :contents C:\LOG147.log
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\AutoRun\command - "" = F:\ .exe – File not found O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\explore\Command - "" = F:\ .exe – File not found O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\open\Command - "" = F:\ .exe – File not found O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell - "" = AutoRun O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found :Commands [purity] [emptytemp] [start explorer] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Logs to include in reply:

OTL.txt
SystemLook.txt

Let me know if there is any change in your computer’s behaviour.

Satchfan

MudBird

Post #8August 31, 2010, 11:03 PM UTC

Okay, Satchfan, thanks again and here are the new log reports.

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 22:47 on 30/08/2010 by Eman (Administrator - Elevation successful)

========== file ==========

C:\LOG147.log - File found and opened.
MD5: 0279ABFA724084DC41C64517A75558F2
Created at 22:53 on 24/05/2008
Modified at 22:53 on 24/05/2008
Size: 477 bytes
Attributes: –a—
No version information available.

========== contents ==========

C:\LOG147.log - Opened succesfully.

CMD = start

Main:: Entering case 1 = start –>
———————-
CU3AppStarter::StartU3App AutoRun = true
———————-
CU3AppStarter::StartU3App Current Lang= 1033
CU3AppStarter::StartU3App Full exe path = C:\Documents and Settings\Eman\Application Data\U3\0001587082E1178C\79EB5C19-AB0E-4dd7-BE89-BF96301D35Z8\Exec\master.exe 1033
CU3AppStarter::StartU3App–>If First time?
CU3AppStarter::IsFileExist–>File exists.
CU3AppStarter::StartU3App–>No

-=End Of File=-

OTL logfile created on: 8/31/2010 7:17:15 AM - Run 2
OTL by OldTimer - Version 3.2.10.0 Folder = C:\Documents and Settings\Eman\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 173.00 Mb Available Physical Memory | 34.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 71.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.32 Gb Total Space | 26.60 Gb Free Space | 35.79% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GEOLOGIST
Current User Name: Eman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\cavrid.exe (CA, Inc.)
PRC - C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
PRC - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
PRC - C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
PRC - C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
PRC - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\lxdccoms.exe ( )
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
PRC - C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
PRC - C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe (Hewlett-Packard )
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (LexBceS) – C:\WINDOWS\System32\LEXBCES.EXE File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (VETMSGNT) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
SRV - (CaCCProvSP) – C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (lxdcCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe ()
SRV - (lxdc_device) – C:\WINDOWS\System32\lxdccoms.exe ( )
SRV - (CAISafe) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (VETEFILE) – C:\WINDOWS\System32\drivers\vetefile.sys (Computer Associates International, Inc.)
DRV - (VETEBOOT) – C:\WINDOWS\System32\drivers\veteboot.sys (Computer Associates International, Inc.)
DRV - (VETMONNT) – C:\WINDOWS\System32\drivers\vetmonnt.sys (Computer Associates International, Inc.)
DRV - (VET-FILT) – C:\WINDOWS\System32\drivers\vet-filt.sys (Computer Associates International, Inc.)
DRV - (VETFDDNT) – C:\WINDOWS\System32\drivers\vetfddnt.sys (Computer Associates International, Inc.)
DRV - (VET-REC) – C:\WINDOWS\System32\drivers\vet-rec.sys (Computer Associates International, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/12 22:25:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/25 20:45:24 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/08/30 21:56:00 | 000,000,000 | —D | M]

[2009/02/12 23:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Extensions
[2010/08/30 23:09:47 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2010/07/13 07:24:22 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(2)
[2009/02/21 21:58:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\[removed]
[2010/07/13 13:29:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\staged-xpis
[2010/08/30 23:09:46 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2006/03/09 15:16:00 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/08/30 21:56:23 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2008/02/27 17:57:38 | 000,106,496 | —- | M] (British Broadcasting Corporation) – C:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll
[2010/07/17 05:00:04 | 000,423,656 | —- | M] (Sun Microsystems, Inc.) – C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [lxdcamon] C:\Program Files\Lexmark 1300 Series\lxdcamon.exe ()
O4 - HKLM..\Run: [lxdcmon.exe] C:\Program Files\Lexmark 1300 Series\lxdcmon.exe File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [YouSendIt.exe] C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
O4 - Startup: C:\Documents and Settings\Eman\Start Menu\Programs\Startup\Download Manager.lnk = C:\Program Files\Snocap\Download Manager\NodeStarter.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_21.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O12 - Plugin for: .csm - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .csml - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cub - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cube - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .dx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .emb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .embl - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .gau - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .jdx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mol - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mop - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .pdb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .rxn - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .scr - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .skc - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .spt - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .tgf - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .xyz - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O15 - HKCU\..Trusted Domains: bigcountry.co.uk ([www] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1144355937828 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/xhtml+xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/30 19:43:00 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/08/30 22:54:43 | 000,000,000 | —D | C] – C:\_OTL
[2010/08/26 18:51:26 | 000,575,488 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/08/25 13:01:21 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/08/25 12:59:39 | 000,812,344 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\Eman\Desktop\HJTInstall.exe
[2010/07/13 14:32:25 | 000,746,216 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:25 | 000,130,280 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/13 12:19:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/07/13 12:06:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/07/13 11:53:41 | 000,000,000 | —D | C] – C:\Program Files\Lexmark 1300 Series
[2010/07/13 07:18:39 | 000,000,000 | —D | C] – C:\Program Files\Snocap
[2010/07/13 07:14:34 | 000,000,000 | —D | C] – C:\Program Files\Corel
[2010/07/13 07:13:35 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Toolbar
[2010/07/08 00:14:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/06/21 21:22:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Eman\Desktop\BADGUYS
[2010/06/21 18:22:04 | 000,000,000 | —D | C] – C:\Config.Msi
[2007/07/31 07:16:51 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxdcinpa.dll
[2007/07/31 07:16:51 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXDChcp.dll
[2007/07/31 07:16:50 | 000,999,424 | —- | C] ( ) – C:\WINDOWS\System32\lxdcusb1.dll
[2007/07/31 07:16:50 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxdciesc.dll
[2007/07/31 07:16:49 | 001,232,896 | —- | C] ( ) – C:\WINDOWS\System32\lxdcserv.dll
[2007/07/31 07:16:49 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxdcprox.dll
[2007/07/31 07:16:49 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpplc.dll
[2007/07/31 07:16:48 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpmui.dll
[2007/07/31 07:16:48 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxdclmpm.dll
[2007/07/31 07:16:47 | 000,700,416 | —- | C] ( ) – C:\WINDOWS\System32\lxdchbn3.dll
[2007/07/31 07:16:45 | 000,425,984 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomm.dll
[2007/07/31 07:16:44 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomc.dll

========== Files - Modified Within 90 Days ==========

[2010/08/31 07:59:16 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/08/31 07:17:45 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/08/31 07:17:44 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/08/30 23:09:53 | 000,813,064 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/08/30 23:09:53 | 000,645,384 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/08/30 23:09:53 | 000,152,586 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/08/30 23:05:21 | 000,013,732 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/08/30 23:04:55 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/08/30 23:04:39 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/08/30 23:04:23 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/08/30 23:04:14 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/08/30 23:03:18 | 005,910,528 | —- | M] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/08/30 23:02:50 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Eman\ntuser.ini
[2010/08/30 22:46:54 | 000,100,908 | —- | M] () – C:\Documents and Settings\Eman\Desktop\SystemLook.exe
[2010/08/27 00:14:45 | 000,284,915 | —- | M] () – C:\Documents and Settings\Eman\Desktop\gmer.zip
[2010/08/26 18:51:29 | 000,575,488 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/08/26 13:49:48 | 000,282,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/08/26 13:32:26 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/08/25 20:48:37 | 000,000,372 | —- | M] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/08/25 13:42:30 | 000,002,445 | —- | M] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.lnk
[2010/08/25 13:36:45 | 001,402,880 | —- | M] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.msi
[2010/08/25 12:59:41 | 000,812,344 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\Eman\Desktop\HJTInstall.exe
[2010/08/16 21:48:39 | 004,240,656 | -H– | M] () – C:\Documents and Settings\Eman\Local Settings\Application Data\IconCache.db
[2010/07/13 14:32:06 | 000,746,216 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:06 | 000,130,280 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/01 08:27:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/21 21:51:22 | 000,002,416 | —- | M] () – C:\WINDOWS\System32\LexFiles.ulf
[2010/06/21 21:24:51 | 000,000,118 | —- | M] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd

========== Files Created - No Company Name ==========

[2010/08/30 22:46:51 | 000,100,908 | —- | C] () – C:\Documents and Settings\Eman\Desktop\SystemLook.exe
[2010/08/27 00:14:39 | 000,284,915 | —- | C] () – C:\Documents and Settings\Eman\Desktop\gmer.zip
[2010/08/25 20:48:37 | 000,000,372 | —- | C] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/08/25 13:36:42 | 001,402,880 | —- | C] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.msi
[2010/08/25 13:01:23 | 000,002,445 | —- | C] () – C:\Documents and Settings\Eman\Desktop\HiJackThis.lnk
[2010/07/13 15:44:31 | 005,910,528 | —- | C] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/06/21 22:10:10 | 000,000,184 | —- | C] () – C:\Documents and Settings\Eman\Install.log
[2010/06/21 21:24:47 | 000,000,118 | —- | C] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd
[2008/09/30 19:39:32 | 000,209,040 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/09/30 19:39:32 | 000,192,656 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/09/30 19:39:31 | 000,204,944 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/09/30 19:39:31 | 000,024,720 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/05/17 08:32:02 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[2008/05/17 08:32:02 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
[2008/05/17 08:19:52 | 000,165,888 | —- | C] () – C:\WINDOWS\System32\hpgt53.dll
[2008/05/02 16:13:17 | 000,001,590 | —- | C] () – C:\Documents and Settings\Eman\Application Data\Multique.ini
[2008/05/02 16:13:17 | 000,001,403 | —- | C] () – C:\Documents and Settings\Eman\Application Data\MQPreset.ini
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\ColorTable
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Eman\Application Data\Clean Electric Guitar
[2008/04/18 19:16:02 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLdu.DAT
[2007/07/31 07:36:51 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxdcvs.dll
[2007/07/31 07:36:42 | 000,344,064 | —- | C] () – C:\WINDOWS\System32\lxdccoin.dll
[2007/07/31 07:18:07 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxdcrwrd.ini
[2007/07/31 07:16:51 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\LXDCinst.dll
[2007/07/31 07:16:46 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxdcgrd.dll
[2006/11/04 09:58:14 | 000,000,870 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/10/11 23:56:16 | 000,001,337 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\QTSBandwidthCache
[2006/05/23 12:33:44 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/05/09 13:47:21 | 000,051,712 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/30 09:32:23 | 000,000,153 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/04/14 07:49:03 | 000,000,484 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2006/04/05 08:35:13 | 000,000,000 | —- | C] () – C:\WINDOWS\import71.INI
[2006/03/28 10:49:33 | 000,000,100 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/19 01:31:01 | 000,018,138 | —- | C] () – C:\Documents and Settings\Eman\Application Data\wklnhst.dat
[2006/02/19 00:39:27 | 000,000,462 | —- | C] () – C:\WINDOWS\ArcView9x.INI
[2006/02/19 00:31:52 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM21.dll
[2006/02/19 00:31:52 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes21.dll
[2006/02/18 21:57:13 | 000,000,127 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\fusioncache.dat
[2006/02/18 20:53:00 | 000,000,000 | —- | C] () – C:\WINDOWS\frontpg.ini
[2006/02/18 20:49:56 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2006/02/18 20:49:55 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2006/02/18 20:49:39 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2006/02/18 20:49:39 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2006/02/18 20:49:36 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2006/01/25 13:48:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/01/10 12:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2002/03/16 17:00:00 | 000,007,420 | —- | C] () – C:\WINDOWS\UA000106.DLL
[1997/06/25 15:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\RegObj.dll

========== LOP Check ==========

[2006/12/14 20:15:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\CA
[2008/04/18 19:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\EnterNHelp
[2006/02/19 01:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\ESRI
[2010/07/13 12:06:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/08/31 08:12:19 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Kontiki
[2008/09/30 19:41:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\muvee Technologies
[2008/04/18 19:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Nikon
[2008/04/18 19:16:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Sample Delay
[2010/08/30 22:30:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ulead Systems
[2008/04/18 19:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ultima_T15
[2006/03/26 15:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\ESRI
[2006/09/18 20:13:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\HorizonWimba
[2007/03/17 18:19:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\InterVideo
[2006/05/27 07:26:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Leadertech
[2008/11/09 10:07:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Nikon
[2007/09/06 09:52:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Template
[2010/01/09 09:03:05 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Ulead Systems
[2007/04/15 19:29:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Walgreens
[2009/11/22 09:46:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\YouSendIt

========== Purity Check ==========

< End of report >

You asked about Visual Studio; yes, I did install it, for a VB.net class I took in 2006. In fact it was the first or second software program I installed when I bought this computer (the other being ArcGIS). It's never given me any trouble.

I attempted to uninstall Corel and the two Lexmark printer drivers, but there were error messages in the process. I saved screen shots of them, but I'll just give you the text unless you actually need to see them.

While removing the Lexmark 1300 driver I got a small message box with the title "%InstallErrorTitle%" and the text "%BuildTemplateErrorMessage%", and an OK button. I've tried it again just now and it still won't uninstall (same message).

The Lexmark Z600 uninstalled just fine, as did the old version of Java.

With the Corel Video Studio uninstall I got a message box with the title "AVControlSDK" and the text "Error extracting support files: The system cannot find the file specified". Nonetheless it appears to have uninstalled correctly, and no longer appears in the list of programs. I don't think I have any other Corel products; this one was an eval and I decided not to buy it or use it.

I rebooted as you instructed after running the OTL fix, and Windows did start normally and I did not get the "Missing security info" message that's been popping up since this started, so that's something. However, I still got the "Do you want to debug?" message. It's a Yes/No dialog box with title "Just-In-Time Debugging" and the following text:

———–
An exception 'System.NullReferenceException' has occured in lxdcamon.exe.
Possible Debuggers:
[listbox]
New instance of Microsoft CLR Debugger 2003
New instance of Visual Studio.NET 2003
[end listbox]
[checkbox] Set the currently selected debugger as the default.
Do you want to debug using the selected debugger? [YES/NO]
———–

I didn't try debugging this time. Any idea what might be triggering this? One or two other things I should mention. Firefox is always prompting me to update my Flash player, but the update doesn't seem compatible with my computer. Also, I use Paint.Net and likewise, the latest update either won't install at all or won't work (I forget which). And the last couple times I tried to start Google Earth, it crashed before reaching the normal opening view. Would all of that be related to the Java issue?

Once again I thank you kindly for your assistance.

E. Ramos

MudBird

Post #9September 2, 2010, 12:42 AM UTC

Further info: I tried restarting it after all the foregoing (having left it on for 5 days straight), and it went back to the same problem. It took more tries than ever to get it started again, and two System Restores. It is now running (I don't know how or why) after being restored to July 13 or thereabouts, so I may need to re-do the fixes, logs etc. I'm not going to turn it off again until we figure out what is causing this (if possible). I hope this round of aggravation proves useful to you in your tech-support training.:-) I see those programs are back in the list, so I'm going to go ahead and uninstall them again, but I won't restart the computer. E. Ramos

Satchfan

Post #10September 2, 2010, 9:20 PM UTC

Thanks for the update MudBird

Let’s try the following to uninstall these programs

Download Revo Uninstaller

Double click the installation file on the desktop to run the installer.
Let it install to the default location.
Double click the new Revo Uninstaller Icon on the desktop to start the program.

You will now see a list of installed programs that Revo Uninstaller can remove.

Locate Lexmark 1300 Series, if present
Right-click the Icon then choose Uninstall.
Click yes to the warning and choose the Uninstall Mode
Choose the Advanced option and then click Next.
This will launch the programs built in uninstaller. Be patient it can take several seconds.
Once the uninstaller is done click Next.
Revo Uninstaller will now scan for leftover information. Be patient it can take several seconds.
Once this scan is done click Next.
You will then be presented of the leftover entries found by Revo Uninstaller
Look at ALL of the entries to ensure they relate to the uninstall.
Next click Select All > Delete to remove the entries.
Click Next.
If there are any program file folders left over you will be presented with a list to be removed.
Again look at ALL of the entries to ensure they are related to the uninstall.
Click Select All > Delete to remove the entries.
Click Finish to go back to the uninstall list.

Repeat the process for Lexmark Z600 Series and Corel Video
Close the program

Please run OTL again and send OTL.txt in your next reply. Also, let me know what the circumstances are now.

Thanks

Satchfan

MudBird

Post #11September 2, 2010, 11:27 PM UTC last edited September 3, 2010, 1:24 AM UTC

Thanks, Satchfan.

Okay, now this is getting weirder. I removed the Lexmark 1300 as you directed (with apparent success), but the Corel Video doesn't appear on the list of programs. Does that mean the I already uninstalled it correctly? But I'm still getting error messages that seem to be related to it. The second time I uninstalled it (yesterday) there was a message to the effect that some component of the Corel program was "already in use" and it indicated that "Security" was using it. I took that to mean that the "Security Info…" message I keep getting is in fact referring to Corel and not something else – that's good news.

The other weird thing is that the OTL icon has disappeared from my desktop. Would the System Restore I did yesterday have caused that? The OTL-generated text files are still there. I've downloaded it again; I'll run another scan and let you know what happens.

Also, I noticed in the Revo list that I have several older versions of Adobe Flash. Should I get rid of these?

Thanks,
Mudbird

—–

Okay, here's the new OTL report:

OTL logfile created on: 9/2/2010 4:29:53 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\Eman\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 250.00 Mb Available Physical Memory | 49.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.32 Gb Total Space | 23.97 Gb Free Space | 32.25% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GEOLOGIST
Current User Name: Eman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\cavrid.exe (CA, Inc.)
PRC - C:\Program Files\Google\Update\1.2.183.23\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
PRC - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
PRC - C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
PRC - C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
PRC - C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
PRC - C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\lxdccoms.exe ( )
PRC - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
PRC - C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
PRC - C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
PRC - C:\Program Files\HPQ\Quick Launch Buttons\eabservr.exe (Hewlett-Packard )
PRC - C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (LexBceS) – C:\WINDOWS\System32\LEXBCES.EXE File not found
SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (VETMSGNT) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
SRV - (CaCCProvSP) – C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (lxdcCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe ()
SRV - (lxdc_device) – C:\WINDOWS\System32\lxdccoms.exe ( )
SRV - (CAISafe) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (VETEFILE) – C:\WINDOWS\System32\drivers\vetefile.sys (Computer Associates International, Inc.)
DRV - (VETEBOOT) – C:\WINDOWS\System32\drivers\veteboot.sys (Computer Associates International, Inc.)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (VETMONNT) – C:\WINDOWS\System32\drivers\vetmonnt.sys (Computer Associates International, Inc.)
DRV - (VET-FILT) – C:\WINDOWS\System32\drivers\vet-filt.sys (Computer Associates International, Inc.)
DRV - (VETFDDNT) – C:\WINDOWS\System32\drivers\vetfddnt.sys (Computer Associates International, Inc.)
DRV - (VET-REC) – C:\WINDOWS\System32\drivers\vet-rec.sys (Computer Associates International, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/12 22:25:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/01 08:13:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/01 08:13:45 | 000,000,000 | —D | M]

[2009/02/12 23:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Extensions
[2010/09/01 17:39:25 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2010/07/13 07:24:22 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(2)
[2009/02/21 21:58:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\[removed]
[2010/07/13 13:29:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\staged-xpis
[2010/09/01 18:57:50 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2006/03/09 15:16:00 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/09/01 07:52:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2008/02/27 17:57:38 | 000,106,496 | —- | M] (British Broadcasting Corporation) – C:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll

O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [lxdcamon] C:\Program Files\Lexmark 1300 Series\lxdcamon.exe ()
O4 - HKLM..\Run: [lxdcmon.exe] C:\Program Files\Lexmark 1300 Series\lxdcmon.exe File not found
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe File not found
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [YouSendIt.exe] C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_18.dll (Sun Microsystems, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O12 - Plugin for: .csm - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .csml - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cub - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cube - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .dx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .emb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .embl - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .gau - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .jdx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mol - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mop - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .pdb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .rxn - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .scr - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .skc - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .spt - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .tgf - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .xyz - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O15 - HKCU\..Trusted Domains: bigcountry.co.uk ([www] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1144355937828 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/xhtml+xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/30 19:43:00 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\AutoRun\command - "" = F:\ .exe – File not found
O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\explore\Command - "" = F:\ .exe – File not found
O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\open\Command - "" = F:\ .exe – File not found
O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell - "" = AutoRun
O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (54619756233228288)

========== Files/Folders - Created Within 90 Days ==========

[2010/09/02 16:23:15 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/09/02 15:55:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Eman\Local Settings\Application Data\VS Revo Group
[2010/09/02 15:54:57 | 000,000,000 | —D | C] – C:\WINDOWS\LastGood
[2010/09/02 15:54:47 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2010/09/02 15:54:43 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/09/02 15:53:22 | 007,282,568 | —- | C] (VS Revo Group ) – C:\Documents and Settings\Eman\Desktop\RevoUninProSetup.exe
[2010/09/01 19:11:50 | 000,000,000 | —D | C] – C:\lexmark
[2010/08/30 22:54:43 | 000,000,000 | —D | C] – C:\_OTL
[2010/08/25 13:01:21 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/07/13 14:32:25 | 000,746,216 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:25 | 000,130,280 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/13 12:19:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/07/13 12:06:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/07/13 11:53:41 | 000,000,000 | —D | C] – C:\Program Files\Lexmark 1300 Series
[2010/07/13 07:18:39 | 000,000,000 | —D | C] – C:\Program Files\Snocap
[2010/07/13 07:14:34 | 000,000,000 | —D | C] – C:\Program Files\Corel
[2010/07/13 07:13:35 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Toolbar
[2010/07/08 00:14:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/06/21 21:22:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Eman\Desktop\BADGUYS
[2010/06/21 18:22:04 | 000,000,000 | —D | C] – C:\Config.Msi
[2007/07/31 07:16:51 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxdcinpa.dll
[2007/07/31 07:16:51 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXDChcp.dll
[2007/07/31 07:16:50 | 000,999,424 | —- | C] ( ) – C:\WINDOWS\System32\lxdcusb1.dll
[2007/07/31 07:16:50 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxdciesc.dll
[2007/07/31 07:16:49 | 001,232,896 | —- | C] ( ) – C:\WINDOWS\System32\lxdcserv.dll
[2007/07/31 07:16:49 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxdcprox.dll
[2007/07/31 07:16:49 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpplc.dll
[2007/07/31 07:16:48 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpmui.dll
[2007/07/31 07:16:48 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxdclmpm.dll
[2007/07/31 07:16:47 | 000,700,416 | —- | C] ( ) – C:\WINDOWS\System32\lxdchbn3.dll
[2007/07/31 07:16:45 | 000,425,984 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomm.dll
[2007/07/31 07:16:44 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomc.dll

========== Files - Modified Within 90 Days ==========

[2010/09/02 16:59:18 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/02 16:29:48 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/09/02 16:29:48 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/09/02 16:23:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/09/02 15:54:49 | 000,000,839 | —- | M] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2010/09/02 15:54:49 | 000,000,821 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Revo Uninstaller Pro.lnk
[2010/09/02 15:53:38 | 007,282,568 | —- | M] (VS Revo Group ) – C:\Documents and Settings\Eman\Desktop\RevoUninProSetup.exe
[2010/09/02 15:37:46 | 000,858,530 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/02 15:37:46 | 000,676,784 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/02 15:37:46 | 000,165,756 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/02 15:35:22 | 000,013,732 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/02 15:35:14 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/02 15:02:46 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/09/02 15:02:14 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/02 15:01:56 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/02 15:01:48 | 000,282,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/02 15:01:03 | 005,910,528 | —- | M] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/09/02 15:00:52 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Eman\ntuser.ini
[2010/09/02 07:36:36 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/09/01 16:19:14 | 004,240,656 | -H– | M] () – C:\Documents and Settings\Eman\Local Settings\Application Data\IconCache.db
[2010/08/27 00:14:45 | 000,284,915 | —- | M] () – C:\Documents and Settings\Eman\Desktop\gmer.zip
[2010/08/25 20:48:37 | 000,000,372 | —- | M] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/07/13 14:32:06 | 000,746,216 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:06 | 000,130,280 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/01 08:27:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010/06/21 21:51:22 | 000,002,416 | —- | M] () – C:\WINDOWS\System32\LexFiles.ulf
[2010/06/21 21:24:51 | 000,000,118 | —- | M] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd

========== Files Created - No Company Name ==========

[2010/09/02 15:54:49 | 000,000,839 | —- | C] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2010/09/02 15:54:49 | 000,000,821 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Revo Uninstaller Pro.lnk
[2010/08/27 00:14:39 | 000,284,915 | —- | C] () – C:\Documents and Settings\Eman\Desktop\gmer.zip
[2010/08/25 20:48:37 | 000,000,372 | —- | C] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/07/13 15:44:31 | 005,910,528 | —- | C] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/06/21 22:10:10 | 000,000,230 | —- | C] () – C:\Documents and Settings\Eman\Install.log
[2010/06/21 21:24:47 | 000,000,118 | —- | C] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd
[2008/09/30 19:39:32 | 000,209,040 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/09/30 19:39:32 | 000,192,656 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/09/30 19:39:31 | 000,204,944 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/09/30 19:39:31 | 000,024,720 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/05/17 08:32:02 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[2008/05/17 08:32:02 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
[2008/05/17 08:19:52 | 000,165,888 | —- | C] () – C:\WINDOWS\System32\hpgt53.dll
[2008/05/02 16:13:17 | 000,001,590 | —- | C] () – C:\Documents and Settings\Eman\Application Data\Multique.ini
[2008/05/02 16:13:17 | 000,001,403 | —- | C] () – C:\Documents and Settings\Eman\Application Data\MQPreset.ini
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\ColorTable
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Eman\Application Data\Clean Electric Guitar
[2008/04/18 19:16:02 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLdu.DAT
[2007/07/31 07:36:51 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxdcvs.dll
[2007/07/31 07:36:42 | 000,344,064 | —- | C] () – C:\WINDOWS\System32\lxdccoin.dll
[2007/07/31 07:18:07 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxdcrwrd.ini
[2007/07/31 07:16:51 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\LXDCinst.dll
[2007/07/31 07:16:46 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxdcgrd.dll
[2006/11/04 09:58:14 | 000,000,870 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/10/11 23:56:16 | 000,001,337 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\QTSBandwidthCache
[2006/05/23 12:33:44 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/05/09 13:47:21 | 000,051,712 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/30 09:32:23 | 000,000,153 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/04/14 07:49:03 | 000,000,484 | —- | C] () – C:\WINDOWS\LEXSTAT.INI
[2006/04/05 08:35:13 | 000,000,000 | —- | C] () – C:\WINDOWS\import71.INI
[2006/03/28 10:49:33 | 000,000,100 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/19 01:31:01 | 000,018,138 | —- | C] () – C:\Documents and Settings\Eman\Application Data\wklnhst.dat
[2006/02/19 00:39:27 | 000,000,462 | —- | C] () – C:\WINDOWS\ArcView9x.INI
[2006/02/19 00:31:52 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM21.dll
[2006/02/19 00:31:52 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes21.dll
[2006/02/18 21:57:13 | 000,000,127 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\fusioncache.dat
[2006/02/18 20:53:00 | 000,000,000 | —- | C] () – C:\WINDOWS\frontpg.ini
[2006/02/18 20:49:56 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2006/02/18 20:49:55 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2006/02/18 20:49:39 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2006/02/18 20:49:39 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2006/02/18 20:49:36 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2006/01/25 13:48:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/01/10 12:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2002/03/16 17:00:00 | 000,007,420 | —- | C] () – C:\WINDOWS\UA000106.DLL
[1997/06/25 15:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\RegObj.dll

========== LOP Check ==========

[2006/12/14 20:15:26 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\CA
[2008/04/18 19:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\EnterNHelp
[2006/02/19 01:15:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\ESRI
[2010/07/13 12:06:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/09/02 17:27:01 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Kontiki
[2008/09/30 19:41:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\muvee Technologies
[2008/04/18 19:16:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Nikon
[2008/04/18 19:16:03 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Sample Delay
[2010/09/01 18:39:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ulead Systems
[2008/04/18 19:16:02 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users.WINDOWS\Application Data\Ultima_T15
[2006/03/26 15:38:00 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\ESRI
[2006/09/18 20:13:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\HorizonWimba
[2007/03/17 18:19:45 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\InterVideo
[2006/05/27 07:26:13 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Leadertech
[2008/11/09 10:07:31 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Nikon
[2007/09/06 09:52:32 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Template
[2010/09/01 18:39:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Ulead Systems
[2007/04/15 19:29:08 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Walgreens
[2009/11/22 09:46:23 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\YouSendIt

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2008/09/30 19:43:00 | 000,000,050 | —- | M] () – C:\AUTOEXEC.BAT
[2006/02/18 16:12:02 | 000,000,211 | -HS- | M] () – C:\boot.ini
[2006/04/06 13:58:50 | 000,007,756 | —- | M] () – C:\caavsetup.log
[2007/04/16 09:00:45 | 000,034,332 | —- | M] () – C:\caavsetupLog.txt
[2010/06/15 23:01:34 | 000,292,618 | —- | M] () – C:\caisslog.txt
[2006/02/18 16:19:20 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2006/02/18 22:57:02 | 000,000,182 | —- | M] () – C:\Guide.log
[2006/02/19 03:24:13 | 535,023,616 | -HS- | M] () – C:\hiberfil.sys
[2006/02/18 16:19:20 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2006/02/18 22:51:30 | 000,000,224 | —- | M] () – C:\LAN.log
[2008/04/02 07:06:49 | 000,000,477 | —- | M] () – C:\LOG1.log
[2008/05/24 15:53:25 | 000,000,477 | —- | M] () – C:\LOG147.log
[2008/04/03 19:42:01 | 000,000,477 | —- | M] () – C:\LOG20.log
[2008/05/05 06:44:48 | 000,000,477 | —- | M] () – C:\LOG3.log
[2008/05/24 08:44:44 | 000,000,477 | —- | M] () – C:\LOG34.log
[2008/03/09 14:30:23 | 000,000,477 | —- | M] () – C:\LOG4C.log
[2008/05/24 11:40:52 | 000,000,477 | —- | M] () – C:\LOG52.log
[2008/03/09 22:34:13 | 000,000,477 | —- | M] () – C:\LOG54.log
[2008/05/26 14:20:36 | 000,000,477 | —- | M] () – C:\LOG77.log
[2008/03/19 07:09:32 | 000,000,477 | —- | M] () – C:\LOGA.log
[2008/03/08 10:16:39 | 000,000,477 | —- | M] () – C:\LOGC.log
[2008/03/10 19:13:54 | 000,000,477 | —- | M] () – C:\LOGD.log
[2009/07/18 08:44:31 | 000,019,110 | —- | M] () – C:\LXDCcomx.log
[2006/02/18 16:19:20 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/09/30 19:43:03 | 000,000,192 | —- | M] () – C:\muvee.log
[2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () – C:\ntldr
[2010/09/02 15:01:44 | 802,430,976 | -HS- | M] () – C:\pagefile.sys
[2006/02/18 22:54:54 | 000,000,167 | —- | M] () – C:\setup.log
[2006/02/18 22:52:37 | 000,000,191 | —- | M] () – C:\syntp.log
[2006/02/18 22:52:04 | 000,000,032 | —- | M] () – C:\ticrdbus.log

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/02/18 16:18:43 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 05:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/01/18 06:18:54 | 000,103,936 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdcdrpp.dll
[2008/07/06 03:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/02/18 19:50:10 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2006/02/18 19:50:10 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2006/02/18 19:50:10 | 000,888,832 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2006/02/18 16:19:30 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users.WINDOWS\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2006/02/18 16:26:21 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2006/02/18 16:26:20 | 000,000,079 | —- | M] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2010/02/09 00:59:54 | 000,918,816 | —- | M] (Sun Microsystems, Inc.) – C:\Documents and Settings\Eman\Desktop\jxpiinstall.exe
[2010/01/08 22:21:37 | 179,976,872 | —- | M] (Macrovision Corporation) – C:\Documents and Settings\Eman\Desktop\KEYVSPRX2IETBB.exe
[2010/09/02 16:23:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/09/02 15:53:38 | 007,282,568 | —- | M] (VS Revo Group ) – C:\Documents and Settings\Eman\Desktop\RevoUninProSetup.exe
[2009/11/22 09:44:56 | 003,309,944 | —- | M] (YouSendIt ) – C:\Documents and Settings\Eman\Desktop\YouSendItExpressSetup2_4_0.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-02 14:37:08
< End of report >

OTL Extras logfile created on: 9/2/2010 4:29:53 PM - Run 1
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\Eman\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 250.00 Mb Available Physical Memory | 49.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 76.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.32 Gb Total Space | 23.97 Gb Free Space | 32.25% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GEOLOGIST
Current User Name: Eman
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
http [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] – "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"135:TCP" = 135:TCP:*:Enabled:TCP Port 135
"5000:TCP" = 5000:TCP:*:Enabled:TCP Port 5000
"5001:TCP" = 5001:TCP:*:Enabled:TCP Port 5001
"5002:TCP" = 5002:TCP:*:Enabled:TCP Port 5002
"5003:TCP" = 5003:TCP:*:Enabled:TCP Port 5003
"5004:TCP" = 5004:TCP:*:Enabled:TCP Port 5004
"5005:TCP" = 5005:TCP:*:Enabled:TCP Port 5005
"5006:TCP" = 5006:TCP:*:Enabled:TCP Port 5006
"5007:TCP" = 5007:TCP:*:Enabled:TCP Port 5007
"5008:TCP" = 5008:TCP:*:Enabled:TCP Port 5008
"5009:TCP" = 5009:TCP:*:Enabled:TCP Port 5009
"5010:TCP" = 5010:TCP:*:Enabled:TCP Port 5010
"5011:TCP" = 5011:TCP:*:Enabled:TCP Port 5011
"5012:TCP" = 5012:TCP:*:Enabled:TCP Port 5012
"5013:TCP" = 5013:TCP:*:Enabled:TCP Port 5013
"5014:TCP" = 5014:TCP:*:Enabled:TCP Port 5014
"5015:TCP" = 5015:TCP:*:Enabled:TCP Port 5015
"5016:TCP" = 5016:TCP:*:Enabled:TCP Port 5016
"5017:TCP" = 5017:TCP:*:Enabled:TCP Port 5017
"5018:TCP" = 5018:TCP:*:Enabled:TCP Port 5018
"5019:TCP" = 5019:TCP:*:Enabled:TCP Port 5019
"5020:TCP" = 5020:TCP:*:Enabled:TCP Port 5020

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Lexmark 1300 Series\app4r.exe" = C:\Program Files\Lexmark 1300 Series\app4r.exe:*:Enabled:Lexmark Imaging Studio – ()

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\WINDOWS\system32\LEXPPS.EXE" = C:\WINDOWS\system32\LEXPPS.EXE:*:Enabled:LEXPPS.EXE – File not found
"C:\Program Files\Lexmark 1300 Series\lxdcamon.exe" = C:\Program Files\Lexmark 1300 Series\lxdcamon.exe:*:Enabled:Lexmark Device Monitor – ()
"C:\Program Files\Lexmark 1300 Series\App4R.exe" = C:\Program Files\Lexmark 1300 Series\App4R.exe:*:Enabled:Lexmark Imaging Studio – ()
"C:\WINDOWS\system32\lxdccoms.exe" = C:\WINDOWS\system32\lxdccoms.exe:*:Enabled:Lexmark Communications System – ( )
"C:\Program Files\Maxima-5.14.0\wxMaxima\wxMaxima.exe" = C:\Program Files\Maxima-5.14.0\wxMaxima\wxMaxima.exe:*:Enabled:wxMaxima – ()
"C:\Program Files\Kontiki\KService.exe" = C:\Program Files\Kontiki\KService.exe:*:Enabled:Delivery Manager Service – (Kontiki Inc.)
"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes – (Apple Inc.)
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe:*:Enabled: – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe:*:Enabled: – ()
"C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe" = C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe:*:Enabled: – (Lexmark International, Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{053B3DA8-91B5-4682-A130-715412A1A252}" = Paint.NET v3.5.4
"{075473F5-846A-448B-BCB3-104AA1760205}" = Sonic Data Module
"{08C0729E-3E50-11DF-9D81-005056806466}" = Google Earth
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{0BEDBD4E-2D34-47B5-9973-57E62B29307C}" = ATI Control Panel
"{15EE79F4-4ED1-4267-9B0F-351009325D7D}" = HP Software Update
"{17B66E83-1BC9-11D5-A54A-0090278A1BB8}" = Microsoft FrontPage Client - English
"{1A655D51-1423-48A3-B748-8F5A0BE294C8}" = Microsoft Visual J# .NET Redistributable Package 1.1
"{20610409-CA18-41A6-9E21-A93AE82EE7C5}" = Visual Studio .NET Professional 2003 - English
"{21657574-BD54-48A2-9450-EB03B2C7FC29}" = Sonic MyDVD Plus
"{26A24AE4-039D-4CA4-87B4-2F83216018FF}" = Java™ 6 Update 18
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager
"{32F66A20-7614-11D4-BD11-00104BD3F987}" = MathPlayer
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3DE0053C-FD9A-483E-B7C9-B06E4392206E}" = iTunes
"{40F8FD5F-4701-48D6-A8FC-1F188007DF38}" = ArcGIS Desktop
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{43A6AA2A-74B5-4E1C-91DB-ECB2F99D9ED7}" = HP User Guides 0008
"{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}" = Bonjour
"{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}" = Apple Mobile Device Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{534AA552-E1F1-4965-B2AA-FBDEB0730D60}" = muvee autoProducer 4.0 - SE
"{5757AE1A-1DB4-4898-9806-09F77FBD5E57}" = MSDN Library for Visual Studio .NET 2003
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler
"{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.4.1
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{726D5831-C98B-4E06-91A1-ECE85E1099E8}" = Roxio RecordNow
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73109D90-9FAB-4333-A622-449B0A9F6A0C}" = KeyChamp 2.0
"{84F1DE76-C48C-4281-87A0-CC9548D1E7F9}" = Rhapsody Player Engine
"{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD
"{94FB906A-CF42-4128-A509-D353026A607E}" = REALTEK Gigabit and Fast Ethernet NIC Driver
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = Sonic Audio Module
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = Sonic Copy Module
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C151CE54-E7EA-4804-854B-F515368B0798}" = Athlon 64 Processor Driver
"{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868}" = Safari
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CEB326EC-8F40-47B2-BA22-BB092565D66F}" = Quick Launch Buttons 5.20 D2
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D466F3D9-510C-4729-B7D4-2E70490E4CDF}" = BBC iPlayer Download Manager
"{D4D24FE5-FAB3-4FE2-AFFC-623955F4DF3A}" = Visual Studio.NET Baseline - English
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0
"{FF6F491D-BC82-4DCC-A72F-1824957C6466}" = TIxx21
"Ad-Aware SE Personal" = Ad-Aware SE Personal
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"All ATI Software" = ATI - Software Uninstall Utility
"ATI Display Driver" = ATI Display Driver
"BBC iPlayer Download Manager" = BBC iPlayer Download Manager
"Broadcom 802.11b Network Adapter" = Broadcom 802.11 Wireless LAN Adapter
"CNXT_AUDIO" = Conexant AC-Link Audio
"CNXT_MODEM_PCI_VEN_1002&DEV;_4378" = Soft Data Fax Modem with SmartCP
"Data Access Objects (DAO) 3.5" = Data Access Objects (DAO) 3.5
"DECCHECK" = Microsoft Windows XP Video Decoder Checkup Utility
"GoldWave v5.24" = GoldWave v5.24
"Google Updater" = Google Updater
"HP PrecisionScan" = HP PrecisionScan
"InstallShield_{8C8224B7-AA9B-4807-97CD-55899BAC83FE}" = YouSendIt Express
"InstallShield_{FF6F491D-BC82-4DCC-A72F-1824957C6466}" = Texas Instruments PCIxx21/x515 drivers.
"IrfanView" = IrfanView (remove only)
"MapObjects 2.0" = ESRI MapObjects 2.3
"MapObjects 2.3 Samples" = ESRI MapObjects 2.3 Samples
"MapObjects 2.3a Sample Data" = ESRI MapObjects 2.3a Sample Data
"Maxima-5.14.0_is1" = Maxima 5.14.0
"MDL Chime/Chime Pro for Internet Explorer" = MDL Chime/Chime Pro for Internet Explorer
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"Multiquence v2.55" = Multiquence v2.55
"Picasa 3" = Picasa 3
"Python 2.1" = Python 2.1
"Python 2.1 combined Win32 extensions" = Python 2.1 combined Win32 extensions
"RealPlayer 12.0" = RealPlayer
"ShockwaveFlash" = Adobe Flash Player 9 ActiveX
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"VETWIN32Vp5" = CA Anti-Virus
"Visual Studio .NET Professional 2003 - English" = Microsoft Visual Studio .NET Professional 2003 - English
"WGA" = Windows Genuine Advantage Validation Tool
"WIC" = Windows Imaging Component
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinZip" = WinZip
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/13/2010 4:46:04 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 8832, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 8/25/2010 3:51:31 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 15924, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 8/25/2010 3:51:31 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 8/25/2010 3:51:38 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 15924, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 8/27/2010 7:45:12 PM | Computer Name = GEOLOGIST | Source = Application Error | ID = 1000
Description = Faulting application firefox.exe, version 1.9.2.3855, faulting module
unknown, version 0.0.0.0, fault address 0x00000001.

Error - 8/28/2010 8:24:50 PM | Computer Name = GEOLOGIST | Source = Application Error | ID = 1000
Description = Faulting application KService.exe, version 5.12.707.160, faulting
module KService.exe, version 5.12.707.160, fault address 0x0021215a.

Error - 8/28/2010 8:26:05 PM | Computer Name = GEOLOGIST | Source = Application Error | ID = 1001
Description = Fault bucket 533075205.

Error - 9/1/2010 6:26:49 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 15924, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

Error - 9/1/2010 6:26:49 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3011
Description = Unloading the performance counter strings for service WmiApRpl (WmiApRpl)
failed. The Error code is the first DWORD in Data section.

Error - 9/1/2010 6:26:52 PM | Computer Name = GEOLOGIST | Source = LoadPerf | ID = 3001
Description = The performance counter name string value in the registry is incorrectly
formatted.
The bogus string is 15924, the bogus index value is the first DWORD in Data section
while the last valid index values are the second and third DWORD in Data section.

[ System Events ]
Error - 9/1/2010 7:19:16 PM | Computer Name = GEOLOGIST | Source = DCOM | ID = 10005
Description = DCOM got error "%1084" attempting to start the service EventSystem
with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

Error - 9/1/2010 8:22:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The LexBce Server service failed to start due to the following error:
%%2

Error - 9/1/2010 8:22:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7001
Description = The Print Spooler service depends on the LexBce Server service which
failed to start because of the following error: %%2

Error - 9/1/2010 8:22:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdcCATSCustConnectService
service to connect.

Error - 9/1/2010 8:22:48 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The lxdcCATSCustConnectService service failed to start due to the
following error: %%1053

Error - 9/2/2010 5:45:49 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the Dnscache service.

Error - 9/2/2010 6:03:00 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The LexBce Server service failed to start due to the following error:
%%2

Error - 9/2/2010 6:03:00 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7001
Description = The Print Spooler service depends on the LexBce Server service which
failed to start because of the following error: %%2

Error - 9/2/2010 6:03:00 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the lxdcCATSCustConnectService
service to connect.

Error - 9/2/2010 6:03:00 PM | Computer Name = GEOLOGIST | Source = Service Control Manager | ID = 7000
Description = The lxdcCATSCustConnectService service failed to start due to the
following error: %%1053

< End of report >

Satchfan

Post #12September 4, 2010, 7:15 AM UTC

Hello MudBird

I don’t understand why, but Lexmark is proving hard to get rid of so we’ll have to do it manually.

Run OTL

Double click on the icon to run it.

Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL PRC - C:\WINDOWS\system32\lxdccoms.exe ( ) SRV - (LexBceS) – C:\WINDOWS\System32\LEXBCES.EXE File not found SRV - (lxdcCATSCustConnectService) – C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe () SRV - (lxdc_device) – C:\WINDOWS\System32\lxdccoms.exe ( ) O4 - HKLM..\Run: [lxdcamon] C:\Program Files\Lexmark 1300 Series\lxdcamon.exe () O4 - HKLM..\Run: [lxdcmon.exe] C:\Program Files\Lexmark 1300 Series\lxdcmon.exe File not found O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe File not found O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_18.dll (Sun Microsystems, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18) O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\AutoRun\command - "" = F:\ .exe – File not found O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\explore\Command - "" = F:\ .exe – File not found O33 - MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\Shell\open\Command - "" = F:\ .exe – File not found O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell - "" = AutoRun O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\Shell\AutoRun\command - "" = E:\LaunchU3.exe – File not found [2010/09/01 19:11:50 | 000,000,000 | —D | C] – C:\lexmark [2010/07/13 11:53:41 | 000,000,000 | —D | C] – C:\Program Files\Lexmark 1300 Series [2007/07/31 07:16:50 | 000,999,424 | —- | C] ( ) – C:\WINDOWS\System32\lxdcusb1.dll [2010/07/13 07:13:35 | 000,000,000 | —D | C] – C:\Program Files\Lexmark Toolbar [2007/07/31 07:16:51 | 000,413,696 | —- | C] ( ) – C:\WINDOWS\System32\lxdcinpa.dll [2007/07/31 07:16:51 | 000,323,584 | —- | C] ( ) – C:\WINDOWS\System32\LXDChcp.dll [2010/07/13 07:14:34 | 000,000,000 | —D | C] – C:\Program Files\Corel [2007/07/31 07:16:50 | 000,397,312 | —- | C] ( ) – C:\WINDOWS\System32\lxdciesc.dll [2007/07/31 07:16:49 | 001,232,896 | —- | C] ( ) – C:\WINDOWS\System32\lxdcserv.dll [2007/07/31 07:16:49 | 000,163,840 | —- | C] ( ) – C:\WINDOWS\System32\lxdcprox.dll [2007/07/31 07:16:49 | 000,094,208 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpplc.dll [2007/07/31 07:16:48 | 000,643,072 | —- | C] ( ) – C:\WINDOWS\System32\lxdcpmui.dll [2007/07/31 07:16:48 | 000,585,728 | —- | C] ( ) – C:\WINDOWS\System32\lxdclmpm.dll [2007/07/31 07:16:47 | 000,700,416 | —- | C] ( ) – C:\WINDOWS\System32\lxdchbn3.dll [2007/07/31 07:16:45 | 000,425,984 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomm.dll [2007/07/31 07:16:44 | 000,684,032 | —- | C] ( ) – C:\WINDOWS\System32\lxdccomc.dll [2010/06/21 21:51:22 | 000,002,416 | —- | M] () – C:\WINDOWS\System32\LexFiles.ulf [2010/06/21 21:24:51 | 000,000,118 | —- | M] () – C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd [2007/07/31 07:36:51 | 000,040,960 | —- | C] () – C:\WINDOWS\System32\lxdcvs.dll [2007/07/31 07:36:42 | 000,344,064 | —- | C] () – C:\WINDOWS\System32\lxdccoin.dll [2007/07/31 07:18:07 | 000,000,044 | —- | C] () – C:\WINDOWS\System32\lxdcrwrd.ini [2007/07/31 07:16:51 | 000,286,720 | —- | C] () – C:\WINDOWS\System32\LXDCinst.dll [2007/07/31 07:16:46 | 000,208,896 | —- | C] () – C:\WINDOWS\System32\lxdcgrd.dll [2006/04/14 07:49:03 | 000,000,484 | —- | C] () – C:\WINDOWS\LEXSTAT.INI [2009/07/18 08:44:31 | 000,019,110 | —- | M] () – C:\LXDCcomx.log [2007/01/18 06:18:54 | 000,103,936 | —- | M] () – C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdcdrpp.dll :Files C:\WINDOWS\system32\LEXPPS.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe :reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Program Files\Lexmark 1300 Series\app4r.exe"=- [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\WINDOWS\system32\LEXPPS.EXE" =- "C:\Program Files\Lexmark 1300 Series\lxdcamon.exe" =- "C:\Program Files\Lexmark 1300 Series\App4R.exe" =- "C:\WINDOWS\system32\lxdccoms.exe" =- "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe" =- "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe" =- "C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe" =- [emptytemp] [start explorer] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)

Satchfan

MudBird

Post #13September 4, 2010, 7:32 AM UTC

Satchfan! I'm so glad, I was just about to go to bed & thought I'd take one more look at this thing. Okay, here goes. I'm going to run the fix and see if it reboots, and then I'll let you know what happens. If I disappear for three days, that means it didn't reboot. :-) Thanks again. Mudbird

Satchfan

Post #14September 4, 2010, 7:51 AM UTC

MudBird

Post #15September 4, 2010, 8:01 AM UTC last edited September 4, 2010, 4:50 PM UTC

Sigh. Ran the OTL fix, tried to reboot, hung up at "Windows is Starting". Two resets, then started in Safe Mode. Rats. I don't think I'd better leave this thing running in Safe Mode with network access, so I'm going to turn it off again and see what it does tomorrow. Can you see anything else in that report besides the Lexmark stuff? Both that and the Corel software seem to be gone from the "Add or Remove" list. Don't know what part of the world you're in, but it's 1am here and I'm done for. Thank you very much for your patience and all your help. I'll check back in the morning. Cheers, Mudbird ps Here's the report that OTL gave me when I started the computer this morning in Safe Mode again: User: NetworkService.NT AUTHORITY ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 2864633 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 40716978 bytes %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes RecycleBin emptied: 5044077 bytes Total Files Cleaned = 127.00 mb OTL by OldTimer - Version 3.2.11.0 log created on 09042010_091237 Files\Folders moved on Reboot… Registry entries deleted on Reboot…

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Windows hangs on startup; System Restore won't "take"

✨ Ask AI

Ask AI