What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Windows hangs on startup; System Restore won't "take"

18 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Don’t worry MudBird, we’ll get to the bottom of this.

Meanwhile, please send me a copy of the OTL fix log and a new OTL log.

A copy of the OTL fix log is saved in C:\_OTL\Moved Files

When you’ve located the fix log:• Open OTL again and click the Quick Scan button (don't check the boxes beside LOP Check or Purity this time)
• Post the OTL.txt log it produces in your next reply.
Please post back with both logs:

Satchfan
Post #17 last edited
A bit of additional info: I looked through my C: drive and can't find any of the programs we removed, but the computer still won't start properly. I did find a folder under Program Files called Lx_cats. I don't know if it's associated with the Lexmark stuff or something entirely different. All it contains are 7 files with names "20A028531027941.A00" to "-A06", an xml file and a file described as "Configuration Settings". I don't know what's in the A0# files, but here is the text of the other two, in case they can provide any useful information: lxdcdefs.xml: –> –> –> –> –> –> –> –> –> –> –> –> –> –> –> lxdcCATS: [CATS Control] CATSParticipation=0 ArchiveCount=10 FirstSurveyDays=60 NextSurveyDays=180 NextArchiveDays=30 NextAIOFetch=0 NextUpload=30 NumRetries=5 TimeoutSecs=50 UploadURL=https://www.lxkcc1.com MaxMsgSizeKb=600 UserName=b2btest Password=b2btest UploadINI=0 DeleteStatus=1 [CATS Scratch] InstallDate=2454313 LastSurvey=2454313 LastArchive=2455031 LastAIOFetch=2455031 LastUpload=2454313 LastUploadError=0 LastConnectError=0 GUID=e58dd193-7a37-41ba-834a-2B79FDCC0364 [Serial Number] Serial=20A028531027941 I don't know what is being uploaded or why; the files in the folder have dates ranging from the beginning to the end of 2009, with one dated November 2007. I'm fairly sure this correlates with the time frame in which we owned the Lexmark 1300, but no idea if it is related or not. Maybe I'm grasping at straws. By the way, I received an email today about some British seat-belt advertisement, which had been forwarded through a whole string of people since May. I don't know the sender, and there was a whole list of recipients, none of whom I recognized. Normally I delete things like that unopened (which I did), but I noticed in the viewing pane that one of the previous recipients was called OldTimer47. Surely that wouldn't be the same OldTimer who wrote OTL? Just wondering. It gave me a bit of a chill. Well, thanks for your help, Satchfan. I won't give up if you won't. Cheers, Mudbird ps Oh, sorry, I somehow didn't see your last message!? I'll get those fix logs to you right away.
Post #18
Thanks for the information MudBird. I see you are still logged in but I won't be able to respond until I have cleared my reply with an expert. I believe is a bit late now where you are, so I should leave this until tomorrow, Satchfan
Post #19
Hello? Satchfan?

I'm very confused now. Did I post something inappropriate a few minutes ago? There was a post from you which I hadn't seen, and one from me which I had edited, and now they're both gone? I apologize if I've misstepped. Or maybe it's a case of crossed messages; now I see a new one from you, about checking with an expert.

Here is the newest OTL log:

OTL logfile created on: 9/6/2010 1:00:56 AM - Run 2
OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\Eman\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

510.00 Mb Total Physical Memory | 340.00 Mb Available Physical Memory | 67.00% Memory free
1.00 Gb Paging File | 1.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.32 Gb Total Space | 24.00 Gb Free Space | 32.30% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: GEOLOGIST
Current User Name: Eman
Logged in as Administrator.

Current Boot Mode: SafeMode with Networking
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 90 Days
Output = Minimal
Quick Scan

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\Eman\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – C:\WINDOWS\System32\hidserv.dll File not found
SRV - (VETMSGNT) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\vetmsg.exe (CA, Inc.)
SRV - (CaCCProvSP) – C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe (CA, Inc.)
SRV - (KService) – C:\Program Files\Kontiki\KService.exe (Kontiki Inc.)
SRV - (CAISafe) – C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\isafe.exe (Computer Associates International, Inc.)
SRV - (SNMP) – C:\WINDOWS\system32\snmp.exe (Microsoft Corporation)
SRV - (W3SVC) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (SMTPSVC) Simple Mail Transfer Protocol (SMTP) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)
SRV - (IISADMIN) – C:\WINDOWS\system32\inetsrv\inetinfo.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (VETEFILE) – C:\WINDOWS\System32\drivers\vetefile.sys (Computer Associates International, Inc.)
DRV - (VETEBOOT) – C:\WINDOWS\System32\drivers\veteboot.sys (Computer Associates International, Inc.)
DRV - (Revoflt) – C:\WINDOWS\system32\drivers\revoflt.sys (VS Revo Group)
DRV - (VETMONNT) – C:\WINDOWS\System32\drivers\vetmonnt.sys (Computer Associates International, Inc.)
DRV - (VET-FILT) – C:\WINDOWS\System32\drivers\vet-filt.sys (Computer Associates International, Inc.)
DRV - (VETFDDNT) – C:\WINDOWS\System32\drivers\vetfddnt.sys (Computer Associates International, Inc.)
DRV - (VET-REC) – C:\WINDOWS\System32\drivers\vet-rec.sys (Computer Associates International, Inc.)
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (HSF_DP) – C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
DRV - (winachsf) – C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSFHWATI) – C:\WINDOWS\system32\drivers\HSFHWATI.sys (Conexant Systems, Inc.)
DRV - (BCM43XX) – C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
DRV - (CAMCHALA) – C:\WINDOWS\system32\drivers\camc6hal.sys (Conexant Systems Inc.)
DRV - (CAMCAUD) – C:\WINDOWS\system32\drivers\camc6aud.sys (Conexant Systems Inc.)
DRV - (RTL8023xp) – C:\WINDOWS\system32\drivers\Rtlnicxp.sys (Realtek Semiconductor Corporation )
DRV - (tifm21) – C:\WINDOWS\system32\drivers\tifm21.sys (Texas Instruments)
DRV - (SynTP) – C:\WINDOWS\system32\drivers\SynTP.sys (Synaptics, Inc.)
DRV - (eabfiltr) – C:\WINDOWS\system32\drivers\eabfiltr.sys (Hewlett-Packard Development Company, L.P.)
DRV - (eabusb) – C:\WINDOWS\system32\drivers\EabUsb.sys (Hewlett-Packard Development Company, L.P.)
DRV - (AmdK8) – C:\WINDOWS\system32\drivers\AmdK8.sys (Advanced Micro Devices)
DRV - (rtl8139) Realtek RTL8139(A/B/C) – C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.youtube.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://www.google.com/search?lr=&ie;=UTF-8&oe;=UTF-8&q;="
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "http://en-us.start.mozilla.com/firefox?client=firefox-a&rls;=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: [removed]:1.0.0.071303000004
FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/12 22:25:57 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/09/01 08:13:51 | 000,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/09/01 08:13:45 | 000,000,000 | —D | M]

[2009/02/12 23:52:55 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Extensions
[2010/09/03 18:48:01 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/07/13 13:25:22 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}(2)
[2010/07/13 07:24:22 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}(2)
[2009/02/21 21:58:19 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\[removed]
[2010/07/13 13:29:36 | 000,000,000 | —D | M] – C:\Documents and Settings\Eman\Application Data\Mozilla\Firefox\Profiles\a9olp3q3.default\extensions\staged-xpis
[2010/09/03 18:48:01 | 000,000,000 | —D | M] – C:\Program Files\Mozilla Firefox\extensions
[2006/03/09 15:16:00 | 000,000,000 | —D | M] (Google Toolbar for Firefox) – C:\Program Files\Mozilla Firefox\extensions\{3112ca9c-de6d-4884-a869-9855de68056c}
[2010/09/01 07:52:48 | 000,000,000 | —D | M] (Java Console) – C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2008/02/27 17:57:38 | 000,106,496 | —- | M] (British Broadcasting Corporation) – C:\Program Files\Mozilla Firefox\plugins\npBBCPlugin.dll

O1 HOSTS File: ([2004/08/04 05:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
O4 - HKLM..\Run: [CAVRID] C:\Program Files\CA\CA Internet Security Suite\CA Anti-Virus\CAVRID.exe (CA, Inc.)
O4 - HKLM..\Run: [cctray] C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe (CA, Inc.)
O4 - HKLM..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe (Hewlett-Packard )
O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
O4 - HKCU..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe (Kontiki Inc.)
O4 - HKCU..\Run: [YouSendIt.exe] C:\Program Files\YouSendIt\Express\YouSendIt.exe ()
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\Nikon Monitor.lnk = C:\Program Files\Common Files\Nikon\Monitor\NkMonitor.exe (Nikon Corporation)
O4 - Startup: C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE (WinZip Computing LP)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\System32\VetRedir.dll (Computer Associates International, Inc.)
O12 - Plugin for: .csm - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .csml - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cub - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .cube - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .dx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .emb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .embl - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .gau - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .jdx - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mol - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .mop - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .pdb - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .rxn - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .scr - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .skc - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .spt - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .tgf - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O12 - Plugin for: .xyz - C:\Program Files\Internet Explorer\PLUGINS\npchime.dll (MDL Information Systems, Inc.)
O15 - HKCU\..Trusted Domains: bigcountry.co.uk ([www] http in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/…b?1144355937828 (WUWebControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\application/xhtml+xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\application/xhtml+xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O18 - Protocol\Filter\text/xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Eman\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/09/30 19:43:00 | 000,000,050 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 90 Days ==========

[2010/09/04 00:48:32 | 000,000,000 | -HSD | C] – C:\WINDOWS\CSC
[2010/09/02 16:23:15 | 000,574,976 | —- | C] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/09/02 15:55:48 | 000,000,000 | —D | C] – C:\Documents and Settings\Eman\Local Settings\Application Data\VS Revo Group
[2010/09/02 15:54:47 | 000,027,064 | —- | C] (VS Revo Group) – C:\WINDOWS\System32\drivers\revoflt.sys
[2010/09/02 15:54:43 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2010/09/02 15:53:22 | 007,282,568 | —- | C] (VS Revo Group ) – C:\Documents and Settings\Eman\Desktop\RevoUninProSetup.exe
[2010/08/30 22:54:43 | 000,000,000 | —D | C] – C:\_OTL
[2010/08/25 13:01:21 | 000,000,000 | —D | C] – C:\Program Files\Trend Micro
[2010/07/13 14:32:25 | 000,746,216 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:25 | 000,130,280 | —- | C] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/13 12:19:24 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Apple
[2010/07/13 12:06:36 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users.WINDOWS\Application Data\InterVideo
[2010/07/13 07:18:39 | 000,000,000 | —D | C] – C:\Program Files\Snocap
[2010/07/08 00:14:12 | 000,000,000 | —D | C] – C:\WINDOWS\System32\NtmsData
[2010/06/21 21:22:08 | 000,000,000 | —D | C] – C:\Documents and Settings\Eman\Desktop\BADGUYS
[2010/06/21 18:22:04 | 000,000,000 | —D | C] – C:\Config.Msi

========== Files - Modified Within 90 Days ==========

[2010/09/06 01:00:41 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/09/06 01:00:41 | 000,000,276 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1993962763-1292428093-725345543-1003.job
[2010/09/06 00:24:39 | 000,858,530 | —- | M] () – C:\WINDOWS\System32\PerfStringBackup.INI
[2010/09/06 00:24:39 | 000,676,196 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2010/09/06 00:24:39 | 000,165,334 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2010/09/06 00:20:47 | 000,013,732 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2010/09/06 00:20:08 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2010/09/06 00:13:18 | 000,000,178 | -HS- | M] () – C:\Documents and Settings\Eman\ntuser.ini
[2010/09/06 00:13:17 | 005,910,528 | —- | M] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/09/05 23:23:04 | 004,240,656 | -H– | M] () – C:\Documents and Settings\Eman\Local Settings\Application Data\IconCache.db
[2010/09/04 19:24:37 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/09/04 09:10:46 | 000,075,264 | —- | M] () – C:\Documents and Settings\Eman\Desktop\SystemLook.exe
[2010/09/04 00:35:39 | 000,000,006 | -H– | M] () – C:\WINDOWS\tasks\SA.DAT
[2010/09/03 23:59:02 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2010/09/03 21:59:10 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2010/09/03 19:24:57 | 000,000,868 | —- | M] () – C:\WINDOWS\tasks\Google Software Updater.job
[2010/09/02 22:17:02 | 000,018,336 | —- | M] () – C:\Documents and Settings\Eman\Application Data\wklnhst.dat
[2010/09/02 16:23:16 | 000,574,976 | —- | M] (OldTimer Tools) – C:\Documents and Settings\Eman\Desktop\OTL.exe
[2010/09/02 15:54:49 | 000,000,839 | —- | M] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2010/09/02 15:54:49 | 000,000,821 | —- | M] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Revo Uninstaller Pro.lnk
[2010/09/02 15:53:38 | 007,282,568 | —- | M] (VS Revo Group ) – C:\Documents and Settings\Eman\Desktop\RevoUninProSetup.exe
[2010/09/02 15:01:48 | 000,282,928 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2010/09/02 07:36:36 | 000,001,355 | —- | M] () – C:\WINDOWS\imsins.BAK
[2010/08/27 00:14:45 | 000,284,915 | —- | M] () – C:\Documents and Settings\Eman\Desktop\gmer.zip
[2010/08/25 20:48:37 | 000,000,372 | —- | M] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/07/13 14:32:06 | 000,746,216 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\vetefile.sys
[2010/07/13 14:32:06 | 000,130,280 | —- | M] (Computer Associates International, Inc.) – C:\WINDOWS\System32\drivers\veteboot.sys
[2010/07/01 08:27:09 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job

========== Files Created - No Company Name ==========

[2010/09/04 19:24:37 | 000,000,664 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2010/09/04 09:11:07 | 000,001,846 | —- | C] () – C:\Documents and Settings\Eman\SystemLook.txt
[2010/09/04 09:10:46 | 000,075,264 | —- | C] () – C:\Documents and Settings\Eman\Desktop\SystemLook.exe
[2010/09/02 15:54:49 | 000,000,839 | —- | C] () – C:\Documents and Settings\Eman\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
[2010/09/02 15:54:49 | 000,000,821 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Desktop\Revo Uninstaller Pro.lnk
[2010/08/27 00:14:39 | 000,284,915 | —- | C] () – C:\Documents and Settings\Eman\Desktop\gmer.zip
[2010/08/25 20:48:37 | 000,000,372 | —- | C] () – C:\Documents and Settings\Eman\My Documents\spider.sav
[2010/07/13 15:44:31 | 005,910,528 | —- | C] () – C:\Documents and Settings\Eman\ntuser.dat
[2010/06/21 22:10:10 | 000,000,230 | —- | C] () – C:\Documents and Settings\Eman\Install.log
[2008/09/30 19:39:32 | 000,209,040 | —- | C] () – C:\WINDOWS\System32\IVIresizeW7.dll
[2008/09/30 19:39:32 | 000,192,656 | —- | C] () – C:\WINDOWS\System32\IVIresizePX.dll
[2008/09/30 19:39:31 | 000,204,944 | —- | C] () – C:\WINDOWS\System32\IVIresizeA6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeP6.dll
[2008/09/30 19:39:31 | 000,196,752 | —- | C] () – C:\WINDOWS\System32\IVIresizeM6.dll
[2008/09/30 19:39:31 | 000,024,720 | —- | C] () – C:\WINDOWS\System32\IVIresize.dll
[2008/05/17 08:32:02 | 000,306,688 | —- | C] () – C:\WINDOWS\System32\Lffpx7.dll
[2008/05/17 08:32:02 | 000,095,232 | —- | C] () – C:\WINDOWS\System32\Lfkodak.dll
[2008/05/17 08:19:52 | 000,165,888 | —- | C] () – C:\WINDOWS\System32\hpgt53.dll
[2008/05/02 16:13:17 | 000,001,590 | —- | C] () – C:\Documents and Settings\Eman\Application Data\Multique.ini
[2008/05/02 16:13:17 | 000,001,403 | —- | C] () – C:\Documents and Settings\Eman\Application Data\MQPreset.ini
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\ColorTable
[2008/04/18 19:16:03 | 000,000,268 | RH– | C] () – C:\Documents and Settings\Eman\Application Data\Clean Electric Guitar
[2008/04/18 19:16:02 | 000,000,020 | -H– | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\PKP_DLdu.DAT
[2006/11/04 09:58:14 | 000,000,870 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2006/10/11 23:56:16 | 000,001,337 | —- | C] () – C:\Documents and Settings\All Users.WINDOWS\Application Data\QTSBandwidthCache
[2006/05/23 12:33:44 | 000,000,754 | —- | C] () – C:\WINDOWS\WORDPAD.INI
[2006/05/09 13:47:21 | 000,051,712 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/04/30 09:32:23 | 000,000,153 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/04/05 08:35:13 | 000,000,000 | —- | C] () – C:\WINDOWS\import71.INI
[2006/03/28 10:49:33 | 000,000,100 | —- | C] () – C:\WINDOWS\WININIT.INI
[2006/02/19 01:31:01 | 000,018,336 | —- | C] () – C:\Documents and Settings\Eman\Application Data\wklnhst.dat
[2006/02/19 00:39:27 | 000,000,462 | —- | C] () – C:\WINDOWS\ArcView9x.INI
[2006/02/19 00:31:52 | 000,299,073 | —- | C] () – C:\WINDOWS\System32\PythonCOM21.dll
[2006/02/19 00:31:52 | 000,065,536 | —- | C] () – C:\WINDOWS\System32\PyWinTypes21.dll
[2006/02/18 21:57:13 | 000,000,127 | —- | C] () – C:\Documents and Settings\Eman\Local Settings\Application Data\fusioncache.dat
[2006/02/18 20:53:00 | 000,000,000 | —- | C] () – C:\WINDOWS\frontpg.ini
[2006/02/18 20:49:56 | 000,021,791 | —- | C] () – C:\WINDOWS\System32\smtpctrs.ini
[2006/02/18 20:49:55 | 000,001,037 | —- | C] () – C:\WINDOWS\System32\ntfsdrct.ini
[2006/02/18 20:49:39 | 000,038,576 | —- | C] () – C:\WINDOWS\System32\w3ctrs.ini
[2006/02/18 20:49:39 | 000,010,225 | —- | C] () – C:\WINDOWS\System32\axperf.ini
[2006/02/18 20:49:36 | 000,011,435 | —- | C] () – C:\WINDOWS\System32\infoctrs.ini
[2006/01/25 13:48:38 | 000,000,000 | —- | C] () – C:\WINDOWS\System32\px.ini
[2004/01/10 12:46:34 | 000,172,032 | —- | C] () – C:\WINDOWS\System32\tifmicon.dll
[2002/03/16 17:00:00 | 000,007,420 | —- | C] () – C:\WINDOWS\UA000106.DLL
[1997/06/25 15:24:16 | 000,040,448 | —- | C] () – C:\WINDOWS\System32\RegObj.dll
< End of report >


Here is the report from the folder "_OTL\MovedFiles\09042010_003231"

All processes killed
========== OTL ==========
No active process named lxdccoms.exe was found!
Service LexBceS stopped successfully!
Service LexBceS deleted successfully!
File C:\WINDOWS\System32\LEXBCES.EXE File not found not found.
Service lxdcCATSCustConnectService stopped successfully!
Service lxdcCATSCustConnectService deleted successfully!
File move failed. C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe scheduled to be moved on reboot.
Service lxdc_device stopped successfully!
Service lxdc_device deleted successfully!
C:\WINDOWS\system32\lxdccoms.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\lxdcamon deleted successfully.
C:\Program Files\Lexmark 1300 Series\lxdcamon.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\lxdcmon.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SunJavaUpdateSched deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\ deleted successfully.
C:\Program Files\Java\jre6\bin\npjpi160_18.dll moved successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\ not found.
File F:\ .exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\ not found.
File F:\ .exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{91979a56-8a5a-11dc-8cb1-0014a525a5c8}\ not found.
File F:\ .exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c4f9a630-1883-11dc-8bb5-0014a525a5c8}\ not found.
File E:\LaunchU3.exe not found.
C:\lexmark\drivers\1300\Wireless\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\Wireless folder moved successfully.
C:\lexmark\drivers\1300\tools\diagnostics\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\tools\diagnostics folder moved successfully.
C:\lexmark\drivers\1300\tools folder moved successfully.
C:\lexmark\drivers\1300\Pubs\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\Pubs folder moved successfully.
C:\lexmark\drivers\1300\install\x86 folder moved successfully.
C:\lexmark\drivers\1300\install\x64 folder moved successfully.
C:\lexmark\drivers\1300\install\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\install\config\Nls folder moved successfully.
C:\lexmark\drivers\1300\install\config\Image folder moved successfully.
C:\lexmark\drivers\1300\install\config folder moved successfully.
C:\lexmark\drivers\1300\install folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k\x64\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k\x64 folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k\i386\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k\i386 folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k\common\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k\common folder moved successfully.
C:\lexmark\drivers\1300\drivers\win_xp2k folder moved successfully.
C:\lexmark\drivers\1300\drivers folder moved successfully.
C:\lexmark\drivers\1300\common\x86 folder moved successfully.
C:\lexmark\drivers\1300\common\x64 folder moved successfully.
C:\lexmark\drivers\1300\common folder moved successfully.
C:\lexmark\drivers\1300\Applications\ToolBar\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\Applications\ToolBar folder moved successfully.
C:\lexmark\drivers\1300\Applications\App4r\SShow\en folder moved successfully.
C:\lexmark\drivers\1300\Applications\App4r\SShow folder moved successfully.
C:\lexmark\drivers\1300\Applications\App4r\Scripts folder moved successfully.
C:\lexmark\drivers\1300\Applications\App4r\PhotoCards folder moved successfully.
C:\lexmark\drivers\1300\Applications\App4r folder moved successfully.
C:\lexmark\drivers\1300\Applications\AIOC\ENGLISH folder moved successfully.
C:\lexmark\drivers\1300\Applications\AIOC folder moved successfully.
C:\lexmark\drivers\1300\Applications folder moved successfully.
C:\lexmark\drivers\1300 folder moved successfully.
C:\lexmark\drivers folder moved successfully.
C:\lexmark folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Sshow folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Scripts folder moved successfully.
C:\Program Files\Lexmark 1300 Series\PhotoCards folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Install\Config\NLS folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Install\Config\Image folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Install\Config folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Install folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Drivers\I386\ENGLISH folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Drivers\I386 folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Drivers\COMMON\ENGLISH folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Drivers\COMMON folder moved successfully.
C:\Program Files\Lexmark 1300 Series\Drivers folder moved successfully.
C:\Program Files\Lexmark 1300 Series folder moved successfully.
C:\WINDOWS\system32\lxdcusb1.dll moved successfully.
C:\Program Files\Lexmark Toolbar folder moved successfully.
C:\WINDOWS\system32\lxdcinpa.dll moved successfully.
C:\WINDOWS\system32\LXDChcp.dll moved successfully.
C:\Program Files\Corel\VS-Installation Files\Utilities\MSVC2005 folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Utilities\Flash Player folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Utilities\AVControlSDK folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Utilities folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Templates\PAL folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Templates\NTSC folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Templates folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Option\M4\MP4Set.ini MP4 pack without ASP folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Option\M4\MP4Set.ini MP4 pack with ASP folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Option\M4\MP4Set.ini Full version folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Option\M4\MP4Set.ini 3GP pack folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Option\M4 folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\Option folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\OEM\TargetMain\Japanese folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\OEM\TargetMain\all folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\OEM\TargetMain folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup\OEM folder moved successfully.
C:\Program Files\Corel\VS-Installation Files\Setup folder moved successfully.
C:\Program Files\Corel\VS-Installation Files folder moved successfully.
C:\Program Files\Corel folder moved successfully.
C:\WINDOWS\system32\lxdciesc.dll moved successfully.
C:\WINDOWS\system32\lxdcserv.dll moved successfully.
C:\WINDOWS\system32\lxdcprox.dll moved successfully.
C:\WINDOWS\system32\lxdcpplc.dll moved successfully.
C:\WINDOWS\system32\lxdcpmui.dll moved successfully.
C:\WINDOWS\system32\lxdclmpm.dll moved successfully.
C:\WINDOWS\system32\lxdchbn3.dll moved successfully.
C:\WINDOWS\system32\lxdccomm.dll moved successfully.
C:\WINDOWS\system32\lxdccomc.dll moved successfully.
C:\WINDOWS\system32\LexFiles.ulf moved successfully.
C:\Documents and Settings\Eman\Desktop\Files named lxd.fnd moved successfully.
C:\WINDOWS\system32\lxdcvs.dll moved successfully.
C:\WINDOWS\system32\lxdccoin.dll moved successfully.
C:\WINDOWS\system32\lxdcrwrd.ini moved successfully.
C:\WINDOWS\system32\LXDCinst.dll moved successfully.
C:\WINDOWS\system32\lxdcgrd.dll moved successfully.
C:\WINDOWS\LEXSTAT.INI moved successfully.
C:\LXDCcomx.log moved successfully.
C:\WINDOWS\system32\spool\prtprocs\w32x86\lxdcdrpp.dll moved successfully.
========== FILES ==========
File\Folder C:\WINDOWS\system32\LEXPPS.EXE not found.
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe moved successfully.
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe moved successfully.
C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe moved successfully.
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Lexmark 1300 Series\app4r.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\LEXPPS.EXE deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Lexmark 1300 Series\lxdcamon.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Program Files\Lexmark 1300 Series\App4R.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\lxdccoms.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcpswx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdcjswx.exe deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\WINDOWS\system32\spool\drivers\w32x86\3\lxdctime.exe deleted successfully.

OTL by OldTimer - Version 3.2.11.0 log created on 09042010_003231

Files\Folders moved on Reboot…
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdcserv.exe moved successfully.

Registry entries deleted on Reboot…


====

and that's all it says. I'm guessing those registry entries weren't deleted, since it didn't really reboot. I'm going to go do some computer-free physics homework now. :-)
Post #21
Hi MudBird

one of the previous recipients was called OldTimer47. Surely that wouldn't be the same OldTimer who wrote OTL?

I wouldn’t say so, as the one in your e-mail seems to be someone called Peter from the UK. I’m afraid that this is just spam but you could add it to your “Blocked Sender List” to ensure that you receive no more from this source.


You can delete the Lx_cats folder. This contains information about your printer – how much ink/toner has been used, the serial number and other statistics regarding your printer – these statistics are reported back to Lexmark, so it is essentially “spyware”.


You don’t appear to have any malware on your computer and these issues could be caused by lack of Windows updates. You have SP2 installed and are missing some critical security updates which might resolve this issue. Support for Windows XP with Service Pack 2 (SP2) ended on July 13, 2010.

Go here for more details and follow the instructions to download SP3:

http://windows.microsoft.com/en-us/windows…of-support-mean

Where it says For information about using Windows Update in Windows XP, see Stay up to date automatically, click on Stay up to date automatically.

When the updates are completed, reboot in normal mode and let me know how things are now.

Satchfan
Post #22
Satchfan, you've been wonderful. I had no idea that SP2 was expired; thanks for that important info! July 13 is precisely the last date I was able to get a working System Restore, so that makes perfect sense. Yesterday I tried to install the major update, but first I had to update Internet Explorer, as it wouldn't let me read the support-page instructions with v.5. (I normally use Firefox, so rarely notice what version of IE I have.) Even after updating IE, it wouldn't proceed while Windows was in Safe Mode. Somehow I managed to install one of the minor patches, though (over the computer's protests!) and then it rebooted normally. So far, so good. When I went to get the major SP3 update, I still couldn't get it to download with IE so finally ended up using Firefox anyway. The update installation was running for a long time - a couple of hours at least - and I was afraid it was going to hang without finishing. But I left it running all night and in the morning the computer had rebooted and was ready to work! I'm glad that my hunch about that LX_Cats folder was right. I'm not as computer-clueless as I used to be. I've got rid of all the Lexmark stuff, the Corel Video Studio, the old Java, and something called Snocap Download Manager, through which I bought some music once and which has never worked right since. I suspect that all this stuff was slowing my Windows startups for a year or more, but it muddled along until that SP3 fix failed to install. I've always had it set on "Update Automatically", but since the update requires a reboot and the reboot doesn't work right, I'm thinking the installation was just never completed. Last night the installer stayed on the "cleaning up" phase longer than anything else. Just one more question: Now that the computer appears to be working right, how do I set a new Restore Point so that it can't possibly revert to the previous state of anarchy? Today is the first day of school for my little boy (2nd grade) so I'll be off now. Thank you ever so much for all your patient assistance. Cheers, Mudbird
Post #23
Hello MudBird I see you are logged in Well done – you’ve done a good job. I will give further instructions later when I have consulted with an expert. Satchfan
Post #24
Hello again MudBird

Before you finish, we need to clear up some of the tools we’ve used and then I’ll give you some guidelines regarding System Restore, security and keeping free from malware.


First

Uninstall OTL
• Double-click OTL.exe
• Click the CleanUp! button.
• Select Yes when the Begin cleanup Process? prompt appears.
• If you are prompted to reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.


Next

Create a new restore point
• Click Start Menu, Run
• Copy and paste the following:

%SystemRoot%\System32\restore\rstrui.exe

• Press OK
• Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create
• When the confirmation screen shows that the restore point has been created, click Close.
Remove old restore points• Go to Start, Programs, Accessories, System tools, Disk Cleanup
• When the Disc Cleanup dialog box appears, click OK
• When it finishes running, a box with tabs will appear, select the ”More options” tab
• On this tab you will find a section for System Restore
• If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.


Clear all your temporary files

Download ATF Cleaner here

To use ATF Cleaner:

Double-click ATF-Cleaner.exe (on your desktop) to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

For Technical Support, double-click the e-mail address located at the bottom of each menu


Set the computer to automatically check for Windows updates.

To turn on Automatic Updates:
• Click Start, Settings and then click Control Panel.
• Double-click Automatic Updates.
• Choose Automatic (recommended).


Update Adobe Acrobat

It is advisable to upgrade to version 9.3.4 in order to secure the program from known vulnerabilities. You can either run Reader and select Check for Updates under the Help menu, or visit the link below to download the update manually. If you have issues installing this update, make sure all browsers are closed before starting.

http://www.adobe.com/support/downloads/pro…&product=10


I recommend installing the following applications

SpywareBlaster. SpywareBlaster blocks over 11,000 bad programs and and sites and uses hardly any resources of your computer.
Malwarebytes-Anti-Malware: This really is an excellent program that you should run on a regular basis, probably weekly.


I also recommend that you read the following:

"How to prevent malware"
by miekiemoes

Remember to keep updating all your programs to help your computer remains clean. You can never update too often and your computer will not be protected from new malware if your programs are not up-to-date.

Safe computing

Satchfan
Post #25
Okay, I did all of those things and read the blog about spyware prevention (I'll bookmark that). I've had several perfectly normal restarts, shutdowns and startups since yesterday. It's lovely being able to use my computer again! Thank you so much! I think you can mark this thread as "RESOLVED". Satchfan, thanks again. E. Ramos

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI