What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

HELP

38 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #31 last edited
We will need to try to run OTL just to be sure we've caught everything. I've updated the instructions for you to make them a little easier to follow to get OTL downloaded to your desktop. Just take it one step at a time and if you get confused please post back and I'll try to clarify for you.


OTL Custom Scan

Download OTL to your Desktop. When you are prompted to Run or Save, please choose Save. In the box that appears, on the left hand side you should see your desktop as a location. Choose that as where to save it.
  • Now you should see the OTL icon on your desktop
  • Right click on the icon and choose "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Under Custom Scan paste this in

    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %PROGRAMFILES%\Internet Explorer\*.dat
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
  • You may need two posts to fit them both in.
Post #32
okay seems like things are fine, wrote emails speed seems fine but i do have something here popping up about addressing a problem with Flash Player, Internet Explorer 8 AND to set up backup (which i read twice before, i did, there was a time after meeting the techs like Tom and LDTATE….. and a few others, Abydos (post menopausal brain, i may have that name all wrong, but what a sweetheart he was)…so many wonderful kind helpful people who actually don't see me as the retard I am… I tried to understand that whole system back up thing. i did. was too hard. and it so hard on an older brain. lol, wonder why i'd drive 5 hours to sit in a parking lot with a tech person?????? LOL, just because every 2 minutes that I am stumped, won't take 20 minutes, 40 minutes or an hour of online time to try to get it right, lol…. and now i'm totally done in….. been on this computer since hello? maybe 3 pm???? and my brain is gone and I got bad news from a friend in an email so have to just shut down now and try to get my head on straight which when I was young I could just chill with some wine and a dooby and get all nice and mellow but who can afford that when you've been unemployed for over two years???? LOL so i'll try all that tomorrow…. and you go rest and have a wonderful night and take with you my deepest gratitude for your patience, your fortitude, your good heart, your TIME, effort and graceful handling of a old twit… i'll talk to you tomorrow and I will try hard to do the OTL. blessings, candice
Post #33
Tomorrow is fine Candice. I'm glad things seem to be running better now. OTL will let me check to be sure nothing is hiding where it shouldn't be. If you get stuck on it let me know. I probably won't be on until the afternoon, but I I will get back to you as soon as I can, You are doing great! Hang in there! I know it can seem overwhelming. There is no quick fix to get rid of malware infections. You are doing just fine.
Post #34
OTL logfile created on: 3/16/2011 3:28:34 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\cici\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.10 Gb Total Space | 80.76 Gb Free Space | 76.84% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 28.15 Gb Free Space | 97.09% Space Free | Partition Type: NTFS

Computer Name: CICI-PC | User Name: cici | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\cici\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10m_ActiveX.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
PRC - c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Program Files\DDNI\DIBS\DDNIService.exe (Digital Delivery Networks, Inc.)
PRC - C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe (Digital Delivery Networks, Inc.)
PRC - C:\Program Files\Lenovo\VeriFace\PManage.exe (Lenovo)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe (Conexant Systems, Inc.)
PRC - C:\Windows\System32\atieclxx.exe (AMD)
PRC - C:\Windows\System32\atiesrxx.exe (AMD)
PRC - C:\Program Files\Lenovo\YouCam\YouCamTray.exe (CyberLink Corp.)
PRC - C:\Program Files\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
PRC - C:\Program Files\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
PRC - C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe (Digital Delivery Networks, Inc.)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\IgrsSvcs.exe (Microsoft Corporation)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\atibtmon.exe (Advanced Micro Devices, Inc.)
PRC - C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)


========== Modules (SafeList) ==========

MOD - C:\Users\cici\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16661_none_420fe3fa2b8113bd\comctl32.dll (Microsoft Corporation)


========== Win32 Services (SafeList) ==========

SRV - (WatAdminSvc) – C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (NisSrv) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe (Microsoft Corporation)
SRV - (DDNIService) – C:\Program Files\DDNI\DIBS\DDNIService.exe (Digital Delivery Networks, Inc.)
SRV - (DDNIMSGService) – C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGService.exe (Digital Delivery Networks, Inc.)
SRV - (AMD External Events Utility) – C:\Windows\System32\atiesrxx.exe (AMD)
SRV - (Lenovo ReadyComm ConnSvc) – C:\Program Files\Lenovo\ReadyComm\ConnSvc.exe (Lenovo Group Limited)
SRV - (Lenovo ReadyComm AppSvc) – C:\Program Files\Lenovo\ReadyComm\AppSvc.exe (Lenovo Group Limited)
SRV - (IGRS) – C:\Program Files\Lenovo\ReadyComm\common\IGRS.exe (Lenovo Group Limited)
SRV - (SensrSvc) – C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (ReadyComm.DirectRouter) – C:\windows\System32\IgrsSvcs.exe (Microsoft Corporation)
SRV - (PS_MDP) – C:\windows\System32\IgrsSvcs.exe (Microsoft Corporation)
SRV - (BcmSqlStartupSvc) – C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation)


========== Driver Services (SafeList) ==========

DRV - (MpKslc5b0b1a7) – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{10997691-7894-4646-97DA-805271436A68}\MpKslc5b0b1a7.sys (Microsoft Corporation)
DRV - (NisDrv) – C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (MpNWMon) – C:\Windows\System32\drivers\MpNWMon.sys (Microsoft Corporation)
DRV - (RSUSBSTOR) – C:\Windows\System32\drivers\RtsUStor.sys (Realtek Semiconductor Corp.)
DRV - (amdkmdag) – C:\Windows\System32\drivers\atipmdag.sys (ATI Technologies Inc.)
DRV - (amdkmdap) – C:\Windows\System32\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV - (CnxtHdAudService) – C:\Windows\System32\drivers\CHDRT32.sys (Conexant Systems Inc.)
DRV - (usbfilter) – C:\Windows\System32\drivers\usbfilter.sys (Advanced Micro Devices)
DRV - (L1C) – C:\Windows\System32\drivers\L1C62x86.sys (Atheros Communications, Inc.)
DRV - (usbsmi) – C:\Windows\System32\drivers\SMIksdrv.sys (SMI)
DRV - (ApfiltrService) – C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.)
DRV - (ACPIVPC) – C:\Windows\System32\drivers\AcpiVpc.sys (Lenovo Corporation)
DRV - (AtiPcie) AMD PCI Express (3GIO) – C:\windows\system32\DRIVERS\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV - (Bridge0) – C:\Windows\System32\drivers\wdbridge.sys (Lenovo)
DRV - (wsvd) – C:\Windows\System32\drivers\wsvd.sys (CyberLink)
DRV - (wdmirror) – C:\Windows\System32\drivers\WDMirror.sys (Windows ® Codename Longhorn DDK provider)
DRV - (netw5v32) Intel® – C:\Windows\System32\drivers\netw5v32.sys (Intel Corporation)
DRV - (k57nd60x) Broadcom NetLink ™ – C:\Windows\System32\drivers\k57nd60x.sys (Broadcom Corporation)
DRV - (WimFltr) – C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://www.msn.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0C F0 B6 E3 D4 E0 CB 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



O1 HOSTS File: ([2009/06/10 17:39:37 | 000,000,824 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [cAudioFilterAgent] C:\Program Files\CONEXANT\cAudioFilterAgent\cAudioFilterAgent.exe (Conexant Systems, Inc.)
O4 - HKLM..\Run: [Energy Management] C:\Program Files\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited)
O4 - HKLM..\Run: [EnergyUtility] C:\Program Files\Lenovo\Energy Management\utility.exe (Lenovo(beijing) Limited)
O4 - HKLM..\Run: [IdeaNotesUser] C:\Program Files\DDNI\Lenovo Idea Notes\DDNIMSGUser.exe (Digital Delivery Networks, Inc.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [SmartAudio] C:\Program Files\CONEXANT\SAII\SAIICpl.exe ()
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UCam_Menu] C:\Program Files\Lenovo\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GShortCut] C:\Program Files\Lenovo\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [VeriFaceManager] C:\Program Files\Lenovo\VeriFace\PManage.exe (Lenovo)
O4 - HKLM..\Run: [YouCam Mirror Tray icon] C:\Program Files\Lenovo\YouCam\YouCamTray.exe (CyberLink Corp.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} http://zone.msn.com/bingame/amun/default/mjolauncher.cab (MJLauncherCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} http://zone.msn.com/bingame/feed/default/SproutLauncher.cab (SproutLauncherCtrl Class)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://zone.msn.com/bingame/popcaploader_v10.cab (PopCapLoader Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 17:42:20 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.clmp3enc - C:\Program Files\Lenovo\Power2Go\CLMP3Enc.ACM (CyberLink Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)


========== Files/Folders - Created Within 30 Days ==========

[2011/03/16 03:21:57 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Users\cici\Desktop\OTL.exe
[2011/03/15 19:03:07 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/03/15 19:02:54 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\javaws.exe
[2011/03/15 19:02:54 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\javaw.exe
[2011/03/15 19:02:54 | 000,145,184 | —- | C] (Sun Microsystems, Inc.) – C:\windows\System32\java.exe
[2011/03/14 17:57:16 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2011/03/14 00:39:11 | 000,000,000 | —D | C] – C:\Users\cici\Desktop\tdsskiller
[2011/03/14 00:11:31 | 000,189,520 | —- | C] (Trend Micro Inc.) – C:\windows\System32\drivers\tmcomm.sys
[2011/03/14 00:08:23 | 000,000,000 | —D | C] – C:\ProgramData\gPiMkPc16633
[2011/03/09 06:00:24 | 001,074,176 | —- | C] (Microsoft Corporation) – C:\windows\System32\DWrite.dll
[2011/03/09 06:00:23 | 000,739,840 | —- | C] (Microsoft Corporation) – C:\windows\System32\d2d1.dll
[2011/03/09 06:00:21 | 000,850,432 | —- | C] (Microsoft Corporation) – C:\windows\System32\sbe.dll
[2011/03/09 06:00:21 | 000,642,048 | —- | C] (Microsoft Corporation) – C:\windows\System32\CPFilters.dll
[2011/03/09 06:00:21 | 000,534,528 | —- | C] (Microsoft Corporation) – C:\windows\System32\EncDec.dll
[2011/03/09 06:00:21 | 000,199,680 | —- | C] (Microsoft Corporation) – C:\windows\System32\mpg2splt.ax
[2011/02/27 13:06:03 | 000,000,000 | —D | C] – C:\ProgramData\Arcade Lab
[2011/02/27 00:44:32 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bricks of Egypt 2
[2011/02/27 00:44:25 | 000,000,000 | —D | C] – C:\Program Files\Bricks of Egypt 2
[2011/02/27 00:43:31 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bricks of Atlantis
[2011/02/27 00:43:24 | 000,000,000 | —D | C] – C:\Program Files\Bricks of Atlantis
[2011/02/27 00:41:39 | 000,000,000 | —D | C] – C:\ProgramData\Big Fish Games
[2011/02/27 00:41:36 | 000,000,000 | —D | C] – C:\Program Files\bfgclient
[2011/02/27 00:40:53 | 000,000,000 | —D | C] – C:\BigFishGamesCache
[2011/02/22 16:45:28 | 000,442,880 | —- | C] (Microsoft Corporation) – C:\windows\System32\XpsPrint.dll
[2011/02/22 16:45:28 | 000,288,256 | —- | C] (Microsoft Corporation) – C:\windows\System32\XpsGdiConverter.dll
[2011/02/20 22:34:17 | 000,000,000 | —D | C] – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\BigPatience
[2011/02/20 22:34:12 | 000,000,000 | —D | C] – C:\Program Files\BigPatience

========== Files - Modified Within 30 Days ==========

[2011/03/16 03:22:05 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\cici\Desktop\OTL.exe
[2011/03/16 02:45:00 | 000,000,904 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2742486753-408597114-3825370978-1003UA.job
[2011/03/16 01:45:00 | 000,000,852 | —- | M] () – C:\windows\tasks\GoogleUpdateTaskUserS-1-5-21-2742486753-408597114-3825370978-1003Core.job
[2011/03/15 22:04:35 | 000,067,584 | –S- | M] () – C:\windows\bootstat.dat
[2011/03/15 19:01:06 | 000,009,920 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011/03/15 19:01:06 | 000,009,920 | -H– | M] () – C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011/03/15 18:58:09 | 000,672,986 | —- | M] () – C:\windows\System32\perfh009.dat
[2011/03/15 18:58:09 | 000,125,044 | —- | M] () – C:\windows\System32\perfc009.dat
[2011/03/15 18:53:55 | 000,065,536 | —- | M] () – C:\windows\System32\Ikeext.etl
[2011/03/15 18:53:45 | 2211,606,528 | -HS- | M] () – C:\hiberfil.sys
[2011/03/14 00:11:23 | 000,000,036 | —- | M] () – C:\Users\cici\AppData\Local\housecall.guid.cache
[2011/03/11 22:45:42 | 000,002,354 | —- | M] () – C:\Users\cici\Desktop\Google Chrome.lnk
[2011/03/07 17:06:50 | 000,351,280 | —- | M] () – C:\br-russia-peterhof.jg6
[2011/02/28 23:11:20 | 000,232,299 | —- | M] () – C:\pare_r_bercons_nous.jg6
[2011/02/27 00:44:32 | 000,001,940 | —- | M] () – C:\Users\Public\Desktop\Play Bricks of Egypt 2.lnk
[2011/02/27 00:43:31 | 000,001,951 | —- | M] () – C:\Users\Public\Desktop\Play Bricks of Atlantis.lnk
[2011/02/27 00:42:49 | 000,000,929 | —- | M] () – C:\Users\Public\Desktop\Game Manager.lnk
[2011/02/21 18:31:22 | 000,282,749 | —- | M] () – C:\withaar-r.jg6
[2011/02/21 18:31:22 | 000,282,749 | —- | M] () – C:\Program Files\withaar-r.jg6
[2011/02/20 22:34:20 | 000,000,916 | —- | M] () – C:\Users\Public\Desktop\BigPatience.lnk
[2011/02/19 01:32:48 | 001,074,176 | —- | M] (Microsoft Corporation) – C:\windows\System32\DWrite.dll
[2011/02/19 01:32:35 | 000,739,840 | —- | M] (Microsoft Corporation) – C:\windows\System32\d2d1.dll
[2011/02/14 20:11:32 | 000,255,948 | —- | M] () – C:\br-austria-nauders.jg6

========== Files Created - No Company Name ==========

[2011/03/14 00:11:23 | 000,000,036 | —- | C] () – C:\Users\cici\AppData\Local\housecall.guid.cache
[2011/03/07 16:43:13 | 000,351,280 | —- | C] () – C:\br-russia-peterhof.jg6
[2011/02/28 16:39:31 | 000,232,299 | —- | C] () – C:\pare_r_bercons_nous.jg6
[2011/02/27 00:44:32 | 000,001,940 | —- | C] () – C:\Users\Public\Desktop\Play Bricks of Egypt 2.lnk
[2011/02/27 00:43:31 | 000,001,951 | —- | C] () – C:\Users\Public\Desktop\Play Bricks of Atlantis.lnk
[2011/02/27 00:42:49 | 000,000,929 | —- | C] () – C:\Users\Public\Desktop\Game Manager.lnk
[2011/02/27 00:41:43 | 000,001,873 | —- | C] () – C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Game Manager.lnk
[2011/02/21 23:24:41 | 000,282,749 | —- | C] () – C:\Program Files\withaar-r.jg6
[2011/02/21 23:24:05 | 000,282,749 | —- | C] () – C:\withaar-r.jg6
[2011/02/20 22:34:20 | 000,000,916 | —- | C] () – C:\Users\Public\Desktop\BigPatience.lnk
[2011/02/15 06:17:36 | 000,255,948 | —- | C] () – C:\br-austria-nauders.jg6
[2010/04/20 02:49:47 | 000,000,512 | —- | C] () – C:\windows\previous.bin
[2010/04/20 02:49:47 | 000,000,512 | —- | C] () – C:\windows\current.bin
[2010/04/20 02:42:12 | 000,016,648 | R— | C] () – C:\windows\System32\LogAPI.dll
[2010/04/20 02:30:20 | 001,410,400 | —- | C] () – C:\windows\System32\IcnOvrly.dll
[2010/04/20 02:30:20 | 000,660,832 | —- | C] () – C:\windows\System32\EncIcons.dll
[2010/04/20 02:30:20 | 000,513,376 | —- | C] () – C:\windows\System32\SimpleExt.dll
[2010/04/20 02:30:19 | 002,110,816 | —- | C] () – C:\windows\System32\Apblend.dll
[2010/04/20 02:30:19 | 001,171,456 | —- | C] () – C:\windows\System32\PicNotify.dll
[2010/04/20 02:30:11 | 001,044,480 | —- | C] () – C:\windows\System32\3DImageRenderer.dll
[2010/04/20 02:09:20 | 000,163,840 | —- | C] () – C:\windows\System32\SM37XCoInst.dll
[2010/04/20 02:04:20 | 000,006,088 | —- | C] () – C:\windows\System32\drivers\CDConfig.bin
[2010/04/20 02:03:12 | 000,000,000 | —- | C] () – C:\windows\ativpsrm.bin
[2010/04/20 02:00:02 | 000,201,875 | —- | C] () – C:\windows\System32\atiicdxx.dat
[2010/04/20 02:00:02 | 000,001,105 | —- | C] () – C:\windows\System32\atipblag.dat
[2009/07/14 00:57:37 | 000,067,584 | –S- | C] () – C:\windows\bootstat.dat
[2009/07/14 00:33:53 | 000,429,840 | —- | C] () – C:\windows\System32\FNTCACHE.DAT
[2009/07/13 22:05:48 | 000,672,986 | —- | C] () – C:\windows\System32\perfh009.dat
[2009/07/13 22:05:48 | 000,291,294 | —- | C] () – C:\windows\System32\perfi009.dat
[2009/07/13 22:05:48 | 000,125,044 | —- | C] () – C:\windows\System32\perfc009.dat
[2009/07/13 22:05:48 | 000,031,548 | —- | C] () – C:\windows\System32\perfd009.dat
[2009/07/13 22:05:05 | 000,000,741 | —- | C] () – C:\windows\System32\NOISE.DAT
[2009/07/13 22:04:11 | 000,215,943 | —- | C] () – C:\windows\System32\dssec.dat
[2009/07/13 19:55:01 | 000,043,131 | —- | C] () – C:\windows\mib.bin
[2009/07/13 19:51:43 | 000,073,728 | —- | C] () – C:\windows\System32\BthpanContextHandler.dll
[2009/07/13 19:42:10 | 000,064,000 | —- | C] () – C:\windows\System32\BWContextHandler.dll
[2009/07/13 18:09:19 | 000,982,196 | —- | C] () – C:\windows\System32\igkrng500.bin
[2009/07/13 18:09:19 | 000,417,344 | —- | C] () – C:\windows\System32\igcompkrng500.bin
[2009/07/13 18:09:19 | 000,139,824 | —- | C] () – C:\windows\System32\igfcg500.bin
[2009/07/13 18:09:19 | 000,097,448 | —- | C] () – C:\windows\System32\igfcg500m.bin
[2009/06/10 17:26:10 | 000,673,088 | —- | C] () – C:\windows\System32\mlang.dat

========== LOP Check ==========

[2010/12/30 15:00:08 | 000,000,000 | —D | M] – C:\Users\cici\AppData\Roaming\ID Vault
[2011/02/06 18:50:13 | 000,032,622 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/06/10 17:42:20 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2011/02/14 20:11:32 | 000,255,948 | —- | M] () – C:\br-austria-nauders.jg6
[2011/03/07 17:06:50 | 000,351,280 | —- | M] () – C:\br-russia-peterhof.jg6
[2009/06/10 17:42:20 | 000,000,010 | —- | M] () – C:\config.sys
[2011/03/15 22:05:00 | 000,574,053 | —- | M] () – C:\FaceProv.log
[2011/03/15 18:53:45 | 2211,606,528 | -HS- | M] () – C:\hiberfil.sys
[2011/02/07 15:44:20 | 000,258,340 | —- | M] () – C:\lawson-c-rapunzel.jg6
[2011/03/15 18:53:47 | 2948,808,704 | -HS- | M] () – C:\pagefile.sys
[2011/02/28 23:11:20 | 000,232,299 | —- | M] () – C:\pare_r_bercons_nous.jg6
[2011/02/16 02:49:20 | 000,063,552 | —- | M] () – C:\TDSSKiller.2.4.12.0_16.02.2011_01.48.34_log.txt
[2010/12/30 15:13:54 | 000,063,842 | —- | M] () – C:\TDSSKiller.2.4.12.0_30.12.2010_14.11.56_log.txt
[2011/02/21 18:31:22 | 000,282,749 | —- | M] () – C:\withaar-r.jg6

< %systemroot%\Fonts\*.com >
[2009/07/14 00:52:25 | 000,026,040 | —- | M] () – C:\windows\Fonts\GlobalMonospace.CompositeFont
[2009/07/14 00:52:25 | 000,026,489 | —- | M] () – C:\windows\Fonts\GlobalSansSerif.CompositeFont
[2009/07/14 00:52:25 | 000,029,779 | —- | M] () – C:\windows\Fonts\GlobalSerif.CompositeFont
[2009/07/14 00:52:25 | 000,043,318 | —- | M] () – C:\windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2009/06/10 17:31:19 | 000,000,065 | —- | M] () – C:\windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2009/07/13 21:15:35 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll
[2009/07/13 21:16:19 | 000,029,696 | —- | M] (Microsoft Corporation) – C:\Windows\System32\spool\prtprocs\w32x86\winprint.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2010/09/23 01:32:56 | 000,301,936 | —- | M] (Microsoft Corporation) – C:\Windows\WLXPGSS.SCR

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/07/14 00:41:57 | 000,000,174 | -HS- | M] () – C:\Program Files\desktop.ini
[2011/02/21 18:31:22 | 000,282,749 | —- | M] () – C:\Program Files\withaar-r.jg6

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/12/29 14:55:21 | 000,000,221 | -HS- | M] () – C:\Users\cici\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/03/16 03:22:05 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Users\cici\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-03-09 19:52:43

< >

========== Alternate Data Streams ==========

@Alternate Data Stream - 95 bytes -> C:\ProgramData\Temp:5C321E34
@Alternate Data Stream - 207 bytes -> C:\ProgramData\Temp:E5D4F1EB
@Alternate Data Stream - 193 bytes -> C:\ProgramData\Temp:B0B6888E

< End of report >
Post #35
OTL Extras logfile created on: 3/16/2011 3:28:34 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\cici\Desktop
Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 67.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 105.10 Gb Total Space | 80.76 Gb Free Space | 76.84% Space Free | Partition Type: NTFS
Drive D: | 29.00 Gb Total Space | 28.15 Gb Free Space | 97.09% Space Free | Partition Type: NTFS

Computer Name: CICI-PC | User Name: cici | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] – Reg Error: Value error.
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{17542DBF-E17C-4562-BC4D-FA3EF3076C45}" = Lenovo ReadyComm 5
"{1755A94E-CA3D-056D-6EBF-F56CBAAA690C}" = CCC Help Portuguese
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{23E45635-6E09-B210-BA84-F0A8A4330539}" = Catalyst Control Center Localization All
"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java™ 6 Update 24
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.® AR81Family Gigabit/Fast Ethernet Driver
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3A41C53D-EE2B-9347-D41D-A59AEB302C53}" = CCC Help Chinese Standard
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3E692081-0878-8C80-6AA6-F4B8E5EB9BE3}" = CCC Help Finnish
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
"{4229CF5A-95F2-023E-690F-BB5572544BA4}" = CCC Help Hungarian
"{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CBABDFD-49F8-47FD-BE7D-ECDE7270525A}" = Windows Live PIMT Platform
"{4F1E50D8-D105-7A9E-ACF6-A713447975C7}" = CCC Help Thai
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{520F7B12-0792-AD52-29DD-7B9E93FB1A2B}" = CCC Help Chinese Traditional
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{56B4002F-671C-49F4-984C-C760FE3806B5}" = Microsoft SQL Server VSS Writer
"{59DF04B0-A502-0031-C829-0A99D7D25502}" = Catalyst Control Center InstallProxy
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{62AFBC6C-70D4-7E8C-3BC4-FDB060A98DFC}" = CCC Help Dutch
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{69291733-6411-C3F7-7B9C-77D75A7AF58B}" = CCC Help Norwegian
"{6A05FEDF-662E-46BF-8A25-010E3F1C9C69}" = Windows Live UX Platform Language Pack
"{6FCBA778-04AA-23B0-1279-42B85CA24C43}" = CCC Help Swedish
"{7064B255-EC91-7EC1-6640-A84C123508E9}" = Catalyst Control Center Graphics Light
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76C66170-C538-4E77-B54D-48E136B5B533}" = Lenovo ReadyComm 5.0 Service
"{76D68A9E-5939-41F2-D22E-6C0045590A00}" = CCC Help Czech
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{80956555-A512-4190-9CAD-B000C36D6B6B}" = Windows Live Messenger
"{84EBDF39-4B33-49D7-A0BD-EB6E2C4E81C1}" = Windows Live Sync
"{86B2FD80-64BB-E002-ECF3-1C1E6105320C}" = CCC Help Turkish
"{8871F50A-D92D-07BE-6BB8-EB6D6B03ACBB}" = ccc-utility
"{8991E763-21F5-4DEA-A938-5D9D77DCB488}" = Broadcom 802.11 Wireless Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{962C911E-70BB-3530-1349-A31BEDD5515C}" = CCC Help Italian
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{987B04C4-B5AC-4AD6-A7E9-8D681085B850}" = AMD USB Filter Driver
"{9A7124E8-7C79-F2CC-0B4C-44859C384DD4}" = CCC Help Greek
"{9BA1808F-4C75-BDFB-E798-755B4F3F22A2}" = CCC Help Japanese
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{9D5740C5-02C8-3C0E-C4BB-A8C2A82C6A52}" = CCC Help Danish
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{A06E1854-1580-4157-AD70-72734D324DEA}" = Lenovo Idea Notes
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A5090413-2251-C33A-6359-CEE203950A5F}" = CCC Help Polish
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A919F9D2-0F0E-C3B3-7ACF-343B46CFF804}" = CCC Help Spanish
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AAF454FC-82CA-4F29-AB31-6A109485E76E}" = Windows Live Writer
"{ABD43020-578D-26E4-2D96-04E0A7E44526}" = CCC Help German
"{AC76BA86-7AD7-1033-7B44-A90100000001}" = Adobe Reader 9.0.1
"{AE1E24C2-E720-42D5-B8E1-48F71A97B4DB}" = Energy Management
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B2164CCB-C002-4B80-8550-7535D80DF237}" = Lenovo DirectShare
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{BD68F46D-8A82-4664-8E68-F87C55BDEFD4}" = Microsoft SQL Server Native Client
"{C66824E4-CBB3-4851-BB3F-E8CFD6350923}" = Windows Live Mail
"{C7FB1A71-D808-4CD2-997D-837B39EA7EB0}" = DIBS
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFF8B8E8-E086-4DE0-935F-FE22CAB54F80}" = Microsoft Search Enhancement Pack
"{D31C5DD0-00AD-3643-CFD2-BE37C8840528}" = CCC Help French
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DAD1693D-3C1B-5D29-E44F-96D2362738F3}" = ATI Catalyst Install Manager
"{DB01AC75-7AA5-2F83-D72B-3A914321A030}" = ccc-core-static
"{DCBD3FBC-56C8-24E0-C82E-1ECB0AEB172E}" = CCC Help Korean
"{DDC8BDEE-DCAC-404D-8257-3E8D4B782467}" = Windows Live Writer Resources
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E30378BA-E43E-E4F8-0D35-53C9C0B2A96A}" = Catalyst Control Center Graphics Full Existing
"{E606D21C-225C-D58E-3497-671288A31AF0}" = CCC Help Russian
"{E9388FCD-B25B-D45B-EFDB-954DE076A417}" = CCC Help English
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECB1C736-4151-6B4D-7CF0-A54B65430461}" = Catalyst Control Center Core Implementation
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F2602F16-02D1-4F1C-99A5-E246C522A59D}" = Lenovo First Boot
"{F542E678-739D-FFCC-A8D1-E42AE775BFFE}" = Catalyst Control Center Graphics Previews Common
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE7AD27A-62B1-44F6-B69C-25D1ECA94F5D}" = Lenovo EasyCamera
"{FFBEBE24-6961-C161-22CD-EFD23F50DF65}" = Catalyst Control Center Graphics Full New
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Astra Jigsaw Art Edition_is1" = Astra Jigsaw Art Edition version 1.21
"Astra Jigsaw Art II_is1" = Astra Jigsaw Art II version 1.21
"Astra Jigsaw Europe Tour_is1" = Astra Jigsaw Europe Tour version 1.21
"Astra Jigsaw France and UK_is1" = Astra Jigsaw France and UK version 1.21
"Astra Jigsaw Italy and Spain_is1" = Astra Jigsaw Italy and Spain version 1.21
"Astra Jigsaw Japan_is1" = Astra Jigsaw Japan version 1.21
"Astra Jigsaw Landmarks Edition_is1" = Astra Jigsaw Landmarks Edition version 1.21
"Astra Jigsaw My Favorite Things_is1" = Astra Jigsaw My Favorite Things version 1.21
"Astra Jigsaw Tropical Edition_is1" = Astra Jigsaw Tropical Edition version 1.21
"Astra Jigsaw USA Edition_is1" = Astra Jigsaw USA Edition version 1.21
"BFG-Bricks of Atlantis" = Bricks of Atlantis
"BFG-Bricks of Egypt 2" = Bricks of Egypt 2
"BFGC" = Big Fish Games: Game Manager
"BigJig_is1" = BigJig version 8.15
"BigPatience_is1" = BigPatience version 5.01
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"CNXT_AUDIO_HDA" = Conexant HD Audio
"Desktop Taipei_is1" = Desktop Taipei version 2.2
"ESET Online Scanner" = ESET Online Scanner v3
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = CyberLink YouCam
"InstallShield_{46F4D124-20E5-4D12-BE52-EC177A7A4B42}" = Lenovo OneKey Recovery
"InstallShield_{B2164CCB-C002-4B80-8550-7535D80DF237}" = Lenovo DirectShare
"Lenovo Idea Central" = Lenovo Idea Central
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"PROHYBRIDR" = 2007 Microsoft Office system
"SpywareBlaster_is1" = SpywareBlaster 4.4
"VeriFace" = VeriFace
"WinLiveSuite" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/20/2011 4:46:29 AM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 2/20/2011 4:47:57 AM | Computer Name = cici-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\silicon
motion\lenovo easycamera\driverpackage\DPInst64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

Error - 2/20/2011 4:48:31 AM | Computer Name = cici-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A certificate chain could not be built to a trusted root authority.
.

Error - 2/20/2011 4:48:32 AM | Computer Name = cici-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A certificate chain could not be built to a trusted root authority.
.

Error - 2/20/2011 11:43:24 PM | Computer Name = cici-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A certificate chain could not be built to a trusted root authority.
.

Error - 2/21/2011 5:48:42 AM | Computer Name = cici-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Failed extract of third-party root list from auto update cab at: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>
with error: A certificate chain could not be built to a trusted root authority.
.

Error - 2/23/2011 8:18:49 AM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 2/26/2011 8:28:13 AM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 2/27/2011 7:53:39 AM | Computer Name = cici-PC | Source = SideBySide | ID = 16842815
Description = Activation context generation failed for "c:\Program Files\Common
Files\Adobe AIR\Versions\1.0\Adobe AIR.dll".Error in manifest or policy file "c:\Program
Files\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll" on line 3. The value "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
of attribute "version" in element "assemblyIdentity" is invalid.

Error - 2/27/2011 7:54:56 AM | Computer Name = cici-PC | Source = SideBySide | ID = 16842785
Description = Activation context generation failed for "c:\program files\silicon
motion\lenovo easycamera\driverpackage\DPInst64.exe". Dependent Assembly Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"
could not be found. Please use sxstrace.exe for detailed diagnosis.

[ System Events ]
Error - 2/9/2011 11:54:38 PM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 10:02:53 PM on ?2/?9/?2011 was unexpected.

Error - 2/14/2011 1:22:11 PM | Computer Name = cici-PC | Source = Microsoft Antimalware | ID = 2001
Description = %%860 has encountered an error trying to update signatures. New Signature
Version: Previous Signature Version: 1.97.1659.0 Update Source: %%859 Update Stage:
%%852 Source Path: http://www.microsoft.com Signature Type: %%800 Update Type: %%803

User:
NT AUTHORITY\SYSTEM Current Engine Version: Previous Engine Version: 1.1.6502.0 Error
code: 0x80072ee2 Error description: The operation timed out

Error - 2/16/2011 9:57:48 PM | Computer Name = cici-PC | Source = DCOM | ID = 10010
Description =

Error - 2/16/2011 9:57:47 PM | Computer Name = cici-PC | Source = Service Control Manager | ID = 7011
Description = A timeout (30000 milliseconds) was reached while waiting for a transaction
response from the Netman service.

Error - 2/21/2011 5:48:14 AM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 4:47:01 AM on ?2/?21/?2011 was unexpected.

Error - 2/21/2011 5:50:19 AM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 4:49:03 AM on ?2/?21/?2011 was unexpected.

Error - 2/21/2011 5:52:25 AM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 4:51:10 AM on ?2/?21/?2011 was unexpected.

Error - 2/21/2011 10:26:25 AM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 4:53:16 AM on ?2/?21/?2011 was unexpected.

Error - 3/1/2011 9:14:18 AM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 4:39:13 AM on ?3/?1/?2011 was unexpected.

Error - 3/11/2011 9:49:06 PM | Computer Name = cici-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 11:30:19 AM on ?3/?11/?2011 was unexpected.


< End of report >
Post #36
ok, there are the two reports. but now I am having a problem with my desktop everytime I start my computer, I get a box that pops up Open File Security Warning Name sdasetup.exe Publisher PCTools Type Application From C\Documentsand settings\owner\desktop when i click on it, my computer completely freezes up and I can't do a thing, have to just close it down by hitting the button on the tower. Whassup with that now???????
Post #37
Fantastic job getting the OTL logs! Those are just what I need. :) Give me a bit to look over them and I'll let you know what we need to do next.

As for the file warning that is popping up on your desktop, do you have Spyware Doctor installed on that machine? It appears to be related to that program. It does not appear to be a malicious file from the looks of it - but it's hard to tell without delving further into it. What I'd do, is to ignore the pop-up box when it comes up. Just minimize it and don't actually click on it. Then do a full virus scan with whatever software you have on that machine and see what it finds - and of course have it remove any threats. If you are still having the problem after that, we'll need to have a separate thread to address that issue. It would get very confusing (for both of us) to try and fix 2 problems in the same thread here. Let me know what you find on the antivirus scan and we'll go from there.

I'll get back to you in a bit with what to do on the laptop.
Post #38
The good news is that I don't see any more signs of malware in those OTL logs!

Now to remove most of the tools that we have used in fixing your machine:
  • Run OTL.exe by right-clicking the icon and choosing Run As Administrator
  • This time, click on the CleanUp button.
If you notice any remaining tools or logs you can delete them by right clicking and choosing delete.


Let me know when you've completed this and then tell me how the desktop is doing after you run an full antivirus scan on it.
Post #39
lol, can't i just take the lazy woman's way out and just hit that recycle button, can't just throw it in there???? Ok…. later, i'm totally absorbed in some relief efforts for the Japanese today , that is more important right now, i'll try to log back on tomorrow OK? but all that suffering, my lord, i MUST do something. NOW. p.s. and i'm doing without any lattes, any manicures and any trips to the movies for the rest of the year and saving my money for helping just one child or one old lady
Post #40
Tomorrow is fine….do what you need to do today - I completely understand. Just don't make me give up my coffee for anyone and we'll be fine LOL!
Post #41
Just wanted to check before closing this thread that your desktop no longer needs my assistance. Hopefully, both the laptop and desktop are running ok now?
Post #42 last edited
yeppers, i think everything is ok now. ….don't now how that weird box got onto my desktop computer must have tried to download something, but there was nothing from PC doctor downloaded onto my machine…just threw it in recycle bin. I did get rid of the OTL properly and threw the rest in recycle bin….I just wish I didn't have to keep getting these stupid infections. I heard yesterday that you can get them from Facebook, and I just joined that as many of my old friends from home are on there and have been bugging me to join. Doesn't sound like it is a very secure site, though I suppose most hackers can get into anything nowadays. Thanks again for all your kind help and your time and energy…..you were wonderful to me. If you get a chance to talk to Tom or LD, tell them I said hi. Now I'm just trying to do some research on the web to see about this new internet explorer 9 they have out, i don't want it if I have to put up with all that BING stuff and all the pop ups with advertising….. bad enough i have to put up with the Lenovo junk all the time on this laptop. Take care i'll be back, for sure…. i've tried every anti virus program out there and don't understand how i get them, but they always seem to find me. Have a happy first day of spring and again, much gratitude for your patience and expertise. brightest blessings, Candice

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI