CPU running close to or at 100% due to svchost.exe

Things were going along fairly smoothly until I allowed a bunch of updates yesterday afternoon. Since then the CPU has been almost constantly at 100% with the main culprit being svchost.exe. Using Process Explorer, that particular svchost item is pml driver HPZ12. We did get a new HP printer, but not just today, and things have been running ok with it up til now. I went into the services tab and disabled both pml driver HPZ12 and net driver HPZ12 and rebooted, but then when I tried to open a game window using java (specifically at Pogo.com), my computer rebooted and I got a "blue screen warning". I ran a scan with my ESET NOD32 and found the following:

C:\System Volume Information\_restore{A0FF62EF-9DDB-4AB5-895A-7038BF04C854}\RP2648\A0178467.exe » WISE » WxBug.EXE Win32/Adware.WBug.A application was a part of the deleted object
C:\System Volume Information\_restore{A0FF62EF-9DDB-4AB5-895A-7038BF04C854}\RP2648\A0178467.exe » WISE » WxBug.EXE » WISE » MiniBugTransporter.dll Win32/Adware.WBug.A application was a part of the deleted object
The scan took almost 6 hours.
At this point I did a system restore back to the day before. I also uninstalled and reinstalled java, although there is a version of java (6-7 I think it was) listed in my list of programs that I could not remove.
The ESET startup scan then alerted me to this:
C:\System Volume Information\_restore{A0FF62EF-9DDB-4AB5-895A-7038BF04C854}\RP2648\A0178467.exe Win32/Adware.WBug.A application deleted - quarantined Event occurred on a file modified by the application: C:\WINNT\system32\svchost.exe.

So, that pile of updates (25 of them!) is now wanting to be installed again, having gone back to a point previous to my letting them update yesterday, but the 100% CPU problem is still there. I posted this message under hardware, thinking the printer was causing the problem and "paws" suggested I use this board instead.

My computer is a Gateway Pentium R 4 CPU 2.40GHz 512 MB RAM Windows XP Professional Version 2002 Service Pack 3
The printer in question is an HP Office Jet 4500 G510 n-z
Thanks for any suggestions you may have.
Sue


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 8:46:20 AM, on 6/16/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Administrator\My Documents\Downloads\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://login.yahoo.com/config/mail?.src=ym&.intl=us
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gatewaybiz.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gatewaybiz.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: (no name) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\YTSingleInstance.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn3\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O3 - Toolbar: AccuWeather.com Toolbar - {b0fdbb8e-5c2c-41ed-a18c-228f9b2f598c} - mscoree.dll (file missing)
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Reader Library Launcher] C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Carbonite Backup] C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O9 - Extra button: Novell Messenger - {3C3171BC-1025-43d1-8D1D-61CF4B38A28F} - C:\Novell\MESSEN~1\NMCL32.exe
O9 - Extra 'Tools' menuitem: Novell Messenger - {3C3171BC-1025-43d1-8D1D-61CF4B38A28F} - C:\Novell\MESSEN~1\NMCL32.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.columbusrealtors.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {0F04992B-E661-4DB9-B223-903AB628225D} (DoMoreRunExe.DoMoreRun) - file://C:\Program Files\Gateway\Do More\DoMoreRunExe.CAB
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLa…erInstaller.CAB
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1005.cab
O16 - DPF: {511073AD-BE56-4D43-AE68-93390514385E} (TechToolsActivex.TechTools) - file://C:\Program Files\gateway\helpspot\TechTools.CAB
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Compone…EngineQuery.dll
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/…_2/axofupld.cab
O16 - DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} (RunExeActiveX.RunExe) - file://C:\Program Files\gateway\helpspot\RunExeActiveX.CAB
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0…oUploader55.cab
O16 - DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} (compid Class) - http://support.gateway.com/support/serialharvest/gwCID.CAB
O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/…/ymmapi_416.dll
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://clubgames.pogo.com/online2/pogop/ma…ameLauncher.cab
O16 - DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/_media/dalaillama/ampx.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINNT\System32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINNT\System32\browseui.dll
O23 - Service: CarboniteService - Carbonite, Inc. (www.carbonite.com) - C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINNT\System32\NMSSvc.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Sandboxie Service (SbieSvc) - tzuk - C:\Program Files\Sandboxie\SbieSvc.exe
O23 - Service: Sony SCSI Helper Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

–
End of file - 11933 bytes

Attached/included are the files you requested. I need you to know also, that when I started up my computer from being away, it downloaded those updates I'd been holding off on. I have not, however, allowed it to do the restart to finish installing them until I hear from you. I don't think I can keep saying no to the restart, though, so it will probably automatically restart soon. I just checked the running processes, too, and now the CPU usage is no longer at or near 100%.

.
DDS (Ver_2011-06-12.02) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by [removed] at 16:50:50 on 2011-06-19
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.193 [GMT -4:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
.
============== Running Processes ===============
.
C:\WINNT\system32\svchost -k DcomLaunch
svchost.exe
C:\WINNT\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\spoolsv.exe
svchost.exe
C:\Program Files\Carbonite\Carbonite Backup\carboniteservice.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\WINNT\system32\svchost.exe -k hpdevmgmt
C:\WINNT\system32\svchost.exe -k HPService
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINNT\System32\svchost.exe -k HPZ12
C:\WINNT\System32\NMSSvc.exe
C:\WINNT\System32\svchost.exe -k HPZ12
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINNT\System32\svchost.exe -k imgsvc
C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\Program Files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Carbonite\Carbonite Backup\CarboniteUI.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\WINNT\system32\wscntfy.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = https://login.yahoo.com/config/mail?.src=ym&.intl=us
uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid;=ie7&rls;=com.microsoft:en-US&ie;=utf8&oe;=utf8
uWindow Title = Windows Internet Explorer provided by Yahoo!
mDefault_Page_URL = hxxp://www.gatewaybiz.com
mStart Page = hxxp://www.gatewaybiz.com
uInternet Settings,ProxyOverride = 127.0.0.1
mSearchAssistant = hxxp://www.google.com/ie
mURLSearchHooks: H - No File
BHO: &Yahoo;! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No File
BHO: {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn3\YTSingleInstance.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll
TB: &Google;: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: AccuWeather.com Toolbar: {b0fdbb8e-5c2c-41ed-a18c-228f9b2f598c} - mscoree.dll
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\administrator\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: []
mRun: [egui] "c:\program files\eset\eset nod32 antivirus\egui.exe" /hide /waitservice
mRun: [Reader Library Launcher] c:\program files\sony\reader\data\bin\launcher\Reader Library Launcher.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [Carbonite Backup] c:\program files\carbonite\carbonite backup\CarboniteUI.exe
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: {3C3171BC-1025-43d1-8D1D-61CF4B38A28F} - c:\novell\messen~1\NMCL32.exe
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: columbusrealtors.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
DPF: DirectAnimation Java Classes - file://c:\winnt\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\java\classes\xmldso.cab
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/templates/ieawsdc.cab
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://c:\program files\gateway\do more\DoMoreRunExe.CAB
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab
DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} - hxxp://office.microsoft.com/officeupdate/content/opuc3.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1005.cab
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - file://c:\program files\gateway\helpspot\TechTools.CAB
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {6F750203-1362-4815-A476-88533DE61D0C} - hxxp://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
DPF: {739E8D90-2F4C-43AD-A1B8-66C356FCEA35} - file://c:\program files\gateway\helpspot\RunExeActiveX.CAB
DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} - hxxp://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {9A57B18E-2F5D-11D5-8997-00104BD12D94} - hxxp://support.gateway.com/support/serialharvest/gwCID.CAB
DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/yse/ymmapi_416.dll
DPF: {A8658086-E6AC-4957-BC8E-7D54A7E8A78D} - hxxp://www.microsoft.com/security/controls/DoomCln.CAB
DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - hxxp://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} - hxxp://download.games.yahoo.com/games/web_games/gamehouse/frenzy/SproutLauncher.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} - hxxp://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient/PTGameLauncher.cab
DPF: {FA3662C3-B8E8-11D6-A667-0010B556D978} - hxxp://cdn.digitalcity.com/_media/dalaillama/ampx.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{60756563-8DB3-43E0-AFC6-7A09C3498AF5} : DhcpNameServer = 192.168.1.1
Handler: nim - {3D206AE2-3039-413B-B748-3ACC562EC22A} - c:\novell\messenger\nmcg32.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxsrvc.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll
mASetup: {A509B1FF-37FF-4bFF-8CFF-4F3A747040FF} - c:\winnt\system32\rundll32.exe c:\winnt\system32\advpack.dll,launchinfsectionex c:\program files\internet explorer\clrtour.inf,DefaultInstall.ResetTour,,12
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;c:\winnt\system32\drivers\Lbd.sys [2009-2-8 64288]
R1 ehdrv;ehdrv;c:\winnt\system32\drivers\ehdrv.sys [2010-7-29 115008]
R1 epfwtdir;epfwtdir;c:\winnt\system32\drivers\epfwtdir.sys [2010-8-3 95896]
R2 ekrn;ESET Service;c:\program files\eset\eset nod32 antivirus\ekrn.exe [2010-8-12 810144]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-7-4 119016]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-2-10 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-2-10 136176]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2010-7-12 1355416]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2010-8-29 15008]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\pc-doc~1\diagno~1\pcdrdrv.sys –> c:\progra~1\pc-doc~1\diagno~1\PCDRDRV.sys [?]
.
=============== Created Last 30 ================
.
2011-06-16 02:10:34 73728 —-a-w- c:\winnt\system32\javacpl.cpl
2011-06-16 01:41:47 ——– d—–w- c:\documents and settings\administrator\local settings\application data\PCHealth
2011-06-16 01:32:01 ——– d—–w- c:\winnt\system32\wbem\repository\FS
2011-06-16 01:32:01 ——– d—–w- c:\winnt\system32\wbem\Repository
2011-06-16 00:54:00 ——– d—–w- c:\documents and settings\administrator\local settings\application data\ESET
2011-06-15 16:44:57 602112 —-a-w- c:\winnt\system32\SETA5.tmp
2011-06-15 16:44:56 55296 —-a-w- c:\winnt\system32\SETA4.tmp
2011-06-15 16:44:52 916480 —-a-w- c:\winnt\system32\SET9E.tmp
2011-06-15 16:44:49 1991680 —-a-w- c:\winnt\system32\SETA9.tmp
2011-06-15 16:44:48 1211904 —-a-w- c:\winnt\system32\SET9F.tmp
2011-06-15 16:44:46 5964800 —-a-w- c:\winnt\system32\SETA3.tmp
2011-06-15 16:42:57 105472 ——w- c:\winnt\system32\dllcache\mup.sys
2011-05-22 22:34:41 404640 —-a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
.
==================== Find3M ====================
.
2011-06-16 02:10:04 472808 —-a-w- c:\winnt\system32\deployJava1.dll
2011-05-24 06:00:13 256 -c–a-w- c:\winnt\system32\pool.bin
2011-05-02 15:31:52 692736 —-a-w- c:\winnt\system32\inetcomm.dll
2011-04-29 16:19:43 456320 —-a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-04-26 14:11:12 11081728 —-a-w- c:\winnt\system32\SETAB.tmp
2011-04-25 16:11:11 43520 —-a-w- c:\winnt\system32\licmgr10.dll
2011-04-25 16:11:11 1469440 ——w- c:\winnt\system32\inetcpl.cpl
2011-04-25 12:01:22 385024 —-a-w- c:\winnt\system32\html.iec
2011-04-21 13:37:43 105472 —-a-w- c:\winnt\system32\drivers\mup.sys
2007-06-08 02:21:06 823768 -c–a-w- c:\program files\Google_Updater.exe
2004-08-13 16:02:42 19197952 -c–a-w- c:\program files\Kodak DC220.exe
.
============= FINISH: 16:52:42.21 ===============


.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-06-12.02)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 8/9/2003 9:44:10 PM
System Uptime: 6/19/2011 3:45:16 PM (1 hours ago)
.
Motherboard: Intel Corporation | | D845GRG
Processor: Intel® Pentium® 4 CPU 2.40GHz | J2E1 | 2399/100mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 76 GiB total, 43.68 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is FIXED (FAT32) - 149 GiB total, 137.552 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E971-E325-11CE-BFC1-08002BE10318}
Description: Officejet 4500 G510n-z
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Officejet 4500 G510n-z
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
==== System Restore Points ===================
.
RP2575: 4/5/2011 4:10:18 PM - System Checkpoint
RP2576: 4/6/2011 5:06:52 PM - System Checkpoint
RP2577: 4/7/2011 5:59:47 PM - System Checkpoint
RP2578: 4/8/2011 6:55:27 PM - System Checkpoint
RP2579: 4/9/2011 12:49:38 PM - Installed TurboTax 2010 wrapper
RP2580: 4/10/2011 1:26:54 PM - System Checkpoint
RP2581: 4/10/2011 9:17:52 PM - Installed TurboTax 2010 wohiper
RP2582: 4/12/2011 12:59:29 AM - System Checkpoint
RP2583: 4/12/2011 8:21:37 PM - Software Distribution Service 3.0
RP2584: 4/13/2011 12:39:34 AM - Installed Rapport
RP2585: 4/14/2011 12:51:24 AM - System Checkpoint
RP2586: 4/15/2011 2:14:15 AM - System Checkpoint
RP2587: 4/16/2011 2:45:52 AM - System Checkpoint
RP2588: 4/17/2011 3:27:24 AM - System Checkpoint
RP2589: 4/18/2011 4:26:36 AM - System Checkpoint
RP2590: 4/19/2011 5:22:30 AM - System Checkpoint
RP2591: 4/20/2011 5:55:20 PM - System Checkpoint
RP2592: 4/20/2011 11:54:42 PM - Removed Java™ 6 Update 23
RP2593: 4/21/2011 1:33:10 AM - Software Distribution Service 3.0
RP2594: 4/21/2011 1:55:13 AM - Removed Rapport
RP2595: 4/24/2011 2:06:31 PM - System Checkpoint
RP2596: 4/24/2011 10:19:03 PM - Installed Java™ 6 Update 24
RP2597: 4/25/2011 10:27:52 PM - System Checkpoint
RP2598: 4/26/2011 10:36:23 PM - System Checkpoint
RP2599: 4/28/2011 12:21:35 AM - System Checkpoint
RP2600: 4/29/2011 2:16:04 AM - System Checkpoint
RP2601: 4/30/2011 2:35:21 AM - System Checkpoint
RP2602: 4/30/2011 3:00:22 AM - Software Distribution Service 3.0
RP2603: 5/1/2011 3:28:37 AM - System Checkpoint
RP2604: 5/2/2011 3:45:22 AM - System Checkpoint
RP2605: 5/3/2011 4:37:55 AM - System Checkpoint
RP2606: 5/4/2011 5:19:53 AM - System Checkpoint
RP2607: 5/5/2011 5:21:19 AM - System Checkpoint
RP2608: 5/6/2011 6:10:55 AM - System Checkpoint
RP2609: 5/7/2011 7:02:08 AM - System Checkpoint
RP2610: 5/8/2011 8:15:05 AM - System Checkpoint
RP2611: 5/8/2011 9:34:41 PM - Printer Driver HP Officejet 4500 G510n-z fax Installed
RP2612: 5/9/2011 10:29:33 PM - System Checkpoint
RP2613: 5/10/2011 10:33:41 PM - System Checkpoint
RP2614: 5/12/2011 2:11:53 AM - System Checkpoint
RP2615: 5/13/2011 2:25:17 AM - System Checkpoint
RP2616: 5/13/2011 7:17:52 PM - Software Distribution Service 3.0
RP2617: 5/14/2011 7:40:57 PM - System Checkpoint
RP2618: 5/15/2011 8:05:18 PM - System Checkpoint
RP2619: 5/16/2011 8:39:44 PM - System Checkpoint
RP2620: 5/17/2011 10:08:47 PM - System Checkpoint
RP2621: 5/18/2011 11:21:52 PM - System Checkpoint
RP2622: 5/19/2011 11:39:51 PM - System Checkpoint
RP2623: 5/20/2011 11:48:53 PM - System Checkpoint
RP2624: 5/22/2011 2:07:22 AM - System Checkpoint
RP2625: 5/23/2011 2:28:36 AM - System Checkpoint
RP2626: 5/24/2011 2:42:18 AM - System Checkpoint
RP2627: 5/25/2011 3:31:28 AM - System Checkpoint
RP2628: 5/25/2011 9:59:01 PM - Restore Operation
RP2629: 5/26/2011 10:02:48 PM - System Checkpoint
RP2630: 5/27/2011 10:50:11 PM - System Checkpoint
RP2631: 5/28/2011 10:50:42 PM - System Checkpoint
RP2632: 5/29/2011 11:01:16 PM - System Checkpoint
RP2633: 5/30/2011 11:58:10 PM - System Checkpoint
RP2634: 6/1/2011 12:01:16 AM - System Checkpoint
RP2635: 6/2/2011 12:14:08 AM - System Checkpoint
RP2636: 6/3/2011 12:25:01 AM - System Checkpoint
RP2637: 6/4/2011 1:10:25 AM - System Checkpoint
RP2638: 6/5/2011 2:01:40 PM - System Checkpoint
RP2639: 6/6/2011 2:29:38 PM - System Checkpoint
RP2640: 6/7/2011 2:32:44 PM - System Checkpoint
RP2641: 6/8/2011 5:27:36 PM - System Checkpoint
RP2642: 6/9/2011 5:48:25 PM - System Checkpoint
RP2643: 6/11/2011 1:31:12 AM - System Checkpoint
RP2644: 6/12/2011 2:26:05 AM - System Checkpoint
RP2645: 6/13/2011 3:26:04 AM - System Checkpoint
RP2646: 6/14/2011 4:26:05 AM - System Checkpoint
RP2647: 6/15/2011 4:27:11 AM - System Checkpoint
RP2648: 6/15/2011 12:45:42 PM - Software Distribution Service 3.0
RP2649: 6/15/2011 9:26:38 PM - Restore Operation
RP2650: 6/15/2011 9:59:37 PM - Removed Java™ 6 Update 24
RP2651: 6/15/2011 10:09:52 PM - Installed Java™ 6 Update 26
RP2652: 6/16/2011 10:50:07 PM - System Checkpoint
RP2653: 6/19/2011 3:49:03 PM - Software Distribution Service 3.0
.
==== Installed Programs ======================
.
.
32 Bit HP CIO Components Installer
4500_G510nz_Help
4500G510nz
4500G510nz_Software_Min
7200
7200_Help
7200Trb
AccuWeather.com Toolbar for Internet Explorer Users
Acrobat.com
ActiveSpeed
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Reader 9.4.4
Adobe SVG Viewer 3.0
AIM 7
AiO_Scan
AiOSoftware
AnswerWorks 4.0 Runtime - English
AOL Instant Messenger
Apple Application Support
Apple Software Update
BlackBerry Desktop Software 4.5
BufferChm
BUM
Carbonite
CCleaner
Compatibility Pack for the 2007 Office system
Coupon Printer for Windows
CP_AtenaShokunin1Config
cp_dwShrek2Albums1
cp_dwShrek2Cards1
CreativeProjects
CreativeProjectsTemplates
CrossLoop 2.60
CueTour
Desktop Weather by The Weather Channel
Destinations
DeviceDiscovery
Do More 7.0
DocMgr
DocProc
Documents To Go
DocumentViewer
Download Updater (AOL LLC)
DVD
Easy CD Creator 5 Basic
ESET NOD32 Antivirus
Fax
Gateway Ink Monitor
Gateway Rhapsody
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
GPBaseService2
GroupWise
GroupWise Messenger
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
HP Customer Participation Program 13.0
HP Document Manager 2.0
HP Image Zone 4.7
HP Imaging Device Functions 13.0
hp instant support
HP Officejet 4500 G510n-z
HP PSC & OfficeJet 4.7
HP Smart Web Printing 4.5
HP Solution Center 13.0
HP Update
HPProductAssistant
HPSSupply
HPSystemDiagnostics
HyperLoad
ICS Viewer 6.0
ImageMixer VCD/DVD2 for OLYMPUS
InstantShare
Insurance Kit 1.0
Intel® Extreme Graphics Driver
Intel® PRO Ethernet Adapter and Software
Intel® PROSet II
Java Auto Updater
Java™ 6 Update 26
KODAK DC220/DC260 Software
KODAK EASYSHARE Gallery Easy Upload, v2.1
KODAK EASYSHARE Gallery Upload ActiveX Control
LP_Flash
Mahjong Garden Deluxe
Malwarebytes' Anti-Malware
MarketResearch
maxx PDFMAILER Standard
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2416447)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Interactive Training
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Media Content
Microsoft Office XP Standard for Students and Teachers
Microsoft Publisher 97
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual J# .NET Redistributable Package 1.1
Moraff's Maximum MahJongg 1.0
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MySpaceIM
Network
OCR Software by I.R.I.S. 13.0
OGA Notifier 2.0.0048.0
OLYMPUS Master
OverDrive Media Console
Palm VersaMail™
PC-Doctor for Windows
PC ScanAndSweep
PhotoGallery
PICTUREKA! MUSEUM MAYHEM
ProductContext
PRS-500 USB driver
QFolder
Question Writer 2.0 - Personal Edition
QuickTime
Reader Library by Sony
Readme
Roxio Media Manager
Sandboxie 3.46
Scan
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB911565)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Shop for HP Supplies
SkinsHP1
Skype™ 5.3
SmartWebPrinting
SolutionCenter
SpywareBlaster 4.4
Status
Supon
The Poppit! Show
Toolbox
TrayApp
Tri Peaks 2 Quest For The Ruby Ring
TurboTax 2010
TurboTax 2010 WinPerFedFormset
TurboTax 2010 WinPerReleaseEngine
TurboTax 2010 WinPerTaxSupport
TurboTax 2010 wohiper
TurboTax 2010 wrapper
U.S. Robotics V.92 PCI Faxmodem
Ulead iPhoto Express 1.1
Unload
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Way To Go! Bowling
WebFldrs XP
WebReg
WexTech AnswerWorks
WildTangent Web Driver
Windows Driver Package - Sony Corporation (PRSUSB) USB (08/08/2006 1.0.03.08080)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinPatrol 2009
Word Riot Deluxe
Word Whomp( TM) Underground
Yahoo! Address AutoComplete
Yahoo! Install Manager
Yahoo! Internet Mail
Yahoo! Mail Quick Select Tool (PhotoMail)
Yahoo! Messenger
Yahoo! Photos Easy Upload Tool 1v7
Yahoo! Software Update
Yahoo! Toolbar
.
==== Event Viewer Messages From Past Week ========
.
6/15/2011 9:36:15 PM, error: Service Control Manager [7034] - The Intuit Update Service service terminated unexpectedly. It has done this 1 time(s).
6/15/2011 9:35:55 PM, error: Service Control Manager [7022] - The Intuit Update Service service hung on starting.
6/15/2011 9:22:57 PM, error: System Error [1003] - Error code 000000f4, parameter1 00000003, parameter2 82c9e768, parameter3 82c9e8dc, parameter4 805fb1d6.
6/15/2011 1:39:59 PM, error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the CarboniteService service, but this action failed with the following error: An instance of the service is already running.
6/15/2011 1:39:00 PM, error: Service Control Manager [7031] - The CarboniteService service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
6/15/2011 1:35:33 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Roxio Hard Drive Watcher 9 service to connect.
.
==== End Of File ===========================

aswMBR version 0.9.6.399 Copyright© 2011 AVAST Software
Run date: 2011-06-19 16:58:06
—————————–
16:58:06.281 OS Version: Windows 5.1.2600 Service Pack 3
16:58:06.281 Number of processors: 1 586 0x207
16:58:06.281 ComputerName: S0031834184 UserName: Sue
16:58:06.828 Initialize success
16:58:27.515 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
16:58:27.515 Disk 0 Vendor: Maxtor_6Y080L0 YAR41BW0 Size: 78167MB BusType: 3
16:58:29.531 Disk 0 MBR read successfully
16:58:29.531 Disk 0 MBR scan
16:58:29.531 Disk 0 Windows XP default MBR code
16:58:31.531 Disk 0 scanning sectors +160071660
16:58:31.546 Disk 0 scanning C:\WINNT\system32\drivers
16:58:38.718 Service scanning
16:58:39.843 Disk 0 trace - called modules:
16:58:39.859 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
16:58:39.859 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82f73ab8]
16:58:39.859 3 CLASSPNP.SYS[f8548fd7] -> nt!IofCallDriver -> \Device\00000063[0x82fccf18]
16:58:39.859 5 ACPI.sys[f84af620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82f76940]
16:58:39.859 Scan finished successfully
16:58:54.140 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\MBR.dat"
16:58:54.156 The log file has been saved successfully to "C:\Documents and Settings\Administrator\Desktop\aswMBR.txt"

This is a second consecutive reply to your last post, so please be sure to read the previous one also. I wanted to let you know about the error message that was created last night (6-25-11 at 10:34 PM) hs_err_pid268. SInce it's Java related, would it have anything to do with that Java 6 update 7 that I can't get removed from my computer? When I try to do that I get the message "Internal Error 2753. RegUtils" then, when I click "OK" on that window, I get "Fatal Error During Installation". At that point it is no longer in the Add/Remove list of programs, but if I leave and return, it is back in the list.
#
# A fatal error has been detected by the Java Runtime Environment:
#
# EXCEPTION_ACCESS_VIOLATION (0xc0000005) at pc=0x00000000, pid=268, tid=3304
#
# JRE version: 6.0_26-b03
# Java VM: Java HotSpot™ Client VM (20.1-b02 mixed mode, sharing windows-x86 )
# Problematic frame:
# C 0x00000000
#
# If you would like to submit a bug report, please visit:
# http://java.sun.com/webapps/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

————— T H R E A D —————

Current thread (0x0307ac00): JavaThread "AWT-Windows" daemon [_thread_in_native, id=3304, stack(0x03460000,0x034b0000)]

siginfo: ExceptionCode=0xc0000005, reading address 0x00000000

Registers:
EAX=0x03e5d288, EBX=0x00000001, ECX=0x02bb1950, EDX=0x00000004
ESP=0x034afa00, EBP=0x034afa2c, ESI=0x0307ad28, EDI=0x02bb1950
EIP=0x00000000, EFLAGS=0x00010293

Top of Stack: (sp=0x034afa00)
0x034afa00: 6d09cb90 034afa94 6d09c650 00000000
0x034afa10: 00000000 00000001 0307ad28 034afa04
0x034afa20: 034afab0 6d0c04a8 00000001 034afa58
0x034afa30: 7e418734 000a055a 0000981a 02bb1950
0x034afa40: 00000000 6d09c650 dcbaabcd 00000000
0x034afa50: 034afa94 6d09c650 034afac0 7e418816
0x034afa60: 6d09c650 000a055a 0000981a 02bb1950
0x034afa70: 00000000 034afb54 034afb4c 005da298

Instructions: (pc=0x00000000)
0xffffffe0:


Register to memory mapping:

EAX=0x03e5d288 is an unknown value
EBX=0x00000001 is an unknown value
ECX=0x02bb1950 is an unknown value
EDX=0x00000004 is an unknown value
ESP=0x034afa00 is pointing into the stack for thread: 0x0307ac00
EBP=0x034afa2c is pointing into the stack for thread: 0x0307ac00
ESI=0x0307ad28 is an unknown value
EDI=0x02bb1950 is an unknown value


Stack: [0x03460000,0x034b0000], sp=0x034afa00, free space=318k
Java frames: (J=compiled Java code, j=interpreted, Vv=VM code)
j sun.awt.windows.WToolkit.eventLoop()V+0
j sun.awt.windows.WToolkit.run()V+52
j java.lang.Thread.run()V+11
v ~StubRoutines::call_stub

————— P R O C E S S —————

Java Threads: ( => current thread )
0x03e2a400 JavaThread "Thread-35" [_thread_blocked, id=500, stack(0x061f0000,0x06240000)]
0x02bf1800 JavaThread "Thread-34" [_thread_blocked, id=308, stack(0x06150000,0x061a0000)]
0x03079400 JavaThread "Timer-3" [_thread_blocked, id=1360, stack(0x03410000,0x03460000)]
0x03fb0000 JavaThread "Image Animator 0" daemon [_thread_blocked, id=2176, stack(0x02fa0000,0x02ff0000)]
0x031b2400 JavaThread "AvatarControllerFactory" daemon [_thread_blocked, id=1028, stack(0x06540000,0x06590000)]
0x03f24c00 JavaThread "TickTimer" daemon [_thread_blocked, id=880, stack(0x061a0000,0x061f0000)]
0x03f27800 JavaThread "DailyWordSearchShell_environment_thread" daemon [_thread_in_Java, id=596, stack(0x06380000,0x063d0000)]
0x02bb0800 JavaThread "ITimer" daemon [_thread_blocked, id=1072, stack(0x06330000,0x06380000)]
0x03e4a400 JavaThread "ScrollBar" daemon [_thread_blocked, id=896, stack(0x06100000,0x06150000)]
0x03ecd800 JavaThread "TextField" daemon [_thread_blocked, id=3968, stack(0x060b0000,0x06100000)]
0x0311fc00 JavaThread "ScrollBar" daemon [_thread_blocked, id=1464, stack(0x06060000,0x060b0000)]
0x03e31400 JavaThread "ScrollBar" daemon [_thread_blocked, id=1348, stack(0x06010000,0x06060000)]
0x031a9400 JavaThread "ScrollBar" daemon [_thread_blocked, id=1404, stack(0x05fc0000,0x06010000)]
0x05749400 JavaThread "ScrollBar" daemon [_thread_blocked, id=3780, stack(0x05f70000,0x05fc0000)]
0x041e1400 JavaThread "ScrollBar" daemon [_thread_blocked, id=1024, stack(0x05f20000,0x05f70000)]
0x03e80400 JavaThread "TickTimer" daemon [_thread_blocked, id=3108, stack(0x05ed0000,0x05f20000)]
0x03e9e400 JavaThread "ScrollBar" daemon [_thread_blocked, id=2532, stack(0x054e0000,0x05530000)]
0x03e92400 JavaThread "BadgeStorage" daemon [_thread_blocked, id=1384, stack(0x05430000,0x05480000)]
0x05728400 JavaThread "SocketConnection" daemon [_thread_in_native, id=3508, stack(0x03c40000,0x03c90000)]
0x03fcb800 JavaThread "Applet-EventThread" daemon [_thread_blocked, id=3312, stack(0x04ac0000,0x04b10000)]
0x0325c400 JavaThread "Direct Clip" daemon [_thread_blocked, id=1852, stack(0x049d0000,0x04a20000)]
0x031b4400 JavaThread "AsynchRasterManager.avatar" daemon [_thread_blocked, id=1828, stack(0x04930000,0x04980000)]
0x031eac00 JavaThread "Thread-27" daemon [_thread_blocked, id=3936, stack(0x04470000,0x044c0000)]
0x031e5400 JavaThread "Thread-26" daemon [_thread_blocked, id=4028, stack(0x04420000,0x04470000)]
0x031acc00 JavaThread "Thread-25" daemon [_thread_blocked, id=2468, stack(0x043d0000,0x04420000)]
0x03ea6800 JavaThread "Java Sound Event Dispatcher" daemon [_thread_blocked, id=3168, stack(0x04380000,0x043d0000)]
0x030ea400 JavaThread "thread applet-com.pogo.game.client2.wordsearch.WordSearchApplet-4" [_thread_in_native, id=600, stack(0x03c90000,0x03ce0000)]
0x030e9c00 JavaThread "thread applet-com.pogo.game.client2.shell.ShellApplet-3" [_thread_blocked, id=3668, stack(0x03ba0000,0x03bf0000)]
0x030e0c00 JavaThread "thread applet-com.pogo.game.client2.shell.ShellApplet-2" [_thread_blocked, id=2136, stack(0x03650000,0x036a0000)]
0x02b1a000 JavaThread "AWT-EventQueue-3" [_thread_blocked, id=660, stack(0x03ce0000,0x03d30000)]
0x030b3c00 JavaThread "AWT-Shutdown" [_thread_blocked, id=2260, stack(0x032b0000,0x03300000)]
0x030af400 JavaThread "Browser Side Object Cleanup Thread" [_thread_blocked, id=3836, stack(0x03b50000,0x03ba0000)]
0x030a9800 JavaThread "Windows Tray Icon Thread" [_thread_in_native, id=2600, stack(0x036f0000,0x03740000)]
0x030a7000 JavaThread "CacheCleanUpThread" daemon [_thread_blocked, id=2256, stack(0x036a0000,0x036f0000)]
0x030a6400 JavaThread "CacheMemoryCleanUpThread" daemon [_thread_blocked, id=1276, stack(0x03600000,0x03650000)]
0x03081800 JavaThread "SysExecutionTheadCreator" daemon [_thread_blocked, id=564, stack(0x035b0000,0x03600000)]
0x0307dc00 JavaThread "Java Plug-In Heartbeat Thread" [_thread_blocked, id=3768, stack(0x03560000,0x035b0000)]
=>0x0307ac00 JavaThread "AWT-Windows" daemon [_thread_in_native, id=3304, stack(0x03460000,0x034b0000)]
0x03078000 JavaThread "Java2D Disposer" daemon [_thread_blocked, id=3820, stack(0x033c0000,0x03410000)]
0x03071400 JavaThread "Java Plug-In Pipe Worker Thread (Client-Side)" daemon [_thread_in_native, id=3596, stack(0x03310000,0x03360000)]
0x02bfa400 JavaThread "Timer-0" [_thread_blocked, id=3520, stack(0x03260000,0x032b0000)]
0x02bb4800 JavaThread "traceMsgQueueThread" daemon [_thread_blocked, id=2704, stack(0x03010000,0x03060000)]
0x02b71c00 JavaThread "Low Memory Detector" daemon [_thread_blocked, id=1884, stack(0x02de0000,0x02e30000)]
0x02b62c00 JavaThread "C1 CompilerThread0" daemon [_thread_blocked, id=3908, stack(0x02d90000,0x02de0000)]
0x02b61400 JavaThread "Attach Listener" daemon [_thread_blocked, id=2336, stack(0x02d40000,0x02d90000)]
0x02b60000 JavaThread "Signal Dispatcher" daemon [_thread_blocked, id=3620, stack(0x02cf0000,0x02d40000)]
0x02b5c800 JavaThread "Finalizer" daemon [_thread_blocked, id=3232, stack(0x02ca0000,0x02cf0000)]
0x02b57c00 JavaThread "Reference Handler" daemon [_thread_blocked, id=3772, stack(0x02c50000,0x02ca0000)]
0x00888000 JavaThread "main" [_thread_blocked, id=2556, stack(0x00910000,0x00960000)]

Other Threads:
0x02b1bc00 VMThread [stack: 0x02c00000,0x02c50000] [id=3892]
0x02b73c00 WatcherThread [stack: 0x02e30000,0x02e80000] [id=872]

VM state:not at safepoint (normal execution)

VM Mutex/Monitor currently owned by a thread: None

Heap
def new generation total 18176K, used 9646K [0x22990000, 0x23d40000, 0x25430000)
eden space 16192K, 54% used [0x22990000, 0x2321bd20, 0x23960000)
from space 1984K, 45% used [0x23960000, 0x23a3fc08, 0x23b50000)
to space 1984K, 0% used [0x23b50000, 0x23b50000, 0x23d40000)
tenured generation total 40152K, used 32007K [0x25430000, 0x27b66000, 0x2a990000)
the space 40152K, 79% used [0x25430000, 0x27371c48, 0x27371e00, 0x27b66000)
compacting perm gen total 12288K, used 5497K [0x2a990000, 0x2b590000, 0x2e990000)
the space 12288K, 44% used [0x2a990000, 0x2aeee690, 0x2aeee800, 0x2b590000)
ro space 10240K, 51% used [0x2e990000, 0x2eebdff8, 0x2eebe000, 0x2f390000)
rw space 12288K, 55% used [0x2f390000, 0x2fa2c208, 0x2fa2c400, 0x2ff90000)

Code Cache [0x00990000, 0x00d38000, 0x02990000)
total_blobs=1982 nmethods=1736 adapters=180 free_code_cache=29741888 largest_free_block=384

Dynamic libraries:
0x00400000 - 0x00424000 C:\Program Files\Java\jre6\bin\java.exe
0x7c900000 - 0x7c9b2000 C:\WINNT\system32\ntdll.dll
0x7c800000 - 0x7c8f6000 C:\WINNT\system32\kernel32.dll
0x77dd0000 - 0x77e6b000 C:\WINNT\system32\ADVAPI32.dll
0x77e70000 - 0x77f03000 C:\WINNT\system32\RPCRT4.dll
0x77fe0000 - 0x77ff1000 C:\WINNT\system32\Secur32.dll
0x5cb70000 - 0x5cb96000 C:\WINNT\system32\ShimEng.dll
0x71590000 - 0x71609000 C:\WINNT\AppPatch\AcLayers.DLL
0x7e410000 - 0x7e4a1000 C:\WINNT\system32\USER32.dll
0x77f10000 - 0x77f59000 C:\WINNT\system32\GDI32.dll
0x7c9c0000 - 0x7d1d7000 C:\WINNT\system32\SHELL32.dll
0x77c10000 - 0x77c68000 C:\WINNT\system32\msvcrt.dll
0x77f60000 - 0x77fd6000 C:\WINNT\system32\SHLWAPI.dll
0x774e0000 - 0x7761e000 C:\WINNT\system32\ole32.dll
0x769c0000 - 0x76a74000 C:\WINNT\system32\USERENV.dll
0x73000000 - 0x73026000 C:\WINNT\system32\WINSPOOL.DRV
0x76390000 - 0x763ad000 C:\WINNT\system32\IMM32.DLL
0x773d0000 - 0x774d3000 C:\WINNT\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
0x7c340000 - 0x7c396000 C:\Program Files\Java\jre6\bin\msvcr71.dll
0x6d7f0000 - 0x6da9f000 C:\Program Files\Java\jre6\bin\client\jvm.dll
0x76b40000 - 0x76b6d000 C:\WINNT\system32\WINMM.dll
0x6d7a0000 - 0x6d7ac000 C:\Program Files\Java\jre6\bin\verify.dll
0x6d320000 - 0x6d33f000 C:\Program Files\Java\jre6\bin\java.dll
0x76bf0000 - 0x76bfb000 C:\WINNT\system32\PSAPI.DLL
0x6d7e0000 - 0x6d7ef000 C:\Program Files\Java\jre6\bin\zip.dll
0x6d420000 - 0x6d426000 C:\Program Files\Java\jre6\bin\jp2native.dll
0x6d1d0000 - 0x6d1e3000 C:\Program Files\Java\jre6\bin\deploy.dll
0x77a80000 - 0x77b15000 C:\WINNT\system32\CRYPT32.dll
0x77b20000 - 0x77b32000 C:\WINNT\system32\MSASN1.dll
0x77120000 - 0x771ab000 C:\WINNT\system32\OLEAUT32.dll
0x3d930000 - 0x3da16000 C:\WINNT\system32\WININET.dll
0x02e80000 - 0x02e89000 C:\WINNT\system32\Normaliz.dll
0x78130000 - 0x78263000 C:\WINNT\system32\urlmon.dll
0x3dfd0000 - 0x3e1b9000 C:\WINNT\system32\iertutil.dll
0x6d6a0000 - 0x6d6e6000 C:\Program Files\Java\jre6\bin\regutils.dll
0x77c00000 - 0x77c08000 C:\WINNT\system32\VERSION.dll
0x6d600000 - 0x6d613000 C:\Program Files\Java\jre6\bin\net.dll
0x71ab0000 - 0x71ac7000 C:\WINNT\system32\WS2_32.dll
0x71aa0000 - 0x71aa8000 C:\WINNT\system32\WS2HELP.dll
0x6d620000 - 0x6d629000 C:\Program Files\Java\jre6\bin\nio.dll
0x6d000000 - 0x6d14b000 C:\Program Files\Java\jre6\bin\awt.dll
0x5d090000 - 0x5d12a000 C:\WINNT\system32\comctl32.dll
0x5ad70000 - 0x5ada8000 C:\WINNT\system32\uxtheme.dll
0x74720000 - 0x7476c000 C:\WINNT\system32\MSCTF.dll
0x77b40000 - 0x77b62000 C:\WINNT\system32\apphelp.dll
0x755c0000 - 0x755ee000 C:\WINNT\system32\msctfime.ime
0x71a50000 - 0x71a8f000 C:\WINNT\System32\mswsock.dll
0x76f20000 - 0x76f47000 C:\WINNT\system32\DNSAPI.dll
0x76d60000 - 0x76d79000 C:\WINNT\system32\iphlpapi.dll
0x76fb0000 - 0x76fb8000 C:\WINNT\System32\winrnr.dll
0x76f60000 - 0x76f8c000 C:\WINNT\system32\WLDAP32.dll
0x76fc0000 - 0x76fc6000 C:\WINNT\system32\rasadhlp.dll
0x6d230000 - 0x6d27f000 C:\Program Files\Java\jre6\bin\fontmanager.dll
0x6d1a0000 - 0x6d1c3000 C:\Program Files\Java\jre6\bin\dcpr.dll
0x6d510000 - 0x6d535000 C:\Program Files\Java\jre6\bin\jsound.dll
0x6d540000 - 0x6d548000 C:\Program Files\Java\jre6\bin\jsoundds.dll
0x73f10000 - 0x73f6c000 C:\WINNT\system32\DSOUND.dll
0x76c30000 - 0x76c5e000 C:\WINNT\system32\WINTRUST.dll
0x76c90000 - 0x76cb8000 C:\WINNT\system32\IMAGEHLP.dll
0x72d20000 - 0x72d29000 C:\WINNT\system32\wdmaud.drv
0x72d10000 - 0x72d18000 C:\WINNT\system32\msacm32.drv
0x77be0000 - 0x77bf5000 C:\WINNT\system32\MSACM32.dll
0x77bd0000 - 0x77bd7000 C:\WINNT\system32\midimap.dll
0x73ee0000 - 0x73ee4000 C:\WINNT\system32\KsUser.dll
0x662b0000 - 0x66308000 C:\WINNT\system32\hnetcfg.dll
0x71a90000 - 0x71a98000 C:\WINNT\System32\wshtcpip.dll
0x6d440000 - 0x6d465000 C:\Program Files\Java\jre6\bin\jpeg.dll
0x605d0000 - 0x605d9000 C:\WINNT\system32\mslbui.dll
0x68000000 - 0x68036000 C:\WINNT\system32\rsaenh.dll
0x5b860000 - 0x5b8b5000 C:\WINNT\system32\netapi32.dll

VM Arguments:
jvm_args: -D__jvm_launched=11001042562 -Xbootclasspath/a:C:\PROGRA~1\Java\jre6\lib\deploy.jar;C:\PROGRA~1\Java\jre6\lib\javaws.jar;C:\PROGRA~1\Java\jre6\lib\plugin.jar -Dsun.awt.warmup=true -Xmx128m
java_command: sun.plugin2.main.client.PluginMain write_pipe_name=jpi2_pid2552_pipe6,read_pipe_name=jpi2_pid2552_pipe5
Launcher Type: SUN_STANDARD

Environment Variables:
PATH=C:\WINNT\system32;C:\WINNT;C:\WINNT\System32\Wbem;C:\Program Files\PC-Doctor for Windows\services;c:\Program Files\Common Files\Adaptec Shared\System;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\Common Files\HP\Digital Imaging\bin;C:\Program Files\HP\Digital Imaging\bin\;C:\Program Files\HP\Digital Imaging\bin\Qt\Qt 4.3.3;
USERNAME=Sue
OS=Windows_NT
PROCESSOR_IDENTIFIER=x86 Family 15 Model 2 Stepping 7, GenuineIntel



————— S Y S T E M —————

OS: Windows XP Build 2600 Service Pack 3

CPU:total 1 (1 cores per cpu, 1 threads per core) family 15 model 2 stepping 7, cmov, cx8, fxsr, mmx, sse, sse2

Memory: 4k page, physical 522032k(24380k free), swap 1278264k(718172k free)

vm_info: Java HotSpot™ Client VM (20.1-b02) for windows-x86 JRE (1.6.0_26-b03), built on May 4 2011 00:50:59 by "java_re" with MS VC++ 7.1 (VS2003)

time: Sat Jun 25 22:34:53 2011
elapsed time: 708 seconds

My svchost.exe is still causing the CPU to range between 80 and 100% causing everything to run slowly. It took over an hour to run defrag last night.

hi
Sending a couple of things. Since I posted last I disabled all of the add-ons for HP printers and the CPU went back to normal. Then, today, I ran the Combo fix and the part about the restore point reminded me I hadn't gone back and cleared out the old ones, so I did that. Then I downloaded the Spybot S & D (which took FOREVER to run - is that normal?) and the CPU 100% has been going on ever since. I notice it put some add-ons in the list. Could that be where the problem is occurring? Then I ran Combofix again. During the second combofix run, I got the following message:pev.cfxxe has encountered a problem and needs to close, giving me the option of sending an error message. Afterwards, combofix appeared to finish out its scan normally.
The first log is from the first combofix run and log2 is from the second. If Spybot is now causing the CPU problem, I may be uninstalling that real soon, especially as long as it took to run its scan!
Thanks,

log:
ComboFix 11-06-27.01 - Sue 06/27/2011 16:32:06.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.159 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator\WINDOWS
C:\setup.exe
C:\Thumbs.db
c:\winnt\AutoRun.ini
c:\winnt\Downloaded Program Files\f3initialsetup1.0.0.15-3.inf
c:\winnt\Downloaded Program Files\popcaploader.inf
c:\winnt\system32\Thumbs.db
.
.
((((((((((((((((((((((((( Files Created from 2011-05-27 to 2011-06-27 )))))))))))))))))))))))))))))))
.
.
2011-06-16 02:10 . 2011-06-16 02:10 73728 —-a-w- c:\winnt\system32\javacpl.cpl
2011-06-16 01:41 . 2011-06-16 01:41 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\PCHealth
2011-06-16 01:32 . 2011-06-16 01:32 ——– d—–w- c:\winnt\system32\wbem\Repository
2011-06-16 00:54 . 2011-06-16 00:54 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\ESET
2011-06-15 16:42 . 2011-04-21 13:37 105472 ——w- c:\winnt\system32\dllcache\mup.sys
2011-06-07 16:35 . 2011-06-07 16:35 103864 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 02:10 . 2010-07-02 03:33 472808 —-a-w- c:\winnt\system32\deployJava1.dll
2011-06-11 03:27 . 2011-05-22 22:34 404640 —-a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-05-29 13:11 . 2009-12-31 16:11 39984 —-a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11 . 2009-12-31 16:11 22712 —-a-w- c:\winnt\system32\drivers\mbam.sys
2011-05-02 15:31 . 2004-06-07 18:19 692736 —-a-w- c:\winnt\system32\inetcomm.dll
2011-04-29 16:19 . 1980-01-01 04:00 456320 —-a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-04-25 16:11 . 2004-08-24 00:32 916480 —-a-w- c:\winnt\system32\wininet.dll
2011-04-25 16:11 . 1980-01-01 04:00 43520 —-a-w- c:\winnt\system32\licmgr10.dll
2011-04-25 16:11 . 1980-01-01 04:00 1469440 ——w- c:\winnt\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-04 05:59 385024 —-a-w- c:\winnt\system32\html.iec
2011-04-21 13:37 . 1980-01-01 04:00 105472 —-a-w- c:\winnt\system32\drivers\mup.sys
2007-06-08 02:21 . 2007-06-08 02:20 823768 -c–a-w- c:\program files\Google_Updater.exe
2004-08-13 16:02 . 2004-08-13 16:02 19197952 -c–a-w- c:\program files\Kodak DC220.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Blue]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Blue]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Red]
@="{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}"
[HKEY_CLASSES_ROOT\CLSID\{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-08-12 2215064]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\HotSync Manager.LNK
backup=c:\winnt\pss\HotSync Manager.LNKStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Notify.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Notify.lnk
backup=c:\winnt\pss\Notify.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
2010-08-29 05:35 864624 -c–a-w- c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2003-03-26 16:15 684032 -c–a-w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2009-12-01 17:38 3951976 —-a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\winnt\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gateway Ink Monitor]
2003-06-25 01:33 303180 -c–a-w- c:\program files\Gateway Utilities\GWInkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2003-07-10 08:13 114688 -c–a-w- c:\winnt\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-02-18 19:49 49208 —-a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2003-07-10 08:25 155648 -c–a-w- c:\winnt\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\masqform.exe]
2003-12-03 17:43 1052672 —-a-w- c:\program files\PureEdge\Viewer 6.0\masqform.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 01:06 4351216 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM_Monitor]
2006-05-16 21:50 40960 -c–a-w- c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reader Library Launcher]
2010-07-13 05:34 906648 —-a-w- c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2008-03-06 20:19 236016 -c–a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SandboxieControl]
2010-07-04 09:49 398568 —-a-w- c:\program files\Sandboxie\SbieCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Novell\\GroupWise\\grpwise.exe"=
"c:\\Novell\\GroupWise\\notify.exe"=
"c:\\Program Files\\Microsoft Office\\Office10\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\WINNT\\system32\\dpvsetup.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqfxt08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
.
R0 Lbd;Lbd;c:\winnt\system32\drivers\Lbd.sys [2/8/2009 8:31 PM 64288]
R1 ehdrv;ehdrv;c:\winnt\system32\drivers\ehdrv.sys [7/29/2010 1:31 PM 115008]
R1 epfwtdir;epfwtdir;c:\winnt\system32\drivers\epfwtdir.sys [8/3/2010 1:28 PM 95896]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [8/12/2010 2:16 PM 810144]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2011 6:56 PM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2011 6:56 PM 136176]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 4:55 AM 1355416]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/29/2010 1:35 AM 15008]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys –> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - NMSSVC
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\winnt\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-21 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
2011-06-27 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-10 22:56]
.
2011-06-27 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-10 22:56]
.
2011-06-26 c:\winnt\Tasks\OGALogon.job
- c:\winnt\system32\OGAEXEC.exe [2009-08-03 20:07]
.
2011-06-27 c:\winnt\Tasks\User_Feed_Synchronization-{7745735E-920B-4997-A418-13B3FF56EE1D}.job
- c:\winnt\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.src=ym&.intl=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.gatewaybiz.com
uInternet Settings,ProxyOverride = 127.0.0.1
Trusted Zone: columbusrealtors.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://c:\program files\Gateway\Do More\DoMoreRunExe.CAB
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - file://c:\program files\gateway\helpspot\TechTools.CAB
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} - hxxp://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient/PTGameLauncher.cab
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
Toolbar-Locked - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
MSConfigStartUp-Microsoft Works Update Detection - c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
MSConfigStartUp-mmtask - c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
MSConfigStartUp-MMTray - c:\program files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
MSConfigStartUp-My Web Search Bar Search Scope Monitor - c:\progra~1\MYWEBS~2\bar\2.bin\m3SrchMn.exe
MSConfigStartUp-MyWebSearch Email Plugin - c:\progra~1\MYWEBS~2\bar\2.bin\mwsoemon.exe
MSConfigStartUp-Performance Center - c:\program files\Ascentive\Performance Center\ApcMain.exe
MSConfigStartUp-SunJavaUpdateSched - c:\program files\Java\jre1.6.0_07\bin\jusched.exe
MSConfigStartUp-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
MSConfigStartUp-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
MSConfigStartUp-Weather - c:\program files\AWS\WeatherBug\Weather.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-27 16:47
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1126280286-3637069651-664671362-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,db,4d,31,ad,1b,01,45,ae,bb,c7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f6,39,76,4a,cd,30,e1,4e,a8,66,b5,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,68,5e,eb,be,a3,c2,c1,43,8b,73,35,\
.
Completion time: 2011-06-27 16:56:30
ComboFix-quarantined-files.txt 2011-06-27 20:56
.
Pre-Run: 47,110,250,496 bytes free
Post-Run: 47,667,044,352 bytes free
.
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
.
- - End Of File - - 794F43E8B9356AFF14BABC2256663E0D

log2
ComboFix 11-06-27.01 - Sue 06/27/2011 20:54:09.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.154 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 4.2 *Disabled/Updated* {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
AV: Lavasoft Ad-Watch Live! Anti-Virus *Disabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
.
.
((((((((((((((((((((((((( Files Created from 2011-05-28 to 2011-06-28 )))))))))))))))))))))))))))))))
.
.
2011-06-27 21:27 . 2011-06-27 22:38 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2011-06-27 21:27 . 2011-06-27 21:34 ——– d—–w- c:\program files\Spybot - Search & Destroy
2011-06-16 02:10 . 2011-06-16 02:10 73728 —-a-w- c:\winnt\system32\javacpl.cpl
2011-06-16 01:41 . 2011-06-16 01:41 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\PCHealth
2011-06-16 01:32 . 2011-06-16 01:32 ——– d—–w- c:\winnt\system32\wbem\Repository
2011-06-16 00:54 . 2011-06-16 00:54 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\ESET
2011-06-15 16:42 . 2011-04-21 13:37 105472 ——w- c:\winnt\system32\dllcache\mup.sys
2011-06-07 16:35 . 2011-06-07 16:35 103864 —-a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-06-16 02:10 . 2010-07-02 03:33 472808 —-a-w- c:\winnt\system32\deployJava1.dll
2011-06-11 03:27 . 2011-05-22 22:34 404640 —-a-w- c:\winnt\system32\FlashPlayerCPLApp.cpl
2011-05-29 13:11 . 2009-12-31 16:11 39984 —-a-w- c:\winnt\system32\drivers\mbamswissarmy.sys
2011-05-29 13:11 . 2009-12-31 16:11 22712 —-a-w- c:\winnt\system32\drivers\mbam.sys
2011-05-02 15:31 . 2004-06-07 18:19 692736 —-a-w- c:\winnt\system32\inetcomm.dll
2011-04-29 16:19 . 1980-01-01 04:00 456320 —-a-w- c:\winnt\system32\drivers\mrxsmb.sys
2011-04-25 16:11 . 2004-08-24 00:32 916480 —-a-w- c:\winnt\system32\wininet.dll
2011-04-25 16:11 . 1980-01-01 04:00 43520 —-a-w- c:\winnt\system32\licmgr10.dll
2011-04-25 16:11 . 1980-01-01 04:00 1469440 ——w- c:\winnt\system32\inetcpl.cpl
2011-04-25 12:01 . 2004-08-04 05:59 385024 —-a-w- c:\winnt\system32\html.iec
2011-04-21 13:37 . 1980-01-01 04:00 105472 —-a-w- c:\winnt\system32\drivers\mup.sys
2007-06-08 02:21 . 2007-06-08 02:20 823768 -c–a-w- c:\program files\Google_Updater.exe
2004-08-13 16:02 . 2004-08-13 16:02 19197952 -c–a-w- c:\program files\Kodak DC220.exe
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Blue]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Green]
@="{95A27763-F62A-4114-9072-E81D87DE3B68}"
[HKEY_CLASSES_ROOT\CLSID\{95A27763-F62A-4114-9072-E81D87DE3B68}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Blue]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Partial]
@="{E300CD91-100F-4E67-9AF3-1384A6124015}"
[HKEY_CLASSES_ROOT\CLSID\{E300CD91-100F-4E67-9AF3-1384A6124015}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Red]
@="{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}"
[HKEY_CLASSES_ROOT\CLSID\{01CCCC8C-1D50-4b13-B96D-4B922DD3128B}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\Carbonite.Yellow]
@="{5E529433-B50E-4bef-A63B-16A6B71B071A}"
[HKEY_CLASSES_ROOT\CLSID\{5E529433-B50E-4bef-A63B-16A6B71B071A}]
2011-03-04 00:52 762000 —-a-r- c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2010-08-12 2215064]
"Reader Library Launcher"="c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe" [2010-07-13 906648]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-06-08 37296]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
"Carbonite Backup"="c:\program files\Carbonite\Carbonite Backup\CarboniteUI.exe" [2011-03-04 948880]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^Documents and Settings^Administrator^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=c:\documents and settings\Administrator\Start Menu\Programs\Startup\HotSync Manager.LNK
backup=c:\winnt\pss\HotSync Manager.LNKStartup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Notify.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Notify.lnk
backup=c:\winnt\pss\Notify.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
2010-08-29 05:35 864624 -c–a-w- c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
2003-03-26 16:15 684032 -c–a-w- c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2011-03-30 04:59 937920 —-a-r- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2011-06-08 04:02 37296 —-a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2009-12-01 17:38 3951976 —-a-w- c:\program files\AIM7\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2008-04-14 00:12 15360 —-a-w- c:\winnt\system32\ctfmon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gateway Ink Monitor]
2003-06-25 01:33 303180 -c–a-w- c:\program files\Gateway Utilities\GWInkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2003-07-10 08:13 114688 -c–a-w- c:\winnt\system32\hkcmd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2011-02-18 19:49 49208 —-a-w- c:\program files\HP\HP Software Update\hpwuschd2.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2003-07-10 08:25 155648 -c–a-w- c:\winnt\system32\igfxtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\masqform.exe]
2003-12-03 17:43 1052672 —-a-w- c:\program files\PureEdge\Viewer 6.0\masqform.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 01:06 4351216 —-a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OM_Monitor]
2006-05-16 21:50 40960 -c–a-w- c:\program files\OLYMPUS\OLYMPUS Master\FirstStart.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2010-11-29 22:38 421888 —-a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reader Library Launcher]
2010-07-13 05:34 906648 —-a-w- c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RoxWatchTray]
2008-03-06 20:19 236016 -c–a-w- c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SandboxieControl]
2010-07-04 09:49 398568 —-a-w- c:\program files\Sandboxie\SbieCtrl.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Novell\\GroupWise\\grpwise.exe"=
"c:\\Novell\\GroupWise\\notify.exe"=
"c:\\Program Files\\Microsoft Office\\Office10\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\WINNT\\system32\\dpvsetup.exe"=
"c:\\Program Files\\AIM7\\aim.exe"=
"c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfcCopy.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxs08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqfxt08.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgplgtupl.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqgpc01.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgm.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqusgh.exe"=
"c:\\Program Files\\HP\\HP Software Update\\HPWUCli.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\smart web printing\\SmartWebPrintExe.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
.
R0 Lbd;Lbd;c:\winnt\system32\drivers\Lbd.sys [2/8/2009 8:31 PM 64288]
R1 ehdrv;ehdrv;c:\winnt\system32\drivers\ehdrv.sys [7/29/2010 1:31 PM 115008]
R1 epfwtdir;epfwtdir;c:\winnt\system32\drivers\epfwtdir.sys [8/3/2010 1:28 PM 95896]
R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [8/12/2010 2:16 PM 810144]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2011 6:56 PM 136176]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2/10/2011 6:56 PM 136176]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/12/2010 4:55 AM 1355416]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\Lavasoft\Ad-Aware\kernexplorer.sys [8/29/2010 1:35 AM 15008]
S3 PCDRDRV;Pcdr Helper Driver;\??\c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys –> c:\progra~1\PC-DOC~1\DIAGNO~1\PCDRDRV.sys [?]
.
— Other Services/Drivers In Memory —
.
*NewlyCreated* - NMSCFG
*NewlyCreated* - NMSSVC
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]
2009-03-08 08:32 128512 —-a-w- c:\winnt\system32\advpack.dll
.
Contents of the 'Scheduled Tasks' folder
.
2011-06-21 c:\winnt\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]
.
2011-06-27 c:\winnt\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-10 22:56]
.
2011-06-28 c:\winnt\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-02-10 22:56]
.
2011-06-27 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-1126280286-3637069651-664671362-500Core.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-27 04:06]
.
2011-06-28 c:\winnt\Tasks\GoogleUpdateTaskUserS-1-5-21-1126280286-3637069651-664671362-500UA.job
- c:\documents and settings\Administrator\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-27 04:06]
.
2011-06-27 c:\winnt\Tasks\OGALogon.job
- c:\winnt\system32\OGAEXEC.exe [2009-08-03 20:07]
.
2011-06-27 c:\winnt\Tasks\User_Feed_Synchronization-{7745735E-920B-4997-A418-13B3FF56EE1D}.job
- c:\winnt\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
——- Supplementary Scan ——-
.
uStart Page = https://login.yahoo.com/config/mail?.src=ym&.intl=us
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.gatewaybiz.com
uInternet Settings,ProxyOverride = 127.0.0.1
Trusted Zone: columbusrealtors.com
Trusted Zone: intuit.com\ttlc
Trusted Zone: turbotax.com
TCP: DhcpNameServer = 192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\winnt\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {0F04992B-E661-4DB9-B223-903AB628225D} - file://c:\program files\Gateway\Do More\DoMoreRunExe.CAB
DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} - hxxp://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
DPF: {511073AD-BE56-4D43-AE68-93390514385E} - file://c:\program files\gateway\helpspot\TechTools.CAB
DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} - hxxp://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} - hxxp://clubgames.pogo.com/online2/pogop/mahjong_escape_ancient/PTGameLauncher.cab
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-06-27 21:12
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_USERS\S-1-5-21-1126280286-3637069651-664671362-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,46,db,4d,31,ad,1b,01,45,ae,bb,c7,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,f6,39,76,4a,cd,30,e1,4e,a8,66,b5,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,68,5e,eb,be,a3,c2,c1,43,8b,73,35,\
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'explorer.exe'(1480)
c:\winnt\system32\WININET.dll
c:\program files\Carbonite\Carbonite Backup\CarboniteNSE.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
Completion time: 2011-06-27 21:18:43
ComboFix-quarantined-files.txt 2011-06-28 01:18
ComboFix2.txt 2011-06-27 20:56
.
Pre-Run: 52,493,459,456 bytes free
Post-Run: 52,466,180,096 bytes free
.
- - End Of File - - A5CE976777F0211AA3D11868C23FBD9B