Spyware / Malware / Virus Removal

Searchqu/406

13 min read

Looking for the outcome? Ask AI

Lord skywalker Topic Starter

Post #1June 17, 2011, 8:36 AM UTC

Hi there, Can you please help me remove Searchqu from my system. I am running XP pro sp3. i have had this now for about a week and am having real trouble trying to remove it or even change my hamoepage back to how it was.

Satchfan

Post #2June 17, 2011, 11:57 AM UTC

Hello Lord skywalker and welcome to the WTT forum.

My name is Satchfan and I would be glad to help you with your computer problem.

Please read the following guidelines which will help to make cleaning your machine easier:
• Please follow all instructions in the order posted
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If you don't understand something, please don't hesitate to ask for clarification before proceeding
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please reply within 3 days. If you do not reply within this period I will post a reminder but topics with no reply in 4 days will be closed!
IMPORTANT:

Please DO NOT install/uninstall any programs unless asked to.
Please DO NOT run any scans other than those requested

===================================================

Download and run OTL

Download OTL to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Under Custom Scan paste this in

netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
nvrd32.sys
symmpi.sys
adp3132.sys
mv61xx.sys
nvraid.sys
/md5stop
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won’t take long.
When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.
You may need two posts to fit them both in.

===================================================

Run aswMBR

Download aswMBR.exe ( 511KB ) to your desktop.

Double click the aswMBR.exe to run it

Click the "Scan" button to start scan
🖼Click to load external image (Posted Image)

On completion of the scan click save log, save it to your desktop and post in your next reply
🖼Click to load external image (Posted Image)

Logs to include with next post:

OTL.txt
Extras.txt
aswMBR log

Thanks

Satchfan

Lord skywalker

Post #3June 17, 2011, 1:26 PM UTC

OTL logfile created on: 6/17/2011 13:52:19 - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: M/d/yyyy

1022.07 Mb Total Physical Memory | 363.69 Mb Available Physical Memory | 35.58% Memory free
2.39 Gb Paging File | 1.92 Gb Available in Paging File | 80.20% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.44 Gb Total Space | 8.17 Gb Free Space | 10.98% Space Free | Partition Type: NTFS
Drive F: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive G: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive M: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive P: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive Q: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive S: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive T: | 1117.66 Gb Total Space | 10.94 Gb Free Space | 0.98% Space Free | Partition Type: NTFS
Drive V: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive X: | 107.42 Gb Total Space | 63.56 Gb Free Space | 59.16% Space Free | Partition Type: NTFS
Drive Y: | 107.42 Gb Total Space | 98.36 Gb Free Space | 91.57% Space Free | Partition Type: NTFS
Drive Z: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS

Computer Name: MEL_GRUNDY | User Name: mel.grundy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
PRC - C:\Program Files\Real\RealPlayer\Update\realsched.exe (RealNetworks, Inc.)
PRC - C:\Program Files\SlySoft\AnyDVD\AnyDVDtray.exe (SlySoft, Inc.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
PRC - C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
PRC - C:\Program Files\LogMeIn\x86\ramaint.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
PRC - C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
PRC - C:\Program Files\ESET\nod32kui.exe (Eset )
PRC - C:\Program Files\ESET\nod32krn.exe (Eset )
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Avaya\IP Office\Phone Manager\PhoneManager.exe (Avaya Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Program Files\SlySoft\AnyDVD\ADvdDiscHlp1.dll (SlySoft, Inc.)
MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (B-Service) – File not found
SRV - (RapportMgmtService) – C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe (Trusteer Ltd.)
SRV - (Kodak AiO Network Discovery Service) – C:\Program Files\Kodak\AiO\Center\EKAiOHostService.exe (Eastman Kodak Company)
SRV - (LMIMaint) – C:\Program Files\LogMeIn\x86\RaMaint.exe (LogMeIn, Inc.)
SRV - (LMIGuardianSvc) – C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe (LogMeIn, Inc.)
SRV - (LogMeIn) – C:\Program Files\LogMeIn\x86\LogMeIn.exe (LogMeIn, Inc.)
SRV - (NOD32krn) – C:\Program Files\Eset\nod32krn.exe (Eset )

========== Driver Services (SafeList) ==========

DRV - (RapportCerberus_26762) – C:\Documents and Settings\All Users\Application Data\Trusteer\Rapport\store\exts\RapportCerberus\26762\RapportCerberus_26762.sys (Trusteer Ltd.)
DRV - (MBAMSwissArmy) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (RapportEI) – C:\Program Files\Trusteer\Rapport\bin\RapportEI.sys (Trusteer Ltd.)
DRV - (RapportKELL) – C:\WINDOWS\System32\Drivers\RapportKELL.sys (Trusteer Ltd.)
DRV - (RapportPG) – C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (Trusteer Ltd.)
DRV - (AnyDVD) – C:\WINDOWS\system32\drivers\AnyDVD.sys (SlySoft, Inc.)
DRV - (LMIRfsClientNP) – C:\WINDOWS\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
DRV - (AMON) – C:\WINDOWS\system32\drivers\amon.sys (Eset )
DRV - (nod32drv) – C:\WINDOWS\system32\drivers\nod32drv.sys ()
DRV - (ati2mtag) – C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
DRV - (fssfltr) – C:\WINDOWS\system32\drivers\fssfltr_tdi.sys (Microsoft Corporation)
DRV - (LMIRfsDriver) – C:\WINDOWS\system32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
DRV - (LMIInfo) – C:\Program Files\LogMeIn\x86\rainfo.sys (LogMeIn, Inc.)
DRV - (mv2) – C:\WINDOWS\system32\drivers\mv2.sys (UVNC BVBA)
DRV - (AtiHdmiService) – C:\WINDOWS\system32\drivers\AtiHdmi.sys (ATI Research Inc.)
DRV - (CLBUDFR) – C:\WINDOWS\System32\drivers\CLBUDFR.sys (CyberLink Corporation.)
DRV - (CLBStor) – C:\WINDOWS\System32\drivers\CLBStor.sys (Cyberlink Co.,Ltd.)
DRV - (ggsemc) – C:\WINDOWS\system32\drivers\ggsemc.sys (Sony Ericsson Mobile Communications)
DRV - (ggflt) – C:\WINDOWS\system32\drivers\ggflt.sys (Sony Ericsson Mobile Communications)
DRV - (CHORUS2) – C:\WINDOWS\system32\drivers\chorus2usb.sys (Windows ® Codename Longhorn DDK provider)
DRV - (seehcri) – C:\WINDOWS\system32\drivers\seehcri.sys (Sony Ericsson Mobile Communications)
DRV - (s3017unic) Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (WDM) – C:\WINDOWS\system32\drivers\s3017unic.sys (MCCI Corporation)
DRV - (s3017obex) – C:\WINDOWS\system32\drivers\s3017obex.sys (MCCI Corporation)
DRV - (s3017mgmt) Sony Ericsson Device 3017 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\system32\drivers\s3017mgmt.sys (MCCI Corporation)
DRV - (s3017nd5) Sony Ericsson Device 3017 USB Ethernet Emulation SEMC3017 (NDIS) – C:\WINDOWS\system32\drivers\s3017nd5.sys (MCCI Corporation)
DRV - (s3017mdm) – C:\WINDOWS\system32\drivers\s3017mdm.sys (MCCI Corporation)
DRV - (s3017mdfl) – C:\WINDOWS\system32\drivers\s3017mdfl.sys (MCCI Corporation)
DRV - (s3017bus) Sony Ericsson Device 3017 driver (WDM) – C:\WINDOWS\system32\drivers\s3017bus.sys (MCCI Corporation)
DRV - (s116unic) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM) – C:\WINDOWS\system32\drivers\s116unic.sys (MCCI Corporation)
DRV - (s116obex) – C:\WINDOWS\system32\drivers\s116obex.sys (MCCI Corporation)
DRV - (s116nd5) Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS) – C:\WINDOWS\system32\drivers\s116nd5.sys (MCCI Corporation)
DRV - (s116mgmt) Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM) – C:\WINDOWS\system32\drivers\s116mgmt.sys (MCCI Corporation)
DRV - (s116mdm) – C:\WINDOWS\system32\drivers\s116mdm.sys (MCCI Corporation)
DRV - (s116mdfl) – C:\WINDOWS\system32\drivers\s116mdfl.sys (MCCI Corporation)
DRV - (s116bus) Sony Ericsson Device 116 driver (WDM) – C:\WINDOWS\system32\drivers\s116bus.sys (MCCI Corporation)
DRV - (thdudf) – C:\WINDOWS\system32\drivers\thdudf.sys (TOSHIBA Corporation)
DRV - (NWADI) – C:\WINDOWS\system32\drivers\NWADIenum.sys (Novatel Wireless Inc)
DRV - (Ser2pl) – C:\WINDOWS\system32\drivers\ser2pl.sys (Prolific Technology Inc.)
DRV - (BANTExt) – C:\WINDOWS\System32\Drivers\BANTExt.sys ()
DRV - (b57w2k) – C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
DRV - (senfilt) – C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm…tf8&oe;=utf8
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406
IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011/05/31 08:53:08 | 000,000,000 | —D | M]

[2010/03/05 15:54:11 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

O1 HOSTS File: ([2004/08/04 06:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O2 - BHO: (IEHlprObj Class) - {CE7C3CF0-4B15-11D1-ABED-709549C10000} - c:\lotus\organize\iehelper.dll ()
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O4 - HKLM..\Run: [Conime] C:\WINDOWS\system32\conime.exe (Microsoft Corporation)
O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [EKIJ5000StatusMonitor] C:\WINDOWS\system32\spool\drivers\w32x86\3\EKIJ5000MUI.exe (Eastman Kodak Company)
O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset )
O4 - HKLM..\Run: [TkBellExe] C:\program files\real\realplayer\update\realsched.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [UpdateReminder] C:\Program Files\ESET\UpdateReminder.exe (ESET, spol. s r.o.)
O4 - HKCU..\Run: [AnyDVD] C:\Program Files\SlySoft\AnyDVD\AnyDVD.exe (SlySoft, Inc.)
O4 - Startup: C:\Documents and Settings\mel.grundy.OBDOMAIN\Start Menu\Programs\Startup\PhoneManager.lnk = C:\Program Files\Avaya\IP Office\Phone Manager\PhoneManager.exe (Avaya Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra Button: Web Entry - {B4E30F61-16D9-11D3-85D1-005004229569} - c:\lotus\organize\bandobjs.dll ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset )
O10 - Protocol_Catalog9\Catalog_Entries\000000000027 - C:\WINDOWS\System32\imon.dll (Eset )
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {6F6FDB9E-5072-498C-BCB0-2B7F00C49EE7} http://support.euro.dell.com/systemprofile…lSystemLite.CAB (DellSystemLite.Scanner)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {96816368-C1E3-414D-A193-63C3CC921990} http://lymeregis-thecobb.remotemanager.co….MJPEGRender.ocx (MJPEGRender Control)
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwa…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} https://secure.logmein.com/activex/ractrl.cab?lmi=100 (Performance Viewer Activex Control)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.21 192.168.0.22 192.168.0.250 192.168.0.248
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = obdomain.local
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O20 - AppInit_DLLs: (c:\progra~1\wi371a~1\datamngr\datamngr.dll) - c:\Program Files\Windows iLivid Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (c:\progra~1\wi371a~1\datamngr\iebho.dll) - c:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (e1.dll) - File not found
O20 - AppInit_DLLs: (slbrusrs.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LMIinit: DllName - LMIinit.dll - C:\WINDOWS\System32\LMIinit.dll (LogMeIn, Inc.)
O24 - Desktop WallPaper: C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/11 18:15:00 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O33 - MountPoints2\{391c54b2-5e98-11e0-93d6-00142250d90c}\Shell - "" = AutoRun
O33 - MountPoints2\{391c54b2-5e98-11e0-93d6-00142250d90c}\Shell\AutoRun - "" = Auto&Play;
O33 - MountPoints2\{391c54b2-5e98-11e0-93d6-00142250d90c}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Error starting restore point: System Restore is disabled.
Error closing restore point: System Restore is disabled.

========== Files/Folders - Created Within 30 Days ==========

[2011/06/17 13:46:29 | 000,580,608 | —- | C] (OldTimer Tools) – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\OTL.exe
[2011/06/17 11:17:58 | 000,000,000 | —D | C] – C:\WINDOWS\SxsCaPendDel
[2011/06/15 09:52:11 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Bandoo
[2011/06/10 10:35:30 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\Ilivid Player
[2011/06/10 10:35:00 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\AppData
[2011/06/10 10:34:59 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchquband
[2011/06/10 10:33:17 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\~0
[2011/06/10 10:32:31 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar
[2011/06/10 10:32:26 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar
[2011/06/10 10:31:55 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\PackageAware
[2011/06/10 09:16:38 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\iTunes
[2011/06/09 14:40:35 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\Media
[2011/06/09 12:38:29 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\Library
[2011/06/09 12:28:47 | 001,554,176 | —- | C] (Reincubate Ltd) – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\iPhoneBackupExtractor.exe
[2011/06/08 16:31:22 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\3403dc32b0ed14ebc8c5c318148215737efb3d32
[2011/06/08 16:31:17 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\c41a4308b3c903c5f8cace3469a638ca6833911b
[2011/06/07 16:59:58 | 000,000,000 | —D | C] – C:\Program Files\iTunes
[2011/05/31 08:53:11 | 000,000,000 | —D | C] – C:\Program Files\Common Files\xing shared
[2011/05/31 08:44:26 | 000,404,640 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/05/23 13:58:23 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Aiseesoft Studio
[2007/07/23 12:17:32 | 000,047,360 | —- | C] (VSO Software) – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\pcouffin.sys
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/06/17 13:50:13 | 000,000,296 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-4221445512-2907854145-1794415620-1139.job
[2011/06/17 13:50:13 | 000,000,288 | —- | M] () – C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-4221445512-2907854145-1794415620-1139.job
[2011/06/17 13:45:59 | 000,580,608 | —- | M] (OldTimer Tools) – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\OTL.exe
[2011/06/17 12:14:08 | 000,002,206 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2011/06/17 12:14:00 | 000,000,366 | —- | M] () – C:\WINDOWS\tasks\SLOW-PCfighter-mel.grundy-Startup.job
[2011/06/17 12:05:17 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2011/06/17 12:05:14 | 1071,788,032 | -HS- | M] () – C:\hiberfil.sys
[2011/06/17 12:04:03 | 000,000,012 | —- | M] () – C:\WINDOWS\bthservsdp.dat
[2011/06/17 12:00:25 | 000,000,008 | RHS- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\ntuser.pol
[2011/06/17 11:42:21 | 000,000,431 | —- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\Shortcut to Mel Personal.lnk
[2011/06/17 11:35:32 | 000,000,792 | —- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Microsoft Office Outlook.lnk
[2011/06/17 11:35:04 | 000,531,678 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2011/06/17 11:35:04 | 000,098,970 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2011/06/17 11:30:07 | 000,001,374 | —- | M] () – C:\WINDOWS\imsins.BAK
[2011/06/16 09:44:36 | 000,002,475 | —- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\HiJackThis.lnk
[2011/06/15 16:58:31 | 000,000,069 | —- | M] () – C:\WINDOWS\NeroDigital.ini
[2011/06/15 16:54:16 | 000,097,792 | —- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/06/14 16:49:02 | 000,000,284 | —- | M] () – C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/06/13 15:21:00 | 000,000,280 | —- | M] () – C:\WINDOWS\tasks\Uniblue SpeedUpMyPC Nag.job
[2011/06/13 09:23:21 | 000,404,640 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2011/06/10 09:16:39 | 000,001,542 | —- | M] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/08 15:25:39 | 000,588,710 | —- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\0b195b1d04f03ba5b423b4dd74cb28e2cd892b2b.mddata
[2011/05/31 08:52:59 | 000,198,848 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\rmoc3260.dll
[2011/05/31 08:52:49 | 000,006,656 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5016.dll
[2011/05/31 08:52:49 | 000,005,632 | —- | M] (RealNetworks, Inc.) – C:\WINDOWS\System32\pndx5032.dll
[2011/05/31 08:52:44 | 000,272,896 | —- | M] (Progressive Networks) – C:\WINDOWS\System32\pncrt.dll
[2011/05/30 23:19:48 | 005,964,800 | —- | M] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2011/05/24 16:19:51 | 000,000,903 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Virtual CloneDrive.lnk
[2011/05/24 14:11:11 | 000,000,083 | -HS- | M] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2011/05/24 11:59:45 | 000,000,852 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CloneDVD2.lnk
[2011/05/23 13:57:51 | 000,001,039 | —- | M] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\Aiseesoft Blu-ray Ripper.lnk
[2011/05/23 13:28:59 | 000,001,908 | —- | M] () – C:\WINDOWS\diagwrn.xml
[2011/05/23 13:28:59 | 000,001,908 | —- | M] () – C:\WINDOWS\diagerr.xml
[2011/05/20 10:03:09 | 000,000,754 | —- | M] () – C:\Documents and Settings\All Users\Desktop\AnyDVD.lnk
[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/06/17 11:22:21 | 000,001,374 | —- | C] () – C:\WINDOWS\imsins.BAK
[2011/06/10 09:16:39 | 000,001,542 | —- | C] () – C:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2011/06/09 12:04:29 | 000,588,710 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\0b195b1d04f03ba5b423b4dd74cb28e2cd892b2b.mddata
[2011/05/24 16:19:51 | 000,000,903 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Virtual CloneDrive.lnk
[2011/05/23 13:57:51 | 000,001,039 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\Aiseesoft Blu-ray Ripper.lnk
[2011/05/23 13:22:35 | 000,001,908 | —- | C] () – C:\WINDOWS\diagwrn.xml
[2011/05/23 13:22:35 | 000,001,908 | —- | C] () – C:\WINDOWS\diagerr.xml
[2011/05/13 12:42:28 | 000,087,552 | —- | C] () – C:\WINDOWS\System32\cpwmon2k.dll
[2011/01/25 10:51:56 | 000,004,096 | -H– | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\keyfile3.drm
[2010/12/10 18:48:21 | 000,000,104 | —- | C] () – C:\WINDOWS\System32\imon1.dat
[2010/10/21 12:23:57 | 000,015,424 | —- | C] () – C:\WINDOWS\System32\drivers\nod32drv.sys
[2010/01/25 12:58:06 | 000,462,848 | —- | C] () – C:\WINDOWS\System32\ractrlkeyhook.dll
[2009/11/20 14:23:51 | 000,593,920 | —- | C] () – C:\WINDOWS\System32\ati2sgag.exe
[2009/11/20 13:58:27 | 000,000,010 | —- | C] () – C:\WINDOWS\WININIT.INI
[2009/11/10 17:18:14 | 000,000,000 | —- | C] () – C:\WINDOWS\ativpsrm.bin
[2009/11/10 16:58:12 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2009/11/10 16:56:38 | 003,107,788 | R— | C] () – C:\WINDOWS\System32\ativvaxx.dat
[2009/10/29 16:18:21 | 000,000,365 | —- | C] () – C:\WINDOWS\lgfwup.ini
[2009/09/23 22:53:26 | 000,887,724 | —- | C] () – C:\WINDOWS\System32\ativva6x.dat
[2009/09/23 22:53:26 | 000,000,003 | —- | C] () – C:\WINDOWS\System32\ativva5x.dat
[2009/09/01 20:55:54 | 000,219,348 | —- | C] () – C:\WINDOWS\System32\atiicdxx.dat
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\WINDOWS\System32\OGAEXEC.exe
[2009/07/27 09:02:14 | 000,002,560 | —- | C] () – C:\WINDOWS\_MSRSTRT.EXE
[2009/05/19 14:35:28 | 000,000,100 | —- | C] () – C:\WINDOWS\cdplayer.ini
[2009/02/18 18:55:20 | 000,294,912 | —- | C] () – C:\WINDOWS\System32\ATIODE.exe
[2009/02/10 19:22:08 | 000,001,324 | —- | C] () – C:\WINDOWS\System32\d3d9caps.dat
[2009/02/03 21:52:02 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\ATIODCLI.exe
[2008/08/04 09:36:35 | 000,000,083 | -HS- | C] () – C:\Documents and Settings\All Users\Application Data\.zreglib
[2008/07/03 15:57:57 | 000,038,543 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Comma Separated Values (Windows).ADR
[2008/05/26 21:59:42 | 000,018,904 | —- | C] () – C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 21:59:40 | 000,106,605 | —- | C] () – C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/16 10:55:17 | 000,077,288 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2008/04/08 13:53:46 | 000,000,051 | —- | C] () – C:\WINDOWS\orion_loader.INI
[2008/04/08 13:53:41 | 000,000,035 | —- | C] () – C:\WINDOWS\orion_pcmcia.INI
[2008/02/26 16:00:46 | 000,000,012 | —- | C] () – C:\WINDOWS\bthservsdp.dat
[2007/11/13 18:45:48 | 000,000,069 | —- | C] () – C:\WINDOWS\NeroDigital.ini
[2007/09/27 10:51:02 | 000,020,698 | —- | C] () – C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 10:48:48 | 000,030,628 | —- | C] () – C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 10:48:28 | 000,031,698 | —- | C] () – C:\WINDOWS\System32\gthrctr.ini
[2007/07/23 12:17:32 | 000,087,608 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\inst.exe
[2007/07/23 12:17:32 | 000,007,887 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\pcouffin.cat
[2007/07/23 12:17:32 | 000,001,144 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\pcouffin.inf
[2007/06/25 14:49:50 | 000,003,840 | —- | C] () – C:\WINDOWS\System32\drivers\BANTExt.sys
[2006/11/07 11:21:50 | 000,000,016 | —- | C] () – C:\WINDOWS\msserrv32.dat
[2006/06/16 03:01:21 | 000,003,858 | —- | C] () – C:\WINDOWS\System32\MRT.INI
[2006/06/01 16:26:24 | 000,012,288 | —- | C] () – C:\WINDOWS\impborl.dll
[2006/05/12 17:29:49 | 000,097,792 | —- | C] () – C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/03/27 16:17:39 | 000,002,914 | —- | C] () – C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2006/03/22 16:03:15 | 000,000,019 | —- | C] () – C:\WINDOWS\SoundConverter.INI
[2006/03/13 15:23:11 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2006/01/24 18:46:30 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2006/01/24 18:29:58 | 000,049,152 | —- | C] () – C:\WINDOWS\setpwrcg.exe
[2006/01/24 18:29:50 | 000,000,401 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/11 18:24:19 | 000,000,791 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/11 18:19:30 | 000,002,048 | –S- | C] () – C:\WINDOWS\bootstat.dat
[2004/08/11 18:12:14 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2004/08/11 18:11:31 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/11 18:07:24 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2004/08/11 18:06:43 | 000,343,424 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/11 18:00:45 | 000,755,200 | —- | C] () – C:\WINDOWS\System32\ir50_32.dll
[2004/08/11 18:00:45 | 000,338,432 | —- | C] () – C:\WINDOWS\System32\ir41_qcx.dll
[2004/08/11 18:00:45 | 000,200,192 | —- | C] () – C:\WINDOWS\System32\ir50_qc.dll
[2004/08/11 18:00:45 | 000,183,808 | —- | C] () – C:\WINDOWS\System32\ir50_qcx.dll
[2004/08/11 18:00:45 | 000,120,320 | —- | C] () – C:\WINDOWS\System32\ir41_qc.dll
[2004/08/11 18:00:30 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/08/11 18:00:28 | 000,531,678 | —- | C] () – C:\WINDOWS\System32\perfh009.dat
[2004/08/11 18:00:28 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\perfi009.dat
[2004/08/11 18:00:28 | 000,098,970 | —- | C] () – C:\WINDOWS\System32\perfc009.dat
[2004/08/11 18:00:28 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\perfd009.dat
[2004/08/11 18:00:27 | 000,004,627 | —- | C] () – C:\WINDOWS\System32\oembios.dat
[2004/08/11 18:00:26 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\oembios.bin
[2004/08/11 18:00:24 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\noise.dat
[2004/08/11 18:00:19 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\mlang.dat
[2004/08/11 18:00:19 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\mib.bin
[2004/08/11 18:00:12 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\dssec.dat
[2004/08/11 18:00:04 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2004/04/08 16:46:56 | 000,000,059 | —- | C] () – C:\WINDOWS\System32\FTD2XXUN.ini
[2003/01/07 16:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[1998/01/13 17:57:36 | 000,047,104 | —- | C] () – C:\WINDOWS\System32\lotrn13.dll

========== LOP Check ==========

[2011/05/23 13:58:23 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Aiseesoft Studio
[2009/11/24 17:05:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ashampoo
[2006/11/06 13:31:33 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\CopyPod
[2009/10/15 16:49:07 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\DriverScanner
[2010/07/15 15:27:58 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Eastman Kodak Company
[2009/10/13 11:16:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
[2010/10/21 12:12:47 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\F-Secure
[2009/04/28 14:01:34 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\fssg
[2009/10/29 16:24:54 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LightScribe
[2011/06/17 08:57:41 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\LogMeIn
[2008/11/14 12:09:36 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Novatel Wireless
[2008/06/30 16:59:30 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\ODIR
[2009/11/24 17:26:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\page
[2009/05/19 15:47:10 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\PC Drivers HeadQuarters
[2011/02/23 17:45:18 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\S10 Software
[2008/08/04 09:36:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\SlySoft
[2008/07/15 10:27:08 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sony
[2009/04/24 17:47:17 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sophos
[2009/11/20 13:48:28 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2010/05/05 16:39:13 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Trusteer
[2011/04/14 12:02:57 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Xerox
[2010/04/01 11:39:11 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2009/09/10 13:45:29 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2009/05/11 18:11:53 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2011/06/17 12:05:12 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\~0
[2005/09/13 11:06:52 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Aladdin Systems
[2009/11/24 17:31:13 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Ashampoo
[2011/06/10 11:56:58 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Bandoo
[2009/11/02 14:10:05 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Blitware
[2009/03/18 13:09:50 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2006/11/06 13:33:55 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\CopyPodPhoto
[2010/03/05 15:49:07 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Dropbox
[2009/05/01 17:26:37 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\F-Secure
[2005/10/26 16:21:15 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\iPodSoft
[2007/06/18 13:40:04 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Leadertech
[2009/10/16 11:29:58 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\LimeWire
[2011/06/09 14:46:36 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\ntr
[2008/01/08 13:18:17 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Oberon Media
[2009/11/24 18:45:08 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Pavtube
[2011/02/23 17:45:18 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\S10 Software
[2011/06/10 10:34:59 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchquband
[2011/06/10 10:35:52 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar
[2011/03/30 13:00:54 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Serif
[2008/07/15 10:27:08 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Sony
[2009/06/23 14:02:33 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Sony Setup
[2009/07/17 10:54:31 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\SPAMfighter
[2011/01/21 17:55:20 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Spotify
[2011/04/14 16:00:46 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Temp
[2010/05/05 16:40:42 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Trusteer
[2008/02/29 16:26:21 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Uniblue
[2009/12/21 13:47:59 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\uTorrent
[2007/08/23 13:17:51 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Vso
[2010/10/21 11:36:58 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Windows Desktop Search
[2010/10/21 12:18:55 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Windows Search
[2011/04/14 12:03:04 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Xerox
[2010/08/15 04:58:00 | 000,000,456 | —- | M] () – C:\WINDOWS\Tasks\Driver Robot.job
[2011/06/17 12:14:00 | 000,000,366 | —- | M] () – C:\WINDOWS\Tasks\SLOW-PCfighter-mel.grundy-Startup.job
[2011/06/13 15:21:00 | 000,000,280 | —- | M] () – C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job
[2008/02/29 16:21:17 | 000,000,402 | —- | M] () – C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2005/10/31 16:56:00 | 000,700,416 | —- | M] (LimeWire) – C:\StubInstaller.exe

< MD5 for: AGP440.SYS >
[2004/08/04 06:00:00 | 018,738,937 | —- | M] () .cab file – C:\i386\sp2.cab:AGP440.sys
[2004/08/04 06:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
[2008/09/19 11:08:17 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
[2008/09/19 11:08:17 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
[2008/04/13 19:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\ServicePackFiles\i386\agp440.sys
[2008/04/13 19:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\dllcache\agp440.sys
[2008/04/13 19:36:38 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 – C:\WINDOWS\system32\drivers\agp440.sys
[2004/08/04 00:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\i386\AGP440.SYS
[2004/08/04 00:07:42 | 000,042,368 | —- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB – C:\WINDOWS\$NtServicePackUninstall$\agp440.sys

< MD5 for: ATAPI.SYS >
[2004/08/04 06:00:00 | 018,738,937 | —- | M] () .cab file – C:\i386\sp2.cab:atapi.sys
[2004/08/04 06:00:00 | 018,738,937 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
[2008/09/19 11:08:17 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
[2008/09/19 11:08:17 | 023,852,652 | —- | M] () .cab file – C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
[2008/04/13 19:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\ServicePackFiles\i386\atapi.sys
[2008/04/13 19:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\dllcache\atapi.sys
[2008/04/13 19:40:30 | 000,096,512 | —- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 – C:\WINDOWS\system32\drivers\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\i386\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0004\DriverFiles\i386\atapi.sys
[2004/08/03 23:59:44 | 000,095,360 | —- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 – C:\WINDOWS\system32\ReinstallBackups\0012\DriverFiles\i386\atapi.sys

< MD5 for: EVENTLOG.DLL >
[2008/04/14 01:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
[2008/04/14 01:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\dllcache\eventlog.dll
[2008/04/14 01:11:53 | 000,056,320 | —- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 – C:\WINDOWS\system32\eventlog.dll
[2004/08/04 06:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\i386\eventlog.dll
[2004/08/04 06:00:00 | 000,055,808 | —- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 – C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll

< MD5 for: NETLOGON.DLL >
[2008/04/14 01:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
[2008/04/14 01:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\dllcache\netlogon.dll
[2008/04/14 01:12:01 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 – C:\WINDOWS\system32\netlogon.dll
[2004/08/04 06:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\i386\netlogon.dll
[2004/08/04 06:00:00 | 000,407,040 | —- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A – C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll

< MD5 for: SCECLI.DLL >
[2004/08/04 06:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\i386\scecli.dll
[2004/08/04 06:00:00 | 000,180,224 | —- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A – C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
[2008/04/14 01:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\ServicePackFiles\i386\scecli.dll
[2008/04/14 01:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\dllcache\scecli.dll
[2008/04/14 01:12:05 | 000,181,248 | —- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 – C:\WINDOWS\system32\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[5 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >

< %systemroot%\System32\config\*.sav >
[2004/08/11 18:06:14 | 000,094,208 | —- | M] () – C:\WINDOWS\system32\config\default.sav
[2004/08/11 18:06:14 | 000,659,456 | —- | M] () – C:\WINDOWS\system32\config\software.sav
[2004/08/11 18:06:14 | 000,876,544 | —- | M] () – C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >
[2011/03/25 14:54:31 | 000,117,752 | —- | M] (SlySoft, Inc.) – C:\WINDOWS\system32\drivers\AnyDVD.sys
[2011/05/29 09:11:20 | 000,022,712 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbam.sys
[2011/05/29 09:11:30 | 000,039,984 | —- | M] (Malwarebytes Corporation) – C:\WINDOWS\system32\drivers\mbamswissarmy.sys
[2011/04/29 17:19:43 | 000,456,320 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mrxsmb.sys
[2011/04/21 14:37:43 | 000,105,472 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\drivers\mup.sys
[2011/04/28 14:34:50 | 000,053,816 | —- | M] (Trusteer Ltd.) – C:\WINDOWS\system32\drivers\RapportKELL.sys
[2011/05/10 08:06:08 | 000,042,496 | —- | M] (Apple, Inc.) – C:\WINDOWS\system32\drivers\usbaapl.sys

========== Alternate Data Streams ==========

@Alternate Data Stream - 24 bytes -> C:\WINDOWS:712155214E18D1D3
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:798A3728

< End of report >

OTL Extras logfile created on: 6/17/2011 13:52:19 - Run 1
OTL by OldTimer - Version 3.2.24.0 Folder = C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: M/d/yyyy

1022.07 Mb Total Physical Memory | 363.69 Mb Available Physical Memory | 35.58% Memory free
2.39 Gb Paging File | 1.92 Gb Available in Paging File | 80.20% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.44 Gb Total Space | 8.17 Gb Free Space | 10.98% Space Free | Partition Type: NTFS
Drive F: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive G: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive M: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive P: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive Q: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive S: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive T: | 1117.66 Gb Total Space | 10.94 Gb Free Space | 0.98% Space Free | Partition Type: NTFS
Drive V: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS
Drive X: | 107.42 Gb Total Space | 63.56 Gb Free Space | 59.16% Space Free | Partition Type: NTFS
Drive Y: | 107.42 Gb Total Space | 98.36 Gb Free Space | 91.57% Space Free | Partition Type: NTFS
Drive Z: | 537.07 Gb Total Space | 4.99 Gb Free Space | 0.93% Space Free | Partition Type: NTFS

Computer Name: MEL_GRUNDY | User Name: mel.grundy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = SafariHTML] – Reg Error: Key error. File not found

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
http [open] – "C:\Program Files\Safari\Safari.exe" -url "%1"
https [open] – "C:\Program Files\Safari\Safari.exe" -url "%1"
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications]
"Enabled" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\AuthorizedApplications\List]
"%programfiles%\Macromedia\Contribute 3:localsubnet:enabled:contribute" = %programfiles%\Macromedia\Contribute 3:localsubnet:enabled:contribute
"%programfiles%\Macromedia\Contribute 3\Contribute.exe:localsubnet:enabled:contribute" = %programfiles%\Macromedia\Contribute 3\Contribute.exe:localsubnet:enabled:contribute
"%programfiles%\Sophos\Remote Management System\RouterNT.exe:localsubnet:enabled:Sophos Required Exclusion" = %programfiles%\Sophos\Remote Management System\RouterNT.exe:localsubnet:enabled:Sophos Required Exclusion

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile\Services\FileAndPrint]
"Enabled" = 1
"RemoteAddresses" = localsubnet

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications]
"Enabled" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile\AuthorizedApplications\List]
"%programfiles%\Sophos\Remote Management System\RouterNT.exe:localsubnet:enabled:Sophos Required Exclusion" = %programfiles%\Sophos\Remote Management System\RouterNT.exe:localsubnet:enabled:Sophos Required Exclusion

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
"5353:UDP" = 5353:UDP:*:Enabled:Bonjour Port 5353
"5985:TCP" = 5985:TCP:*:Disabled:Windows Remote Management
"80:TCP" = 80:TCP:*:Disabled:Windows Remote Management - Compatibility Mode (HTTP-In)
"9322:TCP" = 9322:TCP:*:Enabled:EKDiscovery

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Avaya\IP Office\Phone Manager\PhoneManager.exe" = C:\Program Files\Avaya\IP Office\Phone Manager\PhoneManager.exe:*:Disabled:Phone Manager Pro Application – (Avaya Inc.)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer – (LimeWire)
"C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Dropbox\bin\Dropbox.exe" = C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Dropbox\bin\Dropbox.exe:*:Enabled:Dropbox
"\\ob-dc2\choon\spotify.exe" = \\ob-dc2\choon\spotify.exe:*:Enabled:Spotify
"C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Temporary Internet Files\Content.IE5\34ABTHDR\Spotify%20Installer[1].exe" = C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Temporary Internet Files\Content.IE5\34ABTHDR\Spotify%20Installer[1].exe:*:Enabled:Spotify
"C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe" = C:\Program Files\Kodak\AiO\Center\AiOHomeCenter.exe:*:Enabled:Kodak.AiO.HomeCenter – (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe" = C:\Program Files\Kodak\AiO\Center\Kodak.Statistics.exe:*:Enabled:Kodak.AiO.Statistics – (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe" = C:\Program Files\Kodak\AiO\Center\NetworkPrinterDiscovery.exe:*:Enabled:Kodak.AiO.SetupUtility – (Eastman Kodak Company)
"C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe" = C:\Program Files\Kodak\AiO\Firmware\KodakAiOUpdater.exe:*:Enabled:Kodak.AiO.FwUpdater – (Eastman Kodak Company)
"C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe" = C:\Documents and Settings\All Users\Application Data\Kodak\Installer\Setup.exe:*:Enabled:Kodak.AiO.Installer – (Eastman Kodak Company)
"C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe" = C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe:*:Enabled:DTX broker – (Visicom Media Inc.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Avaya\IP Office\Phone Manager\PhoneManager.exe" = C:\Program Files\Avaya\IP Office\Phone Manager\PhoneManager.exe:*:Enabled:Phone Manager Pro Application – (Avaya Inc.)
"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Enabled:LimeWire swarmed installer – (LimeWire)
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Enabled:LimeWire – (Lime Wire, LLC)
"C:\Program Files\Sophos\Remote Management System\RouterNT.exe" = C:\Program Files\Sophos\Remote Management System\RouterNT.exe:*:Enabled:RouterNT

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center
"{05EF81B7-8BD4-FE4B-F270-5261A1642825}" = Catalyst Control Center Graphics Full New
"{0645A454-AD44-4F0D-99CF-6B762735AD1F}" = aioprnt
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{10934A28-0CC6-4B98-A14F-76B3546003AF}" = ksDIP
"{14AE051F-067D-4704-A65C-704120572842}" = S10 RedEyes 3.2
"{178832DE-9DE0-4C87-9F82-9315A9B03985}" = Windows Live Writer
"{1BD07DF4-FB06-41BA-B896-B2DA59000C96}" = Windows Live Toolbar
"{1C81CE5C-392B-4841-B302-BE37452D1C20}" = RoadAngel USB
"{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}" = Rapport
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"{20D9E71A-F736-494E-873B-4DD644894A97}" = IP Office User Suite
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{22D90DD2-8654-4E8A-B2F1-B6B86A2BF390}" = CyberLink UDF Reader 5.0
"{2519B5EE-F78D-5C29-7C4F-C5990A3F238C}" = Catalyst Control Center Graphics Full Existing
"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java™ 6 Update 18
"{278F4C5A-F506-9A2E-E6E9-33CCF2E19431}" = CCC Help English
"{27EF8E7F-88D1-4ec5-ADE2-7E447FDF114E}" = Kodak AIO Printer
"{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1
"{29F1345E-4DD7-487E-80E9-9E43A3ABC253}" = ASUS VGA Driver
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6
"{3248F0A8-6813-11D6-A77B-00B0D0150080}" = J2SE Runtime Environment 5.0 Update 8
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{3248F0A8-6813-11D6-A77B-00B0D0150100}" = J2SE Runtime Environment 5.0 Update 10
"{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java™ SE Runtime Environment 6 Update 1
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java™ 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java™ 6 Update 3
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java™ 6 Update 5
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{341201D4-4F61-4ADB-987E-9CCE4D83A58D}" = Windows Live Toolbar Extension (Windows Live Toolbar)
"{350C8109-F3BE-132E-A8BE-7E009307C82D}" = Catalyst Control Center Core Implementation
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{407B9B5C-DAC5-4F44-A756-B57CAB4E6A8B}" = Google Earth
"{4475560E-9418-4908-A158-472D873AE139}" = LogMeIn
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{48B41C3A-9A92-4B81-B653-C97FEB85C910}" = C4USelfUpdater
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56BA241F-580C-43D2-8403-947241AAE633}" = center
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5D2CF9D0-113A-476B-986F-288B54571614}" = DevalVR plugin for Internet Explorer (remove)
"{5E29596E-CF90-8E17-8787-B3D1187D86F5}" = Catalyst Control Center Graphics Previews Common
"{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG Tool Kit
"{629BA0F6-5086-7BC6-ECA8-672D43BD8700}" = ccc-utility
"{62BFB4C2-8C4E-4D91-BD7D-81C06EAAC3C0}" = Windows Rights Management Client with Service Pack 2
"{62D09678-2986-576C-6705-B38696DFFEE9}" = ccc-core-static
"{6412CECE-8172-4BE5-935B-6CECACD2CA87}" = Windows Live Mail
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7745B7A9-F323-4BB9-9811-01BF57A028DA}" = Map Button (Windows Live Toolbar)
"{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime
"{786C4AD1-DCBA-49A6-B0EF-B317A344BD66}" = Windows Live Favorites for Windows Live Toolbar
"{7E6066E6-8B5B-4100-B0FA-1D9E9B663CBA}" = iTunes
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8E5233E1-7495-44FB-8DEB-4BE906D59619}" = Junk Mail filter update
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95120000-0122-0409-0000-0000000FF1CE}" = Microsoft Office Outlook Connector
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C9CEB9D-53FD-49A7-85D2-FE674F72F24E}" = Microsoft Search Enhancement Pack
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A5C4AD72-25FE-4899-B6DF-6D8DF63C93CF}" = Highlight Viewer (Windows Live Toolbar)
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.5
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{B10914FD-8812-47A4-85A1-50FCDE7F1F33}" = Windows Live Sync
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B3575D00-27EF-49C2-B9E0-14B3D954E992}" = Apple Application Support
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B944FA21-81AF-4A77-8328-CE4F4CC51033}" = Nero 8
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BE94C681-68E2-4561-8ABC-8D2E799168B4}" = essentials
"{BFBCF96F-7361-486A-965C-54B17AC35421}" = ocr
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C23CD6DA-1958-43A5-ADD0-59396572E02E}" = Apple Mobile Device Support
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{CADE0A0E-BE88-28D9-5A87-32924A2724C2}" = Catalyst Control Center Graphics Light
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D842AD6B-D020-1B3A-682E-BC01B063D5B8}" = Catalyst Control Center HydraVision Full
"{D92FF8EB-BD77-40AE-B68B-A6BFC6F8661D}" = Windows Live Family Safety
"{DA5BDB2A-12F0-4343-8351-21AAEB293990}" = PreReq
"{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1
"{E0F274B7-592B-4669-8FB8-8D9825A09858}" = KODAK AiO Software
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EC905264-BCFE-423B-9C42-C3A106266790}" = Windows Rights Management Client Backwards Compatibility SP2
"{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
"{EE39FFBD-544E-49E4-A999-6819828EAE91}" = Windows Live Photo Gallery
"{F084395C-40FB-4DB3-981C-B51E74E1E83D}" = Smart Menus (Windows Live Toolbar)
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5
"{F7875264-810A-4ABB-B185-2C5A332E483B}" = F-Secure PSC Prerequisites
"{F85A5298-800C-C16F-787A-900083B0B813}" = ccc-core-preinstall
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FE24086F-3B0C-4C47-A874-97A7B8E2FBBE}" = aioscnnr
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Aiseesoft Blu-ray Ripper_is1" = Aiseesoft Blu-ray Ripper
"Aiseesoft iPad Video Converter_is1" = Aiseesoft iPad Video Converter
"All ATI Software" = ATI - Software Uninstall Utility
"AnyDVD" = AnyDVD
"Belarc Advisor 2.0" = Belarc Advisor 7.2
"Boo-Ree Chorus-II USB Driver 1.10 WHQL Certified" = Boo-Ree Chorus-II USB Driver 1.10 WHQL Certified
"CCleaner" = CCleaner
"CloneDVD2" = CloneDVD2
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Formula (ver NH1.01)" = Formula (ver NH1.01)
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"InstallShield_{2070F79D-46BC-4EEA-8F02-9B4DCABAE7CB}" = iPod for Windows 2006-03-23
"Keeper Desktop" = Keeper Desktop
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.0.1200
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"MSNINST" = MSN
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NOD32" = NOD32 antivirus system
"ODIR_is1" = ODIR
"Organizer V99.1" = Lotus Organizer 6.0
"Rapport_msi" = Rapport
"RealPlayer 12.0" = RealPlayer
"Searchqu 406 MediaBar" = Windows iLivid Toolbar
"Talex Updater 2_is1" = Talex Updater 2.0
"VirtualCloneDrive" = VirtualCloneDrive
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"WDN4OAK+" = WDN4OAK+
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Untangle Server @ 192.168.0.254" = Untangle Server @ 192.168.0.254

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 6/17/2011 04:26:48 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1747141

Error - 6/17/2011 04:26:48 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1747141

Error - 6/17/2011 04:26:50 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/17/2011 04:26:50 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1749453

Error - 6/17/2011 04:26:50 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1749453

Error - 6/17/2011 04:26:52 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: Continuously busy for more than a second

Error - 6/17/2011 04:26:52 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledEvent 1751828

Error - 6/17/2011 04:26:52 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 1751828

Error - 6/17/2011 06:09:59 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Received from 192.168.0.126:5353 20 [removed].in-addr.arpa.
PTR mel-grundy-2.local.

Error - 6/17/2011 06:09:59 | Computer Name = MEL_GRUNDY | Source = Bonjour Service | ID = 100
Description = mDNSCoreReceiveResponse: Unexpected conflict discarding 18 [removed].in-addr.arpa.
PTR mel-grundy.local.

[ System Events ]
Error - 6/16/2011 08:57:35 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/16/2011 06:21:47 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/16/2011 06:21:47 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/17/2011 04:26:59 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/17/2011 04:26:59 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/17/2011 06:32:19 | Computer Name = MEL_GRUNDY | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Security Update for Microsoft Visual C++ 2008 Service Pack
1 Redistributable Package (KB2538243).

Error - 6/17/2011 06:42:21 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/17/2011 06:42:21 | Computer Name = MEL_GRUNDY | Source = EventLog | ID = 6004
Description = A driver packet received from the I/O subsystem was invalid. The
data is the packet.

Error - 6/17/2011 08:53:21 | Computer Name = MEL_GRUNDY | Source = SRService | ID = 104
Description = The System Restore initialization process failed.

Error - 6/17/2011 08:53:21 | Computer Name = MEL_GRUNDY | Source = Service Control Manager | ID = 7023
Description = The System Restore Service service terminated with the following error:
%%2

< End of report >

Lord skywalker

Post #4June 17, 2011, 1:34 PM UTC

aswMBR version 0.9.6.399 Copyright© 2011 AVAST Software Run date: 2011-06-17 14:31:33 —————————– 14:31:33.651 OS Version: Windows 5.1.2600 Service Pack 3 14:31:33.651 Number of processors: 2 586 0x403 14:31:33.651 ComputerName: MEL_GRUNDY UserName: mel.grundy 14:31:37.885 Initialize success 14:32:02.684 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 14:32:02.684 Disk 0 Vendor: WDC_WD800JD-75MSA1 10.01E01 Size: 76293MB BusType: 3 14:32:04.715 Disk 0 MBR read successfully 14:32:04.715 Disk 0 MBR scan 14:32:04.715 Disk 0 Windows XP default MBR code 14:32:06.715 Disk 0 scanning sectors +156232125 14:32:06.731 Disk 0 scanning C:\WINDOWS\system32\drivers 14:32:21.263 Service scanning 14:32:22.653 Disk 0 trace - called modules: 14:32:22.669 ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll pciide.sys PCIIDEX.SYS 14:32:22.669 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87366ab8] 14:32:22.669 3 CLASSPNP.SYS[f7652fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-4[0x8732dd98] 14:32:22.669 Scan finished successfully 14:35:45.633 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\MBR.dat" 14:35:45.633 The log file has been saved successfully to "C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\aswMBR.txt"

Satchfan

Post #5June 17, 2011, 3:59 PM UTC

Hello again Lord skywalker

P2P - I see you have P2P software, (uTorrent, LimeWire), installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infection. If your computer is infected, it almost certainly contributed to your current situation.

Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are more often than not, infected. The bad guys use P2P file-sharing as a major conduit to spread their wares.

Please see this topic for more information:

Perils of P2P File Sharing.

I would strongly recommend that you uninstall it now. You can do so via Control Panel, Programs, and then Programs and Features.

Should you decide to keep it, please don’t use it until we have finished up here.

===================================================

OK, let’s get rid of this mess.• Hold down the Windows key and press R to open a run box
• type the following text into the run box

appwiz.cpl
• This will open your Programs And Features
• A list of installed programs will appear
• Remove the following programs if they are there:

Searchqu 406 MediaBar
Anything with iLivid
Anything with Bandoo
===================================================

Run OTL

Double click on the icon to run it.
Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Services :OTL PRC - C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc) SRV - (B-Service) – File not found IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.searchqu.com/406 IE - HKCU\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - Reg Error: Key error. File not found - O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (UrlHelper Class) - {A40DC6C5-79D0-4ca8-A185-8FF989AF1115} - C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc) O3 - HKCU\..\Toolbar\ShellBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No CLSID value found O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc) O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6…922/wmv9VCM.CAB (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Reg Error: Key error.) O20 - AppInit_DLLs: (e1.dll) - File not found O20 - AppInit_DLLs: (slbrusrs.dll) - File not found [2011/06/10 10:32:31 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar [2011/06/10 10:32:26 | 000,000,000 | —D | C] – C:\Program Files\Windows iLivid Toolbar [2011/06/10 10:34:59 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchquband [2011/06/10 10:35:30 | 000,000,000 | —D | C] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\Ilivid Player [2011/06/10 11:56:58 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Bandoo [2011/06/10 10:34:59 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchquband [2011/06/10 10:35:52 | 000,000,000 | —D | M] – C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar @Alternate Data Stream - 24 bytes -> C:\WINDOWS:712155214E18D1D3 @Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:798A3728 :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" =dword:00000000 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe" =- :Files ipconfig /flushdns /c :Commands [resethosts] [emptyflash] [purity] [emptytemp] [Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
===================================================

Run Malwarebytes’ Anti-Malware

I noticed that you had MBAM on your system: if you no longer have it, you can download it from here:
start Malwarebytes-Anti-Malware and update it, (“Update” tab}
once it is updated, click on “Scanner” tab, select Perform quick scan, then click Scan.
when the scan is complete, click OK, then Show Results to view the results.
be sure that everything is checked, and click Remove Selected.
when removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
the log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
copy and paste the contents of that report in your next reply and exit MBAM.
NOTE: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

Logs to include with next post:

OTL fix log
New OTL log
Mbam.txt

Please tell me how your computer is running once this is done.

Thanks

Satchfan

Satchfan

Post #6June 21, 2011, 7:05 AM UTC

Hello Lord skywalker It has been several days since I sent a reply with instructions to help with your computer problem. Please let me know if you are having problems and still need help. Thanks Satchfan

Lord skywalker

Post #7June 21, 2011, 4:08 PM UTC

Hi Satchfan, sorry for the delay but have been in meetings etc.

here are my latest logs. Thanks for this you are great.

All processes killed
========== SERVICES/DRIVERS ==========
========== OTL ==========
No active process named datamngrUI.exe was found!
Service B-Service stopped successfully!
Service B-Service deleted successfully!
File File not found not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{99079a25-328f-4bd4-be04-00955acaa0a7} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\10 deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{99079a25-328f-4bd4-be04-00955acaa0a7}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99079a25-328f-4bd4-be04-00955acaa0a7}\ not found.
File C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\searchqudtx.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A40DC6C5-79D0-4ca8-A185-8FF989AF1115}\ deleted successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\IEBHO.dll moved successfully.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DATAMNGR deleted successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\datamngrUI.exe moved successfully.
Starting removal of ActiveX control {33564D57-0000-0010-8000-00AA00389B71}
C:\WINDOWS\Downloaded Program Files\WMV9VCM.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{33564D57-0000-0010-8000-00AA00389B71}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{33564D57-0000-0010-8000-00AA00389B71}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0008-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0010-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:e1.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:slbrusrs.dll deleted successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar\weather folder moved successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar\coupons folder moved successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\components folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\searchbar folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\options folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\panels folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton\icons folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\weatherbutton folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\uwa folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\radio folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\scripts folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\default folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib\panels folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin\lib folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\skin folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.PPCBully folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\scripts folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\skin folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\js folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.MyStartFacebook folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\scripts folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\skin folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\js folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\images folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2\css folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\net.vmn.www.Coupons_v2 folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\com.djboxservice.dj.DJBox\thumbs folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets\com.djboxservice.dj.DJBox folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\widgets folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\modules folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\lib folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\data\search folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content\data folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome\content folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\chrome folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar folder moved successfully.
C:\Program Files\Windows iLivid Toolbar\Datamngr folder moved successfully.
C:\Program Files\Windows iLivid Toolbar folder moved successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchquband folder moved successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Application Data\Ilivid Player folder moved successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\Bandoo folder moved successfully.
Folder C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchquband\ not found.
Folder C:\Documents and Settings\mel.grundy.OBDOMAIN\Application Data\searchqutoolbar\ not found.
ADS C:\WINDOWS:712155214E18D1D3 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:798A3728 deleted successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr\\"Start" |dword:00000000 /E : value set successfully!
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List\\C:\Program Files\Windows iLivid Toolbar\Datamngr\ToolBar\dtUser.exe deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\mel.grundy.OBDOMAIN\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYFLASH]

User: Administrator

User: administrator.OAKBASE
->Flash cache emptied: 495 bytes

User: Administrator.OBDOMAIN
->Flash cache emptied: 405 bytes

User: All Users

User: Default User

User: eddie.phillips

User: eddie.phillips.OBDOMAIN
->Flash cache emptied: 2385 bytes

User: julie.hewertson
->Flash cache emptied: 2163997 bytes

User: LocalService

User: meetings

User: mel.grundy
->Flash cache emptied: 2864 bytes

User: mel.grundy.OBDOMAIN
->Flash cache emptied: 61943 bytes

User: NetworkService

User: Paul

Total Flash Files Cleaned = 2.00 mb

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 1062276 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: administrator.OAKBASE
->Temp folder emptied: 973766 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: Administrator.OBDOMAIN
->Temp folder emptied: 9699194 bytes
->Temporary Internet Files folder emptied: 43243261 bytes
->Java cache emptied: 13689588 bytes
->Apple Safari cache emptied: 9490432 bytes
->Flash cache emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: eddie.phillips
->Temp folder emptied: 143 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: eddie.phillips.OBDOMAIN
->Temp folder emptied: 50173 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: julie.hewertson
->Temp folder emptied: 49632 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 15274008 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: meetings
->Temp folder emptied: 2631 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: mel.grundy
->Temp folder emptied: 1806444 bytes
->Temporary Internet Files folder emptied: 385528475 bytes
->Java cache emptied: 673037 bytes
->Flash cache emptied: 0 bytes

User: mel.grundy.OBDOMAIN
->Temp folder emptied: 83111641 bytes
->Temporary Internet Files folder emptied: 321464053 bytes
->Java cache emptied: 248753 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 807365865 bytes

User: Paul
->Temp folder emptied: 1306346 bytes
->Temporary Internet Files folder emptied: 32902 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 867101 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 62675394 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 174191242 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 44225 bytes

Total Files Cleaned = 1,844.00 mb

OTL by OldTimer - Version 3.2.24.0 log created on 06212011_162729

Files\Folders moved on Reboot…
C:\Documents and Settings\mel.grundy.OBDOMAIN\Local Settings\Temp\ExchangePerflog_8484fa318ab3db5ecfcccd43.dat moved successfully.

Registry entries deleted on Reboot…

Lord skywalker

Post #8June 21, 2011, 4:09 PM UTC

here is MBAM log Malwarebytes' Anti-Malware 1.51.0.1200 www.malwarebytes.org Database version: 6910 Windows 5.1.2600 Service Pack 3 Internet Explorer 8.0.6001.18702 6/21/2011 16:59:12 mbam-log-2011-06-21 (16-59-12).txt Scan type: Quick scan Objects scanned: 273710 Time elapsed: 6 minute(s), 47 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

Satchfan

Post #9June 21, 2011, 9:25 PM UTC last edited June 21, 2011, 9:25 PM UTC

Hi Lord skywalker How is your computer running now - are there any remaining problems or symptoms that you had previously?

Lord skywalker

Post #10June 22, 2011, 9:08 AM UTC

Hi Satchfan, The homepage searchqu/406 has Gone Yipppeee…

you are a legend thank you so much

Satchfan

Post #11June 22, 2011, 12:56 PM UTC

Hi lord skywalker

That’s good news

I think we’ll run an online scan before tidying up just to check for any stragglers.

Run ESET Online Scan

Hold down Control and click on the following link to open ESET OnlineScan in a new window.

ESET OnlineScan 1. Click the Eset online Scanner button.
2. For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

• Click on esetinstaller.exe to download the ESET Smart Installer. Save it to your desktop.
• Double click on the Eset installer icon on your desktop.

3. Check Yes, I accept the Terms of Use
4. Click the Start button.
5. Accept any security warnings from your browser.
6. Check Scan archives
7. Push the Start button.
8. ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
9. When the scan completes, push List of found threats
10. Push Export to Text file and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Note - when ESET doesn't find any threats, no report will be created.
11. Push the back button.
12. Push Finish
If a log has been produced post it in your next reply.

Satchfan

Lord skywalker

Post #12June 23, 2011, 8:25 AM UTC

Hi Satchfan, Here is my Log from the Eset online scan C:\Documents and Settings\mel.grundy.OBDOMAIN\cdrive\transfer docs\stuff\desktop\DVDXCopy.v1.5.0.WinALL.KeyGen.exe probably a variant of Win32/Keygen.BH application deleted - quarantined I hope this helps.

Satchfan

Post #13June 23, 2011, 8:34 AM UTC

That's good

One last thing before we clean up the tools we've used and secure your system

Run Security Check

Download Security Check by screen317 from here or here.

Save it to your Desktop.
Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

Satchfan

Lord skywalker

Post #14June 23, 2011, 9:34 AM UTC

Satchfan, here are my results

Results of screen317's Security Check version 0.99.15
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Disabled!
NOD32 antivirus system
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CCleaner
Java™ 6 Update 18
Java™ SE Runtime Environment 6 Update 1
Java™ 6 Update 2
Java™ 6 Update 3
Java™ 6 Update 5
Java™ 6 Update 7
Java 2 Runtime Environment, SE v1.4.2_03
Out of date Java installed!
Flash Player Out of Date!
Adobe Flash Player 10.0.32.18
````````````````````````````````
Process Check:
objlist.exe by Laurent
Eset nod32krn.exe
Eset nod32kui.exe
``````````End of Log````````````

Satchfan

Post #15June 23, 2011, 9:46 AM UTC

Good work lordskywalker

Your computer appears to be clean.

Now that you’re free from malware, as long as your computer seems to be running well, please follow these simple steps to tidy up you computer and decrease the likelihood of getting infected again:

Uninstall OTL
• Double-click OTL.exe
• Click the CleanUp! button.
• Select Yes when the Begin cleanup Process? prompt appears.
• If you are prompted to reboot during the cleanup, select Yes.
• The tool will delete itself once it finishes, if not delete it by yourself.
NOTE: If you receive a warning from your firewall or other security programs regarding OTL attempting to contact the internet, please allow it to do so.

===================================================

Create a Restore Point
• Click Start Menu, Run
• Copy and paste the following:

%SystemRoot%\System32\restore\rstrui.exe

• Press OK
• Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create
• When the confirmation screen shows that the restore point has been created, click Close.
Remove old restore points• Go to Start, Programs, Accessories, System tools, Disk Cleanup
• When the Disc Cleanup dialog box appears, click OK
• When it finishes running, a box with tabs will appear, select the ”More options” tab
• On this tab you will find a section for System Restore
• If you press the Clean Up button for that section, Windows will delete all restore points except for the most recent one.
===================================================

Update installed programs

Your version of Flash Player is out-of-date and the Flash player included with SP3 is also old.

Go here and download the latest version.

NEXT

[external image: Posted Image]
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment (JRE) 26 and save it to your desktop.
Scroll down to where it says JDK 6 Update 26 (JDK or JRE)
Click the Download JRE button to the right
Select the Windows platform from the dropdown menu.
Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6u26 with JavaFX 1 License Agreement". Click on Continue. The page will refresh.
Click on the link to download Windows Offline Installation and save the file to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel, double-click on Add or Remove Programs and remove all older versions of Java.
Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java™ 6) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.

After the install is complete, go into the Control Panel (using Classic View) and double-click the Java Icon. (looks like a coffee cup)
- On the General tab, under Temporary Internet Files, click the Settings button.
- Next, click on the Delete Files button
- There are two options in the window to clear the cache - Leave BOTH CheckedApplications and Applets
  Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Window
Click OK to leave the Java Control Panel.

===================================================

Firewall

I see no evidence of a firewall. I suggest you get one in place now. I can’t stress how important it is that you use a firewall on your computer. This is one of the ways computers are open to Malware. Without a firewall, your computer is susceptible to being attacked again. Windows XP firewall is not adequate protection.

If you have a router with firewall features that’s fine – if not, I suggest you do the following:

Download one of the following firewalls:

ZoneAlarm
Sunbelt Personal Firewall

NOTE only install one firewall. Having more than one could cause many programs to stop working altogether. Also, the firewalls may get in each others' way and cause some security holes that would not be there with just one firewall.

For a tutorial on Firewalls and a listing of some other available ones see Understanding and Using Firewalls

===================================================

Recommended programs

SpywareBlaster. SpywareBlaster protects against bad ActiveX, it immunizes your PC against them. It blocks over 11,000 bad sites and uses no resources of your computer.

===================================================

Update and run Malwarebytes. This really is an excellent program that you should update and run on a regular basis, probably weekly.

===================================================

It’s important to keep programs up to date so that malware doesn't exploit any old security flaws.

FileHippo Update Checker is an extremely helpful program that will tell you which of your programs need to be updated.

===================================================

I also recommend that you read the following:

How to prevent malware by miekiemoes

Safe computing

Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Searchqu/406

✨ Ask AI

Ask AI