What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Repost: Blue Screen computer crash

5 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Please reopen my previous post that was suddenly closed by Satchfan. Satchfan closed the thread as they assumed another member Blottedisk was helping me. I have 2 different computers that needed fixing. Blottedisk was helping to resolve the issues on my DESKtop computer which was running very slowly. It has been cleared and they advised me to post in windows forum for further help Satchfan was in the process of helping resolve issues on my LAPtop computer which has blue screen issues on logon. I still need help with the LAPtop blue screen issues…..so could this previous thread please "Blue Screen computer crash" please be reopened and someone please assist me in seeing if this is virus/spyware/malware issue. Thanks.
Post #2
Hi Thoran My apologies for the misunderstanding :unsure: Please give me an update on the situation with the computer that you require help with. Satchfan
Post #3
Hello, I almost always get the blue screen when I turn on my Laptop computer. Usual message is that an error occured and windows shut down to prevent damage. It usually says "Unmountable boot volume". Earlier this week I got the error message that said. Problem seems to be caused by following file: Partmgr.sys Page_fault_in_nonpaged_area." In my other thread I had posted the hijack this log. I ran the MBR and OTL scans suggested but did not get a log titled "extras.txt" Here is the MBR log. I'll post the OTL log in the next reply. MBRCheck, version 1.2.3 © 2010, AD Command-line: Windows Version: Windows XP Home Edition Windows Information: Service Pack 3 (build 2600) Logical Drives Mask: 0x0000000c Kernel Drivers (total 125): 0x804D7000 \WINDOWS\system32\ntoskrnl.exe 0x806EE000 \WINDOWS\system32\hal.dll 0xF7B63000 \WINDOWS\system32\KDCOM.DLL 0xF7A73000 \WINDOWS\system32\BOOTVID.dll 0xF7614000 ACPI.sys 0xF7B65000 \WINDOWS\System32\DRIVERS\WMILIB.SYS 0xF7603000 pci.sys 0xF7663000 isapnp.sys 0xF7A77000 compbatt.sys 0xF7A7B000 \WINDOWS\System32\DRIVERS\BATTC.SYS 0xF7C2B000 pciide.sys 0xF78E3000 \WINDOWS\System32\DRIVERS\PCIIDEX.SYS 0xF7B67000 intelide.sys 0xF75E5000 pcmcia.sys 0xF7673000 MountMgr.sys 0xF75C6000 ftdisk.sys 0xF78EB000 PartMgr.sys 0xF7683000 VolSnap.sys 0xF75AE000 atapi.sys 0xF7693000 disk.sys 0xF76A3000 \WINDOWS\System32\DRIVERS\CLASSPNP.SYS 0xF758E000 fltmgr.sys 0xF757C000 sr.sys 0xF7565000 KSecDD.sys 0xF74D8000 Ntfs.sys 0xF74AB000 NDIS.sys 0xF7491000 Mup.sys 0xF78F3000 avgrkx86.sys 0xF7A7F000 AVGIDSEH.Sys 0xF7853000 \SystemRoot\System32\DRIVERS\intelppm.sys 0xF7B3F000 \SystemRoot\System32\DRIVERS\CmBatt.sys 0xF7421000 \SystemRoot\System32\DRIVERS\ialmnt5.sys 0xF740D000 \SystemRoot\System32\DRIVERS\VIDEOPRT.SYS 0xF79A3000 \SystemRoot\System32\DRIVERS\usbuhci.sys 0xF73E9000 \SystemRoot\System32\DRIVERS\USBPORT.SYS 0xF79AB000 \SystemRoot\System32\DRIVERS\usbehci.sys 0xF7863000 \SystemRoot\System32\DRIVERS\bcm4sbxp.sys 0xF739C000 \SystemRoot\System32\DRIVERS\bcmwl5.sys 0xF7873000 \SystemRoot\System32\DRIVERS\i8042prt.sys 0xF735A000 \SystemRoot\System32\DRIVERS\SynTP.sys 0xF7B99000 \SystemRoot\System32\DRIVERS\USBD.SYS 0xF79B3000 \SystemRoot\System32\DRIVERS\mouclass.sys 0xF79BB000 \SystemRoot\System32\DRIVERS\kbdclass.sys 0xF7883000 \SystemRoot\System32\Drivers\AFS2K.SYS 0xF79C3000 \SystemRoot\System32\Drivers\MxlW2k.SYS 0xF7893000 \SystemRoot\System32\DRIVERS\cdrom.sys 0xF78A3000 \SystemRoot\System32\DRIVERS\redbook.sys 0xF7337000 \SystemRoot\System32\DRIVERS\ks.sys 0xF72FA000 \SystemRoot\system32\drivers\stac97.sys 0xF72D6000 \SystemRoot\system32\drivers\portcls.sys 0xF78B3000 \SystemRoot\system32\drivers\drmk.sys 0xF71C9000 \SystemRoot\System32\DRIVERS\BCMSM.sys 0xF79CB000 \SystemRoot\System32\Drivers\Modem.SYS 0xF79D3000 \SystemRoot\system32\DRIVERS\avgfwdx.sys 0xF7C52000 \SystemRoot\System32\DRIVERS\audstub.sys 0xF78C3000 \SystemRoot\System32\DRIVERS\rasl2tp.sys 0xF7B53000 \SystemRoot\System32\DRIVERS\ndistapi.sys 0xF71B2000 \SystemRoot\System32\DRIVERS\ndiswan.sys 0xF78D3000 \SystemRoot\System32\DRIVERS\raspppoe.sys 0xF76C3000 \SystemRoot\System32\DRIVERS\raspptp.sys 0xF79DB000 \SystemRoot\System32\DRIVERS\TDI.SYS 0xF71A1000 \SystemRoot\System32\DRIVERS\psched.sys 0xF76D3000 \SystemRoot\System32\DRIVERS\msgpc.sys 0xF79E3000 \SystemRoot\System32\DRIVERS\ptilink.sys 0xF79EB000 \SystemRoot\System32\DRIVERS\raspti.sys 0xF76E3000 \SystemRoot\System32\DRIVERS\termdd.sys 0xF7B9B000 \SystemRoot\System32\DRIVERS\swenum.sys 0xF711B000 \SystemRoot\System32\DRIVERS\update.sys 0xF79F3000 \SystemRoot\System32\DRIVERS\omci.sys 0xF7458000 \SystemRoot\System32\DRIVERS\mssmbios.sys 0xF7703000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xEF042000 \SystemRoot\system32\drivers\ialmkchw.sys 0xEF024000 \SystemRoot\system32\drivers\ialmsbw.sys 0xF7723000 \SystemRoot\System32\DRIVERS\usbhub.sys 0xF7B03000 \SystemRoot\System32\Drivers\i2omgmt.SYS 0xF7743000 \SystemRoot\system32\DRIVERS\avgmfx86.sys 0xF7BA3000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7D68000 \SystemRoot\System32\Drivers\Null.SYS 0xF7BA5000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7A0B000 \SystemRoot\System32\drivers\vga.sys 0xF7BA7000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7BA9000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7A13000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7A1B000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7B07000 \SystemRoot\System32\DRIVERS\rasacd.sys 0xEEF29000 \SystemRoot\System32\DRIVERS\ipsec.sys 0xEEED0000 \SystemRoot\System32\DRIVERS\tcpip.sys 0xEEE89000 \SystemRoot\system32\DRIVERS\avgtdix.sys 0xEEE63000 \SystemRoot\System32\DRIVERS\ipnat.sys 0xF7783000 \SystemRoot\System32\DRIVERS\wanarp.sys 0xEEE3B000 \SystemRoot\System32\DRIVERS\netbt.sys 0xEEE19000 \SystemRoot\System32\drivers\afd.sys 0xF77B3000 \SystemRoot\System32\DRIVERS\netbios.sys 0xEEDEE000 \SystemRoot\System32\DRIVERS\rdbss.sys 0xEED7E000 \SystemRoot\System32\DRIVERS\mrxsmb.sys 0xF7803000 \SystemRoot\System32\Drivers\Fips.SYS 0xEED6A000 \SystemRoot\system32\DRIVERS\ctxusbm.sys 0xEED2E000 \SystemRoot\system32\DRIVERS\avgldx86.sys 0xEEFE4000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xEEC9E000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7BCB000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7B3B000 \SystemRoot\System32\drivers\Dxapi.sys 0xF792B000 \SystemRoot\System32\watchdog.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7C4D000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF020000 \SystemRoot\System32\ialmdnt5.dll 0xBF012000 \SystemRoot\System32\ialmrnt5.dll 0xBF042000 \SystemRoot\System32\ialmdev5.DLL 0xBF073000 \SystemRoot\System32\ialmdd5.DLL 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xEEB7A000 \SystemRoot\System32\DRIVERS\mdc8021x.sys 0xEEB76000 \SystemRoot\System32\DRIVERS\ndisuio.sys 0xEE901000 \SystemRoot\System32\DRIVERS\mrxdav.sys 0xF7C1F000 \SystemRoot\System32\Drivers\ASCTRM.SYS 0xF797B000 \SystemRoot\system32\DRIVERS\AVGIDSShim.Sys 0xEE76A000 \SystemRoot\System32\DRIVERS\srv.sys 0xF7A2B000 \SystemRoot\system32\DRIVERS\AVGIDSFilter.Sys 0xEE60A000 \SystemRoot\system32\DRIVERS\AVGIDSDriver.Sys 0xEE349000 \SystemRoot\System32\Drivers\HTTP.sys 0xEDFF2000 \SystemRoot\system32\drivers\wdmaud.sys 0xEE50A000 \SystemRoot\system32\drivers\sysaudio.sys 0xEDF63000 \SystemRoot\system32\drivers\kmixer.sys 0xEE2D9000 \SystemRoot\system32\DRIVERS\asyncmac.sys 0x7C900000 \WINDOWS\SYSTEM32\ntdll.dll Processes (total 43): 0 System Idle Process 4 System 1040 C:\WINDOWS\SYSTEM32\smss.exe 1308 csrss.exe 1332 C:\WINDOWS\SYSTEM32\winlogon.exe 1380 C:\WINDOWS\SYSTEM32\services.exe 1392 C:\WINDOWS\SYSTEM32\lsass.exe 1556 C:\WINDOWS\SYSTEM32\svchost.exe 1656 svchost.exe 1696 C:\WINDOWS\SYSTEM32\svchost.exe 1912 svchost.exe 1964 svchost.exe 528 C:\WINDOWS\SYSTEM32\spoolsv.exe 604 svchost.exe 668 C:\Program Files\AVG\AVG10\avgwdsvc.exe 704 C:\Program Files\Java\jre6\bin\jqs.exe 1800 C:\WINDOWS\SYSTEM32\svchost.exe 184 C:\WINDOWS\SYSTEM32\WLTRYSVC.EXE 232 C:\WINDOWS\SYSTEM32\BCMWLTRY.EXE 1796 C:\Program Files\Canon\CAL\CALMAIN.exe 2360 alg.exe 764 C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe 3096 C:\WINDOWS\explorer.exe 804 C:\WINDOWS\SYSTEM32\wuauclt.exe 1504 C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe 2700 C:\Program Files\Real\RealPlayer\realplay.exe 3544 C:\Program Files\HP\HP Software Update\hpwuSchd.exe 2996 C:\Program Files\HP\hpcoretech\hpcmpmgr.exe 3012 C:\Program Files\Common Files\Java\Java Update\jusched.exe 3048 C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe 2740 C:\Program Files\AVG\AVG10\avgtray.exe 3144 C:\Program Files\Citrix\ICA Client\concentr.exe 3172 C:\Program Files\Dell Support\DSAgnt.exe 1272 C:\WINDOWS\SYSTEM32\ctfmon.exe 2424 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe 3348 C:\Program Files\Citrix\ICA Client\wfcrun32.exe 2520 C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe 1192 C:\Program Files\Internet Explorer\iexplore.exe 4040 C:\Program Files\Internet Explorer\iexplore.exe 1480 C:\Program Files\Common Files\Java\Java Update\jucheck.exe 3992 C:\Program Files\AVG\AVG10\avgui.exe 3576 C:\WINDOWS\SYSTEM32\wscntfy.exe 2352 C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe \\.\C: –> \\.\PhysicalDrive0 at offset 0x00000000`02f10c00 (NTFS) PhysicalDrive0 Model Number: TOSHIBAMK3021GAS, Rev: GA129D Size Device Name MBR Status ——————————————– 27 GB \\.\PhysicalDrive0 Dell MBR code detected SHA1: 84B95CE8A54B7C5C3AAF149934FC46FB70FF8365 Done!
Post #4
Continued from prior post…..here is the OTL log

OTL logfile created on: 11/8/2011 6:13:28 PM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\TamiH\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1022.33 Mb Total Physical Memory | 512.30 Mb Available Physical Memory | 50.11% Memory free
1.28 Gb Paging File | 0.91 Gb Available in Paging File | 70.93% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 24.89 Gb Total Space | 7.68 Gb Free Space | 30.86% Space Free | Partition Type: NTFS

Computer Name: TAMI | User Name: TamiH | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\TamiH\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
PRC - C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG PC Tuneup 2011\BoostSpeed.exe (AVG)
PRC - C:\Program Files\Common Files\Java\Java Update\jucheck.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\wfcrun32.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Real\RealPlayer\realplay.exe (RealNetworks, Inc.)
PRC - C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
PRC - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
PRC - C:\Program Files\HP\HP Software Update\hpwuSchd.exe (Hewlett-Packard)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe ()
MOD - C:\Program Files\AVG\AVG PC Tuneup 2011\madExcept_.bpl ()
MOD - C:\Program Files\AVG\AVG PC Tuneup 2011\madBasic_.bpl ()
MOD - C:\Program Files\AVG\AVG PC Tuneup 2011\madDisAsm_.bpl ()
MOD - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\TrackUtils.dll ()
MOD - C:\Program Files\MUSICMATCH\Musicmatch Jukebox\CoreDll.dll ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) – File not found
SRV - (AppMgmt) – File not found
SRV - (AVGIDSAgent) – C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgfws) – C:\Program Files\AVG\AVG10\avgfws.exe (AVG Technologies CZ, s.r.o.)
SRV - (avgwd) – C:\Program Files\AVG\AVG10\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (CCALib8) – C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)
SRV - (Pml Driver HPZ12) – C:\WINDOWS\SYSTEM32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (AVGIDSDriver) – C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSDriver.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgtdix) – C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgrkx86) – C:\WINDOWS\system32\DRIVERS\avgrkx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgmfx86) – C:\WINDOWS\SYSTEM32\DRIVERS\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AVGIDSEH) – C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSShim) – C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSShim.sys (AVG Technologies CZ, s.r.o. )
DRV - (AVGIDSFilter) – C:\WINDOWS\SYSTEM32\DRIVERS\AVGIDSFilter.sys (AVG Technologies CZ, s.r.o. )
DRV - (Avgldx86) – C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwfd) – C:\WINDOWS\SYSTEM32\DRIVERS\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (Avgfwdx) – C:\WINDOWS\SYSTEM32\DRIVERS\avgfwdx.sys (AVG Technologies CZ, s.r.o.)
DRV - (ctxusbm) – C:\WINDOWS\SYSTEM32\DRIVERS\ctxusbm.sys (Citrix Systems, Inc.)
DRV - (AFS2K) – C:\WINDOWS\System32\drivers\AFS2K.SYS (Oak Technology Inc.)
DRV - (iAimFP4) – C:\WINDOWS\SYSTEM32\DRIVERS\wvchntxx.sys (Intel® Corporation)
DRV - (iAimFP3) – C:\WINDOWS\SYSTEM32\DRIVERS\wsiintxx.sys (Intel® Corporation)
DRV - (iAimTV4) – C:\WINDOWS\SYSTEM32\DRIVERS\wch7xxnt.sys (Intel® Corporation)
DRV - (iAimTV3) – C:\WINDOWS\SYSTEM32\DRIVERS\watv04nt.sys (Intel® Corporation)
DRV - (iAimTV1) – C:\WINDOWS\SYSTEM32\DRIVERS\watv02nt.sys (Intel® Corporation)
DRV - (iAimTV0) – C:\WINDOWS\SYSTEM32\DRIVERS\watv01nt.sys (Intel® Corporation)
DRV - (i81x) – C:\WINDOWS\SYSTEM32\DRIVERS\i81xnt5.sys (Intel® Corporation)
DRV - (iAimFP0) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv01nt.sys (Intel® Corporation)
DRV - (iAimFP1) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv02nt.sys (Intel® Corporation)
DRV - (iAimFP2) – C:\WINDOWS\SYSTEM32\DRIVERS\wadv05nt.sys (Intel® Corporation)
DRV - (MxlW2k) – C:\WINDOWS\System32\drivers\MxlW2k.sys (MusicMatch, Inc.)
DRV - (ASCTRM) – C:\WINDOWS\System32\drivers\asctrm.sys (Windows ® 2000 DDK provider)
DRV - (MDC8021X) AEGIS Protocol (IEEE 802.1x) – C:\WINDOWS\SYSTEM32\DRIVERS\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (BCM43XX) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMWL5.SYS (Broadcom Corporation)
DRV - (omci) – C:\WINDOWS\SYSTEM32\DRIVERS\omci.sys (Dell Inc)
DRV - (bcm4sbxp) – C:\WINDOWS\SYSTEM32\DRIVERS\bcm4sbxp.sys (Broadcom Corporation)
DRV - (STAC97) Audio Driver (WDM) – C:\WINDOWS\SYSTEM32\DRIVERS\stac97.sys (SigmaTel, Inc.)
DRV - (BCMModem) – C:\WINDOWS\SYSTEM32\DRIVERS\BCMSM.sys (Broadcom Corporation)
DRV - (EL90XBC) – C:\WINDOWS\SYSTEM32\DRIVERS\EL90XBC5.SYS (3Com Corporation)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========


IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\Software\MozillaPlugins\@canon.com/MycameraPlugin: C:\Program Files\Canon\MyCamera Download Plugin\NPCIG.dll (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60310.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/09/17 15:28:46 | 000,000,000 | —D | M]


O1 HOSTS File: ([2010/09/01 10:28:14 | 000,000,027 | —- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [ConnectionCenter] C:\Program Files\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [MMTray] C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mm_tray.exe (Musicmatch, Inc.)
O4 - HKLM..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe (RealNetworks, Inc.)
O4 - HKLM..\Run: [zzzHPSETUP] D:\Setup.exe \RESET File not found
O4 - HKCU..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [MoneyAgent] C:\Program Files\Microsoft Money\System\mnyexpr.exe (Microsoft Corp.)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\FlashUtil10m_ActiveX.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Low Rights present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra Button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html File not found
O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {1C11B948-582A-433F-A98D-A8C4D5CC64F2} http://lazboy3d.icovia.com/PLANNER/Core/Pl…yerAX_Win32.cab (20-20 3D Viewer)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} http://www.crucial.com/controls/cpcScanner.cab (Crucial cpcScan)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shock…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FC31B805-CB36-4FA0-8C69-FC95B778BE27}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\SYSTEM32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\TamiH\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\TamiH\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2002/09/03 07:59:58 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: MSACM.CEGSM - C:\WINDOWS\System32\MOBILEV.ACM ()
Drivers32: msacm.iac2 - C:\WINDOWS\System32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\TSSOFT32.ACM (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\IR32_32.DLL ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: vidc.LEAD - C:\WINDOWS\System32\LCodcCMP.dll (LEAD Technologies, Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/11/08 18:10:31 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Documents and Settings\TamiH\Desktop\OTL.exe
[2011/11/04 18:20:01 | 000,000,000 | -H-D | C] – C:\$AVG
[2011/10/31 17:18:03 | 000,388,608 | —- | C] (Trend Micro Inc.) – C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe
[2011/10/31 16:31:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/10/23 20:59:24 | 000,000,000 | —D | C] – C:\Documents and Settings\TamiH\My Documents\Maui 2011_10_15

========== Files - Modified Within 30 Days ==========

[2011/11/08 18:10:39 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\TamiH\Desktop\OTL.exe
[2011/11/08 18:06:32 | 000,080,384 | —- | M] () – C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe
[2011/11/08 18:02:51 | 000,000,000 | —- | M] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\prvlcl.dat
[2011/11/08 17:38:11 | 000,000,388 | —- | M] () – C:\WINDOWS\tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
[2011/11/08 17:34:29 | 000,617,187 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavifw.avm
[2011/11/08 17:34:27 | 137,421,893 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/11/08 17:27:18 | 000,441,174 | —- | M] () – C:\WINDOWS\System32\PERFH009.DAT
[2011/11/08 17:27:18 | 000,072,042 | —- | M] () – C:\WINDOWS\System32\PERFC009.DAT
[2011/11/08 17:24:03 | 000,001,170 | —- | M] () – C:\WINDOWS\System32\WPA.DBL
[2011/11/08 17:24:00 | 000,002,048 | –S- | M] () – C:\WINDOWS\BOOTSTAT.DAT
[2011/11/08 17:23:57 | 1072,062,464 | -HS- | M] () – C:\hiberfil.sys
[2011/10/31 17:18:05 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe
[2011/10/25 23:43:46 | 000,173,383 | —- | M] () – C:\WINDOWS\System32\drivers\AVG\iavichjg.avm
[2011/10/23 21:33:35 | 000,096,713 | —- | M] () – C:\Documents and Settings\TamiH\Desktop\Maui tropical plantation map.jpg

========== Files Created - No Company Name ==========

[2011/11/08 18:06:27 | 000,080,384 | —- | C] () – C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe
[2011/10/23 21:40:51 | 000,096,713 | —- | C] () – C:\Documents and Settings\TamiH\Desktop\Maui tropical plantation map.jpg
[2011/09/13 17:15:54 | 002,359,350 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\ZBWallpaper_2.bmp
[2011/09/13 17:14:08 | 002,359,350 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\ZBWallpaper_1.bmp
[2011/09/13 17:13:04 | 001,327,158 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\ZBWallpaper.bmp
[2011/05/29 12:28:36 | 000,003,584 | —- | C] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/26 10:24:46 | 000,390,032 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2011/01/09 22:17:56 | 000,000,000 | —- | C] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\prvlcl.dat
[2008/09/18 11:45:11 | 000,000,002 | —- | C] () – C:\WINDOWS\msoffice.ini
[2007/10/20 18:29:04 | 000,034,468 | —- | C] () – C:\WINDOWS\hpomdl03.dat
[2007/10/20 18:29:04 | 000,028,922 | —- | C] () – C:\WINDOWS\hpoins03.dat
[2005/11/21 22:21:02 | 000,004,212 | -H– | C] () – C:\WINDOWS\System32\zllictbl.dat
[2005/09/26 17:57:11 | 000,000,000 | —- | C] () – C:\WINDOWS\Textart.INI
[2005/09/14 10:25:29 | 000,061,678 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\PFP120JPR.{PB
[2005/09/14 10:25:29 | 000,012,358 | —- | C] () – C:\Documents and Settings\TamiH\Application Data\PFP120JCM.{PB
[2005/09/12 09:07:04 | 000,047,787 | —- | C] () – C:\WINDOWS\hpiins01.dat
[2005/04/30 19:58:46 | 000,000,128 | —- | C] () – C:\Documents and Settings\TamiH\Local Settings\Application Data\fusioncache.dat
[2004/10/07 17:25:26 | 000,565,248 | R— | C] () – C:\WINDOWS\System32\hpotscl.dll
[2004/08/26 10:49:48 | 000,000,376 | —- | C] () – C:\WINDOWS\ODBC.INI
[2004/08/03 08:03:13 | 000,000,061 | —- | C] () – C:\WINDOWS\smscfg.ini
[2004/08/03 07:56:49 | 000,149,504 | —- | C] () – C:\WINDOWS\UNWISE.EXE
[2004/08/03 07:42:23 | 000,000,335 | —- | C] () – C:\WINDOWS\nsreg.dat
[2004/08/03 07:42:08 | 000,110,592 | —- | C] () – C:\WINDOWS\System32\AegisI5.exe
[2004/08/03 07:42:08 | 000,045,056 | —- | C] () – C:\WINDOWS\System32\WLTRYSVC.EXE
[2004/08/03 07:37:03 | 000,077,824 | —- | C] () – C:\WINDOWS\System32\SynTPCoI.dll
[2004/08/03 07:34:36 | 000,000,780 | —- | C] () – C:\WINDOWS\orun32.ini
[2004/08/03 07:15:48 | 000,002,048 | –S- | C] () – C:\WINDOWS\BOOTSTAT.DAT
[2004/08/03 07:13:42 | 000,363,520 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2004/08/03 07:13:34 | 000,441,174 | —- | C] () – C:\WINDOWS\System32\PERFH009.DAT
[2004/08/03 07:13:34 | 000,072,042 | —- | C] () – C:\WINDOWS\System32\PERFC009.DAT
[2004/08/03 07:13:19 | 000,001,793 | —- | C] () – C:\WINDOWS\System32\fxsperf.ini
[2004/08/03 06:53:58 | 000,000,547 | —- | C] () – C:\WINDOWS\System32\OEMINFO.INI
[2004/08/02 14:20:40 | 000,004,569 | —- | C] () – C:\WINDOWS\System32\secupd.dat
[2004/05/26 14:09:26 | 000,024,576 | —- | C] () – C:\WINDOWS\System32\DSRIRREM.EXE
[2004/05/04 16:11:06 | 000,000,283 | —- | C] () – C:\WINDOWS\System32\DLBCPLC.INI
[2003/01/07 15:05:08 | 000,002,695 | —- | C] () – C:\WINDOWS\System32\OUTLPERF.INI
[2002/09/03 08:05:08 | 000,259,048 | —- | C] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2002/09/03 07:59:14 | 000,004,161 | —- | C] () – C:\WINDOWS\ODBCINST.INI
[2002/09/03 07:56:30 | 000,021,640 | —- | C] () – C:\WINDOWS\System32\emptyregdb.dat
[2002/09/03 07:31:46 | 013,107,200 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.BIN
[2002/09/03 07:31:44 | 000,004,594 | —- | C] () – C:\WINDOWS\System32\OEMBIOS.DAT
[2002/08/29 04:00:00 | 000,673,088 | —- | C] () – C:\WINDOWS\System32\MLANG.DAT
[2002/08/29 04:00:00 | 000,272,128 | —- | C] () – C:\WINDOWS\System32\PERFI009.DAT
[2002/08/29 04:00:00 | 000,218,003 | —- | C] () – C:\WINDOWS\System32\DSSEC.DAT
[2002/08/29 04:00:00 | 000,046,258 | —- | C] () – C:\WINDOWS\System32\MIB.BIN
[2002/08/29 04:00:00 | 000,028,626 | —- | C] () – C:\WINDOWS\System32\PERFD009.DAT
[2002/08/29 04:00:00 | 000,001,804 | —- | C] () – C:\WINDOWS\System32\dcache.bin
[2002/08/29 04:00:00 | 000,000,741 | —- | C] () – C:\WINDOWS\System32\NOISE.DAT
[2001/09/13 12:06:26 | 000,036,864 | —- | C] () – C:\WINDOWS\SETPWRCG.EXE

========== LOP Check ==========

[2011/01/08 16:49:14 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVG10
[2011/01/12 12:25:06 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Citrix
[2011/01/08 16:48:28 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2011/10/31 17:03:52 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\iolo
[2011/05/30 09:31:51 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2011/11/08 18:18:55 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\TEMP
[2004/08/03 07:44:25 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/02/27 22:22:25 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\AVG
[2011/01/08 16:54:39 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\AVG10
[2011/01/18 11:12:21 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\ICAClient
[2005/10/05 17:41:22 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\Snapfish
[2009/08/26 21:05:24 | 000,000,000 | —D | M] – C:\Documents and Settings\TamiH\Application Data\Viewpoint
[2011/11/08 17:38:11 | 000,000,388 | —- | M] () – C:\WINDOWS\Tasks\AVG PC Tuneup 2011 Integrator Start On Windows Logon.job
[2004/08/19 19:43:26 | 000,000,258 | —- | M] () – C:\WINDOWS\Tasks\ISP signup reminder 1.job

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2005/12/10 17:59:13 | 000,010,920 | —- | M] () – C:\aolconnfix.exe
[2005/12/10 17:59:13 | 000,001,039 | —- | M] () – C:\aolconnfix.txt
[2002/09/03 07:59:58 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2009/03/15 16:51:42 | 000,000,211 | —- | M] () – C:\Boot.bak
[2010/05/15 11:16:38 | 000,000,281 | RHS- | M] () – C:\BOOT.INI
[2002/09/03 07:38:46 | 000,000,512 | -HS- | M] () – C:\BOOTSECT.DOS
[2004/08/03 22:00:00 | 000,260,272 | —- | M] () – C:\cmldr
[2010/09/01 10:34:45 | 000,007,751 | —- | M] () – C:\ComboFix.txt
[2002/09/03 07:59:58 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2004/08/03 07:02:10 | 000,005,375 | RH– | M] () – C:\DELL.SDR
[2011/11/08 17:23:57 | 1072,062,464 | -HS- | M] () – C:\hiberfil.sys
[2007/10/20 18:48:25 | 000,000,377 | —- | M] () – C:\hpcmerr.log
[2002/09/03 07:59:58 | 000,000,000 | -H– | M] () – C:\IO.SYS
[2002/09/03 07:59:58 | 000,000,000 | -H– | M] () – C:\MSDOS.SYS
[2009/03/15 16:26:27 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2010/09/02 12:12:57 | 000,250,048 | RHS- | M] () – C:\NTLDR
[2011/11/08 17:23:55 | 402,653,184 | -HS- | M] () – C:\pagefile.sys
[2004/08/03 07:44:54 | 000,000,087 | —- | M] () – C:\SystemInfo.ini

< %systemroot%\Fonts\*.com >

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2002/09/03 07:59:02 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\DESKTOP.INI

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/10/14 15:43:18 | 000,027,648 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2003/06/18 17:31:48 | 000,018,944 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\mdippr.dll
[2006/10/14 15:44:44 | 000,671,744 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\PrintFilterPipelineSvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2002/09/03 07:47:18 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\DEFAULT.SAV
[2002/09/03 07:47:18 | 000,602,112 | —- | M] () – C:\WINDOWS\System32\config\SOFTWARE.SAV
[2002/09/03 07:47:18 | 000,380,928 | —- | M] () – C:\WINDOWS\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/09/02 12:41:06 | 000,000,272 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\DESKTOP.INI

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/09/02 13:40:50 | 000,000,177 | -HS- | M] () – C:\Documents and Settings\TamiH\Application Data\Microsoft\Internet Explorer\Quick Launch\DESKTOP.INI
[2004/08/19 19:45:11 | 000,000,079 | —- | M] () – C:\Documents and Settings\TamiH\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/03/13 13:51:50 | 004,738,888 | —- | M] (AVG Technologies) – C:\Documents and Settings\TamiH\Desktop\AVG Internet Security 2011.exe
[2011/10/31 17:18:05 | 000,388,608 | —- | M] (Trend Micro Inc.) – C:\Documents and Settings\TamiH\Desktop\HiJackThis.exe
[2011/11/08 18:06:32 | 000,080,384 | —- | M] () – C:\Documents and Settings\TamiH\Desktop\MBRCheck.exe
[2011/11/08 18:10:39 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Documents and Settings\TamiH\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-09-02 23:46:24

========== Alternate Data Streams ==========

@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

< End of report >
Post #5
Hi thoran

I see no sign of malware but we can’t rule it out yet.

Combination security packages such as the AVG Internet Security 2011 are quite resource-intensive and could be slowing the computer down but we’ll have a couple more checks.


Run OTL

  • Double click on the icon to run it.
  • Copy/paste ALL the following text written inside the code box into the Custom Scans/Fixes box located at the bottom of OTL

    :Services

:OTL
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - No CLSID value found
O4 - HKLM..\Run: [zzzHPSETUP] D:\Setup.exe \RESET File not found
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
@Alternate Data Stream - 152 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0B4227B4

:Commands
[purity]
[emptytemp]
[Reboot]

  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot when it is done
  • Then post a new OTL log (don't check the boxes beside LOP Check or Purity this time)
Please post Extras.txt from the first OTL run: this should be on your desktop. If it is not, do the following:

Run OTL again

Under Extra Registry put a check in Use SafeList:

🖼Click to load external image (Posted Image)

Click Run Scan

===========================================

Download the GMER Rootkit Scanner

[external image: Posted Image]
Download GMER Rootkit Scanner from here or here.
  • Extract the contents of the zipped file to desktop.
  • Double click GMER.exe. If asked to allow gmer.sys driver to load, please consent .
  • If it gives you a warning about rootkit activity and asks if you want to run a full scan…click on NO.

    [external image: Posted Image]
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following …
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish.
  • Once done, click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  • Save it where you can easily find it, such as your desktop, and attach it in your reply.
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

===========================================

Please post back with the following logfiles logfiles:

OTL fix log
OTL.txt
Extras.txt
Gmer.txt

Thanks

Satchfan
Post #6
Hello thoran It has been several days since I posted instructions to help with your computer problem. Please let me know if you are having problems and still need help. Thanks Satchfan

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI