Spyware / Malware / Virus Removal

promlems with laptop [Solved]

11 min read

Looking for the outcome? Ask AI

fertigline Topic Starter

Post #1December 26, 2011, 11:52 PM UTC

My wife's laptop is having some issues. First she uninstalled a program and I think it uninstalled a shared driver because now some of her other programs don't work. Second her music got copied to her recycle bin. As near as I can tell her songs are still in the music folder and working fine. Any help would be greatly appreciated.

She is running Windows Vista SP2.

Here are the results from the scan.

OTL logfile created on: 12/26/2011 5:29:41 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Michele\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.90% Memory free
4.21 Gb Paging File | 3.01 Gb Available in Paging File | 71.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.78 Gb Total Space | 21.46 Gb Free Space | 30.76% Space Free | Partition Type: NTFS
Drive D: | 69.51 Gb Total Space | 69.42 Gb Free Space | 99.87% Space Free | Partition Type: NTFS

Computer Name: MICHELE-PC | User Name: Michele | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Users\Michele\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Users\Michele\AppData\Local\Temp\RtkBtMnt.exe (Realtek Semiconductor Corp.)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
PRC - C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
PRC - C:\Acer\Empowering Technology\eRecovery\eRAgent.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
PRC - C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
PRC - C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
PRC - C:\Acer\ALaunch\ALaunchSvc.exe ()
PRC - C:\Acer\Empowering Technology\Acer.Empowering.Framework.Supervisor.exe (Acer Inc.)
PRC - C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
PRC - C:\Acer\Empowering Technology\ePower\ePower_DMC.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
PRC - C:\Acer\Empowering Technology\eNet\eNMTray.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
PRC - C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
PRC - C:\Acer\Mobility Center\MobilityService.exe ()

========== Modules (No Company Name) ==========

MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\6bc98e9b5eedaa8f71c5454d36a4b772\System.Management.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\8645de531003807d00822e03986a075d\System.ServiceProcess.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\e00630ec1e225a2376fdd430645e20f7\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\6d2f689baff5da3df134fdec0742a13c\System.Runtime.Remoting.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\40da9084d0863e07d7ce55953833b8b0\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1363115565fff5a641243a48f396f107\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\367c4043efc2f32d843cb588b0dc97fc\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll ()
MOD - C:\Acer\Empowering Technology\eSettings\eSettings.Plugin.dll ()
MOD - C:\Acer\Empowering Technology\eSettings\eSettings.Presenter.dll ()
MOD - C:\Acer\Empowering Technology\eSettings\eSettings.View.dll ()
MOD - C:\Acer\Empowering Technology\eSettings.Model.ComputerInterfaces.dll ()
MOD - C:\Windows\System32\BatchCrypto.dll ()
MOD - C:\Windows\System32\ShowErrMsg.dll ()
MOD - C:\Acer\Empowering Technology\eRecovery\ServiceInterface.dll ()
MOD - C:\Acer\Empowering Technology\Acer.Empowering.Framework.DialogManager.dll ()
MOD - C:\Acer\Empowering Technology\Acer.Empowering.Framework.PasswordSetting.dll ()
MOD - C:\Acer\Empowering Technology\ePresentation\ePresentationCTL.dll ()
MOD - C:\Acer\Empowering Technology\eNet\eNetPlugin.dll ()
MOD - C:\Acer\Empowering Technology\eLock\eLockCTL.dll ()
MOD - C:\Windows\System32\igfxTMM.dll ()
MOD - C:\Windows\System32\hccutils.dll ()
MOD - C:\Acer\Empowering Technology\ePower\SysHook.dll ()

========== Win32 Services (SafeList) ==========

SRV - (RichVideo) Cyberlink RichVideo Service(CRVS) – File not found
SRV - (LVSrvLauncher) – File not found
SRV - (LightScribeService) – File not found
SRV - (gusvc) – File not found
SRV - (gupdatem) Google Update Service (gupdatem) – File not found
SRV - (gupdate) Google Update Service (gupdate) – File not found
SRV - (CLTNetCnService) – File not found
SRV - (ekrn) – C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe (ESET)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV - (eSettingsService) – C:\Acer\Empowering Technology\eSettings\Service\capuserv.exe ()
SRV - (eDataSecurity Service) – C:\Acer\Empowering Technology\eDataSecurity\eDSService.exe (HiTRSUT)
SRV - (eRecoveryService) – C:\Acer\Empowering Technology\eRecovery\eRecoveryService.exe (Acer Inc.)
SRV - (ALaunchService) – C:\Acer\ALaunch\ALaunchSvc.exe ()
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) – C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RP7.EXE (SEIKO EPSON CORPORATION)
SRV - (WMIService) – C:\Acer\Empowering Technology\ePower\ePowerSvc.exe (acer)
SRV - (eNet Service) – C:\Acer\Empowering Technology\eNet\eNet Service.exe (Acer Inc.)
SRV - (eLockService) – C:\Acer\Empowering Technology\eLock\Service\eLockServ.exe (Acer Inc.)
SRV - (MobilityService) – C:\Acer\Mobility Center\MobilityService.exe ()

========== Driver Services (SafeList) ==========

DRV - (eamonm) – C:\Windows\System32\drivers\eamonm.sys (ESET)
DRV - (epfwwfpr) – C:\Windows\System32\drivers\epfwwfpr.sys (ESET)
DRV - (ehdrv) – C:\Windows\System32\drivers\ehdrv.sys (ESET)
DRV - (f5ipfw) – C:\Windows\System32\drivers\urfltwlh.sys (F5 Networks)
DRV - (urvpndrv) – C:\Windows\System32\drivers\urvpnwlh.sys (F5 Networks)
DRV - (NETw4v32) Intel® – C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
DRV - (int15) – C:\Acer\Empowering Technology\eRecovery\int15.sys ()
DRV - (LVMVDrv) – C:\Windows\System32\drivers\LVMVdrv.sys (Logitech Inc.)
DRV - (LVUVC) Acer OrbiCam(UVC) – C:\Windows\System32\drivers\lvuvc.sys (Logitech Inc.)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (bcm4sbxp) – C:\Windows\System32\drivers\bcm4sbxp.sys (Broadcom Corporation)
DRV - (ESDCR) – C:\Windows\System32\drivers\ESD7SK.sys (ENE Technology Inc.)
DRV - (ESMCR) – C:\Windows\System32\drivers\ESM7SK.sys (ENE Technology Inc.)
DRV - (EMSCR) – C:\Windows\System32\drivers\EMS7SK.sys (ENE Technology Inc.)
DRV - (XAudio) – C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (Afc) – C:\Windows\System32\drivers\afc.sys (Arcsoft, Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://en.us.acer.yahoo.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://en.us.acer.yahoo.com
IE - HKLM\..\URLSearchHook: {7b13ec3e-999a-4b70-b9cb-2617b8323822} - No CLSID value found

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SEARCH PAGE =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Yahoo! Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ww.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\InprocServer32 File not found
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://ww.yahoo.com/"
FF - prefs.js..extensions.enabledItems: [removed]:7
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Content Upload Plugin,version=1.0.0: C:\Program Files\DivX\DivX Content Uploader\npUpload.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.2888: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.2946: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.11.2806: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll File not found
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine,version=1.0: C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.79\npGoogleUpdate3.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll File not found
FF - HKCU\Software\MozillaPlugins\@movenetworks.com/Quantum Media Player: C:\Users\Michele\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll (Move Networks)
FF - HKCU\Software\MozillaPlugins\@real.com/RhapsodyPlayerEngine: C:\Users\Michele\AppData\Roaming\nprhapengine.dll File not found

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/12/24 09:50:49 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\[removed]: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011/11/02 08:17:55 | 000,000,000 | —D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[removed]: C:\Users\Michele\AppData\Roaming\Move Networks [2010/02/22 07:45:00 | 000,000,000 | —D | M]

[2010/11/13 20:01:49 | 000,000,000 | —D | M] (No name found) – C:\Users\Michele\AppData\Roaming\Mozilla\Extensions
[2009/06/16 10:18:32 | 000,000,000 | —D | M] (No name found) – C:\Users\Michele\AppData\Roaming\Mozilla\Extensions\[removed]
[2011/12/24 22:02:56 | 000,000,000 | —D | M] (No name found) – C:\Users\Michele\AppData\Roaming\Mozilla\Firefox\Profiles\23icuuwi.default\extensions
[2010/11/14 20:50:29 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\Users\Michele\AppData\Roaming\Mozilla\Firefox\Profiles\23icuuwi.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/24 09:50:47 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2011/12/24 09:50:47 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\distribution\extensions
[2011/12/24 09:50:47 | 000,000,000 | —D | M] (Yahoo! Toolbar) – C:\Program Files\Mozilla Firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/11/20 23:04:51 | 000,134,104 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/11/20 20:04:05 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/11/20 20:04:05 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

O1 HOSTS File: ([2009/02/01 18:49:36 | 000,000,759 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Yahoo! Toolbar Helper) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll File not found
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (no name) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - No CLSID value found.
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O3 - HKLM\..\Toolbar: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477e-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll File not found
O3 - HKCU\..\Toolbar\ShellBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (Acer eDataSecurity Management) - {5CBE3B7C-1E47-477E-A7DD-396DB0476E29} - C:\Windows\System32\eDStoolbar.dll (HiTRUST)
O4 - HKLM..\Run: [Acer Assist Launcher] C:\Program Files\Acer Assist\launcher.exe File not found
O4 - HKLM..\Run: [Acer Product Registration] "C:\Program Files\Acer Registration\ACE1.exe" /startup File not found
O4 - HKLM..\Run: [Acer Tour] File not found
O4 - HKLM..\Run: [Acer Tour Reminder] C:\Acer\AcerTour\Reminder.exe (Acer Inc.)
O4 - HKLM..\Run: [AcerOrbicamRibbon] "C:\Program Files\Acer\OrbiCam10\OrbiCam.exe" /hide File not found
O4 - HKLM..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" File not found
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" File not found
O4 - HKLM..\Run: [ALaunch] C:\Acer\ALaunch\AlaunchClient.exe File not found
O4 - HKLM..\Run: [BYRUA_AGENT] C:\ProgramData\LGMOBILEAX\BYR_Client\VZWUAAgent.exe (LG Electronics)
O4 - HKLM..\Run: [eDataSecurity Loader] C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe (HiTRUST)
O4 - HKLM..\Run: [eDSMSNfix] C:\Acer\Empowering Technology\eDSMSNfix.exe File not found
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKLM..\Run: [eRecoveryService] File not found
O4 - HKLM..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe File not found
O4 - HKLM..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\Logitech\LComMgr\Communications_Helper.exe" File not found
O4 - HKLM..\Run: [LVCOMSX] "C:\Program Files\Common Files\Logitech\LComMgr\LVComSX.exe" File not found
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SetPanel] C:\Acer\APanel\APanel.cmd File not found
O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe File not found
O4 - HKLM..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot File not found
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Acer Tour Reminder] File not found
O4 - HKCU..\Run: [EPSON Stylus CX7400 Series] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [EPSON Stylus CX7400 Series (Copy 1)] C:\Windows\System32\spool\DRIVERS\W32X86\3\E_FATICDA.EXE (SEIKO EPSON CORPORATION)
O4 - HKCU..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" File not found
O4 - HKCU..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_1_0 File not found
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL File not found
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: arielcorp.com ( https in Trusted sites)
O15 - HKCU\..Trusted Domains: arielcorp.com ([www] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwa…director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {2A0B9B82-D5C8-4D3D-8338-AD55B23662B1} C:\Users\Michele\AppData\Local\Temp\f5tmp\cachecleaner.cab (F5 Networks CacheCleaner)
O16 - DPF: {2BCDB465-81F9-41CB-832C-8037A4064446} C:\Users\Michele\AppData\Local\Temp\f5tmp\urxvpn.cab (F5 Networks VPN Manager)
O16 - DPF: {45B69029-F3AB-4204-92DE-D5140C3E8E74} C:\Users\Michele\AppData\Local\Temp\IXP000.TMP\InstallerControl.cab (F5 Networks Auto Update)
O16 - DPF: {6C275925-A1ED-4DD2-9CEE-9823F5FDAA10} C:\Users\Michele\AppData\Local\Temp\f5tmp\urTermProxy.cab (F5 Networks SSLTunnel)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} http://pogo.oberon-media.com/online2/pogo/…eb.1.0.0.10.cab (CPlayFirstzenerchiControl Object)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CC85ACDF-B277-486F-8C70-2C9B2ED2A4E7} C:\Users\Michele\AppData\Local\Temp\f5tmp\urxshost.cab (F5 Networks SuperHost Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://games.pogo.com/online2/pogo/chuzzle…aploader_v6.cab (PopCapLoader Object)
O16 - DPF: {E0FF21FA-B857-45C5-8621-F120A0C17FF2} C:\Users\Michele\AppData\Local\Temp\f5tmp\urxhost.cab (F5 Networks Host Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E692E074-289B-4C1A-84A0-30585EC2A430}: DhcpNameServer = [removed] [removed]
O20 - AppInit_DLLs: (eNetHook.dll) -C:\Windows\System32\eNetHook.dll (acer)
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img23.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img23.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O33 - MountPoints2\{2f643ff3-a97b-11e0-aa14-0016d4ddcf25}\Shell - "" = AutoRun
O33 - MountPoints2\{2f643ff3-a97b-11e0-aa14-0016d4ddcf25}\Shell\AutoRun\command - "" = F:\TL_Bootstrap.exe
O33 - MountPoints2\{2f644a6f-a97b-11e0-aa14-0016d4ddcf25}\Shell - "" = AutoRun
O33 - MountPoints2\{2f644a6f-a97b-11e0-aa14-0016d4ddcf25}\Shell\AutoRun\command - "" = F:\TL_Bootstrap.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.mkdmp3enc - C:\PROGRA~1\ACERAR~1\DVWIZA~1\Kernel\Burner\MKDMP3Enc.ACM File not found
Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.i420 - C:\Windows\System32\lvcodec2.dll (Logitech Inc.)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/12/26 17:25:17 | 000,584,192 | —- | C] (OldTimer Tools) – C:\Users\Michele\Desktop\OTL.exe
[2011/12/26 09:34:26 | 000,000,000 | —D | C] – C:\Users\Michele\AppData\Local\Microsoft Help
[2011/12/26 09:33:34 | 000,000,000 | —D | C] – C:\Program Files\Common Files\DESIGNER
[2011/12/26 09:33:33 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Works
[2011/12/26 09:33:09 | 000,000,000 | —D | C] – C:\Program Files\Microsoft.NET
[2011/12/24 23:58:26 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Java
[2011/12/24 23:57:59 | 000,157,472 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/12/24 23:57:59 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/12/24 23:57:59 | 000,149,280 | —- | C] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/12/24 23:57:30 | 000,000,000 | —D | C] – C:\Program Files\Java
[2011/12/24 23:48:02 | 000,000,000 | —D | C] – C:\Program Files\Microsoft Silverlight
[2011/12/24 09:39:18 | 000,000,000 | -H-D | C] – C:\Users\Michele\AppData\Local\acer eNM
[2011/12/24 09:38:45 | 000,000,000 | —D | C] – C:\Users\Michele\AppData\Local\VirtualStore
[2011/12/23 20:48:48 | 000,000,000 | —D | C] – C:\Users\Michele\AppData\Roaming\DivX
[2011/12/23 20:44:41 | 000,000,000 | —D | C] – C:\ProgramData\DivX
[2011/12/15 07:32:26 | 002,382,848 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mshtml.tlb
[2011/12/15 07:32:24 | 001,798,144 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript9.dll
[2011/12/15 07:32:24 | 000,231,936 | —- | C] (Microsoft Corporation) – C:\Windows\System32\url.dll
[2011/12/15 07:32:24 | 000,176,640 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ieui.dll
[2011/12/15 07:32:23 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jsproxy.dll
[2011/12/15 07:32:20 | 001,427,456 | —- | C] (Microsoft Corporation) – C:\Windows\System32\inetcpl.cpl
[2011/12/15 06:52:11 | 002,043,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\win32k.sys
[2011/12/15 06:52:04 | 003,602,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntkrnlpa.exe
[2011/12/15 06:52:03 | 003,550,080 | —- | C] (Microsoft Corporation) – C:\Windows\System32\ntoskrnl.exe
[2011/12/15 06:51:57 | 000,429,056 | —- | C] (Microsoft Corporation) – C:\Windows\System32\EncDec.dll
[2011/12/15 06:51:52 | 000,049,152 | —- | C] (Microsoft Corporation) – C:\Windows\System32\csrsrv.dll
[2011/12/15 06:51:02 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2007/06/05 11:29:04 | 000,016,384 | —- | C] ( ) – C:\Windows\System32\ClearEvent.exe
[2007/04/10 04:32:24 | 000,053,248 | —- | C] ( ) – C:\Windows\System32\Interop.Shell32.dll
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/12/26 17:31:00 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/12/26 17:31:00 | 000,003,168 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/12/26 17:25:23 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Michele\Desktop\OTL.exe
[2011/12/26 16:51:00 | 000,000,886 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011/12/26 16:45:52 | 000,007,168 | —- | M] () – C:\Users\Michele\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/26 11:21:38 | 000,414,368 | —- | M] (Adobe Systems Incorporated) – C:\Windows\System32\FlashPlayerCPLApp.cpl
[2011/12/26 06:50:59 | 000,000,882 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011/12/25 21:30:59 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2011/12/25 21:30:56 | 2137,120,768 | -HS- | M] () – C:\hiberfil.sys
[2011/12/24 23:57:34 | 000,157,472 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaws.exe
[2011/12/24 23:57:34 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\javaw.exe
[2011/12/24 23:57:33 | 000,472,808 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\deployJava1.dll
[2011/12/24 23:57:33 | 000,149,280 | —- | M] (Sun Microsystems, Inc.) – C:\Windows\System32\java.exe
[2011/12/24 09:50:49 | 000,000,834 | —- | M] () – C:\Users\Michele\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/12/24 09:50:49 | 000,000,810 | —- | M] () – C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011/12/24 09:35:37 | 000,002,560 | —- | M] () – C:\Windows\_MSRSTRT.EXE
[2011/12/15 07:39:26 | 000,316,584 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2011/12/15 07:36:49 | 223,738,190 | —- | M] () – C:\Windows\MEMORY.DMP
[2011/12/15 06:44:26 | 000,595,684 | —- | M] () – C:\Windows\System32\perfh009.dat
[2011/12/15 06:44:26 | 000,101,350 | —- | M] () – C:\Windows\System32\perfc009.dat
[3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/12/24 09:38:51 | 000,007,168 | —- | C] () – C:\Users\Michele\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/12/24 09:35:37 | 000,002,560 | —- | C] () – C:\Windows\_MSRSTRT.EXE
[2011/07/09 19:25:08 | 000,002,427 | —- | C] () – C:\Windows\System32\lgAxconfig.ini
[2010/09/04 22:10:52 | 000,153,088 | —- | C] () – C:\Program Files\UNWISE.EXE
[2009/10/20 14:52:12 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2009/10/20 14:52:12 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2009/10/20 14:51:22 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2009/10/01 18:09:26 | 000,073,220 | —- | C] () – C:\Windows\System32\EPPICPrinterDB.dat
[2009/10/01 18:09:26 | 000,000,097 | —- | C] () – C:\Windows\System32\PICSDK.ini
[2009/10/01 18:09:25 | 000,031,053 | —- | C] () – C:\Windows\System32\EPPICPattern131.dat
[2009/10/01 18:09:25 | 000,029,114 | —- | C] () – C:\Windows\System32\EPPICPattern1.dat
[2009/10/01 18:09:25 | 000,027,417 | —- | C] () – C:\Windows\System32\EPPICPattern121.dat
[2009/10/01 18:09:25 | 000,021,021 | —- | C] () – C:\Windows\System32\EPPICPattern3.dat
[2009/10/01 18:09:25 | 000,015,670 | —- | C] () – C:\Windows\System32\EPPICPattern5.dat
[2009/10/01 18:09:25 | 000,013,280 | —- | C] () – C:\Windows\System32\EPPICPattern2.dat
[2009/10/01 18:09:25 | 000,010,673 | —- | C] () – C:\Windows\System32\EPPICPattern4.dat
[2009/10/01 18:09:25 | 000,004,943 | —- | C] () – C:\Windows\System32\EPPICPattern6.dat
[2009/10/01 18:09:25 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_PT.dat
[2009/10/01 18:09:25 | 000,001,140 | —- | C] () – C:\Windows\System32\EPPICPresetData_BP.dat
[2009/10/01 18:09:25 | 000,001,137 | —- | C] () – C:\Windows\System32\EPPICPresetData_ES.dat
[2009/10/01 18:09:25 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_FR.dat
[2009/10/01 18:09:25 | 000,001,130 | —- | C] () – C:\Windows\System32\EPPICPresetData_CF.dat
[2009/10/01 18:09:25 | 000,001,104 | —- | C] () – C:\Windows\System32\EPPICPresetData_EN.dat
[2009/10/01 18:07:33 | 000,000,079 | —- | C] () – C:\Windows\EPSCX7400.ini
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | —- | C] () – C:\Windows\System32\OGAEXEC.exe
[2007/10/27 04:57:38 | 000,000,037 | —- | C] () – C:\Windows\Acer.ini
[2007/06/05 11:29:04 | 000,016,384 | —- | C] () – C:\Windows\System32\LauncheRyAgentUser.exe
[2007/06/05 11:04:48 | 000,000,030 | —- | C] () – C:\Windows\SETPANEL.INI
[2007/06/05 11:04:46 | 000,000,092 | —- | C] () – C:\Windows\CLEANUP.INI
[2007/04/10 05:43:43 | 000,001,024 | RH– | C] () – C:\Windows\System32\NTIBUN4.dll
[2007/04/10 04:42:55 | 000,076,584 | —- | C] () – C:\Windows\System32\drivers\int15.sys
[2007/04/10 04:42:55 | 000,015,656 | —- | C] () – C:\Windows\System32\drivers\int15_64.sys
[2007/04/10 04:42:00 | 000,065,536 | —- | C] () – C:\Windows\System32\NATTraversal.dll
[2007/04/10 04:32:24 | 000,331,776 | —- | C] () – C:\Windows\System32\ScrollBarLib.dll
[2007/04/10 04:12:36 | 000,356,352 | —- | C] () – C:\Windows\EMCRI.dll
[2007/04/10 04:04:38 | 000,001,132 | —- | C] () – C:\Windows\RtDefLvl.ini
[2007/04/10 03:29:34 | 000,204,800 | —- | C] () – C:\Windows\System32\igfxCoIn_v1114.dll
[2007/04/10 03:29:34 | 000,053,248 | —- | C] () – C:\Windows\System32\oemdspif.dll
[2007/04/10 03:29:32 | 000,077,824 | —- | C] () – C:\Windows\System32\hccutils.dll
[2007/04/10 03:29:31 | 001,060,424 | —- | C] () – C:\Windows\System32\WdfCoInstaller01000.dll
[2007/04/10 03:28:47 | 000,042,594 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2007/02/07 01:58:10 | 000,204,800 | —- | C] () – C:\Windows\System32\NotesActnMenu.dll
[2007/02/07 01:57:58 | 000,266,240 | —- | C] () – C:\Windows\System32\NotesExtmngr.dll
[2007/02/07 01:57:20 | 000,086,016 | —- | C] () – C:\Windows\System32\MSNSpook.dll
[2007/02/07 01:56:30 | 000,028,672 | —- | C] () – C:\Windows\System32\BatchCrypto.dll
[2007/02/07 01:56:28 | 000,073,728 | —- | C] () – C:\Windows\System32\APISlice.dll
[2007/02/07 01:52:08 | 000,063,488 | —- | C] () – C:\Windows\System32\ShowErrMsg.dll
[2006/12/25 17:44:48 | 000,022,016 | —- | C] () – C:\Windows\System32\MailFormat_U.dll
[2006/11/13 07:50:06 | 000,071,680 | —- | C] () – C:\Windows\System32\HTCA_SelfExtract.bin
[2006/11/02 07:57:28 | 000,067,584 | –S- | C] () – C:\Windows\bootstat.dat
[2006/11/02 07:47:37 | 000,316,584 | —- | C] () – C:\Windows\System32\FNTCACHE.DAT
[2006/11/02 07:35:32 | 000,005,632 | —- | C] () – C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:33:01 | 000,595,684 | —- | C] () – C:\Windows\System32\perfh009.dat
[2006/11/02 05:33:01 | 000,287,440 | —- | C] () – C:\Windows\System32\perfi009.dat
[2006/11/02 05:33:01 | 000,101,350 | —- | C] () – C:\Windows\System32\perfc009.dat
[2006/11/02 05:33:01 | 000,030,674 | —- | C] () – C:\Windows\System32\perfd009.dat
[2006/11/02 05:25:21 | 000,061,440 | —- | C] () – C:\Windows\System32\igfxTMM.dll
[2006/11/02 05:23:21 | 000,215,943 | —- | C] () – C:\Windows\System32\dssec.dat
[2006/11/02 03:58:30 | 000,043,131 | —- | C] () – C:\Windows\mib.bin
[2006/11/02 03:19:00 | 000,000,741 | —- | C] () – C:\Windows\System32\NOISE.DAT
[2006/11/02 02:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini
[2006/11/02 02:25:31 | 000,673,088 | —- | C] () – C:\Windows\System32\mlang.dat
[2001/12/26 17:12:30 | 000,065,536 | —- | C] () – C:\Windows\System32\multiplex_vcd.dll
[2001/09/04 00:46:38 | 000,110,592 | —- | C] () – C:\Windows\System32\Hmpg12.dll
[2001/07/30 17:33:56 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC.dll
[2001/07/23 23:04:36 | 000,118,784 | —- | C] () – C:\Windows\System32\HMPV2_ENC_MMX.dll

========== LOP Check ==========

[2007/10/27 04:58:29 | 000,000,000 | —D | M] – C:\Users\Michele\AppData\Roaming\Acer
[2010/02/17 17:26:39 | 000,000,000 | —D | M] – C:\Users\Michele\AppData\Roaming\ESET
[2007/10/27 04:58:29 | 000,000,000 | —D | M] – C:\Users\Michele\AppData\Roaming\Leadertech
[2011/12/25 21:30:02 | 000,032,596 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2007/04/10 04:37:19 | 000,003,380 | —- | M] () – C:\-20070410.log
[2006/09/18 16:43:36 | 000,000,024 | —- | M] () – C:\autoexec.bat
[2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () – C:\bootmgr
[2007/04/10 03:30:30 | 000,008,192 | R-S- | M] () – C:\BOOTSECT.BAK
[2006/09/18 16:43:37 | 000,000,010 | —- | M] () – C:\config.sys
[2011/12/25 21:30:56 | 2137,120,768 | -HS- | M] () – C:\hiberfil.sys
[2007/10/28 03:21:11 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2007/10/28 03:21:11 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2011/12/25 21:30:55 | 2450,919,424 | -HS- | M] () – C:\pagefile.sys
[2007/04/10 04:05:28 | 000,000,420 | —- | M] () – C:\RHDSetup.log
[2007/04/10 04:28:10 | 000,000,178 | —- | M] () – C:\setup.log
[2007/04/10 04:48:50 | 000,000,000 | —- | M] () – C:\Trace.log

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | —- | M] () – C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | —- | M] () – C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | —- | M] () – C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/12/23 06:54:45 | 000,037,665 | —- | M] () – C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | —- | M] () – C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 07:35:48 | 000,022,528 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2006/10/19 12:00:56 | 000,187,392 | —- | M] () – C:\Windows\Acer.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2002/07/26 16:02:06 | 000,153,088 | —- | M] () – C:\Program Files\UNWISE.EXE

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | —- | M] () – C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | —- | M] () – C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | —- | M] () – C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | —- | M] () – C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2011/05/23 19:34:27 | 000,000,286 | -HS- | M] () – C:\Users\Michele\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/11/02 08:04:50 | 001,263,344 | —- | M] (ESET) – C:\Users\Michele\Desktop\eset_nod32_antivirus_live_installer.exe
[2011/12/26 17:25:23 | 000,584,192 | —- | M] (OldTimer Tools) – C:\Users\Michele\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-24 15:04:36

========== Alternate Data Streams ==========

@Alternate Data Stream - 116 bytes -> C:\ProgramData\TEMP:DD4DD9B9

< End of report >

OTL Extras logfile created on: 12/26/2011 5:29:41 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Michele\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1.99 Gb Total Physical Memory | 1.07 Gb Available Physical Memory | 53.90% Memory free
4.21 Gb Paging File | 3.01 Gb Available in Paging File | 71.49% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 69.78 Gb Total Space | 21.46 Gb Free Space | 30.76% Space Free | Partition Type: NTFS
Drive D: | 69.51 Gb Total Space | 69.42 Gb Free Space | 99.87% Space Free | Partition Type: NTFS

Computer Name: MICHELE-PC | User Name: Michele | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [MediaMonkey.1Play] – "C:\Program Files\MediaMonkey\MediaMonkey.exe" "%1"
Directory [MediaMonkey.2PlayNext] – "C:\Program Files\MediaMonkey\MediaMonkey.exe" /NEXT "%1"
Directory [MediaMonkey.3Enqueue] – "C:\Program Files\MediaMonkey\MediaMonkey.exe" /ADD "%1"
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{07FB6E4D-0B0D-432C-99B6-12D0DD1D2CF0}" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"{2564132A-89FC-4665-A9A2-1559BF33012E}" = dir=in | app=c:\program files\acer arcade deluxe\videomagician\magicdirector.exe |
"{61D6F5A3-DAD3-4E8C-9CE5-63523CC49926}" = dir=in | app=c:\program files\acer arcade deluxe\acer arcade deluxe\acer arcade deluxe.exe |
"{710ACE43-16F2-4BF1-8D40-B096E40BB00F}" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"{A5804DF0-A6C2-47CE-8E8C-3CF154F8B0B5}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{B26291DD-6DFB-4E50-B7DA-DCA02BDC6CE0}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{D7234E07-012D-42D4-AF05-A6748696508A}" = dir=in | app=c:\program files\acer arcade deluxe\dv wizard\powerdv.exe |
"{F92F3B7D-937B-4CE2-AE67-C63A3EC4BEBC}" = dir=in | app=c:\program files\acer arcade deluxe\dvdivine\dvdivine.exe |
"TCP Query User{061B2241-48F1-489B-9CC2-035A6A1372FF}C:\program files\real\realplayer\realplay.exe" = protocol=6 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"TCP Query User{07D70E9D-A026-4195-8741-F66B7B13119E}C:\program files\limewire\limewire.exe" = protocol=6 | dir=in | app=c:\program files\limewire\limewire.exe |
"TCP Query User{4E92F911-A73F-48D6-93FB-990A78D06A4A}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{5691CD52-560A-44A1-B188-99BAE29264C6}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{3828BF99-2344-4E81-8743-7A1605FD8AD6}C:\program files\limewire\limewire.exe" = protocol=17 | dir=in | app=c:\program files\limewire\limewire.exe |
"UDP Query User{47FA933A-F41D-4BC9-A3B8-310933062B56}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{68DAAF7F-CA78-4FCF-8B8C-B67C23823B9D}C:\program files\real\realplayer\realplay.exe" = protocol=17 | dir=in | app=c:\program files\real\realplayer\realplay.exe |
"UDP Query User{EAD50A99-5A30-4A90-92E8-E32CA6CA312E}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0D6D96F4-0CAF-4522-B05F-70A88EDECDFD}" = ArcSoft Print Creations
"{0F79C1B2-36B2-4B62-8221-42721CF54638}" = Acer OrbiCam Application
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}" = SMSC Fast Infrared Driver
"{24ADC0E4-8D3E-40C4-9106-F2DE5E9112F1}" = EPSON Stylus CX7400 Series Scanner Driver Update
"{26A24AE4-039D-4CA4-87B4-2F83216030FF}" = Java™ 6 Update 30
"{2D371881-67FB-4EAB-B59A-F59DC43199DD}" = LG United Mobile Drivers
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{35725FBC-A136-4A46-9F29-091759D9BB93}" = MVision
"{3CFC16D1-C831-4CEB-B27D-342E7E2D5603}" = ESET NOD32 Antivirus
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{67ADE9AF-5CD9-4089-8825-55DE4B366799}" = NTI Backup NOW! 4.7
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{A87B11AC-4344-4E5D-8B12-8F471A87DAD9}" = LightScribe 1.4.136.1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer
"{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{C8CE30F9-CBD0-43B1-BFD3-B18F55A48827}" = Calendar Creator 10
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D03E7B00-CA85-4684-9321-1888873C34BD}" = ArcSoft PhotoImpression 6
"{EA516024-D84D-41F1-814F-83175A6188F2}" = Logitech Video Enumerator
"{EFBDC2B0-FAA8-4B78-8DE1-AEBE7958FA37}" = Acer Arcade Deluxe
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"4000 Family Clip Art & 750 Fonts" = 4000 Family Clip Art & 750 Fonts
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"AcerOrbiCamDrv" = Acer Camera Driver
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Calendar Creator 6.0 Deluxe" = Calendar Creator 6.0 Deluxe
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV;_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"DAO (Data Access Objects) 3.5" = DAO (Data Access Objects) 3.5
"Digital Editions" = Adobe Digital Editions
"Easy CD-DA Extractor 12" = Easy CD-DA Extractor 12
"EPSON Printer and Utilities" = EPSON Printer Software
"EPSON Scanner" = EPSON Scan
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MediaMonkey_is1" = MediaMonkey 3.2
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox 8.0.1 (x86 en-US)" = Mozilla Firefox 8.0.1 (x86 en-US)
"RealPlayer 6.0" = RealPlayer
"Silent Package Run-Time Sample" = EPSON CX7400 User's Guide
"Slot City 2" = Encore Software's Slot City 2 Plus Video Poker
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WebPost" = Microsoft Web Publishing Wizard 1.52
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Move Media Player" = Move Media Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/14/2010 8:47:49 AM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18865, time stamp
0x4b077416, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0x1440, application
start time 0x01ca951787c1559b.

Error - 1/16/2010 9:01:45 AM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application AcroRd32.exe, version 7.0.8.218, time stamp 0x446abf60,
faulting module Multimedia.api, version 7.0.5.172, time stamp 0x4334ea96, exception
code 0xc0000005, fault offset 0x000f57ac, process id 0x156c, application start time
0x01ca96ac01ae83e0.

Error - 1/17/2010 4:49:23 PM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18865, time stamp
0x4b077416, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0xaac, application
start time 0x01ca97b62ee15da0.

Error - 1/19/2010 10:19:33 AM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18865, time stamp
0x4b077416, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0x838, application
start time 0x01ca99123f18dec0.

Error - 1/19/2010 10:38:02 AM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18865, time stamp
0x4b077416, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0x60c, application
start time 0x01ca9913885700c0.

Error - 1/19/2010 4:07:59 PM | Computer Name = Michele-PC | Source = Application Hang | ID = 1002
Description = The program WINWORD.EXE version 12.0.6504.5000 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: c40 Start Time: 01ca99326fbd54f0 Termination Time: 60000

Error - 1/21/2010 5:55:52 PM | Computer Name = Michele-PC | Source = Application Hang | ID = 1002
Description = The program WINWORD.EXE version 12.0.6504.5000 stopped interacting
with Windows and was closed. To see if more information about the problem is available,
check the problem history in the Problem Reports and Solutions control panel. Process
ID: 340 Start Time: 01ca9acc8f69fa4d Termination Time: 60000

Error - 1/22/2010 11:09:20 AM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18865, time stamp
0x4b077416, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0x1768, application
start time 0x01ca9b71e97dc540.

Error - 1/22/2010 12:25:48 PM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18865, time stamp
0x4b077416, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0x1c8, application
start time 0x01ca9b74e26eb450.

Error - 1/25/2010 8:36:30 PM | Computer Name = Michele-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18882, time stamp
0x4b3ed243, faulting module ntdll.dll, version 6.0.6002.18005, time stamp 0x49e03821,
exception code 0xc0000005, fault offset 0x0003e13d, process id 0x3f8, application
start time 0x01ca9e1f1b86bbf0.

[ Media Center Events ]
Error - 11/24/2007 3:55:27 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 11/26/2007 1:43:34 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 3/7/2008 6:41:20 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 5/24/2008 9:17:00 AM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 5/26/2008 3:52:58 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 5/27/2008 9:48:51 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 6/1/2008 12:21:13 AM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 6/6/2008 10:16:49 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package MCESpotlight.

Error - 8/28/2008 6:31:51 AM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/29/2009 9:45:01 PM | Computer Name = Michele-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

========== Last 10 Event Log Errors ==========

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

CatByte

Post #2December 27, 2011, 9:14 PM UTC

Second her music got copied to her recycle bin

Just to be on the cautious side > back up all her music files first before emptying the recycle bin in case it deletes all her music.

Please run the following:

Please download aswMBR to your desktop.

Double click the aswMBR.exe icon to run it
When asked if you want to download Avast's virus definitions please select Yes.
Click the Scan button to start the scan
On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.
You will also notice another file created on the desktop named MBR.dat. Right click that file and select Send To>Compressed (zipped) file. Attach that zipped file in your next reply as well

fertigline

Post #3December 28, 2011, 2:31 AM UTC

Here are the results from the aswMBR scan. aswMBR version 0.9.9.1120 Copyright© 2011 AVAST Software Run date: 2011-12-27 21:20:25 —————————– 21:20:25.961 OS Version: Windows 6.0.6002 Service Pack 2 21:20:25.961 Number of processors: 2 586 0xF02 21:20:25.961 ComputerName: MICHELE-PC UserName: Michele 21:20:26.819 Initialize success 21:20:31.842 AVAST engine defs: 11122702 21:20:36.585 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 21:20:36.585 Disk 0 Vendor: Hitachi_HTS541616J9SA00 SB4OC70P Size: 152627MB BusType: 3 21:20:38.675 Disk 0 MBR read successfully 21:20:38.691 Disk 0 MBR scan 21:20:38.691 Disk 0 unknown MBR code 21:20:38.691 Disk 0 Partition 1 00 27 Hidden NTFS WinRE NTFS 9993 MB offset 63 21:20:38.722 Disk 0 Partition 2 80 (A) 06 FAT16 NTFS 71453 MB offset 20466810 21:20:38.753 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 71178 MB offset 166802895 21:20:38.784 Disk 0 scanning sectors +312576705 21:20:38.956 Disk 0 scanning C:\Windows\system32\drivers 21:21:19.812 Service scanning 21:21:21.403 Modules scanning 21:21:44.959 Disk 0 trace - called modules: 21:21:44.991 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS intelide.sys PCIIDEX.SYS atapi.sys 21:21:45.006 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x854db3b8] 21:21:45.006 3 CLASSPNP.SYS[883ba8b3] -> nt!IofCallDriver -> [0x84dea888] 21:21:45.006 5 acpi.sys[87c966bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84e37030] 21:21:45.677 AVAST engine scan C:\Windows 21:21:49.343 AVAST engine scan C:\Windows\system32 21:24:57.822 AVAST engine scan C:\Windows\system32\drivers 21:25:14.701 AVAST engine scan C:\Users\Michele 21:27:13.402 Disk 0 MBR has been saved successfully to "C:\Users\Michele\Desktop\MBR.dat" 21:27:13.417 The log file has been saved successfully to "C:\Users\Michele\Desktop\aswMBR.txt"

Attachments:

📎MBR.zip

CatByte

Post #4December 28, 2011, 2:44 AM UTC

Hi,

Please do the following

Refer to the ComboFix User's Guide

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Place ComboFix.exe on your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with ComboFix.
You can get help on disabling your protection programs here
Double click on ComboFix.exe & follow the prompts.
Your desktop may go blank. This is normal. It will return when ComboFix is done. ComboFix may reboot your machine. This is normal.
When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

———————————————————————————————
Ensure your AntiVirus and AntiSpyware applications are re-enabled.

———————————————————————————————

NOTE: If you encounter a message "illegal operation attempted on registry key that has been marked for deletion" and no programs will run - please just reboot and that will resolve that error.

fertigline

Post #5December 28, 2011, 5:33 AM UTC

here's the combo fix log.

ComboFix 11-12-27.01 - Michele 12/27/2011 23:58:14.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2037.858 [GMT -5:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
AV: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {77DEAFED-8149-104B-25A1-21771CA47CD1}
SP: ESET NOD32 Antivirus 5.0 *Disabled/Updated* {CCBF4E09-A773-1FC5-1F11-1A056723366C}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\UNWISE.EXE
c:\users\Michele\g2mdlhlpx.exe
c:\users\Michele\MoveMediaPlayerWin_071503000010.exe
c:\windows\Downloaded Program Files\popcaploader.dll
c:\windows\Downloaded Program Files\popcaploader.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-11-28 to 2011-12-28 )))))))))))))))))))))))))))))))
.
.
2011-12-28 05:07 . 2011-12-28 05:08 ——– d—–w- c:\users\Michele\AppData\Local\temp
2011-12-28 05:07 . 2011-12-28 05:07 ——– d—–w- c:\users\Default\AppData\Local\temp
2011-12-28 00:54 . 2011-12-28 02:05 56200 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BD894381-6308-401B-A5DC-A27B02F66905}\offreg.dll
2011-12-28 00:54 . 2011-11-21 10:47 6823496 —-a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{BD894381-6308-401B-A5DC-A27B02F66905}\mpengine.dll
2011-12-26 14:34 . 2011-12-26 14:34 ——– d—–w- c:\users\Michele\AppData\Local\Microsoft Help
2011-12-26 14:33 . 2011-12-26 14:33 ——– d—–w- c:\program files\Microsoft Works
2011-12-26 14:33 . 2011-12-26 14:33 ——– d—–w- c:\program files\Microsoft.NET
2011-12-25 04:58 . 2011-12-25 04:58 ——– d—–w- c:\program files\Common Files\Java
2011-12-25 04:57 . 2011-12-25 04:57 ——– d—–w- c:\program files\Java
2011-12-25 04:52 . 2011-12-25 04:52 0 —-a-w- c:\windows\system32\RENE6F5.tmp
2011-12-25 04:52 . 2011-12-25 04:52 0 —-a-w- c:\windows\system32\RENE6F4.tmp
2011-12-25 04:52 . 2011-12-25 04:52 0 —-a-w- c:\windows\system32\RENE6F3.tmp
2011-12-25 04:48 . 2011-12-25 04:48 ——– d—–w- c:\program files\Microsoft Silverlight
2011-12-24 14:39 . 2011-12-24 14:39 ——– d–h–w- c:\users\Michele\AppData\Local\acer eNM
2011-12-24 14:38 . 2011-12-24 14:38 ——– d—–w- c:\users\Michele\AppData\Local\VirtualStore
2011-12-24 14:35 . 2011-12-24 14:35 2560 —-a-w- c:\windows\_MSRSTRT.EXE
2011-12-24 01:48 . 2011-12-24 01:48 ——– d—–w- c:\users\Michele\AppData\Roaming\DivX
2011-12-24 01:44 . 2011-12-24 14:15 ——– d—–w- c:\programdata\DivX
2011-12-15 11:52 . 2011-11-23 13:37 2043904 —-a-w- c:\windows\system32\win32k.sys
2011-12-15 11:52 . 2011-10-27 08:01 3602816 —-a-w- c:\windows\system32\ntkrnlpa.exe
2011-12-15 11:52 . 2011-10-27 08:01 3550080 —-a-w- c:\windows\system32\ntoskrnl.exe
2011-12-15 11:51 . 2011-10-14 16:02 429056 —-a-w- c:\windows\system32\EncDec.dll
2011-12-15 11:51 . 2011-10-25 15:56 49152 —-a-w- c:\windows\system32\csrsrv.dll
2011-12-15 11:51 . 2011-11-08 14:42 2048 —-a-w- c:\windows\system32\tzres.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-12-26 16:21 . 2011-05-17 10:42 414368 —-a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-25 04:57 . 2010-09-16 00:08 472808 —-a-w- c:\windows\system32\deployJava1.dll
2011-11-21 04:04 . 2011-12-24 14:50 134104 —-a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-11-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-11-06 106496]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-11-06 81920]
"RtHDVCpl"="RtHDVCpl.exe" [2007-03-01 4390912]
"eDataSecurity Loader"="c:\acer\Empowering Technology\eDataSecurity\eDSloader.exe" [2007-02-07 464168]
"Acer Tour Reminder"="c:\acer\AcerTour\Reminder.exe" [2007-01-17 151552]
"BYRUA_AGENT"="c:\programdata\LGMOBILEAX\BYR_Client\VZWUAAgent.exe" [2011-06-14 392280]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2011-09-22 3080264]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
c:\users\Michele\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Empowering Technology Launcher.lnk - c:\acer\Empowering Technology\eAPLauncher.exe [2007-4-10 528384]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\eNetHook.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2011-06-09 18:06 254696 —-a-w- c:\program files\Common Files\Java\Java Update\jusched.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [x]
R3 Andbus;LGE Android Platform Composite USB Device;c:\windows\system32\DRIVERS\lgandbus.sys [x]
R3 AndDiag;LGE Android Platform USB Serial Port;c:\windows\system32\DRIVERS\lganddiag.sys [x]
R3 AndGps;LGE Android Platform USB GPS NMEA Port;c:\windows\system32\DRIVERS\lgandgps.sys [x]
R3 ANDModem;LGE Android Platform USB Modem;c:\windows\system32\DRIVERS\lgandmodem.sys [x]
R3 f5ipfw;F5 Networks StoneWall Filter;c:\windows\system32\drivers\urfltwlh.sys [2007-10-01 13952]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [x]
S1 ehdrv;ehdrv;c:\windows\system32\DRIVERS\ehdrv.sys [2011-08-04 118104]
S2 ALaunchService;ALaunch Service;c:\acer\ALaunch\ALaunchSvc.exe [2007-01-26 50688]
S2 eamonm;eamonm;c:\windows\system32\DRIVERS\eamonm.sys [2011-08-09 163424]
S2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2011-09-22 974944]
S2 epfwwfpr;epfwwfpr;c:\windows\system32\DRIVERS\epfwwfpr.sys [2011-08-04 103112]
S3 urvpndrv;F5 Networks VPN Adapter;c:\windows\system32\DRIVERS\urvpnwlh.sys [2007-10-01 29824]
.
.
— Other Services/Drivers In Memory —
.
*Deregistered* - aswMBR
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://ww.yahoo.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://en.us.acer.yahoo.com
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ycomp/defaults/su/*http://www.yahoo.com
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
Trusted Zone: arielcorp.com\email
Trusted Zone: arielcorp.com\www
TCP: DhcpNameServer = [removed] [removed]
FF - ProfilePath - c:\users\Michele\AppData\Roaming\Mozilla\Firefox\Profiles\23icuuwi.default\
FF - prefs.js: browser.startup.homepage - hxxp://ww.yahoo.com/
FF - prefs.js: network.proxy.type - 0
.
- - - - ORPHANS REMOVED - - - -
.
BHO-{7b13ec3e-999a-4b70-b9cb-2617b8323822} - (no file)
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-Acer Tour Reminder - (no file)
HKCU-Run-swg - c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
HKLM-Run-ALaunch - c:\acer\ALaunch\AlaunchClient.exe
HKLM-Run-SynTPEnh - c:\program files\Synaptics\SynTP\SynTPEnh.exe
HKLM-Run-Acer Tour - (no file)
HKLM-Run-LManager - c:\progra~1\LAUNCH~1\LManager.exe
HKLM-Run-LogitechCommunicationsManager - c:\program files\Common Files\Logitech\LComMgr\Communications_Helper.exe
HKLM-Run-AcerOrbicamRibbon - c:\program files\Acer\OrbiCam10\OrbiCam.exe
HKLM-Run-eRecoveryService - (no file)
HKLM-Run-LVCOMSX - c:\program files\Common Files\Logitech\LComMgr\LVComSX.exe
HKLM-Run-eDSMSNfix - c:\acer\Empowering Technology\eDSMSNfix.exe
HKLM-Run-Acer Product Registration - c:\program files\Acer Registration\ACE1.exe
HKLM-Run-Acer Assist Launcher - c:\program files\Acer Assist\launcher.exe
HKLM-Run-SetPanel - c:\acer\APanel\APanel.cmd
HKLM-Run-TkBellExe - c:\program files\Common Files\Real\Update_OB\realsched.exe
HKLM-Run-Malwarebytes Anti-Malware (reboot) - c:\program files\Malwarebytes' Anti-Malware\mbam.exe
HKLM-Run-Adobe Reader Speed Launcher - c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe
HKLM-Run-Adobe ARM - c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
AddRemove-4000 Family Clip Art & 750 Fonts - c:\program files\Starshine\4000FCA\DeIsL1.isu
AddRemove-Acer Assist - c:\program files\Acer Assist\uninstall.exe
AddRemove-Acer Registration - c:\program files\Acer Registration\uninstall.exe
AddRemove-AcerOrbiCamDrv - c:\program files\Common Files\Acer\OrbiCam\BIN\SETUP.EXE
AddRemove-Adobe AIR - c:\program files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe
AddRemove-Calendar Creator 6.0 Deluxe - c:\progra~1\CALEND~1.0DE\UNWISE.EXE
AddRemove-CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118 - c:\program files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118\HXFSETUP.EXE
AddRemove-DAO (Data Access Objects) 3.5 - c:\progra~1\COMMON~1\MICROS~1\DAO\UNWISE.EXE
AddRemove-Digital Editions - c:\program files\Adobe\Adobe Digital Editions\uninstall.exe
AddRemove-EPSON Scanner - c:\program files\epson\escndv\setup\setup.exe
AddRemove-InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2} - c:\progra~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe
AddRemove-Malwarebytes' Anti-Malware_is1 - c:\program files\Malwarebytes' Anti-Malware\unins000.exe
AddRemove-MediaMonkey_is1 - c:\program files\MediaMonkey\unins000.exe
AddRemove-RealJukebox 1.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe
AddRemove-RealPlayer 6.0 - c:\program files\Common Files\Real\Update_OB\r1puninst.exe
AddRemove-Silent Package Run-Time Sample - c:\program files\epson\guide\cx7400_e\uninstall.exe
AddRemove-Slot City 2 - c:\program files\Encore Software\Slot City 2 Plus Video Poker\Uninst.isu
AddRemove-{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4} - c:\program files\InstallShield Installation Information\{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}\setup.exe
AddRemove-{67ADE9AF-5CD9-4089-8825-55DE4B366799} - c:\program files\InstallShield Installation Information\{67ADE9AF-5CD9-4089-8825-55DE4B366799}\setup.exe
AddRemove-{D03E7B00-CA85-4684-9321-1888873C34BD} - c:\program files\InstallShield Installation Information\{D03E7B00-CA85-4684-9321-1888873C34BD}\Setup.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-12-28 00:07
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes …
.
scanning hidden autostart entries …
.
scanning hidden files …
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
——————— DLLs Loaded Under Running Processes ———————
.
- - - - - - - > 'winlogon.exe'(728)
c:\windows\system32\eNetHook.dll
.
- - - - - - - > 'lsass.exe'(756)
c:\windows\system32\eNetHook.dll
.
Completion time: 2011-12-28 00:15:52
ComboFix-quarantined-files.txt 2011-12-28 05:15
.
Pre-Run: 26,135,912,448 bytes free
Post-Run: 26,301,845,504 bytes free
.
- - End Of File - - 45D86398E9A68B16AF6150DA7D9AF547

CatByte

Post #6December 28, 2011, 1:42 PM UTC last edited January 6, 2012, 2:12 AM UTC

A number of software programs were removed from your machine as "orphaned" - meaning parts that they need to run were not present on the machine, so they could not function, therefore they were removed.

If your wife sees there are programs that she requires, then she will need to re-install those programs.

You might want to consider a Startup repair

http://www.bleepingcomputer.com/tutorials/…startup-repair/

Let me know how that goes,

in the meantime, also do this:

Please download Malwarebytes' Anti-Malware

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish, so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected. <– very important
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process, if asked to restart the computer, please do so immediately.

NEXT

Go here to run an online scanner from ESET.

Turn off the real time scanner of any existing antivirus program while performing the online scan
Tick the box next to YES, I accept the Terms of Use.
Click Start
When asked, allow the activeX control to install
Click Start
Make sure that the option Remove found threats is unticked and the Scan Archives option is ticked.
Click on Advanced Settings, ensure the options Scan for potentially unwanted applications, Scan for potentially unsafe applications, and Enable Anti-Stealth Technology are ticked.
Click Scan
Wait for the scan to finish
When the scan completes, press the LIST OF THREATS FOUND button
Press EXPORT TO TEXT FILE , name the file ESETSCAN and save it to your desktop
Include the contents of this report in your next reply.
Press the BACK button.
Press Finish

fertigline

Post #7December 28, 2011, 11:25 PM UTC

Ok, I scanned with Ebam and here are those results: Malwarebytes Anti-Malware (Trial) 1.60.0.1800 www.malwarebytes.org Database version: v2011.12.28.05 Windows Vista Service Pack 2 x86 NTFS Internet Explorer 9.0.8112.16421 Michele :: MICHELE-PC [administrator] Protection: Enabled 12/28/2011 5:59:50 PM mbam-log-2011-12-28 (17-59-50).txt Scan type: Quick scan Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM Scan options disabled: P2P Objects scanned: 161498 Time elapsed: 4 minute(s), 21 second(s) Memory Processes Detected: 0 (No malicious items detected) Memory Modules Detected: 0 (No malicious items detected) Registry Keys Detected: 1 HKCR\AppID\activex.DLL (Adware.180Solutions) -> Quarantined and deleted successfully. Registry Values Detected: 0 (No malicious items detected) Registry Data Items Detected: 0 (No malicious items detected) Folders Detected: 0 (No malicious items detected) Files Detected: 0 (No malicious items detected) (end)

CatByte

Post #8December 29, 2011, 12:31 AM UTC

OK good were you able to do the online ESET scan? how is the computer running? Are there any outstanding issues?

fertigline

Post #9December 29, 2011, 3:12 AM UTC

the eset scan webt fine , no issues there……….. however………. I have a new problem. When I tried to reinstall some of the programs I came up with a "Calendar Creator" program window that says : the install script engine is missing from this machine. If available, please run ISScript.msi, or contact your support personnel for further assistance." I have tried to unistall the "Calendar creator" program. No luck there. I have also tried to download and install the "ISScript.msi" file. No luck there either.

CatByte

Post #10December 29, 2011, 3:24 AM UTC

Is this a program you want to keep?

where did it originate from? This was one of the programs that I referred to earlier, where there had been missing files and ComboFix removed the orphaned entries,

you may need to install a number of programs again, or try REVO uninstaller to get rid of any remnants

Download and install the Revo Uninstaller

Double click the new Revo Uninstaller icon on your desktop to start the program
Scroll through the listed programs and Right Click on the program you wish to uninstall
From the pop out menu choose Uninstall
Click Yes to the confirmation dialogue
In the next window select the Advanced mode
Click Next to start uninstalling the program
Answer Yes to confirm the uninstall
When the program has completed the four steps, click Next to allow the program to search for leftovers
Once complete, click Next, then Finish
Repeat the above steps for any other programs you wish to remove.

If that doesn't work then please do the following

Click Start>Run and copy/paste the following bolded text into the Run box and click OK:

C:\Qoobox\ComboFix-quarantined-files.txt

A report should pop open for you. Please post the contents in your next reply.

fertigline

Post #11December 29, 2011, 4:17 AM UTC

The Revo didn't work. Here are the results of the run command: 2011-12-28 05:15:06 . 2011-12-28 05:15:06 2,536 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-{D03E7B00-CA85-4684-9321-1888873C34BD}.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 2,338 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-{67ADE9AF-5CD9-4089-8825-55DE4B366799}.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 2,456 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-{1AEC7728-1640-4E98-AABC-5EBE3FB57FE4}.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 646 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Slot City 2.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 538 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Silent Package Run-Time Sample.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 1,236 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-RealPlayer 6.0.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 504 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-RealJukebox 1.0.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 4,174 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-MediaMonkey_is1.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 2,196 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Malwarebytes' Anti-Malware_is1.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 2,846 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}.reg.dat 2011-12-28 05:15:06 . 2011-12-28 05:15:06 604 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-EPSON Scanner.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:06 634 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Digital Editions.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 632 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-DAO (Data Access Objects) 3.5.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 704 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 580 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Calendar Creator 6.0 Deluxe.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 1,238 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Adobe AIR.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 1,066 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-AcerOrbiCamDrv.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 1,096 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Acer Registration.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 918 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-Acer Assist.reg.dat 2011-12-28 05:15:05 . 2011-12-28 05:15:05 720 —-a-w- C:\Qoobox\Quarantine\Registry_backups\AddRemove-4000 Family Clip Art & 750 Fonts.reg.dat 2011-12-28 05:14:11 . 2011-12-28 05:14:11 259 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Adobe ARM.reg.dat 2011-12-28 05:14:11 . 2011-12-28 05:14:11 259 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Adobe Reader Speed Launcher.reg.dat 2011-12-28 05:14:11 . 2011-12-28 05:14:11 198 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Malwarebytes Anti-Malware (reboot).reg.dat 2011-12-28 05:14:11 . 2011-12-28 05:14:11 172 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TkBellExe.reg.dat 2011-12-28 05:14:11 . 2011-12-28 05:14:11 123 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-SetPanel.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 396 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Acer Assist Launcher.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 396 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Acer Product Registration.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 142 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-eDSMSNfix.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 161 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-LVCOMSX.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 103 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-eRecoveryService.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 161 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-AcerOrbicamRibbon.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 197 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-LogitechCommunicationsManager.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 131 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-LManager.reg.dat 2011-12-28 05:14:09 . 2011-12-28 05:14:09 396 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Acer Tour.reg.dat 2011-12-28 05:14:06 . 2011-12-28 05:14:06 144 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-SynTPEnh.reg.dat 2011-12-28 05:13:57 . 2011-12-28 05:13:57 130 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-ALaunch.reg.dat 2011-12-28 05:13:54 . 2011-12-28 05:13:54 175 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-updateMgr.reg.dat 2011-12-28 05:13:54 . 2011-12-28 05:13:54 168 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-swg.reg.dat 2011-12-28 05:13:52 . 2011-12-28 05:13:52 104 —-a-w- C:\Qoobox\Quarantine\Registry_backups\HKCU-Run-Acer Tour Reminder.reg.dat 2011-12-28 05:13:49 . 2011-12-28 05:13:49 171 —-a-w- C:\Qoobox\Quarantine\Registry_backups\WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440}.reg.dat 2011-12-28 05:13:48 . 2011-12-28 05:13:48 186 —-a-w- C:\Qoobox\Quarantine\Registry_backups\BHO-{7b13ec3e-999a-4b70-b9cb-2617b8323822}.reg.dat 2011-12-28 05:02:15 . 2011-12-28 05:02:15 5,900 —-a-w- C:\Qoobox\Quarantine\Registry_backups\tcpip.reg 2011-12-28 04:55:41 . 2011-12-28 04:58:14 62 —-a-w- C:\Qoobox\Quarantine\catchme.log 2011-10-12 22:18:21 . 2011-10-12 22:18:22 60,304 —-a-w- C:\Qoobox\Quarantine\C\Users\Michele\g2mdlhlpx.exe.vir 2010-09-05 03:10:52 . 2002-07-26 21:02:06 153,088 —-a-w- C:\Qoobox\Quarantine\C\Program Files\UNWISE.EXE.vir 2009-09-14 18:09:28 . 2009-09-14 18:09:37 1,686,272 —-a-w- C:\Qoobox\Quarantine\C\Users\Michele\MoveMediaPlayerWin_071503000010.exe.vir 2003-12-19 22:02:06 . 2003-12-19 22:02:06 126,976 —-a-w- C:\Qoobox\Quarantine\C\Windows\Downloaded Program Files\popcaploader.dll.vir 2003-12-19 20:43:48 . 2003-12-19 20:43:48 241 —-a-w- C:\Qoobox\Quarantine\C\Windows\Downloaded Program Files\popcaploader.inf.vir

CatByte

Post #12December 29, 2011, 2:08 PM UTC

Hi,

we can try restoring the registry key for that program

Open Windows explorer and navigate to this folder

C:\QooBox\Quarantine\Registry_Backups

In the right hand panel, locate this file

C:\Qoobox\Quarantine\Registry_backups\AddRemove-Calendar Creator 6.0 Deluxe.reg.dat

you will need to delete the extra extension so the file ends in .reg like this

for C:\Qoobox\Quarantine\Registry_backups\AddRemove-Calendar Creator 6.0 Deluxe.reg.dat remove the .dat so you have this remaining

C:\Qoobox\Quarantine\Registry_backups\AddRemove-Calendar Creator 6.0 Deluxe.reg

To do that right click on the file > select rename

remove only the .dat from the end of the filename
left click near the file name to ensure the rename is correct
Next double click the renamed file to ALLOW it to merge into the registry

I also notice from qoobox that C:\Qoobox\Quarantine\C\Program Files\UNWISE.EXE.vir was removed, which is an uninstaller program used by many different software programs, this one was likely infected for it to have been removed.

Let's get it analyzed first:

please do this:

submit a file to virustotal for analysis

Use the browse button on that page to navigate to the location of the file to be scanned.
In the right hand panel,
click on the file C:\Qoobox\Quarantine\C\Program Files\UNWISE.EXE.vir
then click the open button.
The file will now be displayed in the submit box.
Scroll down a bit and click "send file", wait for the results
If you get a message saying File has already been analyzed: click Reanalyze file now
Once scanned, copy and paste the link to the results page in your next reply.

Quite often, the easiest way to resolve corrupted programs is to re-install them over what is left on the machine, that usually takes care of it.

Let me know

fertigline

Post #13January 5, 2012, 2:01 AM UTC

Just wanted to let you know that I would like to continue working on this. I had a family member in the hospital and then got sick myself. I should continue with this issue sometime this evening or tomorrow morning. Thanks for your patience.

CatByte

Post #14January 5, 2012, 2:03 AM UTC

no problem, Hope you are feeling better

fertigline

Post #15January 5, 2012, 9:53 AM UTC

here is the virustotal link.

http://www.virustotal.com/file-scan/report…2876-1325756412

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

promlems with laptop [Solved]

✨ Ask AI

Ask AI