What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Start.funmoods infection [Solved]

16 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #16
Hello JonTom,
I have posted the two logs that you require from the OTL scan , I hope that they are correct, thanks yet again for your quick replies , all the best , Neale

All processes killed
Error: Unable to interpret in the current context!
========== FILES ==========
C:\Program Files\FoxTabPDFConverter\Uninstall\Uninstall.exe moved successfully.
C:\Users\`neale\Cars,Bikes,Planes\Downloads\registrybooster.exe moved successfully.
C:\Users\`neale\AppData\Local\Babylon\Setup\HtmlScreens folder moved successfully.
C:\Users\`neale\AppData\Local\Babylon\Setup folder moved successfully.
C:\Users\`neale\AppData\Local\Babylon folder moved successfully.
C:\Users\`neale\Desktop\PageRage-SilentInstaller.exe moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

User: `neale
->Temp folder emptied: 4444173 bytes
->Temporary Internet Files folder emptied: 7552648 bytes
->Java cache emptied: 0 bytes
->Google Chrome cache emptied: 15370025 bytes
->Flash cache emptied: 837 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 18714 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 26.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

User: `neale
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.39.2 log created on 04162012_101310

Files\Folders moved on Reboot…
C:\Windows\temp\JETE030.tmp moved successfully.

Registry entries deleted on Reboot…




OTL logfile created on: 16/04/2012 10:32:30 - Run 3
OTL by OldTimer - Version 3.2.39.2 Folder = C:\Users\`neale\Cars,Bikes,Planes\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.99 Gb Total Physical Memory | 1.24 Gb Available Physical Memory | 62.24% Memory free
4.21 Gb Paging File | 3.38 Gb Available in Paging File | 80.29% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 222.79 Gb Total Space | 77.62 Gb Free Space | 34.84% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 6.38 Gb Free Space | 63.76% Space Free | Partition Type: NTFS

Computer Name: NEALEPC | User Name: `neale | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/11 19:41:53 | 000,593,920 | —- | M] (OldTimer Tools) – C:\Users\`neale\Cars,Bikes,Planes\Downloads\OTL.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | —- | M] (Microsoft Corporation) – C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe
PRC - [2011/03/25 13:34:00 | 004,371,768 | —- | M] (Virgin Media) – C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe
PRC - [2010/04/14 13:27:58 | 008,263,584 | —- | M] (Steek) – C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe
PRC - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
PRC - [2009/04/11 07:27:36 | 002,926,592 | —- | M] (Microsoft Corporation) – C:\Windows\explorer.exe
PRC - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe
PRC - [2008/05/01 23:41:38 | 000,136,488 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\WTablet\Pen_TabletUser.exe
PRC - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) – C:\Windows\System32\Pen_Tablet.exe
PRC - [2007/10/09 17:21:06 | 000,169,328 | —- | M] (Maxtor Corporation) – C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe
PRC - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe
PRC - [2007/02/08 06:16:24 | 000,303,104 | —- | M] (SigmaTel, Inc.) – C:\Windows\sttray.exe
PRC - [2006/11/12 02:19:46 | 000,446,976 | —- | M] (Gteko Ltd.) – C:\Program Files\DellSupport\DSAgnt.exe
PRC - [2006/11/05 11:22:16 | 000,221,184 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
PRC - [2006/11/05 10:55:48 | 000,010,752 | —- | M] (Sonic Solutions) – C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
PRC - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () – C:\Windows\System32\PSIService.exe
PRC - [2006/10/12 15:57:08 | 000,102,400 | —- | M] (SEIKO EPSON CORPORATION) – C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe
PRC - [2006/09/29 12:39:20 | 000,151,552 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
PRC - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2005/09/21 19:08:48 | 000,290,816 | —- | M] (WALTOP International Corp.) – C:\Windows\System32\ATWTUSB.EXE


========== Modules (No Company Name) ==========

MOD - [2011/03/25 13:25:14 | 000,158,208 | —- | M] () – C:\Program Files\Virgin Media\Service Manager\Windows7Features.dll
MOD - [2010/04/14 13:26:16 | 007,059,360 | —- | M] () – C:\Program Files\VirginMedia\V Stuff Backup\AGMailAgent.exe
MOD - [2007/02/09 19:32:36 | 000,061,440 | —- | M] () – C:\Windows\System32\igfxTMM.dll
MOD - [2007/02/09 19:32:28 | 000,077,824 | —- | M] () – C:\Windows\System32\hccutils.dll
MOD - [2006/11/05 10:58:44 | 000,516,096 | —- | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\LayoutDll9.dll
MOD - [2006/11/05 10:28:18 | 004,587,520 | R— | M] () – C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\ROXIPP41.dll


========== Win32 Services (SafeList) ==========

SRV - [2011/04/27 15:39:26 | 000,208,944 | —- | M] (Microsoft Corporation) [On_Demand | Running] – c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe – (NisSrv)
SRV - [2011/04/27 15:39:26 | 000,011,736 | —- | M] (Microsoft Corporation) [Auto | Running] – c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe – (MsMpSvc)
SRV - [2011/03/25 13:34:04 | 000,689,464 | —- | M] (Radialpoint Inc.) [Auto | Running] – C:\Program Files\Virgin Media\Service Manager\ServicepointService.exe – (ServicepointService)
SRV - [2010/02/19 13:37:14 | 000,517,096 | —- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe – (SwitchBoard)
SRV - [2008/09/06 11:38:59 | 000,068,608 | —- | M] () [Auto | Running] – C:\Program Files\Common Files\Autodata Limited Shared\Service\ADCDLicSvc.exe – (Autodata Limited License Service)
SRV - [2008/05/01 23:40:44 | 003,032,360 | —- | M] (Wacom Technology, Corp.) [Auto | Running] – C:\Windows\System32\Pen_Tablet.exe – (TabletServicePen)
SRV - [2008/01/19 08:38:24 | 000,272,952 | —- | M] (Microsoft Corporation) [Auto | Stopped] – C:\Program Files\Windows Defender\MpSvc.dll – (WinDefend)
SRV - [2007/10/09 17:21:02 | 000,124,280 | —- | M] (Seagate Technology LLC) [Auto | Running] – C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe – (Basics Service)
SRV - [2006/11/07 13:27:02 | 000,070,656 | —- | M] () [On_Demand | Stopped] – C:\Program Files\DellSupport\brkrsvc.exe – (DSBrokerService)
SRV - [2006/11/02 20:40:12 | 000,174,656 | —- | M] () [Auto | Running] – C:\Windows\System32\PSIService.exe – (ProtexisLicensing)
SRV - [2006/09/29 12:38:50 | 000,081,920 | —- | M] (Intel Corporation) [Auto | Running] – C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe – (IAANTMON) Intel®


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkfwd.sys – (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\nwlnkflt.sys – (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] – system32\DRIVERS\ipinip.sys – (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] – C:\Users\`neale\AppData\Local\Temp\catchme.sys – (catchme)
DRV - File not found [Kernel | Disabled | Stopped] – C:\Windows\system32\drivers\blbdrive.sys – (blbdrive)
DRV - File not found [Kernel | Disabled | Stopped] – system32\DRIVERS\AVGIDSShim.Sys – (AVGIDSShim)
DRV - [2012/04/16 10:15:04 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{40356C91-CEEE-486F-87FA-9F9685896807}\MpKsl454598f1.sys – (MpKsl454598f1)
DRV - [2012/04/16 10:10:02 | 000,029,904 | —- | M] (Microsoft Corporation) [Kernel | System | Running] – c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{40356C91-CEEE-486F-87FA-9F9685896807}\MpKsl0ad04d05.sys – (MpKsl0ad04d05)
DRV - [2011/04/27 15:25:24 | 000,065,024 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\NisDrvWFP.sys – (NisDrv)
DRV - [2011/04/18 13:18:50 | 000,043,392 | —- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\MpNWMon.sys – (MpNWMon)
DRV - [2009/12/30 11:21:18 | 000,027,192 | —- | M] (VS Revo Group) [File_System | On_Demand | Stopped] – C:\Windows\System32\drivers\revoflt.sys – (Revoflt)
DRV - [2008/03/17 21:14:52 | 000,015,144 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacmoumonitor.sys – (wacmoumonitor)
DRV - [2008/01/19 05:25:05 | 000,220,672 | —- | M] (Intel Corporation) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\e1e6032.sys – (e1express) Intel®
DRV - [2008/01/15 21:11:46 | 000,013,480 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacomvhid.sys – (wacomvhid)
DRV - [2007/02/16 20:12:36 | 000,011,312 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\wacommousefilter.sys – (wacommousefilter)
DRV - [2007/02/16 01:11:28 | 000,011,440 | —- | M] (Wacom Technology) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\WacomVKHid.sys – (WacomVKHid)
DRV - [2007/02/08 06:16:26 | 000,647,680 | —- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\stwrt.sys – (STHDA)
DRV - [2006/11/10 15:05:00 | 000,018,688 | —- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Running] – C:\Windows\System32\drivers\afc.sys – (Afc)
DRV - [2006/11/02 08:36:43 | 002,028,032 | —- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] – C:\Windows\System32\drivers\atikmdag.sys – (R300)
DRV - [2006/10/05 16:07:28 | 000,004,736 | —- | M] (Gteko Ltd.) [Kernel | On_Demand | Running] – C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys – (DSproct)
DRV - [2006/08/17 15:43:52 | 000,007,424 | –S- | M] (Gteko Ltd.) [Kernel | Auto | Running] – C:\Program Files\DellSupport\Drivers\dsunidrv.sys – (dsunidrv)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…amp;rlz=1I7DKUK
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?…;ctid=CT2769726

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://uk.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 2C 13 EE 83 20 1B CD 01 [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerm…mp;sourceid=ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@radialpoint.com/SPA,version=1: C:\Program Files\Virgin Media\Service Manager\nprpspa.dll (Virgin Media)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\`neale\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/04/29 11:30:02 | 000,000,000 | —D | M]

[2012/04/09 17:17:57 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions

========== Chrome ==========

CHR - default_search_provider: Yahoo! UK & Ireland (Enabled)
CHR - default_search_provider: search_url = http://uk.search.yahoo.com/search?ei={inpu…p={searchTerms}
CHR - default_search_provider: suggest_url = http://uk-sayt.ff.search.yahoo.com/gossip-…d={searchTerms}
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\pdf.dll
CHR - plugin: Google Gears 0.5.33.0 (Enabled) = C:\Users\`neale\AppData\Local\Google\Chrome\Application\18.0.1025.152\gears.dll
CHR - plugin: Service Manager (Enabled) = C:\Program Files\Virgin Media\Service Manager\nprpspa.dll
CHR - plugin: Google Update (Enabled) = C:\Users\`neale\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin

O1 HOSTS File: ([2012/04/14 17:33:44 | 000,000,098 | —- | M]) - C:\Windows\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [atwtusb] C:\Windows\System32\ATWTUSB.EXE (WALTOP International Corp.)
O4 - HKLM..\Run: [basicsmssmenu] C:\Program Files\Seagate\Basics\Basics Status\MaxMenuMgrBasics.exe (Maxtor Corporation)
O4 - HKLM..\Run: [ECenter] c:\DELL\E-Center\EULALauncher.exe ( )
O4 - HKLM..\Run: [EEventManager] C:\Program Files\epson\Creativity Suite\Event Manager\EEventManager.exe (SEIKO EPSON CORPORATION)
O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe (Intel Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [RoxWatchTray] C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe (Sonic Solutions)
O4 - HKLM..\Run: [ServiceManager.exe] C:\Program Files\Virgin Media\Service Manager\ServiceManager.exe (Virgin Media)
O4 - HKLM..\Run: [SigmatelSysTrayApp] C:\Windows\sttray.exe (SigmaTel, Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKCU..\Run: [DellSupport] C:\Program Files\DellSupport\DSAgnt.exe (Gteko Ltd.)
O4 - HKCU..\Run: [V Stuff Backup] C:\Program Files\VirginMedia\V Stuff Backup\v_stuff_backup.exe (Steek)
O4 - Startup: C:\Users\`neale\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (InterTrust Technologies Corporation, Inc.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D0CD46C3-08EC-4676-B2D6-0382B1DA21DE}: DhcpNameServer = [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 22:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = comfile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/04/15 17:10:33 | 000,000,000 | —D | C] – C:\Program Files\ESET
[2012/04/13 20:29:51 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Triumph 500 racer
[2012/04/13 19:27:28 | 000,000,000 | —D | C] – C:\_OTL
[2012/04/09 17:19:49 | 000,000,000 | —D | C] – C:\Program Files\7-Zip
[2012/04/09 17:18:14 | 000,000,000 | —D | C] – C:\Users\`neale\AppData\Local\Wajam
[2012/04/09 17:18:13 | 000,000,000 | —D | C] – C:\Program Files\Wajam
[2012/04/09 17:17:57 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Firefox
[2012/04/05 20:03:48 | 000,000,000 | —D | C] – C:\Users\`neale\Cars,Bikes,Planes\Honda CB350

========== Files - Modified Within 30 Days ==========

[2012/04/16 10:19:50 | 000,610,860 | —- | M] () – C:\Windows\System32\perfh009.dat
[2012/04/16 10:19:50 | 000,109,268 | —- | M] () – C:\Windows\System32\perfc009.dat
[2012/04/16 10:16:29 | 000,054,156 | -H– | M] () – C:\Windows\QTFont.qfn
[2012/04/16 10:14:50 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/16 10:14:50 | 000,003,568 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/16 10:14:35 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2012/04/15 20:10:21 | 000,002,635 | —- | M] () – C:\Users\`neale\Desktop\Jasc Paint Shop Pro 9.lnk
[2012/04/15 19:58:00 | 000,000,912 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/15 18:58:01 | 000,000,860 | —- | M] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2012/04/15 16:13:55 | 000,000,908 | —- | M] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/14 17:33:44 | 000,000,098 | —- | M] () – C:\Windows\System32\drivers\etc\Hosts
[2012/04/11 19:44:08 | 000,001,021 | —- | M] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/11 16:45:55 | 030,890,992 | —- | M] () – C:\Users\`neale\Cars,Bikes,Planes\pspbrwse.jbf
[2012/04/11 11:01:23 | 000,002,049 | —- | M] () – C:\Users\`neale\Desktop\Google Chrome.lnk
[2012/04/11 11:01:23 | 000,002,011 | —- | M] () – C:\Users\`neale\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/04/04 15:56:40 | 000,022,344 | —- | M] (Malwarebytes Corporation) – C:\Windows\System32\drivers\mbam.sys
[2012/03/21 18:54:22 | 003,720,208 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT

========== Files Created - No Company Name ==========

[2012/04/15 16:13:55 | 000,000,908 | —- | C] () – C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/04/11 19:44:08 | 000,001,021 | —- | C] () – C:\Users\`neale\Desktop\OTL - Shortcut.lnk
[2012/04/09 18:53:50 | 000,000,912 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000UA.job
[2012/04/09 18:53:48 | 000,000,860 | —- | C] () – C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3123012570-1870344975-3280608661-1000Core.job
[2011/09/04 15:44:28 | 000,098,304 | —- | C] () – C:\Windows\System32\redmonnt.dll
[2011/09/02 20:23:31 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe AIFF Format CS5 Prefs
[2011/06/18 12:30:02 | 000,000,132 | —- | C] () – C:\Users\`neale\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2011/04/16 11:17:49 | 000,000,258 | RHS- | C] () – C:\ProgramData\ntuser.pol
[2011/03/17 18:07:56 | 000,018,904 | —- | C] () – C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2011/03/16 15:53:25 | 000,107,612 | —- | C] () – C:\Windows\System32\StructuredQuerySchema.bin
[2011/03/16 15:53:24 | 000,117,248 | —- | C] () – C:\Windows\System32\EhStorAuthn.dll
[2010/12/13 18:41:10 | 000,140,800 | —- | C] () – C:\Windows\serifun.exe
[2010/12/13 18:22:46 | 000,061,440 | —- | C] () – C:\Windows\System32\cdTextCtl.dll
[2010/07/27 20:35:49 | 000,006,224 | —- | C] () – C:\Users\`neale\AppData\Roaming\pspbrwse.jbf

========== LOP Check ==========

[2007/08/12 17:46:50 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Alien Skin
[2011/03/09 17:25:57 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\AVG10
[2010/12/10 15:46:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Blender Foundation
[2010/12/03 18:18:59 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Canneverbe Limited
[2011/09/05 13:39:46 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CasaPortale.de
[2010/12/14 18:26:39 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\CD Label Designer
[2008/05/09 14:23:53 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\EPSON
[2007/07/02 19:59:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Hemera
[2010/09/01 19:39:48 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\InterTrust
[2007/08/27 16:34:22 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Opera
[2011/05/21 18:50:26 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011/07/11 17:10:16 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\SumatraPDF
[2007/04/25 20:03:28 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Template
[2011/05/11 13:44:47 | 000,000,000 | —D | M] – C:\Users\`neale\AppData\Roaming\Virgin Media
[2012/04/16 10:14:01 | 000,032,620 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Wolseley Ten 1923 (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\TWN:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Thundersprint 2010 (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (24) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Teifi Valley Railway.Wales (13) copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Tatton Park July (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Steam car (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Sideways car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Rotax (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Reg new shop (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC .JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\RAC - Copy.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Punto.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (89).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (88).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Malpas Steam Rally 2011 (87).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\llangollen feb 2007 002.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Jap Jag copy,Micra based web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\India Bombay03.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\IMG_0871.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Hurricane.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Honton 250 email (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Fruin.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ferrari bike.02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\EMC V car mod2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Ducati 125 four073.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DOT (2):Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW068.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 05072.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 03070.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DKW 02069.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\DEC 2006 136.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Concorde.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Car jigsaw.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Boeing 777.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Birkenhead tram museum web.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter03JPG.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Biggest helicopter.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga Straight from SD card 030 (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 07.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 05.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Beluga 01.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park modified 01.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (22).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle Park 2011 (19).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Astle 2009 (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.tif:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\American car (2).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Amal carb067.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Almera (3).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\AJS.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.09.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.08.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\airbus wing.06.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380.jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 13.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 12.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 11.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 03.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (9).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (7).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (6).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (5).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (40).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (14).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A380 (11).jpg:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A350 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A340.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A329.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus a321 at Hamburg.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 04.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A320 02.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\Airbus A319.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original.JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (9).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (8).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (7).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (6).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (5).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (4).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (3).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (28).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (27).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (26).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (25).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (2).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (15).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (14).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (13).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (12).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (11).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine original (10).JPG:Roxio EMC Stream
@Alternate Data Stream - 76 bytes -> C:\Users\`neale\Cars,Bikes,Planes\1000 Engine modified copy (3).jpg:Roxio EMC Stream

< End of report >
Post #17
Hello airbus99

Your latest system log appears to be clean :)

Provided you are no longer experiencing any problems we can remove our tools:

  • Create a new System Restore point


    • Click on the Windows Orb (Start button) and the on Control Panel.
    • Click on System and Maintenance and then on the System menu option.
    • Click on System Protection in the left-hand task list.
    • Click on the Create button.
    • Provide a title (eg, todays date).
    • Click on the Create button.
    • Click on OK.

  • Please perform the following cleanup procedure


    • Double click on the OTL.exe icon on your desktop to run the program. (Note: If you are running Vista/Windows 7, right-click on the file and choose Run As Administrator).
    • Once OTL has opened, click on the "CleanUp!" button.
    • Follow any prompts that you receive.

  • Removal of Tools


    • You no longer need aswMBR or CKScanner. Please delete them from your machine.

    Once you have completed the above steps you should be good to go! If you have any further questions, please feel free to ask.

  • Finally, please take the time to read through the information provided below:

    Enhance your System Security

    • For an excellent list of free anti virus software, free online virus scanners, free spyware detection/removal and free firewalls, click here.

    • IMPORTANT! Please make sure you only have ONE firewall and ONE real-time antivirus installed on your system. When using "on demand" scanners, first update the detection signature files, then disconnect from the internet and disable your resident security program before running the scan.
    • Once complete, remember to re-engage your resident security before going online.

    Web Browsers and Browser Security

    Firefox
    • Firefox is generally considered to have greater browsing security in comparison to other popular programs. You can download Firefox 3.0 from here.

    No-Script
    • If you use Firefox as your default browser, No-Script can provide additional security by preventing malicious scripts from being executed on your system.
    • You can download No-Script by clicking here.

    Internet Explorer
    • The newest version of Internet Explorer is available from here.

    SpywareBlaster
    • If you use Internet Explorer as your default browser, SpywareBlaster would be a valuable addition to your online security.
    • SpywareBlaster prevents malicious ActiveX objects from being downloaded onto your system.
    • You can download SpywareBlaster by clicking here.

    Web of Trust
    • When using search engines, Web of Trust provides you with an easy way of telling the good sites from the bad and is compatible with both Firefox and Internet Explorer.
    • Coloured symbols are displayed next to search results, giving you more confidence in the links you choose to click on: Green (To go), Yellow (Caution) and Red (Stop).
    • You can download Web of Trust by clicking here.

    Keep your Software Updated
    • Outdated software can sometimes have vulnerabilities that are exploitable by malware.
    • Check if there are available updates for your installed software with Secunia's Online Software Inspector by clicking here.

    Passwords
    • Learn how to create strong passwords by clicking here and test the strength of the passwords you already use by clicking here.

    General Reading

    Learn How To Combat Malware
    • Would you like to learn how to fight back against malware and help others? Enroll at the What The Tech (Formerly Tom Coyotes) Malware Classroom by clicking here.
Post #18
Hello JonTom, Yes, you are a genius !! All appears to running better than ever , I have deleted the programmes as suggested and have run the OTL cleanup . I am Hospital visiting today and tomorrow , so I'll spend some time on Wednesday as I 'll have some more time to read all the information you have left me concerning System Security. One final question , would you recommend that I remove Windows Essentials security and use one of the ones suggested in your last post ? Thanks , I'm in your debt for all your kind and knowledgeable help that you have given to me over the last few days, I really could not have managed without you !!. All the very to you , Neale
Post #19
Hello airbus99

Yes, you are a genius !!

Not at all, but I'm happy I was able to help :)

would you recommend that I remove Windows Essentials security and use one of the ones suggested in your last post ?

The links I provide are suggestions only. Microsoft Security Essentials is a good program. If you like using it, keep it.

Best wishes
JonTom

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI