Spyware / Malware / Virus Removal

Please help, winlogon.exe and logon.scr problem

14 min read

Looking for the outcome? Ask AI

andrevtw

Post #16August 11, 2012, 4:19 PM UTC

the screenshot

Attachments:

📎006.jpg

andrevtw

Post #17August 11, 2012, 4:27 PM UTC

I don't know how to describe the symptom.. the pc seems works normal, but i couldn't install antivirus nor to update the windows security…. often the flashplayer crashed without reason, and i think that something working to upload or download… not sure…

Conspire

Post #18August 11, 2012, 4:46 PM UTC

Alright, I'll get back to you tomorrow.

andrevtw

Post #19August 11, 2012, 6:07 PM UTC

Thank you and have a great weekend

Conspire

Post #20August 12, 2012, 10:04 AM UTC

Do you recognize these ports? [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5353:TCP"= 5353:TCP:*:Disabled:Adobe CSI CS4 "3581:TCP"= 3581:TCP:MultiuserPortTCP3581 "3581:UDP"= 3581:UDP:MultiuserPortUDP3581 "3597:TCP"= 3597:TCP:MultiuserPortTCP3597 "3645:TCP"= 3645:TCP:MultiuserPortTCP3645 I need to have a look at your Extras.txt log. Can you find it and post that in your next reply?

andrevtw

Post #21August 12, 2012, 12:29 PM UTC

I did saw them in firewall exception, i dont know where they are come from. once removed them from the exception list but then reappeared… then I thought maybe Windows Update using those ports…

Here the only Extras.txt that i could find

OTL Extras logfile created on: 09/05/2012 2:15:36 - Run 1
OTL by OldTimer - Version 3.2.42.3 Folder = C:\Documents and Settings\edi\Desktop\BERSIH2\STEP 2
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000421 | Country: Indonesia | Language: IND | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,29 Gb Available Physical Memory | 64,80% Memory free
7,71 Gb Paging File | 7,17 Gb Available in Paging File | 92,99% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 67,44 Gb Free Space | 69,06% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 123,50 Gb Free Space | 84,31% Space Free | Partition Type: NTFS
Drive E: | 221,62 Gb Total Space | 196,16 Gb Free Space | 88,51% Space Free | Partition Type: NTFS
Drive F: | 585,45 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 37,26 Gb Total Space | 15,20 Gb Free Space | 40,79% Space Free | Partition Type: NTFS
Drive H: | 130,36 Gb Total Space | 26,90 Gb Free Space | 20,64% Space Free | Partition Type: FAT32
Drive I: | 130,41 Gb Total Space | 38,64 Gb Free Space | 29,63% Space Free | Partition Type: FAT32
Drive M: | 1,86 Gb Total Space | 0,81 Gb Free Space | 43,65% Space Free | Partition Type: FAT

Computer Name: MASTES | User Name: edi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] – "C:\Program Files\Opera\Opera.exe" "%1"
.url [@ = InternetShortcut] – rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = FirefoxHTML] – C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
https [open] – "C:\Program Files\Opera\Opera.exe" "%1"
InternetShortcut [open] – rundll32.exe ieframe.dll,OpenURL %l
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] – C:\Program Files\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] – "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] – "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] – "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DoNotAllowExceptions" = 0
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"5353:TCP" = 5353:TCP:*:Disabled:Adobe CSI CS4
"3581:TCP" = 3581:TCP:*:Enabled:MultiuserPortTCP3581
"3581:UDP" = 3581:UDP:*:Enabled:MultiuserPortUDP3581
"3597:TCP" = 3597:TCP:*:Enabled:MultiuserPortTCP3597
"3645:TCP" = 3645:TCP:*:Enabled:MultiuserPortTCP3645

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe" = C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Enabled:CyberLink PowerDVD 8.0 – (CyberLink Corp.)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" = C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Disabled:Adobe CSI CS4 – (Adobe Systems Incorporated)
"C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe" = C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe:*:Disabled:CyberLink PowerDVD 8.0 – (CyberLink Corp.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox – (Mozilla Corporation)
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Disabled:Google Earth – (Google)
"C:\Program Files\Google\Google Talk\googletalk.exe" = C:\Program Files\Google\Google Talk\googletalk.exe:*:Disabled:Google Talk
"C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe" = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\Application\chrome.exe:LocalSubNet:Enabled:Google Chrome – (Google Inc.)
"C:\Program Files\GameHouse Games Collection\GameHouse Sudoku\GHSudoku.exe" = C:\Program Files\GameHouse Games Collection\GameHouse Sudoku\GHSudoku.exe:*:Enabled:GameHouse Sudoku – (GameHouse, Inc)
"C:\Documents and Settings\edi\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe" = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe:*:Enabled:Google Talk Plugin – (Google)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Disabled:Yahoo! Messenger
"C:\Documents and Settings\edi\Local Settings\Application Data\Google Translator\Google Translator.exe" = C:\Documents and Settings\edi\Local Settings\Application Data\Google Translator\Google Translator.exe:*:Enabled:Google Translator – (Opera Software)
"C:\Program Files\NComputing vSpace\KMUPDATE.EXE" = C:\Program Files\NComputing vSpace\KMUPDATE.EXE:*:Enabled:vSpace Update – ()
"C:\Program Files\Adobe\Adobe Help\Adobe Help.exe" = C:\Program Files\Adobe\Adobe Help\Adobe Help.exe:*:Enabled:Adobe Help – ()
"C:\Program Files\TeamViewer\Version7\TeamViewer.exe" = C:\Program Files\TeamViewer\Version7\TeamViewer.exe:*:Enabled:Teamviewer Remote Control Application – (TeamViewer GmbH)
"C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe" = C:\Program Files\TeamViewer\Version7\TeamViewer_Service.exe:*:Enabled:Teamviewer Remote Control Service – (TeamViewer GmbH)
"C:\Premier75\BASlink\BASlink.exe" = C:\Premier75\BASlink\BASlink.exe:*:Disabled: MYOB Premier v7.5 BASlink – (MYOB Technology, Pty Ltd.)
"C:\Program Files\FinalMediaPlayer\FMPCheckForUpdates.exe" = C:\Program Files\FinalMediaPlayer\FMPCheckForUpdates.exe:*:Disabled:Final Media Player Update Checker – (Bitberry Software)
"C:\Program Files\Smartfren Connex CE682 UI\App.exe" = C:\Program Files\Smartfren Connex CE682 UI\App.exe:*:Enabled:Smartfren Connex CE682 UI – ()

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = LG CyberLink YouCam
"{02DFF6B1-1654-411C-8D7B-FD6052EF016F}" = Apple Software Update
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0610.1
"{08CA9554-B5FE-4313-938F-D4A417B81175}" = QuickTime
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1111706F-666A-4037-7777-203328764D10}" = JavaFX 2.0.3
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_iP1900_series" = Canon iP1900 series Printer Driver
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MP140_series" = Canon MP140 series
"{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}" = Adobe SGM CS4
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}" = Adobe InDesign CS4
"{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}" = Adobe InDesign CS4 Icon Handler
"{1F0C7B37-947C-4FFE-866E-4FB7EDA8B4F5}" = b2b Indonesia 10th Ed
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = LG Power Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217003FF}" = Java™ 7 Update 3
"{2BAF2B96-7560-48B4-87D4-10178DDBE217}" = Adobe InDesign CS4 Application Feature Set Files (Roman)
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = LG CyberLink PowerDVD
"{2D87E961-577B-492B-AD54-1368680FB9A7}" = Bing Maps 3D
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = LG CyberLink Power2Go
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{474F25F5-BDC9-40E5-B1B6-F6BF23FC106F}" = Windows Live Essentials
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A52555C-032A-4083-BDD9-6A85ABFB39A8}" = Adobe SING CS4
"{4BA65BD2-DA5E-11D2-9B64-00105A02D21F}" = MYOB Premier 3
"{4E98F23B-1328-4322-A6EC-2EDC8FC3A4FE}" = FontNav
"{4EAE665D-957A-4D04-9679-3AD582008877}" = NVIDIA PhysX
"{529125EF-E3AC-4B74-97E6-F688A7C0F1BF}" = Paint.NET v3.5.10
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG ODD Auto Firmware Update
"{63218538-4A69-497F-8455-904261B0E9E4}" = CorelDRAW Graphics Suite X3
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{73EC658D-A1C6-40CA-8E86-E05821BAACE7}" = Java DB 10.6.2.1
"{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}" = Adobe InDesign CS4 Common Base Files
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
"{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
"{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
"{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
"{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
"{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{939740B5-0064-4779-854A-8C1086181C05}" = Macromedia FreeHand MXa
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-1033-F400-7760-000000000005}" = Adobe Acrobat X Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{ADD5DB49-72CF-11D8-9D75-000129760D75}" = LG CyberLink PowerBackup
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.18
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0209
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B57EAFF2-D6EE-4C6C-9175-ED9F17BFC1BC}" = Windows Live Messenger
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = LG CyberLink PowerProducer
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LG CyberLink LabelPrint
"{C94E45B0-6AA6-4FB9-9AAE-22085F631880}" = VBA
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CA1CA5F8-7500-45C5-9D4C-47D13FBC92D2}" = Adobe Setup
"{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"{D53E0CE7-06A0-4C21-A3CF-82DFA268F195}" = MYOB Premier v7.5
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E5FCED12-3E77-4C0E-A305-5AEB38A52A70}" = AdobeColorCommonSetCMYK
"{E6158D07-2637-4ECF-B576-37C489669174}" = Windows Live Call
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EFE3D683-903C-4B58-AB8F-C68C69F33758}" = System Requirements Lab for Intel
"{EFEDD205-43FE-4208-B682-0937E803E19E}_is1" = NexusFont 2.5 (ver 2.5.7.1562)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F428D0FB-765D-40EB-BDD8-A1E7F5C597FA}" = Update Manager
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{F993F285-0F98-4E13-9421-41DB36806EE3}" = Salaat Time 2.1
"{FBF2CAD3-A2C7-4180-8395-EA6E8FAD655D}_is1" = The Hadith Software Version 1.1
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FD207C2C-A7FF-332A-AC85-5A5ACED6F31B}" = Google Talk Plugin
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Adobe_1710d324011afc3e7658e969025f4ba" = Adobe InDesign CS4
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"ENTERPRISE" = Microsoft Office Enterprise 2007
"ERUNT_is1" = ERUNT 1.1j
"FinalMediaPlayer_is1" = Final Media Player 2011
"GameHouse Sudoku" = GameHouse Games Collection: GameHouse Sudoku
"ie8" = Windows Internet Explorer 8
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = LG CyberLink YouCam
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = LG Power Tools
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = LG CyberLink PowerDVD
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = LG CyberLink Power2Go
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = LG CyberLink PowerProducer
"InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LG CyberLink LabelPrint
"InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
"InstallShield_{D36DD326-7280-11D8-97C8-000129760CBE}" = CyberLink PhotoNow
"InstallShield_{D53E0CE7-06A0-4C21-A3CF-82DFA268F195}" = MYOB Premier v7.5
"LAME_is1" = LAME v3.99.3 (for Windows)
"Luxor" = GameHouse Games Collection: Luxor
"MagicDisc 2.6.93" = MagicDisc 2.6.93
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 11.0 (x86 en-US)" = Mozilla Firefox 11.0 (x86 en-US)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NComputing vSpace" = NComputing vSpace
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"Smartfren Connex CE682 UI_is1" = Smartfren Connex CE682 UI
"TeamViewer 7" = TeamViewer 7
"The KMPlayer" = The KMPlayer (remove only)
"Tumblebugs" = GameHouse Games Collection: Tumblebugs
"WCDMA Modem_is1" = WCDMA Modem
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinPcapInst" = WinPcap 4.1.2
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xvid Video Codec 1.3.1" = Xvid Video Codec
"Zuma Deluxe" = GameHouse Games Collection: Zuma Deluxe

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Google Translator" = Google Translator
"KalydoPlayer" = Kalydo Player 3.08.01
"Winamp Detect" = Winamp Detector Plug-in

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/04/2012 10:53:53 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 03/05/2012 7:41:13 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 03/05/2012 7:48:20 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 03/05/2012 8:12:34 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 03/05/2012 8:35:26 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 06/05/2012 8:23:29 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 06/05/2012 8:46:47 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 06/05/2012 9:34:03 | Computer Name = MASTES | Source = JavaQuickStarterService | ID = 1
Description =

Error - 07/05/2012 22:27:32 | Computer Name = MASTES | Source = MsiInstaller | ID = 1008
Description = The installation of C:\Documents and Settings\edi\Desktop\HijackThis.msi
is not permitted due to an error in software restriction policy processing. The
object cannot be trusted.

Error - 07/05/2012 22:27:43 | Computer Name = MASTES | Source = MsiInstaller | ID = 1008
Description = The installation of M:\Antivirus\HijackThis.msi is not permitted due
to an error in software restriction policy processing. The object cannot be trusted.

[ OSession Events ]
Error - 08/03/2010 4:55:20 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 20708
seconds with 3240 seconds of active time. This session ended with a crash.

Error - 08/03/2010 21:27:40 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 351
seconds with 60 seconds of active time. This session ended with a crash.

Error - 11/03/2010 23:33:57 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 5703
seconds with 1320 seconds of active time. This session ended with a crash.

Error - 21/04/2010 8:53:36 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 21640
seconds with 120 seconds of active time. This session ended with a crash.

Error - 18/08/2010 0:52:49 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 6095
seconds with 180 seconds of active time. This session ended with a crash.

Error - 03/11/2010 4:09:17 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 17167
seconds with 1860 seconds of active time. This session ended with a crash.

Error - 08/06/2011 18:54:40 | Computer Name = MASTES | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 61944
seconds with 1260 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 08/05/2012 14:11:13 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:14 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:14 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:15 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:17 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:17 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:17 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:20 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:20 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

Error - 08/05/2012 14:11:23 | Computer Name = MASTES | Source = HpLegacyKeyboard | ID = 327707
Description =

< End of report >

Conspire

Post #22August 12, 2012, 2:01 PM UTC

We will try to fix the Windows Update for the mean time while I try to figure out the cause of winlogon.exe and logon.scr.

Run OTL.exe

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"5353:TCP" =-
"3581:TCP" =-
"3581:UDP" =-
"3597:TCP" =-
"3645:TCP" =-

:Commands
[REBOOT]
[RESETHOSTS]
[CLEARALLRESTOREPOINTS]

Then click the Run Fix button at the top
Let the program run unhindered, reboot when it is done
Then post Fix OTL log as well as a new OTL log by rerunning it after reboot without custom scans script.

andrevtw

Post #23August 12, 2012, 4:46 PM UTC

Thank You Conspire

Runfix done. but after reboot OTL didnt generate the any log
i did the next step then
by rerunning OTL i assumed by clicking the Run Scan button, here the log :

OTL logfile created on: 12/08/2012 23:25:19 - Run 4
OTL by OldTimer - Version 3.2.56.0 Folder = C:\Documents and Settings\edi\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000421 | Country: Indonesia | Language: IND | Date Format: dd/MM/yyyy

2,00 Gb Total Physical Memory | 1,50 Gb Available Physical Memory | 75,00% Memory free
7,71 Gb Paging File | 7,38 Gb Available in Paging File | 95,76% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 97,65 Gb Total Space | 68,00 Gb Free Space | 69,63% Space Free | Partition Type: NTFS
Drive D: | 146,48 Gb Total Space | 123,44 Gb Free Space | 84,27% Space Free | Partition Type: NTFS
Drive E: | 221,62 Gb Total Space | 196,16 Gb Free Space | 88,51% Space Free | Partition Type: NTFS
Drive F: | 3,62 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: MASTES | User Name: edi | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\edi\Desktop\OTL (1).exe (OldTimer Tools)
PRC - C:\Program Files\lg_fwupdate\fwupdate.exe (BitLeader)
PRC - C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files\Adobe\Acrobat 10.0\Acrobat\acrotray.exe (Adobe Systems Inc.)
PRC - C:\Program Files\Smartfren Connex CE682 UI\HEject.exe ()
PRC - C:\WINDOWS\system32\KmServc.exe (NComputing Inc.)
PRC - C:\Program Files\NComputing vSpace\KMMSG.EXE (NComputing Inc.)
PRC - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
PRC - C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
PRC - C:\Program Files\Gigabyte\EasySaver\essvr.exe ()
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

========== Modules (No Company Name) ==========

MOD - C:\Program Files\Smartfren Connex CE682 UI\HEject.exe ()
MOD - C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll ()
MOD - C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll ()
MOD - C:\Program Files\Gigabyte\EasySaver\ycc.dll ()
MOD - C:\Program Files\Gigabyte\EasySaver\essvr.exe ()

========== Win32 Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) – C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Skype C2C Service) – C:\Documents and Settings\All Users\Application Data\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (MBAMService) – C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SkypeUpdate) – C:\Program Files\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (nvUpdatusService) – C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation)
SRV - (CDROM_Eject_H) – C:\Program Files\Smartfren Connex CE682 UI\HEject.exe ()
SRV - (FLEXnet Licensing Service) – C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (SwitchBoard) – C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (HpService) – C:\WINDOWS\system32\KmServc.exe (NComputing Inc.)
SRV - (ES lite Service) – C:\Program Files\Gigabyte\EasySaver\essvr.exe ()

========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\ComboFix\catchme.sys File not found
DRV - (avfwim) – system32\DRIVERS\avfwim.sys File not found
DRV - (gdrv) – C:\WINDOWS\gdrv.sys (Windows ® 2000 DDK provider)
DRV - (MBAMProtector) – C:\WINDOWS\system32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (sptd) – C:\WINDOWS\system32\drivers\sptd.sys (Duplex Secure Ltd.)
DRV - (qcusbser) – C:\WINDOWS\system32\drivers\qcusbser.sys (QUALCOMM Incorporated)
DRV - (cpudrv) – C:\Program Files\SystemRequirementsLab\cpudrv.sys ()
DRV - (UsbModemDriver) – C:\WINDOWS\system32\drivers\USB_MODEM_H.sys ()
DRV - (cmntusbser) – C:\WINDOWS\system32\drivers\cmntusbser.sys (Wireless Device)
DRV - (npf) – C:\WINDOWS\system32\drivers\npf.sys (CACE Technologies, Inc.)
DRV - (X300Audio) – C:\WINDOWS\system32\drivers\X3HAudio.sys (NComputing)
DRV - (x300bus) – C:\WINDOWS\system32\drivers\X300Bus.sys (NComputing Inc.)
DRV - (X300) – C:\WINDOWS\system32\drivers\X300M.SYS (NComputing Inc.)
DRV - (HpPciVga) – C:\WINDOWS\system32\drivers\KmWpsMs.sys (NComputing Inc.)
DRV - (HpHelper) – C:\WINDOWS\system32\drivers\KmHlprk.sys (NComputing Inc.)
DRV - (HpXpMouPnp) – C:\WINDOWS\system32\drivers\KmMouPnp.sys (NComputing Inc.)
DRV - (HpUsbMouse) – C:\WINDOWS\system32\drivers\KmMouCls.sys (NComputing Inc.)
DRV - (HpXpKbdPnp) – C:\WINDOWS\system32\drivers\KmKbdPnp.sys (NComputing Inc.)
DRV - (HpLegacyKeyboard) – C:\WINDOWS\system32\drivers\KmJBox.sys (NComputing Inc.)
DRV - (HpUsbKeyboard) – C:\WINDOWS\system32\drivers\KmKbdCls.sys (NComputing Inc.)
DRV - (HpXpHidCls) – C:\WINDOWS\system32\drivers\KmHidCls.sys (NComputing Inc.)
DRV - (HpStore) – C:\WINDOWS\system32\drivers\KmStore.sys (NComputing Inc.)
DRV - (USB_BusEnum_H) – C:\WINDOWS\system32\drivers\USB_BusEnum_H.sys ()
DRV - (USB_WinMux_H) – C:\WINDOWS\system32\drivers\USB_WinMux_H.sys ()
DRV - (RTLE8023xp) – C:\WINDOWS\system32\drivers\Rtenicxp.sys (Realtek Semiconductor Corporation )
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (Ambfilt) – C:\WINDOWS\system32\drivers\Ambfilt.sys (Creative)
DRV - (Monfilt) – C:\WINDOWS\system32\drivers\Monfilt.sys (Creative Technology Ltd.)
DRV - (USB_ETS_H) – C:\WINDOWS\system32\drivers\USB_ETS_H.sys (Via Telecom, Inc.)
DRV - (mcdbus) – C:\WINDOWS\system32\drivers\mcdbus.sys (MagicISO, Inc.)
DRV - (EL90XBC) – C:\WINDOWS\system32\drivers\el90xbc5.sys (3Com Corporation)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.avg.com/?cid={39F11AB7-1510…mp;d=2012-02-22 08:17:15&v;=9.0.0.23&sap;=hp
IE - HKCU\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {95B7759C-8C7F-4BF1-B163-73684A933233}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…amp;Form=IE8SRC
IE - HKCU\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={39F11AB…mp;d=2012-02-22 08:17:15&v;=9.0.0.23&sap;=dsp&q;={searchTerms}
IE - HKCU\..\SearchScopes\{CC57369D-AB74-49F1-9D0D-CD1191BB6398}: "URL" = http://www3.iamwired.net/websearch.php?src…h={SearchTerms}
IE - HKCU\..\SearchScopes\{D09B3AA3-020F-47CE-B0F0-9D32C07C92C8}: "URL" = http://search.yahoo.com/search?p={searchTe…-8&fr;=b1ie7
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.defaulturl: "http://id.search.yahoo.com/search?fr=ffsp1&p;="
FF - prefs.js..browser.search.param.yahoo-fr: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "chrf-ytbm"
FF - prefs.js..browser.search.param.yahoo-type: "${8}"
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "https://www.facebook.com/"
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.1.20091029021655
FF - prefs.js..extensions.enabledItems: {5114f273-942c-13e7-42cd-25a7e81c9ff9}:[removed]
FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906
FF - prefs.js..extensions.enabledItems: {35379F86-8CCB-4724-AE33-4278DE266C70}:1.0.5
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.3.1: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.3.1: C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/VirtualEarth3D,version=4.0: C:\Program Files\Virtual Earth 3D\ [2010/11/06 17:12:10 | 000,000,000 | —D | M]
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@eximion.com/KalydoPlayer3.08.01: C:\Documents and Settings\edi\Application Data\Kalydo\KalydoPlayer\npkalydo.dll (Eximion B.V.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Documents and Settings\edi\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Documents and Settings\edi\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\edi\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Browser\WCFirefoxExtn [2012/04/18 20:28:14 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\Java\jre6\lib\deploy\jqs\ff
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/08/10 04:31:58 | 000,000,000 | —D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/18 20:28:25 | 000,000,000 | —D | M]

[2010/03/04 15:22:03 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\edi\Application Data\Mozilla\Extensions
[2012/08/10 18:05:35 | 000,000,000 | —D | M] (No name found) – C:\Documents and Settings\edi\Application Data\Mozilla\Firefox\Profiles\e9sl24b3.default\extensions
[2011/10/17 00:28:02 | 000,001,742 | —- | M] () – C:\Documents and Settings\edi\Application Data\Mozilla\Firefox\Profiles\e9sl24b3.default\searchplugins\search-the-web.xml
[2010/04/29 15:15:00 | 000,000,261 | —- | M] () – C:\Documents and Settings\edi\Application Data\Mozilla\Firefox\Profiles\e9sl24b3.default\searchplugins\Search.xml
[2012/08/10 04:31:58 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions
[2010/04/29 15:14:01 | 000,000,000 | —D | M] (LoudMo Contextual Ad Assistant) – C:\Program Files\Mozilla Firefox\extensions\{5114f273-942c-13e7-42cd-25a7e81c9ff9}
[2012/08/09 12:51:17 | 000,000,000 | —D | M] (Skype Click to Call) – C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/04/23 15:38:16 | 000,372,140 | —- | M] () (No name found) – C:\DOCUMENTS AND SETTINGS\EDI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\E9SL24B3.DEFAULT\EXTENSIONS\{5C46D283-ABDE-4DCE-B83C-08881401921C}.XPI
[2012/08/09 14:09:30 | 000,057,998 | —- | M] () (No name found) – C:\DOCUMENTS AND SETTINGS\EDI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\E9SL24B3.DEFAULT\EXTENSIONS\[removed]
[2012/01/11 01:18:38 | 000,031,961 | —- | M] () (No name found) – C:\DOCUMENTS AND SETTINGS\EDI\APPLICATION DATA\MOZILLA\FIREFOX\PROFILES\E9SL24B3.DEFAULT\EXTENSIONS\[removed]
[2010/03/23 07:44:15 | 000,000,000 | —D | M] (Microsoft .NET Framework Assistant) – C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012/07/14 07:17:47 | 000,136,672 | —- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/12/10 00:23:32 | 000,012,800 | —- | M] (Nullsoft, Inc.) – C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012/03/22 22:58:36 | 000,003,768 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\avg-secure-search.xml
[2012/07/14 07:16:36 | 000,002,252 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/07/14 07:16:36 | 000,002,040 | —- | M] () – C:\Program Files\mozilla firefox\searchplugins\twitter.xml

========== Chrome ==========

CHR - homepage: http://www.google.com/
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{g
oogle:searchFieldtrialParameter}sourceid=chrome&ie;={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl;={language}&q;={searchTerms}
CHR - homepage: http://www.google.com/
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.75\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.75\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\Application\21.0.1180.75\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Freemake np-plugin for google chrome (Enabled) = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\bpegkgagfojjbcpkihigfmkojdmmimdf\1.0.0_0\npFreemake.dll
CHR - plugin: Google Talk Plugin (Enabled) = C:\Documents and Settings\edi\Application Data\Mozilla\plugins\npgoogletalk.dll
CHR - plugin: Google Talk Plugin Video Accelerator (Enabled) = C:\Documents and Settings\edi\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll
CHR - plugin: BitTorrent (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
CHR - plugin: Windows Genuine Advantage (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npLegitCheckPlugin.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.5 (861) (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Winamp Application Detector (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npwachk.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Kalydo Player Plugin for Mozilla (Enabled) = C:\Documents and Settings\edi\Application Data\Kalydo\KalydoPlayer\npkalydo.dll
CHR - plugin: Google Update (Enabled) = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Unity Player (Enabled) = C:\Documents and Settings\edi\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll
CHR - plugin: Google Earth Plugin (Enabled) = C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll
CHR - plugin: Java™ Platform SE 7 U3 (Enabled) = C:\Program Files\Oracle\JavaFX 2.0 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.30.255 (Enabled) = C:\windows\system32\npDeployJava1.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\windows\system32\Adobe\Director\np32dsw.dll
CHR - Extension: YouTube = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: RestyleTimeline = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coifppihcdijmpfpcnainhnnfplikkfg\0.0.4_0\
CHR - Extension: Google Search = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: FB Photo Zoom = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\elioihkkcdgakfbahdoddophfngopipi\1.1206.11.1_0\
CHR - Extension: TimelineRemove = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nfhopoibjodcfbppkiginpbcpekbdgln\1.0.1_0\
CHR - Extension: Gmail = C:\Documents and Settings\edi\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\

O1 HOSTS File: ([2012/08/12 23:13:30 | 000,000,098 | —- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll File not found
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [HpMessage] C:\Program Files\NComputing vSpace\KMMSG.EXE (NComputing Inc.)
O4 - HKLM..\Run: [LGODDFU] C:\Program Files\lg_fwupdate\lgfw.exe (Bitleader)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - Startup: C:\Documents and Settings\edi\Start Menu\Programs\Startup\MagicDisc.lnk = C:\Program Files\MagicDisc\MagicDisc.exe (MagicISO, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoPublishingWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWebServices = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoOnlinePrintsWizard = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-…indows-i586.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{982484CC-DAEB-4CA7-BD53-18FF1FBA5C3A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{982484CC-DAEB-4CA7-BD53-18FF1FBA5C3A}: NameServer = 203.130.196.155,202.134.0.61
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\KmWinLog: DllName - (Kmlogon.dll) - C:\WINDOWS\System32\Kmlogon.dll (NComputing Inc.)
O20 - Winlogon\Notify\WgaLogon: DllName - (WgaLogon.dll) - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\edi\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\edi\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/08/15 11:44:12 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O32 - AutoRun File - [2010/10/29 19:30:46 | 000,000,000 | —D | M] - D:\autorun.inf – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/08/12 23:13:30 | 000,000,000 | —D | C] – C:\_OTL
[2012/08/11 22:58:57 | 000,693,235 | —- | C] (Farbar) – C:\Documents and Settings\edi\Desktop\FSS.exe
[2012/08/11 21:08:22 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Desktop\CC Support
[2012/08/11 03:19:43 | 000,000,000 | —D | C] – C:\Documents and Settings\edi\Desktop\Chef
[2012/08/10 23:42:12 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2012/08/10 23:42:12 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2012/08/10 23:42:12 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2012/08/10 23:42:12 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2012/08/10 23:42:00 | 000,000,000 | —D | C] – C:\Qoobox
[2012/08/10 23:28:30 | 000,000,000 | —D | C] – C:\V3CFix
[2012/08/10 23:20:13 | 004,728,003 | R— | C] (Swearware) – C:\Documents and Settings\edi\Desktop\ComboFix.exe
[2012/08/10 06:08:43 | 000,000,000 | —D | C] – C:\Documents and Settings\edi\Desktop\Driver
[2012/08/10 04:32:00 | 000,000,000 | —D | C] – C:\Program Files\Mozilla Maintenance Service
[2012/08/10 04:32:00 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Mozilla
[2012/08/09 19:48:13 | 000,000,000 | —D | C] – C:\Documents and Settings\edi\Desktop\NoVirus
[2012/08/09 19:43:19 | 000,596,480 | —- | C] (OldTimer Tools) – C:\Documents and Settings\edi\Desktop\OTL (1).exe
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Dokumen\*.tmp files -> D:\Dokumen\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/08/12 23:25:12 | 000,000,418 | -H– | M] () – C:\WINDOWS\tasks\User_Feed_Synchronization-{8156EAED-8E9E-4BD4-8E2C-F988EBF4A243}.job
[2012/08/12 23:24:00 | 000,000,886 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/12 23:21:25 | 000,528,394 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2012/08/12 23:21:25 | 000,098,562 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2012/08/12 23:17:36 | 000,000,882 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/12 23:17:21 | 000,017,488 | —- | M] (Windows ® 2000 DDK provider) – C:\WINDOWS\gdrv.sys
[2012/08/12 23:17:14 | 000,002,262 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2012/08/12 23:17:04 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2012/08/12 23:13:30 | 000,000,098 | —- | M] () – C:\WINDOWS\System32\drivers\etc\Hosts
[2012/08/12 22:53:00 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/11 23:08:00 | 000,001,456 | —- | M] () – C:\Documents and Settings\edi\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs
[2012/08/11 22:57:32 | 000,693,235 | —- | M] (Farbar) – C:\Documents and Settings\edi\Desktop\FSS.exe
[2012/08/10 23:25:39 | 004,728,003 | R— | M] (Swearware) – C:\Documents and Settings\edi\Desktop\ComboFix.exe
[2012/08/10 11:51:03 | 000,881,494 | —- | M] () – C:\Documents and Settings\edi\Desktop\SecurityCheck (1).exe
[2012/08/10 11:47:37 | 000,302,592 | —- | M] () – C:\Documents and Settings\edi\Desktop\74y76v6t.exe
[2012/08/10 08:04:29 | 000,426,184 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2012/08/10 08:04:29 | 000,070,344 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2012/08/10 04:32:02 | 000,000,742 | —- | M] () – C:\Documents and Settings\edi\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012/08/10 04:32:02 | 000,000,724 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2012/08/09 19:44:38 | 000,596,480 | —- | M] (OldTimer Tools) – C:\Documents and Settings\edi\Desktop\OTL (1).exe
[2012/08/09 13:55:46 | 000,002,246 | —- | M] () – C:\Documents and Settings\edi\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2012/08/09 13:02:31 | 000,000,337 | —- | M] () – C:\WINDOWS\lgfwup.ini
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 D:\Dokumen\*.tmp files -> D:\Dokumen\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/08/10 23:42:12 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2012/08/10 23:42:12 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2012/08/10 23:42:12 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2012/08/10 23:42:12 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2012/08/10 23:42:12 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2012/08/10 11:51:34 | 000,881,494 | —- | C] () – C:\Documents and Settings\edi\Desktop\SecurityCheck (1).exe
[2012/08/10 11:49:10 | 000,302,592 | —- | C] () – C:\Documents and Settings\edi\Desktop\74y76v6t.exe
[2012/08/10 08:19:46 | 000,000,886 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2012/08/10 08:19:46 | 000,000,882 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2012/08/10 06:25:44 | 000,000,830 | —- | C] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2012/08/10 04:32:02 | 000,000,730 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2012/05/06 20:53:29 | 000,045,115 | —- | C] () – C:\WINDOWS\System32\KmWinSta.dll
[2012/05/06 19:26:05 | 000,038,400 | —- | C] () – C:\WINDOWS\System32\drivers\USB_BusEnum_H.sys
[2012/05/06 19:26:05 | 000,030,080 | —- | C] () – C:\WINDOWS\System32\drivers\USB_WinMux_H.sys
[2012/05/06 19:26:05 | 000,021,504 | —- | C] () – C:\WINDOWS\System32\drivers\USB_MODEM_H.sys
[2012/05/03 17:49:45 | 000,000,020 | —- | C] () – C:\Documents and Settings\edi\defogger_reenable
[2012/04/25 20:56:13 | 000,172,544 | —- | C] () – C:\WINDOWS\System32\RTPScan.dll
[2012/04/25 20:56:13 | 000,165,376 | —- | C] () – C:\WINDOWS\System32\unrar.dll
[2012/04/25 20:56:12 | 000,133,632 | —- | C] () – C:\WINDOWS\System32\PCMAVext.dll
[2012/04/23 10:40:54 | 000,000,026 | —- | C] () – C:\WINDOWS\3G Connection.INI
[2012/04/08 08:12:36 | 000,000,666 | RHS- | C] () – C:\Documents and Settings\edi\ntuser.pol
[2012/03/23 03:59:43 | 000,000,132 | —- | C] () – C:\Documents and Settings\edi\Application Data\Adobe GIF Format CS5 Prefs
[2012/02/27 11:21:20 | 000,067,756 | -H– | C] () – C:\WINDOWS\System32\mlfcache.dat
[2012/02/08 17:33:00 | 000,002,828 | -HS- | C] () – C:\WINDOWS\System32\KGyGaAvL.sys
[2012/01/21 12:46:16 | 000,408,282 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1220945662-1935655697-1801674531-1004-0.dat
[2012/01/21 12:46:11 | 001,011,666 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1220945662-1935655697-1801674531-1005-0.dat
[2012/01/21 12:46:01 | 000,412,466 | —- | C] () – C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2011/12/29 22:34:43 | 000,293,992 | —- | C] () – C:\WINDOWS\System32\nvdrsdb1.bin
[2011/12/29 22:34:43 | 000,293,992 | —- | C] () – C:\WINDOWS\System32\nvdrsdb0.bin
[2011/12/29 22:34:43 | 000,000,001 | —- | C] () – C:\WINDOWS\System32\nvdrssel.bin
[2011/12/29 22:34:23 | 002,783,770 | —- | C] () – C:\WINDOWS\System32\nvdata.data
[2011/10/10 11:04:13 | 000,650,752 | —- | C] () – C:\WINDOWS\System32\xvidcore.dll
[2011/10/10 11:04:13 | 000,240,640 | —- | C] () – C:\WINDOWS\System32\xvidvfw.dll
[2011/09/04 15:27:23 | 000,001,456 | —- | C] () – C:\Documents and Settings\edi\Local Settings\Application Data\Adobe Save for Web 12.0 Prefs
[2011/08/28 23:54:36 | 000,354,816 | —- | C] () – C:\WINDOWS\System32\psisdecd.dll
[2011/08/28 21:03:20 | 002,015,744 | —- | C] () – C:\WINDOWS\BSS.dat
[2011/08/28 20:51:00 | 000,000,302 | —- | C] () – C:\WINDOWS\EReg515.dat
[2011/08/04 05:32:09 | 000,000,236 | —- | C] () – C:\WINDOWS\KA.INI
[2011/08/04 03:51:27 | 000,000,839 | —- | C] () – C:\WINDOWS\Disney.ini
[2011/06/08 12:24:57 | 000,000,000 | —- | C] () – C:\WINDOWS\drvxl32.INI
[2011/06/08 12:24:56 | 000,000,000 | —- | C] () – C:\WINDOWS\drvwd32.INI
[2011/06/08 12:24:55 | 000,000,000 | —- | C] () – C:\WINDOWS\drvwp32.INI
[2011/06/04 15:42:35 | 000,000,132 | —- | C] () – C:\Documents and Settings\edi\Application Data\Adobe PNG Format CS5 Prefs
[2011/05/24 15:44:26 | 000,000,026 | —- | C] () – C:\WINDOWS\popcinfo.dat
[2011/02/12 04:23:34 | 000,053,299 | —- | C] () – C:\WINDOWS\System32\pthreadVC.dll
[2011/02/01 18:06:27 | 000,000,000 | —- | C] () – C:\WINDOWS\Pool.INI
[2011/02/01 17:32:48 | 000,004,096 | —- | C] () – C:\WINDOWS\d3dx.dat
[2011/01/09 23:33:30 | 000,000,056 | -H– | C] () – C:\WINDOWS\System32\ezsidmv.dat
[2010/11/28 16:55:07 | 000,009,646 | RHS- | C] () – C:\Documents and Settings\All Users\ntuser.pol
[2010/04/26 11:03:34 | 000,136,704 | —- | C] () – C:\Documents and Settings\edi\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

< End of report >

Conspire

Post #24August 13, 2012, 3:11 AM UTC

Are you able to run Windows update after OTL fix?

Go to My Computer-> Tools-> Folder Options-> View tab:

Under the Hidden files and folders heading:
Select - Show hidden files and folders.
Uncheck- Hide protected operating system files (recommended) option.
Also, make sure there is no checkmark beside Hide file extensions for known file types.
Click OK. (Remember to Hide files and folders once done)

Please go to one of the below sites to scan the following files:
Virus Total (Recommended)
jotti.org
VirScan

click on Browse, and upload the following file for analysis:
c:\windows\system32\Kmlogon.dll
c:\windows\System32\KmServc.exe

Then click Submit. Allow the file to be scanned, and then please copy and paste the results link(for Virus Total) here for me to see.
If it says already scanned – click "reanalyze now"
Please post the results in your next reply.

===================================================

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Double-click SystemLook.exe to run it.
Copy the content of the following codebox into the main textfield:
```
:process
logon.scr
winlogon.exe
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

andrevtw

Post #25August 14, 2012, 3:43 AM UTC

i'm sorry for the late reply, we're entering the culminating week here

There's no change for Windows Update, not working.
here's the result from Virus Total, though i'm not quite sure about the link you asked for.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

https://www.virustotal.com/file/d39ce19f748…sis/1344914653/

SHA256: d39ce19f748cba5e840b1ec3beb5dcd26c0ba5d2bf93f6cf47aa35d8c412291f
File name: KmServc.exe
Detection ratio: 0 / 42
Analysis date: 2012-08-14 03:24:13 UTC ( 0 minutes ago )

https://www.virustotal.com/file/643a521f564…sis/1344914483/

SHA256: 643a521f564893fd21a343ec1cd1caa11514dc4e2d6a5e0bc5d381e8decdc7e6
File name: Kmlogon.dll
Detection ratio: 0 / 42
Analysis date: 2012-08-14 03:21:23 UTC ( 0 minutes ago )

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Here's from SystemLook.txt :

SystemLook 30.07.11 by jpshortstuff
Log created at 10:30 on 14/08/2012 by edi
Administrator - Elevation successful

========== process ==========

logon.scr - 5 handle(s) returned.
File path: C:\WINDOWS\system32\logon.scr
MD5: 9FAD7DFF67555FF1E06BC4A3893024A7
Modules:
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\uxtheme.dll

File path: C:\WINDOWS\system32\logon.scr
MD5: 9FAD7DFF67555FF1E06BC4A3893024A7
Modules:
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\uxtheme.dll

File path: C:\WINDOWS\system32\logon.scr
MD5: 9FAD7DFF67555FF1E06BC4A3893024A7
Modules:
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\uxtheme.dll

File path: C:\WINDOWS\system32\logon.scr
MD5: 9FAD7DFF67555FF1E06BC4A3893024A7
Modules:
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\uxtheme.dll

File path: C:\WINDOWS\system32\logon.scr
MD5: 9FAD7DFF67555FF1E06BC4A3893024A7
Modules:
C:\WINDOWS\system32\logon.scr
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\uxtheme.dll

winlogon.exe - 6 handle(s) returned.
File path: \??\C:\WINDOWS\system32\winlogon.exe
MD5: Unable to calculate MD5.
Modules:
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\CRYPT32.dll
C:\WINDOWS\system32\MSASN1.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\NDdeApi.dll
C:\WINDOWS\system32\PROFMAP.dll
C:\WINDOWS\system32\NETAPI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\REGAPI.dll
C:\WINDOWS\system32\SETUPAPI.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\WINSTA.dll
C:\WINDOWS\system32\WINTRUST.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\MSGINA.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\ODBC32.dll
C:\WINDOWS\system32\comdlg32.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
C:\WINDOWS\system32\odbcint.dll
C:\WINDOWS\system32\SHSVCS.dll
C:\WINDOWS\system32\msctfime.ime
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\cscdll.dll
C:\WINDOWS\System32\dimsntfy.dll
C:\WINDOWS\system32\Kmlogon.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\WlNotify.dll
C:\WINDOWS\system32\MPR.dll
C:\WINDOWS\system32\WinSCard.dll
C:\WINDOWS\system32\WTSAPI32.dll
C:\WINDOWS\system32\WINSPOOL.DRV
C:\WINDOWS\system32\rsaenh.dll
C:\WINDOWS\system32\Apphelp.dll

File path: \??\C:\WINDOWS\system32\winlogon.exe
MD5: Unable to calculate MD5.
Modules:
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\CRYPT32.dll
C:\WINDOWS\system32\MSASN1.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\NDdeApi.dll
C:\WINDOWS\system32\PROFMAP.dll
C:\WINDOWS\system32\NETAPI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\REGAPI.dll
C:\WINDOWS\system32\SETUPAPI.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\WINSTA.dll
C:\WINDOWS\system32\WINTRUST.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\MSGINA.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\ODBC32.dll
C:\WINDOWS\system32\comdlg32.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
C:\WINDOWS\system32\odbcint.dll
C:\WINDOWS\system32\SHSVCS.dll
C:\WINDOWS\system32\msctfime.ime
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\cscdll.dll
C:\WINDOWS\System32\dimsntfy.dll
C:\WINDOWS\system32\Kmlogon.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\WlNotify.dll
C:\WINDOWS\system32\MPR.dll
C:\WINDOWS\system32\WinSCard.dll
C:\WINDOWS\system32\WTSAPI32.dll
C:\WINDOWS\system32\WINSPOOL.DRV
C:\WINDOWS\system32\rsaenh.dll
C:\WINDOWS\system32\Apphelp.dll

File path: \??\C:\WINDOWS\system32\winlogon.exe
MD5: Unable to calculate MD5.
Modules:
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\CRYPT32.dll
C:\WINDOWS\system32\MSASN1.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\NDdeApi.dll
C:\WINDOWS\system32\PROFMAP.dll
C:\WINDOWS\system32\NETAPI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\REGAPI.dll
C:\WINDOWS\system32\SETUPAPI.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\WINSTA.dll
C:\WINDOWS\system32\WINTRUST.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\MSGINA.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\ODBC32.dll
C:\WINDOWS\system32\comdlg32.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
C:\WINDOWS\system32\odbcint.dll
C:\WINDOWS\system32\SHSVCS.dll
C:\WINDOWS\system32\msctfime.ime
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\cscdll.dll
C:\WINDOWS\System32\dimsntfy.dll
C:\WINDOWS\system32\Kmlogon.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\WlNotify.dll
C:\WINDOWS\system32\MPR.dll
C:\WINDOWS\system32\WinSCard.dll
C:\WINDOWS\system32\WTSAPI32.dll
C:\WINDOWS\system32\WINSPOOL.DRV
C:\WINDOWS\system32\rsaenh.dll
C:\WINDOWS\system32\Apphelp.dll

File path: \??\C:\WINDOWS\system32\winlogon.exe
MD5: Unable to calculate MD5.
Modules:
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\CRYPT32.dll
C:\WINDOWS\system32\MSASN1.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\NDdeApi.dll
C:\WINDOWS\system32\PROFMAP.dll
C:\WINDOWS\system32\NETAPI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\REGAPI.dll
C:\WINDOWS\system32\SETUPAPI.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\WINSTA.dll
C:\WINDOWS\system32\WINTRUST.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\MSGINA.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\ODBC32.dll
C:\WINDOWS\system32\comdlg32.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
C:\WINDOWS\system32\odbcint.dll
C:\WINDOWS\system32\SHSVCS.dll
C:\WINDOWS\system32\msctfime.ime
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\cscdll.dll
C:\WINDOWS\System32\dimsntfy.dll
C:\WINDOWS\system32\Kmlogon.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\WlNotify.dll
C:\WINDOWS\system32\MPR.dll
C:\WINDOWS\system32\WinSCard.dll
C:\WINDOWS\system32\WTSAPI32.dll
C:\WINDOWS\system32\WINSPOOL.DRV
C:\WINDOWS\system32\rsaenh.dll
C:\WINDOWS\system32\Apphelp.dll

File path: \??\C:\WINDOWS\system32\winlogon.exe
MD5: Unable to calculate MD5.
Modules:
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\CRYPT32.dll
C:\WINDOWS\system32\MSASN1.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\NDdeApi.dll
C:\WINDOWS\system32\PROFMAP.dll
C:\WINDOWS\system32\NETAPI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\REGAPI.dll
C:\WINDOWS\system32\SETUPAPI.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\WINSTA.dll
C:\WINDOWS\system32\WINTRUST.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\MSGINA.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\ODBC32.dll
C:\WINDOWS\system32\comdlg32.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
C:\WINDOWS\system32\odbcint.dll
C:\WINDOWS\system32\SHSVCS.dll
C:\WINDOWS\system32\msctfime.ime
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\cscdll.dll
C:\WINDOWS\System32\dimsntfy.dll
C:\WINDOWS\system32\Kmlogon.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\WlNotify.dll
C:\WINDOWS\system32\MPR.dll
C:\WINDOWS\system32\WinSCard.dll
C:\WINDOWS\system32\WTSAPI32.dll
C:\WINDOWS\system32\WINSPOOL.DRV
C:\WINDOWS\system32\rsaenh.dll
C:\WINDOWS\system32\Apphelp.dll

File path: \??\C:\WINDOWS\system32\winlogon.exe
MD5: Unable to calculate MD5.
Modules:
\??\C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\ntdll.dll
C:\WINDOWS\system32\kernel32.dll
C:\WINDOWS\system32\ADVAPI32.dll
C:\WINDOWS\system32\RPCRT4.dll
C:\WINDOWS\system32\Secur32.dll
C:\WINDOWS\system32\AUTHZ.dll
C:\WINDOWS\system32\msvcrt.dll
C:\WINDOWS\system32\CRYPT32.dll
C:\WINDOWS\system32\MSASN1.dll
C:\WINDOWS\system32\USER32.dll
C:\WINDOWS\system32\GDI32.dll
C:\WINDOWS\system32\NDdeApi.dll
C:\WINDOWS\system32\PROFMAP.dll
C:\WINDOWS\system32\NETAPI32.dll
C:\WINDOWS\system32\USERENV.dll
C:\WINDOWS\system32\PSAPI.DLL
C:\WINDOWS\system32\REGAPI.dll
C:\WINDOWS\system32\SETUPAPI.dll
C:\WINDOWS\system32\VERSION.dll
C:\WINDOWS\system32\WINSTA.dll
C:\WINDOWS\system32\WINTRUST.dll
C:\WINDOWS\system32\IMAGEHLP.dll
C:\WINDOWS\system32\WS2_32.dll
C:\WINDOWS\system32\WS2HELP.dll
C:\WINDOWS\system32\IMM32.DLL
C:\WINDOWS\system32\MSGINA.dll
C:\WINDOWS\system32\COMCTL32.dll
C:\WINDOWS\system32\ODBC32.dll
C:\WINDOWS\system32\comdlg32.dll
C:\WINDOWS\system32\SHELL32.dll
C:\WINDOWS\system32\SHLWAPI.dll
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
C:\WINDOWS\system32\odbcint.dll
C:\WINDOWS\system32\SHSVCS.dll
C:\WINDOWS\system32\sfc.dll
C:\WINDOWS\system32\sfc_os.dll
C:\WINDOWS\system32\ole32.dll
C:\WINDOWS\system32\Apphelp.dll
C:\WINDOWS\system32\msctfime.ime
C:\WINDOWS\system32\WINSCARD.DLL
C:\WINDOWS\system32\WTSAPI32.dll
C:\WINDOWS\system32\sxs.dll
C:\WINDOWS\system32\uxtheme.dll
C:\WINDOWS\system32\cscdll.dll
C:\WINDOWS\System32\dimsntfy.dll
C:\WINDOWS\system32\rsaenh.dll
C:\WINDOWS\system32\Kmlogon.dll
C:\WINDOWS\system32\WINMM.dll
C:\WINDOWS\system32\WlNotify.dll
C:\WINDOWS\system32\MPR.dll
C:\WINDOWS\system32\WINSPOOL.DRV
C:\WINDOWS\system32\msv1_0.dll
C:\WINDOWS\system32\cryptdll.dll
C:\WINDOWS\system32\iphlpapi.dll
C:\WINDOWS\system32\wldap32.dll
C:\WINDOWS\system32\SAMLIB.dll
C:\WINDOWS\system32\RASAPI32.dll
C:\WINDOWS\system32\rasman.dll
C:\WINDOWS\system32\TAPI32.dll
C:\WINDOWS\system32\rtutils.dll
C:\WINDOWS\system32\cscui.dll
C:\WINDOWS\system32\xpsp2res.dll
C:\WINDOWS\system32\COMRes.dll
C:\WINDOWS\system32\OLEAUT32.dll
C:\WINDOWS\system32\CLBCATQ.DLL
C:\WINDOWS\system32\NTMARTA.DLL
C:\WINDOWS\system32\wdmaud.drv
C:\WINDOWS\system32\msacm32.drv
C:\WINDOWS\system32\MSACM32.dll
C:\WINDOWS\system32\midimap.dll
C:\WINDOWS\system32\wbem\wbemprox.dll
C:\WINDOWS\system32\wbem\wbemcomn.dll
C:\WINDOWS\system32\wbem\wbemsvc.dll
C:\WINDOWS\system32\wbem\fastprox.dll
C:\WINDOWS\system32\MSVCP60.dll
C:\WINDOWS\system32\NTDSAPI.dll
C:\WINDOWS\system32\DNSAPI.dll

-= EOF =-

Conspire

Post #26August 14, 2012, 5:50 AM UTC

Not sure if you have went through Microsoft website or not but here's the link to diagnose the problem : http://support.microsoft.com/mats/windows_update/

Also, the multiple instances of winlogon.exe and logon.scr are harmless. Not sure why there is so many of it, but they should not pose any threats to your computer.

andrevtw

Post #27August 14, 2012, 9:20 AM UTC

Thank you so much Conspire So they are harmless… and now I can install antivirus I guess…. Just went thru that link to Microsoft, and they installed and ran the Fix It program… still the same then i go from Control Panel -> System -> Automatic Update -> Windows Update website, and after some checking they returned with this report: ~~~~~~~~~~~~~~~~ [Error number: 0x8DDD0003] Network policy settings prevent you from using this website to get updates for your computer. If you believe you have received this message in error, please contact your system administrator. Read more about steps you can take to resolve this problem (error number 0x8DDD0003) yourself. I did go to read more and got this : ~~~~~~~~~~~~~~~~~~~~~~~~~~ When trying to access the Update site, you see the 0x8ddd0003 error Last updated : 10/21/2005 Print | Close Problem description The error message reads: Network policy settings prevent you from using Windows Update to download and install updates. This error may occur if the Remove access to use all Windows Update features group policy has been enabled by your system administrator. ~~~~~~~~~~~~~~~~~~~~~~~~~~ I guess i have to see the Group Policy setting… which i don't quite familiar. Thank you so much for your help, your assist, all of your time, Conspire Have a great week

Conspire

Post #28August 14, 2012, 10:05 AM UTC last edited August 14, 2012, 10:06 AM UTC

You may install antivirus now.

Here try this fix by DougKnox : Download

What this does is to remove any existing policy settings restrictions for Windows Update. Just double click on it will do. Hope this will work.

andrevtw

Post #29August 14, 2012, 12:19 PM UTC

Have tried the fix, it's has no effect…

in the meantime just downloaded and installed Avast Antivirus… there was a pop up window said: "avast.setup has encountered a problem and needs to close " but I didnt click the [close] button, instead let the setup continue.. and it's working. What was happening on that? Didn't reboot the machine yet, still downloading some fixes and update manually from Microsoft Fix It… Will tell you what happen after rebooting….

Conspire

Post #30August 14, 2012, 1:19 PM UTC

Most likely that your Windows has corrupted system files. I think it would be a better idea to actually reinstall it.

SFC – System File Checker Workaround

Please try this workaround (you will need your Windows® XP SP3 CD).

(In the event that you do not have a Windows® XP CD with SP3, you will need to 'borrow' one from a friend or colleague, as the manufacturer's "Recovery Discs" will not work in this instance.)

Insert the Windows® XP CD in your drive. (Hold down the Shift Key to prevent it from starting.)

Go Start > Run …in the box type in sfc /scannow …please take note of the space between the sfc and the /.

This is the System File Checker…it will scan all the Windows® core system files to ensure that they are in their respective correct places, and if not replace them from the CD.

During the scan you may be asked to Insert the CD, if this happens just go retry and let it do its thing.

One important point: While sfc is running, it is not advisable to do any other work, or have any browsers/programs running on the computer, until the scan is complete. (This process will generally take around 45-65 minutes to complete).

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Please help, winlogon.exe and logon.scr problem

✨ Ask AI

Ask AI