What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Hard drive filling up start menu programs missing [Closed]

2 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Greetings Whatthetech:

I've been trying to correct an issue on an XP SP3 ASUS. This netbook has only 8gb HDD, so I'm battling to keep some room available for storage. I've run several programs Avira, Avast (which is missing now), ( I did run aswMBR earlier, and received "suspicious" notations regarding "dxgthk.sys" and "ntdll.dll") Superantispyware (which found some items) and the list goes on. I'm not real tech savvy, but I can attach the scan results from OTL & Extras:

OTL:
OTL logfile created on: 9/22/2013 10:56:13 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Ellen Smith\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.04 Mb Total Physical Memory | 315.08 Mb Available Physical Memory | 62.63% Memory free
1.20 Gb Paging File | 0.79 Gb Available in Paging File | 65.54% Paging File free
Paging file location(s): C:\pagefile.sys 2 200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 7.48 Gb Total Space | 0.28 Gb Free Space | 3.81% Space Free | Partition Type: NTFS

Computer Name: YOUR-1UT28O6MCF | User Name: Ellen Smith | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Ellen Smith\My Documents\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware)
PRC - C:\Program Files\Secunia\PSI\psia.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\sua.exe (Secunia)
PRC - C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
PRC - C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe (ASUSTeK Computer Inc.)
PRC - C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\13092201\algo.dll ()


========== Services (SafeList) ==========

SRV - (HidServ) – %SystemRoot%\System32\hidserv.dll File not found
SRV - (AppMgmt) – %SystemRoot%\System32\appmgmts.dll File not found
SRV - (AdobeFlashPlayerUpdateSvc) – C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (avast! Antivirus) – C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (Secunia PSI Agent) – C:\Program Files\Secunia\PSI\psia.exe (Secunia)
SRV - (Secunia Update Agent) – C:\Program Files\Secunia\PSI\sua.exe (Secunia)
SRV - (!SASCORE) – C:\Program Files\SUPERAntiSpyware\SASCore.exe (SUPERAntiSpyware.com)


========== Driver Services (SafeList) ==========

DRV - (WDICA) – File not found
DRV - (SRTSPX) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSPX.SYS File not found
DRV - (SRTSP) – C:\WINDOWS\system32\drivers\NIS\1000000.07D\SRTSP.SYS File not found
DRV - (PDRFRAME) – File not found
DRV - (PDRELI) – File not found
DRV - (PDFRAME) – File not found
DRV - (PDCOMP) – File not found
DRV - (PCIDump) – File not found
DRV - (NAVEX15) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVEX15.SYS File not found
DRV - (NAVENG) – C:\Documents and Settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\VirusDefs\20080829.024\NAVENG.SYS File not found
DRV - (lbrtfdc) – File not found
DRV - (i2omgmt) – File not found
DRV - (Changer) – File not found
DRV - (catchme) – C:\DOCUME~1\ELLENS~1\LOCALS~1\Temp\catchme.sys File not found
DRV - (aswSP) – File not found
DRV - (aswMBR) – C:\DOCUME~1\ELLENS~1\LOCALS~1\Temp\aswMBR.sys File not found
DRV - (aswFsBlk) – File not found
DRV - (aswVmm) – C:\WINDOWS\System32\drivers\aswVmm.sys ()
DRV - (aswTdi) – C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswSnx) – C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (AswRdr) – C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswRvrt) – C:\WINDOWS\System32\drivers\aswRvrt.sys ()
DRV - (aswMonFlt) – C:\WINDOWS\system32\drivers\aswMonFlt.sys (AVAST Software)
DRV - (PSI) – C:\WINDOWS\system32\drivers\psi_mf_x86.sys (Secunia)
DRV - (SASDIFSV) – C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) – C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (WDC_SAM) – C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
DRV - (AR5416) – C:\WINDOWS\system32\drivers\athw.sys (Atheros Communications, Inc.)
DRV - (AsusACPI) – C:\WINDOWS\system32\drivers\ASUSACPI.SYS (ASUSTeK Computer Inc.)
DRV - (IntcAzAudAddService) – C:\WINDOWS\system32\drivers\RtkHDAud.sys (Realtek Semiconductor Corp.)
DRV - (AtcL002) – C:\WINDOWS\system32\drivers\l251x86.sys (Atheros Communications, Inc.)
DRV - (AR5211) – C:\WINDOWS\system32\drivers\ar5211.sys (Atheros Communications, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={sea…ferrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.bing.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}…amp;FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6BB20D8B-7669-47C3-A79E-0E865AFD5F5A}: "URL" = http://www.google.com/search?q={searchTerm…utputEncoding?}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)



========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{g
oogle:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:ins
tantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncodin
g}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q;={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}sugkey={google:suggestAPIKeyPar
ameter}
CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.66\PepperFlash\pepflashplayer.dll
CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.66\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files\Google\Chrome\Application\29.0.1547.66\pdf.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 8.0\Reader\Browser\nppdf32.dll
CHR - plugin: Java Deployment Toolkit 6.0.170.4 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npdeploytk.dll
CHR - plugin: Java™ Platform SE 6 U17 (Enabled) = C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npdrmv2.dll
CHR - plugin: Windows Media Player Plug-in Dynamic Link Library (Enabled) = C:\Program Files\Windows Media Player\npdsplay.dll
CHR - plugin: Microsoft\u00AE DRM (Enabled) = C:\Program Files\Windows Media Player\npwmsdrm.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll
CHR - plugin: Windows Presentation Foundation (Enabled) = c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
CHR - Extension: avast! Online Security = C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki\8.0.8_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\

O1 HOSTS File: ([2006/02/28 22:00:00 | 000,000,734 | —- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
O4 - HKLM..\Run: [AsusACPIServer] C:\Program Files\EeePC\ACPI\AsAcpiSvr.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusEPCMonitor] C:\Program Files\EeePC\ACPI\AsEPCMon.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AsusTray] C:\Program Files\EeePC\ACPI\AsTray.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Asus Power Management Utility.lnk = C:\Program Files\ASUS\EeePC\Asus Power Management Utility\Asus Power Management Utility.exe (ASUSTeK Computer Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoRun OSCleaner.lnk = C:\Program Files\ASUS\Asus OS Cleaner\AsOSCleaner.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk = C:\Program Files\Secunia\PSI\psi_tray.exe (Secunia)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed]
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EA9B3AEC-6BE8-4E88-9DCA-9DFFC6434A67}: DhcpNameServer = [removed] [removed] [removed]
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 00:09:03 | 000,000,000 | —- | M] () - C:\AUTOEXEC.BAT – [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] – "%1" %*
O35 - HKLM\..exefile [open] – "%1" %*
O37 - HKLM\…com [@ = ComFile] – "%1" %*
O37 - HKLM\…exe [@ = exefile] – "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - %SystemRoot%\System32\appmgmts.dll File not found
NetSvcs: HidServ - %SystemRoot%\System32\hidserv.dll File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: MSVideo8 - C:\WINDOWS\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2013/09/22 22:54:55 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Desktop\Are you Infected Need Help _files
[2013/09/22 19:27:51 | 000,000,000 | RH-D | C] – C:\Documents and Settings\Ellen Smith\Recent
[2013/09/22 16:00:42 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Application Data\JAM Software
[2013/09/22 15:59:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\TreeSize Free
[2013/09/22 15:58:31 | 000,000,000 | —D | C] – C:\Program Files\JAM Software
[2013/09/22 00:07:15 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\Secunia PSI
[2013/09/22 00:05:08 | 000,000,000 | —D | C] – C:\Program Files\Secunia
[2013/09/21 22:55:10 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Sophos
[2013/09/21 22:54:49 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Start Menu\Programs\Sophos
[2013/09/21 22:51:18 | 000,000,000 | —D | C] – C:\Program Files\Sophos
[2013/09/21 05:48:23 | 000,000,000 | R–D | C] – C:\Documents and Settings\Ellen Smith\My Documents\My Pictures
[2013/09/21 05:17:06 | 000,000,000 | -H-D | C] – C:\WINDOWS\ie8
[2013/09/21 00:15:56 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2013/09/21 00:15:31 | 000,000,000 | —D | C] – C:\Program Files\SUPERAntiSpyware
[2013/09/20 19:54:13 | 000,000,000 | —D | C] – C:\a4345a34030f633cb66ef901b5
[2013/09/20 10:37:54 | 000,000,000 | —D | C] – C:\496cc2162e07b128cf43
[2013/09/20 10:00:24 | 000,000,000 | —D | C] – C:\332222e38604f6d316676b4b
[2013/09/20 06:32:09 | 000,012,928 | —- | C] (Microsoft Corporation) – C:\WINDOWS\System32\dllcache\usb8023x.sys
[2013/09/19 15:16:59 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2013/09/19 15:16:50 | 000,056,080 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/09/19 15:16:50 | 000,049,760 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/09/19 15:16:49 | 000,770,344 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/09/19 15:16:44 | 000,066,336 | —- | C] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/09/19 15:16:43 | 000,229,648 | —- | C] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[2013/09/19 15:11:21 | 000,041,664 | —- | C] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/09/19 15:06:16 | 000,000,000 | —D | C] – C:\Program Files\AVAST Software
[2013/09/19 11:08:05 | 000,000,000 | —D | C] – C:\Program Files\stinger
[2013/09/18 20:29:27 | 000,000,000 | -HSD | C] – C:\RECYCLER
[2013/09/18 16:43:42 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\APN
[2013/09/18 16:41:47 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Avira
[2013/09/18 16:01:13 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/09/18 15:59:56 | 000,022,856 | —- | C] (Malwarebytes Corporation) – C:\WINDOWS\System32\drivers\mbam.sys
[2013/09/18 15:31:19 | 000,000,000 | -H-D | C] – C:\Documents and Settings\All Users\Application Data\Common Files
[2013/09/18 15:31:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\MFAData
[2013/09/18 15:31:19 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\MFAData
[2013/09/18 12:45:12 | 000,000,000 | RHSD | C] – C:\cmdcons
[2013/09/18 12:41:31 | 000,518,144 | —- | C] (SteelWerX) – C:\WINDOWS\SWREG.exe
[2013/09/18 12:41:31 | 000,406,528 | —- | C] (SteelWerX) – C:\WINDOWS\SWSC.exe
[2013/09/18 12:41:31 | 000,212,480 | —- | C] (SteelWerX) – C:\WINDOWS\SWXCACLS.exe
[2013/09/18 12:41:31 | 000,060,416 | —- | C] (NirSoft) – C:\WINDOWS\NIRCMD.exe
[2013/09/18 12:40:53 | 000,000,000 | —D | C] – C:\Qoobox
[2013/09/18 12:40:44 | 000,000,000 | R–D | C] – C:\Documents and Settings\All Users\Documents\My Videos
[2013/09/18 12:40:43 | 000,000,000 | R–D | C] – C:\Documents and Settings\Ellen Smith\My Documents\My Videos
[2013/09/18 12:40:43 | 000,000,000 | R–D | C] – C:\Documents and Settings\Ellen Smith\Start Menu\Programs\Administrative Tools
[2013/09/18 12:40:22 | 000,000,000 | —D | C] – C:\WINDOWS\erdnt
[2013/09/18 10:46:43 | 000,000,000 | —D | C] – C:\Program Files\VS Revo Group
[2013/09/17 10:58:25 | 000,692,616 | —- | C] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/09/17 08:22:12 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/09/17 04:34:13 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\PCHealth
[2013/09/16 12:54:18 | 000,000,000 | —D | C] – C:\f9872dc65113e17ed6ca
[2013/09/16 10:31:46 | 000,000,000 | —D | C] – C:\Program Files\Malwarebytes' Anti-Malware
[2013/09/16 09:49:51 | 000,000,000 | —D | C] – C:\d646bba2dc553899dd74d43c4672f8
[2013/09/15 23:51:29 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Application Data\Malwarebytes
[2013/09/15 22:32:12 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Application Data\SUPERAntiSpyware.com
[2013/09/15 22:31:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2013/09/15 22:30:49 | 000,011,520 | —- | C] (Western Digital Technologies) – C:\WINDOWS\System32\drivers\wdcsam.sys
[2013/09/15 22:30:45 | 000,000,000 | —D | C] – C:\Program Files\Western Digital
[2013/09/15 22:30:19 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\Western Digital
[2013/09/15 21:57:58 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\My Documents\Downloads
[2013/09/15 21:52:47 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\Google
[2013/09/15 20:25:55 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2013/09/15 13:59:24 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2013/09/15 13:52:43 | 000,000,000 | —D | C] – C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2013/09/15 13:52:36 | 000,000,000 | —D | C] – C:\Program Files\CCleaner
[2013/09/15 13:52:19 | 000,000,000 | —D | C] – C:\Program Files\Google
[2013/09/15 12:43:06 | 000,000,000 | —D | C] – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\Deployment
[2008/05/30 16:09:14 | 015,523,560 | —- | C] (Macrovision Corporation) – C:\Program Files\U1 Setup.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/09/22 23:03:02 | 000,000,830 | —- | M] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/22 22:54:55 | 000,090,875 | —- | M] () – C:\Documents and Settings\Ellen Smith\Desktop\Are you Infected Need Help .htm
[2013/09/22 22:21:59 | 000,000,512 | —- | M] () – C:\Documents and Settings\Ellen Smith\Desktop\MBR.dat
[2013/09/22 20:25:00 | 000,000,896 | —- | M] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/22 19:43:49 | 000,001,158 | —- | M] () – C:\WINDOWS\System32\wpa.dbl
[2013/09/22 15:59:19 | 000,000,874 | —- | M] () – C:\Documents and Settings\Ellen Smith\Desktop\TreeSize Free.lnk
[2013/09/22 15:16:00 | 000,000,378 | -H– | M] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/09/22 01:07:35 | 000,002,048 | –S- | M] () – C:\WINDOWS\bootstat.dat
[2013/09/22 00:07:01 | 000,000,753 | —- | M] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013/09/21 22:54:51 | 000,002,086 | —- | M] () – C:\Documents and Settings\Ellen Smith\Desktop\Sophos Virus Removal Tool.lnk
[2013/09/21 20:18:14 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2013/09/21 11:49:27 | 000,442,140 | —- | M] () – C:\WINDOWS\System32\perfh009.dat
[2013/09/21 11:49:27 | 000,071,910 | —- | M] () – C:\WINDOWS\System32\perfc009.dat
[2013/09/21 05:47:50 | 000,263,824 | —- | M] () – C:\WINDOWS\System32\FNTCACHE.DAT
[2013/09/20 15:05:39 | 000,692,616 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerApp.exe
[2013/09/20 15:05:36 | 000,071,048 | —- | M] (Adobe Systems Incorporated) – C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013/09/20 13:10:47 | 000,000,664 | —- | M] () – C:\WINDOWS\System32\d3d9caps.dat
[2013/09/19 15:16:44 | 000,002,577 | —- | M] () – C:\WINDOWS\System32\CONFIG.NT
[2013/09/18 16:01:14 | 000,000,784 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/18 10:17:40 | 000,000,211 | —- | M] () – C:\Boot.bak
[2013/09/16 11:18:39 | 000,000,000 | —- | M] () – C:\end
[2013/09/16 11:02:28 | 000,000,048 | —- | M] () – C:\WINDOWS\wininit.ini
[2013/09/15 23:50:02 | 000,144,817 | —- | M] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\census.cache
[2013/09/15 23:49:52 | 000,150,292 | —- | M] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\ars.cache
[2013/09/15 21:58:26 | 000,000,036 | —- | M] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\housecall.guid.cache
[2013/09/15 21:53:14 | 000,001,831 | —- | M] () – C:\Documents and Settings\Ellen Smith\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/09/15 20:25:55 | 000,001,813 | —- | M] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/09/15 13:52:43 | 000,000,682 | —- | M] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/08/30 02:48:13 | 000,177,864 | —- | M] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/08/30 02:48:13 | 000,056,080 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswTdi.sys
[2013/08/30 02:48:12 | 000,770,344 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswSnx.sys
[2013/08/30 02:48:12 | 000,049,760 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswRdr.sys
[2013/08/30 02:48:12 | 000,049,376 | —- | M] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/08/30 02:48:11 | 000,066,336 | —- | M] (AVAST Software) – C:\WINDOWS\System32\drivers\aswMonFlt.sys
[2013/08/30 02:47:40 | 000,041,664 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr
[2013/08/30 02:47:32 | 000,229,648 | —- | M] (AVAST Software) – C:\WINDOWS\System32\aswBoot.exe
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/09/22 22:54:55 | 000,090,875 | —- | C] () – C:\Documents and Settings\Ellen Smith\Desktop\Are you Infected Need Help .htm
[2013/09/22 22:15:13 | 000,000,512 | —- | C] () – C:\Documents and Settings\Ellen Smith\Desktop\MBR.dat
[2013/09/22 15:59:19 | 000,000,874 | —- | C] () – C:\Documents and Settings\Ellen Smith\Desktop\TreeSize Free.lnk
[2013/09/22 00:07:01 | 000,000,753 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Secunia PSI Tray.lnk
[2013/09/22 00:07:01 | 000,000,716 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Secunia PSI.lnk
[2013/09/21 22:54:51 | 000,002,086 | —- | C] () – C:\Documents and Settings\Ellen Smith\Desktop\Sophos Virus Removal Tool.lnk
[2013/09/21 20:15:39 | 000,000,917 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Asus Power Management Utility.lnk
[2013/09/21 20:15:39 | 000,000,575 | —- | C] () – C:\Documents and Settings\All Users\Start Menu\Programs\Startup\AutoRun OSCleaner.lnk
[2013/09/19 15:16:49 | 000,177,864 | —- | C] () – C:\WINDOWS\System32\drivers\aswVmm.sys
[2013/09/19 15:16:49 | 000,049,376 | —- | C] () – C:\WINDOWS\System32\drivers\aswRvrt.sys
[2013/09/19 15:16:49 | 000,000,378 | -H– | C] () – C:\WINDOWS\tasks\avast! Emergency Update.job
[2013/09/18 16:01:14 | 000,000,784 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/09/18 12:46:16 | 000,000,211 | —- | C] () – C:\Boot.bak
[2013/09/18 12:46:07 | 000,260,272 | RHS- | C] () – C:\cmldr
[2013/09/18 12:41:31 | 000,256,000 | —- | C] () – C:\WINDOWS\PEV.exe
[2013/09/18 12:41:31 | 000,208,896 | —- | C] () – C:\WINDOWS\MBR.exe
[2013/09/18 12:41:31 | 000,098,816 | —- | C] () – C:\WINDOWS\sed.exe
[2013/09/18 12:41:31 | 000,080,412 | —- | C] () – C:\WINDOWS\grep.exe
[2013/09/18 12:41:31 | 000,068,096 | —- | C] () – C:\WINDOWS\zip.exe
[2013/09/17 10:58:28 | 000,000,830 | —- | C] () – C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/09/16 11:02:28 | 000,000,048 | —- | C] () – C:\WINDOWS\wininit.ini
[2013/09/16 10:45:36 | 000,000,000 | —- | C] () – C:\end
[2013/09/15 23:50:02 | 000,144,817 | —- | C] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\census.cache
[2013/09/15 23:49:52 | 000,150,292 | —- | C] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\ars.cache
[2013/09/15 21:58:26 | 000,000,036 | —- | C] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\housecall.guid.cache
[2013/09/15 21:34:04 | 000,001,831 | —- | C] () – C:\Documents and Settings\Ellen Smith\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/09/15 20:25:55 | 000,001,813 | —- | C] () – C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/09/15 20:20:47 | 000,000,896 | —- | C] () – C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/09/15 13:52:43 | 000,000,682 | —- | C] () – C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/02/11 08:52:05 | 000,003,072 | —- | C] () – C:\WINDOWS\System32\iacenc.dll
[2011/10/24 08:33:16 | 000,000,032 | —- | C] () – C:\Documents and Settings\All Users\Application Data\ezsid.dat
[2009/12/24 11:08:53 | 000,000,128 | —- | C] () – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\fusioncache.dat

========== ZeroAccess Check ==========

[2008/05/27 23:50:16 | 000,000,227 | RHS- | M] () – C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll – [2008/10/15 20:00:10 | 001,499,136 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll – [2009/02/09 07:10:48 | 000,473,600 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll – [2008/04/14 07:42:10 | 000,273,920 | —- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/09/18 16:43:42 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\APN
[2013/09/19 15:06:16 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/09/18 15:31:19 | 000,000,000 | -H-D | M] – C:\Documents and Settings\All Users\Application Data\Common Files
[2013/09/18 15:54:50 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\MFAData
[2013/09/21 22:55:45 | 000,000,000 | —D | M] – C:\Documents and Settings\All Users\Application Data\Sophos
[2013/09/22 16:00:42 | 000,000,000 | —D | M] – C:\Documents and Settings\Ellen Smith\Application Data\JAM Software

========== Purity Check ==========



========== Custom Scans ==========

< %USERPROFILE%\..|smtmp;true;true;true /FP >

< %temp%\smtmp\*.* /s > >

< MD5 for: EXPLORER.EXE >
[2008/04/14 07:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\explorer.exe
[2008/04/14 07:42:20 | 001,033,728 | —- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 – C:\WINDOWS\system32\dllcache\explorer.exe

< MD5 for: EXPLORER.EXE.3C2F65A1.INI.INUSE >
[2008/12/08 09:26:55 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Documents and Settings\Default User\Local Settings\Application Data\ApplicationHistory\Explorer.EXE.3c2f65a1.ini.inuse
[2008/12/08 09:26:55 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\Documents and Settings\Ellen Smith\Local Settings\Application Data\ApplicationHistory\Explorer.EXE.3c2f65a1.ini.inuse
[2008/12/08 09:26:55 | 000,000,000 | —- | M] () MD5=D41D8CD98F00B204E9800998ECF8427E – C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\ApplicationHistory\Explorer.EXE.3c2f65a1.ini.inuse

< MD5 for: EXPLORER.EXE.CONFIG >
[2008/08/27 22:10:24 | 000,000,173 | —- | M] () MD5=34E5BEA84C6DFABE35C806897E27732E – C:\WINDOWS\explorer.exe.config

< MD5 for: EXPLORER.EXE-3B758B55.PF >
[2013/09/21 19:12:26 | 000,019,362 | —- | M] () MD5=A14A0BBB594BECAF040AC462FFD4DBA8 – C:\WINDOWS\Prefetch\EXPLORER.EXE-3B758B55.pf

< MD5 for: EXPLORER.SCF >
[2006/02/28 22:00:00 | 000,000,080 | —- | M] () MD5=A3975A7D2C98B30A2AE010754FFB9392 – C:\WINDOWS\explorer.scf

< MD5 for: IEXPLORE.CHM >
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\332222e38604f6d316676b4b\iexplore.chm
[2009/02/21 01:21:24 | 000,529,818 | —- | M] () MD5=1435F4731719DF5F57D17DC38196245D – C:\WINDOWS\Help\iexplore.chm
[2007/04/03 00:09:24 | 000,204,810 | —- | M] () MD5=60858526AAD1CC55F5F0055B8E3B66FE – C:\WINDOWS\ie7\iexplore.chm
[2006/09/01 08:43:50 | 000,503,758 | —- | M] () MD5=652E46500C149D1DC948BF9CEA8C4933 – C:\WINDOWS\ie8\iexplore.chm

< MD5 for: IEXPLORE.EXE >
[2008/12/19 00:25:25 | 000,634,024 | —- | M] (Microsoft Corporation) MD5=030D78FE84A086ED376EFCBD2D72C522 – C:\WINDOWS\ie7updates\KB976325-IE7\iexplore.exe
[2008/08/23 00:56:15 | 000,635,848 | —- | M] (Microsoft Corporation) MD5=1F03216084447F990AE797317D0A6E70 – C:\WINDOWS\ie7updates\KB958215-IE7\iexplore.exe
[2008/02/29 03:55:46 | 000,625,664 | —- | M] (Microsoft Corporation) MD5=2D0E5592AB5A46C27DAF7CCAFF4F5B59 – C:\WINDOWS\ie7updates\KB956390-IE7\iexplore.exe
[2009/10/28 01:54:16 | 000,634,632 | —- | M] (Microsoft Corporation) MD5=4F9B04D546C23A295F3F0AE015BE51DB – C:\WINDOWS\ie7updates\KB978207-IE7\iexplore.exe
[2009/12/18 08:05:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=53C291F3B01EECECBD7FD358EA3ACC94 – C:\WINDOWS\erdnt\cache\iexplore.exe
[2009/12/18 08:05:43 | 000,634,648 | —- | M] (Microsoft Corporation) MD5=53C291F3B01EECECBD7FD358EA3ACC94 – C:\WINDOWS\ie7updates\KB2870699-IE7\iexplore.exe
[2008/04/14 07:42:24 | 000,093,184 | —- | M] (Microsoft Corporation) MD5=55794B97A7FAABD2910873C85274F409 – C:\WINDOWS\ie7\iexplore.exe
[2007/01/08 18:08:42 | 000,623,616 | —- | M] (Microsoft Corporation) MD5=93A6A4F5293AE19E3B37021AABCF0902 – C:\WINDOWS\ie7updates\KB947864-IE7\iexplore.exe
[2008/10/15 02:06:26 | 000,633,632 | —- | M] (Microsoft Corporation) MD5=9D3DB9ADFABD2F0BC778EC03250A3ABB – C:\WINDOWS\ie7updates\KB961260-IE7\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\332222e38604f6d316676b4b\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | -HS- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\Program Files\Internet Explorer\iexplore.exe
[2009/03/08 14:09:26 | 000,638,816 | —- | M] (Microsoft Corporation) MD5=B60DDDD2D63CE41CB8C487FCFBB6419E – C:\WINDOWS\system32\dllcache\iexplore.exe
[2007/08/13 18:43:56 | 000,622,080 | —- | M] (Microsoft Corporation) MD5=DE49B348A18369B4626FBA1D49B07FB4 – C:\WINDOWS\ie7updates\KB928090-IE7\iexplore.exe
[2013/07/31 17:34:24 | 000,643,224 | —- | M] (Microsoft Corporation) MD5=E9F7D600EBE12211D8C73515FFB303D3 – C:\WINDOWS\ie8\iexplore.exe
[2013/07/31 17:34:24 | 000,643,224 | —- | M] (Microsoft Corporation) MD5=E9F7D600EBE12211D8C73515FFB303D3 – C:\WINDOWS\SoftwareDistribution\Download\cc13c1e74a3d0deb167906327b621c28\sp3qfe\iexplore.exe

< MD5 for: IEXPLORE.EXE.MUI >
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\332222e38604f6d316676b4b\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\en-US\iexplore.exe.mui
[2009/03/08 14:21:44 | 000,012,288 | —- | M] (Microsoft Corporation) MD5=943030B55FDB56FB8B8FCC086071E119 – C:\Program Files\Internet Explorer\iexplore.exe.mui
[2007/08/13 18:43:36 | 000,573,440 | —- | M] (Microsoft Corporation) MD5=B58D8A1C7EE0E922EC7D2616DA136FC3 – C:\WINDOWS\ie8\iexplore.exe.mui

< MD5 for: IEXPLORE.EXE-164D1EDC.PF >
[2013/09/21 19:12:25 | 000,022,236 | —- | M] () MD5=391DB7F37D40EDE7B86D8CCFFDCD5CD1 – C:\WINDOWS\Prefetch\IEXPLORE.EXE-164D1EDC.pf

< MD5 for: IEXPLORE.EXE-27122324.PF >
[2013/09/22 19:40:18 | 000,144,642 | —- | M] () MD5=61E3677C47D804F68A5773350B42FA4B – C:\WINDOWS\Prefetch\IEXPLORE.EXE-27122324.pf

< MD5 for: IEXPLORE.HLP >
[2006/02/28 22:00:00 | 000,180,335 | —- | M] () MD5=3F19AF1B745140DAFAC6F78F561A3C62 – C:\WINDOWS\Help\iexplore.hlp

< MD5 for: SERVICES >
[2008/05/28 00:06:35 | 000,007,144 | —- | M] () MD5=BF190A29ACAD66AF6294F80EBEF9AA32 – C:\WINDOWS\system32\drivers\etc\services

< MD5 for: SERVICES.EXE >
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\dllcache\services.exe
[2009/02/06 06:11:05 | 000,110,592 | —- | M] (Microsoft Corporation) MD5=65DF52F5B8B6E9BBD183505225C37315 – C:\WINDOWS\system32\services.exe

< MD5 for: SERVICES.LNK >
[2013/09/16 11:24:59 | 000,001,602 | —- | M] () MD5=618FAA22C452E0C33143EA4BAF5F0AC7 – C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools\Services.lnk

< MD5 for: SERVICES.MSC >
[2006/02/28 22:00:00 | 000,033,464 | —- | M] () MD5=E8089AA2A6F7FEE89B38C1F2D77BA6C6 – C:\WINDOWS\system32\services.msc

< MD5 for: WINLOGON.EXE >
[2008/04/14 07:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\dllcache\winlogon.exe
[2008/04/14 07:42:40 | 000,507,904 | —- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E – C:\WINDOWS\system32\winlogon.exe

< MD5 for: WINLOGON.EXE-37E64970.PF >
[2013/09/21 19:12:27 | 000,020,356 | —- | M] () MD5=C056BFEF360387F03644E4BAD8922233 – C:\WINDOWS\Prefetch\WINLOGON.EXE-37E64970.pf

< %SYSTEMDRIVE%\*.* >
[2008/12/05 16:01:26 | 000,000,157 | —- | M] () – C:\AsusUpdate.log
[2008/04/25 00:09:03 | 000,000,000 | —- | M] () – C:\AUTOEXEC.BAT
[2013/09/18 10:17:40 | 000,000,211 | —- | M] () – C:\Boot.bak
[2013/09/21 20:18:14 | 000,000,327 | RHS- | M] () – C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () – C:\cmldr
[2013/09/18 13:04:36 | 000,035,227 | —- | M] () – C:\ComboFix.txt
[2008/04/25 00:09:03 | 000,000,000 | —- | M] () – C:\CONFIG.SYS
[2013/09/16 11:18:39 | 000,000,000 | —- | M] () – C:\end
[2008/04/25 00:09:03 | 000,000,000 | RHS- | M] () – C:\IO.SYS
[2008/04/25 00:09:03 | 000,000,000 | RHS- | M] () – C:\MSDOS.SYS
[2008/04/14 00:13:04 | 000,047,564 | RHS- | M] () – C:\NTDETECT.COM
[2008/04/14 02:01:44 | 000,250,048 | RHS- | M] () – C:\ntldr
[2013/09/22 01:07:27 | 791,220,224 | -HS- | M] () – C:\pagefile.sys
[2008/05/30 13:50:56 | 000,000,522 | —- | M] () – C:\RHDSetup.log
[2008/05/28 00:15:23 | 000,000,268 | -H– | M] () – C:\sqmdata00.sqm
[2008/05/28 00:15:23 | 000,000,244 | -H– | M] () – C:\sqmnoopt00.sqm
[2013/09/16 00:26:42 | 000,150,954 | —- | M] () – C:\TDSSKiller.2.9.2.0_16.09.2013_00.25.52_log.txt
[2013/09/18 17:06:41 | 000,079,004 | —- | M] () – C:\TDSSKiller.2.9.2.0_18.09.2013_17.06.06_log.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 16:39:28 | 000,026,040 | —- | M] () – C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 15:53:56 | 000,026,489 | —- | M] () – C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 16:39:28 | 000,029,779 | —- | M] () – C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 15:58:52 | 000,030,808 | —- | M] () – C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2008/04/25 00:07:38 | 000,000,067 | -HS- | M] () – C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2006/10/26 19:56:12 | 000,033,104 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll
[2008/07/06 05:50:03 | 000,597,504 | —- | M] (Microsoft Corporation) – C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >
[2013/08/30 02:47:40 | 000,041,664 | —- | M] (AVAST Software) – C:\WINDOWS\avastSS.scr

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >
[2010/09/27 17:20:18 | 000,001,674 | -H– | M] () – C:\Documents and Settings\Ellen Smith\Application Data\Microsoft\LastFlashConfig.WFC

< %PROGRAMFILES%\*.* >
[2008/05/07 09:34:00 | 015,523,560 | —- | M] (Macrovision Corporation) – C:\Program Files\U1 Setup.exe
[1 C:\Program Files\*.tmp files -> C:\Program Files\*.tmp -> ]

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< dir "%systemdrive%\*" /S /A:L /C >
Volume in drive C has no label.
Volume Serial Number is AC99-5951
Directory of C:\WINDOWS\assembly\GAC_32\System.EnterpriseServices
09/21/2013 11:48 AM 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Directory of C:\WINDOWS\assembly\GAC_MSIL\IEExecRemote
09/21/2013 11:48 AM 2.0.0.0__b03f5f7f11d50a3a
0 File(s) 0 bytes
Total Files Listed:
0 File(s) 0 bytes
2 Dir(s) 288,006,144 bytes free

< %systemroot%\System32\config\*.sav >
[2008/04/25 07:52:24 | 000,094,208 | —- | M] () – C:\WINDOWS\System32\config\default.sav
[2008/04/25 07:52:24 | 001,064,960 | —- | M] () – C:\WINDOWS\System32\config\software.sav
[2008/04/25 07:52:24 | 000,905,216 | —- | M] () – C:\WINDOWS\System32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2008/04/25 00:09:10 | 000,000,294 | -HS- | M] () – C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >
[2008/08/27 22:10:24 | 000,000,173 | —- | M] () – C:\WINDOWS\explorer.exe.config

< %systemroot%\system32\*.db >
[2008/01/31 14:07:12 | 000,004,608 | —- | M] () – C:\WINDOWS\system32\THUMBS.DB
[1 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2009/12/24 11:09:10 | 000,000,119 | -HS- | M] () – C:\Documents and Settings\Ellen Smith\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2008/05/27 23:47:09 | 000,000,079 | —- | M] () – C:\Documents and Settings\Ellen Smith\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2013-09-22 06:05:21

< End of report >

Extras:
OTL Extras logfile created on: 9/22/2013 10:56:13 PM - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Ellen Smith\My Documents\Downloads
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

503.04 Mb Total Physical Memory | 315.08 Mb Available Physical Memory | 62.63% Memory free
1.20 Gb Paging File | 0.79 Gb Available in Paging File | 65.54% Paging File free
Paging file location(s): C:\pagefile.sys 2 200 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 7.48 Gb Total Space | 0.28 Gb Free Space | 3.81% Space Free | Partition Type: NTFS

Computer Name: YOUR-1UT28O6MCF | User Name: Ellen Smith | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = ChromeHTML] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] – "%1" %*
htmlfile – Reg Error: Key error.
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 – (Microsoft Corporation)
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 – (Microsoft Corporation)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0673654C-5296-453B-9798-B61CD7E03FEB}" = SES Driver
"{0A755762-EED8-47AB-A446-505766F93D43}" = Atheros Communications Inc.® L2 Fast Ethernet Driver
"{184E7118-0295-43C4-B72C-1D54AA75AAF7}" = Windows Live Mail
"{19F5658D-92E8-4A08-8657-D38ABB1574B2}" = Asus ACPI Driver
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{587178E7-B1DF-494E-9838-FA4DD36E873C}" = ASUSUpdate for Eee PC
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{84E2AA5A-8BA3-4F08-9F6F-C14E4C679FF0}" = Asus OS Cleaner
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}" = Visual Studio 2012 x86 Redistributables
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{B829E117-D072-41EA-9606-9826A38D34C1}" = Sophos Virus Removal Tool
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C38DDE4F-5FBD-4FA3-9337-BC3EFCEA36A6}" = Asus Power Management Utility
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"Google Chrome" = Google Chrome
"HDMI" = Intel® Graphics Media Accelerator Driver
"ie8" = Windows Internet Explorer 8
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Secunia PSI" = Secunia PSI (3.0.0.7011)
"TreeSize Free_is1" = TreeSize Free V2.7

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 9/21/2013 6:05:55 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: PresentationFramework, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
. Error code = 0x8007000e

Error - 9/21/2013 6:25:51 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: c:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.ServiceModel.dll
. Error code = 0x8007000e

Error - 9/21/2013 6:32:23 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
. Error code = 0x8007000e

Error - 9/21/2013 6:32:43 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
. Error code = 0x8007000e

Error - 9/21/2013 6:33:23 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
. Error code = 0x8007000e

Error - 9/21/2013 6:34:00 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089
. Error code = 0x8007000e

Error - 9/21/2013 6:34:56 AM | Computer Name = YOUR-1UT28O6MCF | Source = .NET Runtime Optimization Service | ID = 1101
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Failed to compile: PresentationCore, Version=3.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35
. Error code = 0x8007000e

Error - 9/22/2013 4:56:43 PM | Computer Name = YOUR-1UT28O6MCF | Source = Application Hang | ID = 1002
Description = Hanging application mbam.exe, version 1.75.0.1, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 9/22/2013 4:57:39 PM | Computer Name = YOUR-1UT28O6MCF | Source = Application Hang | ID = 1001
Description = Fault bucket -816940832.

Error - 9/22/2013 8:53:40 PM | Computer Name = YOUR-1UT28O6MCF | Source = VSSetup | ID = 5000
Description = EventType vssetup, P1 microsoft .net framework 4 client profile setup,
P2 4.0.30319, P3 10.0.30319.1, P4 1, P5 , P6 none_ui_silent_error, P7 0x13ec,
P8 0, P9 , P10 NIL.

[ System Events ]
Error - 9/22/2013 1:39:16 AM | Computer Name = YOUR-1UT28O6MCF | Source = Service Control Manager | ID = 7000
Description = The aswFsBlk service failed to start due to the following error: %%2

Error - 9/22/2013 1:39:25 AM | Computer Name = YOUR-1UT28O6MCF | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
aswSP SRTSP SRTSPX

Error - 9/22/2013 2:07:49 AM | Computer Name = YOUR-1UT28O6MCF | Source = Service Control Manager | ID = 7000
Description = The aswFsBlk service failed to start due to the following error: %%2

Error - 9/22/2013 2:07:57 AM | Computer Name = YOUR-1UT28O6MCF | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
aswSP SRTSP SRTSPX

Error - 9/22/2013 2:43:40 PM | Computer Name = YOUR-1UT28O6MCF | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.100 for the Network Card with network
address 0015AFA7BE4C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/22/2013 4:49:22 PM | Computer Name = YOUR-1UT28O6MCF | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.100 for the Network Card with network
address 0015AFA7BE4C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/22/2013 6:03:27 PM | Computer Name = YOUR-1UT28O6MCF | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 0015AFA7BE4C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/22/2013 7:06:12 PM | Computer Name = YOUR-1UT28O6MCF | Source = Dhcp | ID = 1002
Description = The IP address lease 192.168.1.101 for the Network Card with network
address 0015AFA7BE4C has been denied by the DHCP server 192.168.1.1 (The DHCP Server
sent a DHCPNACK message).

Error - 9/22/2013 8:54:09 PM | Computer Name = YOUR-1UT28O6MCF | Source = Windows Update Agent | ID = 20
Description = Installation Failure: Windows failed to install the following update
with error 0x80070643: Microsoft .NET Framework 4 Client Profile for Windows XP
x86 (KB982670).

Error - 9/22/2013 10:14:46 PM | Computer Name = YOUR-1UT28O6MCF | Source = Dhcp | ID = 1001
Description = Your computer was not assigned an address from the network (by the
DHCP Server) for the Network Card with network address 0015AFA7BE4C. The following
error occurred: %%1223. Your computer will continue to try and obtain an address
on its own from the network address (DHCP) server.


< End of report >
Post #2

:welcome:

Hello jpr123,

my name is Jo and I will help you with your computer problems.


Please be advised that I am currently in training, so my responses will need to be approved by one of our experts before I post them. This is only to ensure you are receiving accurate instructions. It may cause a delay in my replies.


Please follow these guidelines:
  • Logs can take a while to research, so please be patient.
  • Read and follow the instructions in the sequence they are posted.
  • print or copy & save instructions.
  • Do not install / uninstall any applications, unless otherwise instructed.
  • Use only that tools you have been instructed to use.
  • Copy and Paste the log files inside your post, unless otherwise instructed.
  • Ask for clarification, if you have any questions.
  • Stay with this topic ‘til you get the “all clean” post.
  • My first language is not english. So please do not use slang or idioms. It could be hard for me to read. Thanks for your understanding.
I will return as soon as possible with more instructions.
Post #3
Hello jpr123,

  • Hard drive filling up start menu programs missing
  • run aswMBR earlier, and received "suspicious" notations regarding "dxgthk.sys" and "ntdll.dll"
  • Superantispyware found some items
Do you still have the logs from aswMBR and Superantispyware? If yes, please post them.

Please give us details about "start menu programs missing".


1. Download Security Check by screen317 from here or here.
  • Save it to your Desktop.
  • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

2. Download Unhide to your desktop and then double-click on the Unhide icon.
  • The program will open a black box and start making the files on your fixed disks visible again.
  • Once it has finished, the program will display a Windows alert stating that your files have been restored.
  • Reboot your computer for all of the settings to go into effect.
When Unhide is complete, it will create a logfile on the Windows Desktop called Unhide.txt.
Post the content of Unhide.txt with your next reply.
Post #4
Hi Jo, Thanks for your interest in trying to help resolve these issues. While I'm not sure which program repaired the issues, they seem to have been resolved. Thanks again! Joe
Post #5
Hello jpr123,

We used the Unhide program to repair the start menu items.

Do all start menu programs work now?

How much Free Space do you have on drive C:\ now?

Please post the logs, which Security Check and the Unhide program did create, thanks.
Post #6
Hi, it has been several days since I sent my last set of instructions to help with your computer problem. Please let me know if you are having problems and still need help. Note: Threads will be closed if no response after 3 days.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI