TechSpot

Vista hangs within minutes of startup, works fine safe mode

Inactive
By carolinacharlie
Jan 1, 2011
  1. This began happening a few hours after my father used my laptop to "check his e-mail and stuff" and of course now my system is totally fracked up!

    When booting up in normal mode, Vista comes up normally but within a few minutes any running program freezes and I get the eternal spinning blue circle in place of my cursor. The only way to shot down the computer at that point is to remove the battery and unplug the laptop. I still get the same behavior even when disabling all of the non-Windows services on start-up through msconfig. Safe mode works fine, no hanging there.

    The problem is that I can only run the programs outlined in the 8-step process in safe mode -- in normal mode, the system hangs before any logs can be generated.

    Anyway, I'm pasting the logs from safe mode below. If the logs must be generated in normal mode, I can keep trying -- the time it takes for Vista to get stuck varies, and I might be able to get all of the logs generated eventually.

    Thanks in advance for any guidance you can provide.


    Malwarebytes' Anti-Malware 1.50.1.1100
    www.malwarebytes.org

    Database version: 5438

    Windows 6.0.6002 Service Pack 2 (Safe Mode)
    Internet Explorer 7.0.6002.18005

    1/1/2011 5:51:54 PM
    mbam-log-2011-01-01 (17-51-54).txt

    Scan type: Quick scan
    Objects scanned: 147002
    Time elapsed: 30 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)


    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit quick scan 2011-01-01 18:23:07
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST920042 rev.3.AD
    Running: 0whouzlx.exe; Driver: C:\Users\CHARLI~1\AppData\Local\Temp\kwaiapod.sys


    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
    Disk \Device\Harddisk0\DR0 sector 62: copy of MBR

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
    AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----



    DDS (Ver_10-12-12.02) - NTFSx86 NETWORK
    Run by Charlie Reece at 18:24:19.43 on Sat 01/01/2011
    Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_20
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3581.2979 [GMT -5:00]

    AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
    SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
    FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}

    ============== Running Processes ===============

    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
    C:\Windows\system32\wbem\unsecapp.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Mozilla Firefox\plugin-container.exe
    C:\Users\Charlie Reece\Downloads\dds.scr
    C:\Windows\system32\wbem\wmiprvse.exe

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
    uWindow Title = Internet Explorer provided by Dell
    uInternet Settings,ProxyOverride = *.local
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    mRun: [<NO NAME>]
    mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableLUA = 0 (0x0)
    mPolicies-system: DisableCAD = 1 (0x1)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
    Notify: psfus - c:\windows\system32\psqlpwd.dll
    LSA: Notification Packages = scecli psqlpwd

    ================= FIREFOX ===================

    FF - ProfilePath - c:\users\charli~1\appdata\roaming\mozilla\firefox\profiles\wt74y5dz.default\
    FF - component: c:\users\charlie reece\appdata\roaming\mozilla\firefox\profiles\wt74y5dz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\winnt_x86-msvc\components\WeaveCrypto.dll
    FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\users\charlie reece\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\users\charlie reece\appdata\roaming\mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\users\charlie reece\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
    FF - Ext: URL Lister: urllister@binnyva.com - %profile%\extensions\urllister@binnyva.com
    FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}

    ============= SERVICES / DRIVERS ===============

    R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\drivers\tmlwf.sys [2010-12-31 142352]
    R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-2-1 179712]
    R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-5-28 4233728]
    S2 AbsoluteNotifier;Absolute Notifier;c:\program files\absolute software\absolute notifier\AbsoluteNotifierService.exe [2010-10-8 10408]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 rpcnetp;rpcnetp;c:\windows\system32\rpcnetp.exe [2009-8-22 17408]
    S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2010-12-31 51792]
    S2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2010-12-31 36432]
    S2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\drivers\tmwfp.sys [2010-12-31 235024]
    S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\steam\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe --> c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [?]
    S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-8-29 21504]
    S3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\drivers\OEM04Vfx.sys [2008-2-1 7424]
    S3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\drivers\OEM04Vid.sys [2008-2-1 234720]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-1-31 73728]
    S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\trendm~1\intern~2\TmPfw.exe [2010-12-31 488768]
    S4 tmproxy;Trend Micro Proxy Service;c:\program files\trend micro\internet security\TmProxy.exe [2010-12-31 648456]

    =============== Created Last 30 ================

    2011-01-01 21:44:50 -------- d-----w- c:\users\charli~1\appdata\roaming\Malwarebytes
    2011-01-01 21:44:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-01-01 21:44:46 -------- d-----w- c:\progra~2\Malwarebytes
    2011-01-01 21:44:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-01-01 21:44:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2010-12-31 16:07:39 -------- d-----w- c:\windows\system32\log
    2010-12-31 15:57:26 66320 ----a-w- c:\windows\system32\drivers\tmtdi.sys
    2010-12-31 15:57:26 59472 ----a-w- c:\windows\system32\drivers\tmactmon.sys
    2010-12-31 15:57:26 51792 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
    2010-12-31 15:57:26 36432 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
    2010-12-31 15:57:26 249424 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
    2010-12-31 15:57:26 235024 ----a-w- c:\windows\system32\drivers\tmwfp.sys
    2010-12-31 15:57:26 163408 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2010-12-31 15:57:26 142352 ----a-w- c:\windows\system32\drivers\tmlwf.sys
    2010-12-31 15:57:26 1331512 ----a-w- c:\windows\system32\drivers\vsapint.sys
    2010-12-30 01:59:04 -------- d-----w- c:\progra~2\MFAData
    2010-12-27 23:44:35 92424 ----a-w- c:\program files\mozilla firefox\32bit\ncfg.exe
    2010-12-27 23:44:35 480784 ----a-w- c:\program files\mozilla firefox\32bit\vsapiins.exe
    2010-12-27 23:44:35 218376 ----a-w- c:\program files\mozilla firefox\32bit\TmEngDrv.dll
    2010-12-27 23:44:35 1991944 ----a-w- c:\program files\mozilla firefox\32bit\TISSuprt.exe
    2010-12-27 23:44:35 156936 ----a-w- c:\program files\mozilla firefox\32bit\libexpat.dll
    2010-12-27 23:44:35 1332112 ----a-w- c:\program files\mozilla firefox\32bit\TSRemove.exe
    2010-12-27 23:44:35 124168 ----a-w- c:\program files\mozilla firefox\32bit\TmDbg32.dll
    2010-12-27 23:28:05 -------- d-sh--w- C:\found.001
    2010-12-26 03:31:47 -------- d-sh--w- C:\found.000
    2010-12-24 19:33:31 23694 ----a-w- c:\windows\system32\win32k2.sys
    2010-12-24 19:33:26 -------- d-----w- c:\program files\MEDA MP3 Splitter
    2010-12-24 05:01:51 -------- d-----w- c:\users\charli~1\appdata\roaming\EAC
    2010-12-24 05:01:51 -------- d-----w- c:\users\charli~1\appdata\roaming\AccurateRip
    2010-12-24 05:01:48 -------- d-----w- c:\program files\Exact Audio Copy
    2010-12-23 01:05:18 -------- d-----w- c:\program files\NCH Software
    2010-12-19 17:41:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-12-19 17:41:21 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
    2010-12-16 19:46:52 -------- d-----w- c:\users\charli~1\appdata\roaming\Absolute Software
    2010-12-16 00:12:06 66048 ----a-w- c:\program files\windows mail\wabmig.exe
    2010-12-16 00:12:06 515584 ----a-w- c:\program files\windows mail\wab.exe
    2010-12-16 00:12:06 33280 ----a-w- c:\program files\windows mail\wabfind.dll
    2010-12-16 00:12:03 2038272 ----a-w- c:\windows\system32\win32k.sys
    2010-12-16 00:12:01 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2010-12-16 00:12:01 352768 ----a-w- c:\windows\system32\taskschd.dll
    2010-12-16 00:12:01 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2010-12-16 00:12:01 270336 ----a-w- c:\windows\system32\taskcomp.dll
    2010-12-16 00:12:01 171520 ----a-w- c:\windows\system32\taskeng.exe
    2010-12-16 00:12:00 81920 ----a-w- c:\windows\system32\consent.exe
    2010-12-14 00:05:56 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin7.dll
    2010-12-09 16:11:14 -------- d-----w- c:\windows\pss

    ==================== Find3M ====================

    2011-01-01 21:30:19 17408 ----a-w- c:\windows\system32\rpcnetp.exe
    2011-01-01 21:06:56 57752 ----a-w- c:\windows\system32\rpcnet.dll
    2011-01-01 21:06:56 17408 ----a-w- c:\windows\system32\rpcnetp.dll
    2010-11-29 22:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 22:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-12 18:46:58 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-31 02:50:15 29184 ----a-w- c:\windows\system32\CtLoJack.dll
    2010-10-28 15:44:56 34304 ----a-w- c:\windows\system32\atmlib.dll
    2010-10-28 13:27:47 292352 ----a-w- c:\windows\system32\atmfd.dll
    2010-10-28 13:20:12 2048 ----a-w- c:\windows\system32\tzres.dll
    2010-10-21 20:08:42 834048 ----a-w- c:\windows\system32\wininet.dll
    2010-10-21 18:30:50 389632 ----a-w- c:\windows\system32\html.iec
    2010-10-20 17:41:28 78336 ----a-w- c:\windows\system32\ieencode.dll

    ============= FINISH: 18:25:06.51 ===============



    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_10-12-12.02)

    Microsoft® Windows Vista™ Home Premium
    Boot Device: \Device\HarddiskVolume3
    Install Date: 1/31/2008 5:50:16 PM
    System Uptime: 1/1/2011 4:30:05 PM (2 hours ago)

    Motherboard: Dell Inc. | |
    Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz | Microprocessor | 2194/200mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 174 GiB total, 22.6 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 2.636 GiB free.
    F: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP190: 12/24/2010 12:45:36 AM - Scheduled Checkpoint
    RP191: 12/31/2010 11:08:33 AM - Device Driver Package Install: Trend Micro Network Service
    RP192: 12/31/2010 11:08:59 AM - Device Driver Package Install: TrendMicro Network Service
    RP193: 12/31/2010 11:09:22 AM - Device Driver Package Install: Trend Micro Network Service

    ==== Installed Programs ======================

    µTorrent
    3ivx MPEG-4 5.0.3 (remove only)
    7-Zip 4.65
    Absolute Notifier
    Adobe AIR
    Adobe Common File Installer
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Photoshop Elements 6.0
    Adobe Premiere Elements 4.0
    Adobe Premiere Elements 4.0 Templates
    Adobe Reader 8.2.5
    Advanced Audio FX Engine
    Advanced Video FX Engine
    Adventure Tools
    Amazon MP3 Downloader 1.0.10
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    Audible Download Manager
    Bejeweled 2 Deluxe
    Bonjour
    Broadcom Management Programs
    Browser Address Error Redirector
    CCleaner
    Character Builder
    Consumer Complete Care Services Agreement
    CutePDF Writer 2.8
    Defraggler
    Dell DataSafe Online
    Dell Driver Download Manager
    Dell Getting Started Guide
    Dell Support Center (Support Software)
    Dell Touchpad
    Dell Webcam Center
    Dell Webcam Manager
    Ditto
    Dropbox
    Exact Audio Copy 1.0beta1
    Fallout 3 - Game of the Year Edition
    ffdshow [rev 3055] [2009-08-16]
    Fingerprint Reader Suite 5.6
    Flickr Uploadr 3.2.1
    FlipShare
    FolderSize.Win32 1.0.7.0
    Freespace 2
    Google Talk Plugin
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Intel PROSet Wireless
    Intel(R) PROSet/Wireless WiFi Software
    iPhone Configuration Utility
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 20
    Java(TM) SE Runtime Environment 6
    Laptop Integrated Webcam Driver (1.03.01.1011)
    Live! Cam Avatar Creator
    Live! Cam Avatar v1.0
    Malwarebytes' Anti-Malware
    MEDA MP3 Splitter 2.0.1
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Games for Windows - LIVE Redistributable
    Microsoft Silverlight
    Microsoft SQL Server Compact 3.5 SP1 English
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    MobileMe Control Panel
    Mozilla Firefox (3.6.6)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    Music, Photos & Videos Launcher
    mWMI
    nrg2iso
    NVIDIA Display Control Panel
    NVIDIA Drivers
    NVIDIA PhysX
    OGA Notifier 2.0.0048.0
    OpenOffice.org 3.2
    OSU-gt RC8
    Picaboo X
    Picasa 3
    Planescape Torment
    Product Documentation Launcher
    QualxServ Service Agreement
    QuickSet
    QuickTime
    Roxio Creator Audio
    Roxio Creator BDAV Plugin
    Roxio Creator Copy
    Roxio Creator Data
    Roxio Creator DE
    Roxio Creator Tools
    Roxio Express Labeler
    Roxio MyDVD DE
    Roxio Update Manager
    Safari
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Sid Meier's Civilization V
    SigmaTel Audio
    Sonic Activation Module
    Steam
    System Requirements Lab
    Trend Micro Internet Security
    Trend Micro PC-cillin Internet Security
    Uninstall Startup Inspector
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    User's Guides
    VLC media player 1.0.1
    WIDCOMM Bluetooth Software 6.0.1.3100
    Windows Media Player Firefox Plugin

    ==== Event Viewer Messages From Past Week ========

    12/31/2010 9:58:04 AM, Error: Service Control Manager [7031] - The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    12/31/2010 9:53:05 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
    12/31/2010 9:48:01 AM, Error: EventLog [6008] - The previous system shutdown at 9:45:07 AM on 12/31/2010 was unexpected.
    12/31/2010 9:43:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B68-F52A-11D8-B9A5-505054503030}
    12/31/2010 9:41:15 AM, Error: EventLog [6008] - The previous system shutdown at 9:34:09 AM on 12/31/2010 was unexpected.
    12/31/2010 8:59:04 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.195 for the Network Card with network address 001DE072DD7B has been denied by the DHCP server 172.17.1.1 (The DHCP Server sent a DHCPNACK message).
    12/31/2010 8:58:09 PM, Error: EventLog [6008] - The previous system shutdown at 2:01:21 PM on 12/31/2010 was unexpected.
    12/31/2010 12:10:50 PM, Error: EventLog [6008] - The previous system shutdown at 11:44:45 AM on 12/31/2010 was unexpected.
    12/31/2010 11:40:25 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
    12/31/2010 11:33:42 AM, Error: EventLog [6008] - The previous system shutdown at 11:25:25 AM on 12/31/2010 was unexpected.
    12/31/2010 11:09:38 AM, Error: Service Control Manager [7030] - The Trend Micro Proxy Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    12/31/2010 11:09:33 AM, Error: Service Control Manager [7030] - The Trend Micro Personal Firewall service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
    12/31/2010 11:05:26 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
    12/31/2010 11:04:54 AM, Error: Service Control Manager [7022] - The Trend Micro Central Control Component service hung on starting.
    12/31/2010 10:38:40 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr Wanarpv6
    12/31/2010 10:37:43 AM, Error: EventLog [6008] - The previous system shutdown at 10:32:48 AM on 12/31/2010 was unexpected.
    12/31/2010 10:36:55 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
    12/31/2010 10:36:52 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume .
    12/31/2010 1:18:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wcncsvc with arguments "" in order to run the server: {375FF000-DD27-11D9-8F9C-0002B3988E81}
    12/31/2010 1:18:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
    12/30/2010 9:59:44 PM, Error: EventLog [6008] - The previous system shutdown at 9:55:05 PM on 12/30/2010 was unexpected.
    12/30/2010 9:59:24 PM, Error: Application Popup [877] - There was error [DATABASE OPEN FAILED] processing the driver database.
    12/29/2010 8:12:56 PM, Error: EventLog [6008] - The previous system shutdown at 8:04:46 PM on 12/29/2010 was unexpected.
    12/29/2010 8:04:47 PM, Error: BTHUSB [17] - The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.
    12/27/2010 9:49:59 PM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
    12/27/2010 9:49:21 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
    12/27/2010 9:21:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wcncsvc with arguments "" in order to run the server: {375FF001-DD27-11D9-8F9C-0002B3988E81}
    12/27/2010 9:17:31 PM, Error: EventLog [6008] - The previous system shutdown at 7:28:21 PM on 12/27/2010 was unexpected.
    12/27/2010 7:24:30 PM, Error: EventLog [6008] - The previous system shutdown at 6:47:31 PM on 12/27/2010 was unexpected.
    12/27/2010 6:37:56 PM, Error: Service Control Manager [7001] - The Trend Micro Proxy Service service depends on the Trend Micro TDI Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/27/2010 6:37:15 PM, Error: EventLog [6008] - The previous system shutdown at 6:35:15 PM on 12/27/2010 was unexpected.
    12/27/2010 6:30:17 PM, Error: EventLog [6008] - The previous system shutdown at 6:22:17 PM on 12/27/2010 was unexpected.
    12/27/2010 6:04:25 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer CutePDF Writer with shared resource name CutePDF Writer. Error 2114. The printer cannot be used by others on the network.
    12/27/2010 5:55:20 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx tmtdi Wanarpv6
    12/27/2010 5:53:44 PM, Error: EventLog [6008] - The previous system shutdown at 5:49:28 PM on 12/27/2010 was unexpected.
    12/27/2010 5:35:01 PM, Error: EventLog [6008] - The previous system shutdown at 5:00:34 PM on 12/27/2010 was unexpected.
    12/26/2010 9:53:30 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.
    12/26/2010 9:22:16 AM, Error: EventLog [6008] - The previous system shutdown at 10:46:31 PM on 12/25/2010 was unexpected.
    12/26/2010 6:58:50 PM, Error: EventLog [6008] - The previous system shutdown at 5:45:52 PM on 12/26/2010 was unexpected.
    12/26/2010 5:35:57 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\RegBack\COMPONENTS' was corrupted and it has been recovered. Some data might have been lost.
    12/26/2010 5:31:21 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\RegBack\SYSTEM' was corrupted and it has been recovered. Some data might have been lost.
    12/26/2010 4:50:29 PM, Error: EventLog [6008] - The previous system shutdown at 4:39:52 PM on 12/26/2010 was unexpected.
    12/26/2010 4:36:57 PM, Error: EventLog [6008] - The previous system shutdown at 4:02:44 PM on 12/26/2010 was unexpected.
    12/26/2010 3:56:52 PM, Error: EventLog [6008] - The previous system shutdown at 2:35:07 PM on 12/26/2010 was unexpected.
    12/26/2010 2:20:17 PM, Error: EventLog [6008] - The previous system shutdown at 12:34:23 PM on 12/26/2010 was unexpected.
    12/26/2010 11:59:28 AM, Error: EventLog [6008] - The previous system shutdown at 10:17:05 AM on 12/26/2010 was unexpected.
    12/26/2010 10:03:13 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Base Filtering Engine service, but this action failed with the following error: An instance of the service is already running.
    12/26/2010 10:02:25 AM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 3 time(s).
    12/26/2010 10:01:46 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
    12/26/2010 10:01:13 AM, Error: Service Control Manager [7031] - The Windows Firewall service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    12/26/2010 10:01:13 AM, Error: Service Control Manager [7031] - The Diagnostic Policy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    12/26/2010 10:01:13 AM, Error: Service Control Manager [7031] - The Base Filtering Engine service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
    12/25/2010 3:01:13 PM, Error: EventLog [6008] - The previous system shutdown at 2:55:23 PM on 12/25/2010 was unexpected.
    12/25/2010 2:51:34 PM, Error: EventLog [6008] - The previous system shutdown at 2:42:28 PM on 12/25/2010 was unexpected.
    12/25/2010 10:41:20 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\RegBack\SOFTWARE' was corrupted and it has been recovered. Some data might have been lost.
    12/25/2010 10:15:41 PM, Error: Service Control Manager [7031] - The Windows Firewall service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    12/25/2010 10:15:41 PM, Error: Service Control Manager [7031] - The Diagnostic Policy Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    12/25/2010 10:15:41 PM, Error: Service Control Manager [7031] - The Base Filtering Engine service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
    12/25/2010 1:55:08 PM, Error: EventLog [6008] - The previous system shutdown at 1:49:48 PM on 12/25/2010 was unexpected.
    12/25/2010 1:43:44 PM, Error: EventLog [6008] - The previous system shutdown at 1:36:45 PM on 12/25/2010 was unexpected.
    1/1/2011 4:37:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
    1/1/2011 4:32:45 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:31:21 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr tmtdi Wanarpv6
    1/1/2011 4:31:21 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:31:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    1/1/2011 4:31:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    1/1/2011 4:31:14 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    1/1/2011 4:31:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    1/1/2011 4:31:03 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
    1/1/2011 4:31:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    1/1/2011 4:30:38 PM, Error: EventLog [6008] - The previous system shutdown at 4:27:54 PM on 1/1/2011 was unexpected.
    1/1/2011 4:30:22 PM, Error: volmgr [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
    1/1/2011 4:25:17 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
    1/1/2011 4:25:17 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
    1/1/2011 4:25:17 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
    1/1/2011 4:25:17 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    1/1/2011 4:25:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    1/1/2011 4:25:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    1/1/2011 4:19:45 PM, Error: EventLog [6008] - The previous system shutdown at 4:10:40 PM on 1/1/2011 was unexpected.
    1/1/2011 4:06:09 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx tmlwf tmtdi Wanarpv6
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    1/1/2011 4:05:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    1/1/2011 4:05:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    1/1/2011 4:04:58 PM, Error: EventLog [6008] - The previous system shutdown at 4:01:02 PM on 1/1/2011 was unexpected.
    1/1/2011 3:52:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C}
    1/1/2011 3:51:10 PM, Error: EventLog [6008] - The previous system shutdown at 3:47:07 PM on 1/1/2011 was unexpected.
    1/1/2011 3:41:11 PM, Error: EventLog [6008] - The previous system shutdown at 3:16:56 PM on 1/1/2011 was unexpected.

    ==== End Of File ===========================
     
  2. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =====================================================================

    Yes, you're definitely infected.

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode.

    2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  3. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    Here's combofix.txt

    And thanks for your help!



    ComboFix 11-01-01.01 - Charlie Reece 01/01/2011 21:58:10.1.2 - x86 NETWORK
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3581.2717 [GMT -5:00]
    Running from: c:\users\Charlie Reece\Desktop\ComboFix.exe
    AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
    FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}
    SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Install.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-12-02 to 2011-01-02 )))))))))))))))))))))))))))))))
    .

    2011-01-02 03:08 . 2011-01-02 03:08 0 ----a-w- c:\windows\system32\NTAgent.exe
    2011-01-02 03:05 . 2011-01-02 03:08 -------- d-----w- c:\users\Charlie Reece\AppData\Local\temp
    2011-01-02 03:05 . 2011-01-02 03:05 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-01-01 23:53 . 2011-01-01 23:53 -------- d-----w- c:\program files\ESET
    2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Malwarebytes
    2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\programdata\Malwarebytes
    2011-01-01 21:44 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-01-01 21:44 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-31 16:07 . 2010-12-31 16:07 -------- d-----w- c:\windows\system32\log
    2010-12-31 15:57 . 2010-12-31 15:57 66320 ----a-w- c:\windows\system32\drivers\tmtdi.sys
    2010-12-31 15:57 . 2010-12-31 15:57 235024 ----a-w- c:\windows\system32\drivers\tmwfp.sys
    2010-12-31 15:57 . 2010-12-31 15:57 142352 ----a-w- c:\windows\system32\drivers\tmlwf.sys
    2010-12-31 15:57 . 2010-07-30 22:29 249424 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
    2010-12-31 15:57 . 2010-07-30 22:29 36432 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
    2010-12-31 15:57 . 2010-07-30 22:06 1331512 ----a-w- c:\windows\system32\drivers\vsapint.sys
    2010-12-31 15:57 . 2010-07-19 23:03 59472 ----a-w- c:\windows\system32\drivers\tmactmon.sys
    2010-12-31 15:57 . 2010-07-19 23:03 51792 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
    2010-12-31 15:57 . 2010-07-19 23:02 163408 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2010-12-30 01:59 . 2010-12-31 15:26 -------- d-----w- c:\programdata\MFAData
    2010-12-27 23:44 . 2007-09-18 22:31 92424 ----a-w- c:\program files\Mozilla Firefox\32bit\ncfg.exe
    2010-12-27 23:44 . 2007-09-18 22:31 480784 ----a-w- c:\program files\Mozilla Firefox\32bit\vsapiins.exe
    2010-12-27 23:44 . 2007-09-18 22:31 218376 ----a-w- c:\program files\Mozilla Firefox\32bit\TmEngDrv.dll
    2010-12-27 23:44 . 2007-09-18 22:31 1991944 ----a-w- c:\program files\Mozilla Firefox\32bit\TISSuprt.exe
    2010-12-27 23:44 . 2007-09-18 22:31 156936 ----a-w- c:\program files\Mozilla Firefox\32bit\libexpat.dll
    2010-12-27 23:44 . 2007-09-18 22:31 1332112 ----a-w- c:\program files\Mozilla Firefox\32bit\TSRemove.exe
    2010-12-27 23:44 . 2007-09-18 22:31 124168 ----a-w- c:\program files\Mozilla Firefox\32bit\TmDbg32.dll
    2010-12-27 23:28 . 2010-12-27 23:28 -------- d-----w- C:\found.001
    2010-12-26 03:31 . 2010-12-26 03:31 -------- d-----w- C:\found.000
    2010-12-24 19:33 . 2010-12-25 17:26 23694 ----a-w- c:\windows\system32\win32k2.sys
    2010-12-24 19:33 . 2010-12-24 19:33 -------- d-----w- c:\program files\MEDA MP3 Splitter
    2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\EAC
    2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\AccurateRip
    2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\program files\Exact Audio Copy
    2010-12-23 01:06 . 2010-12-23 01:06 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\NCH Swift Sound
    2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\programdata\NCH Swift Sound
    2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\program files\NCH Software
    2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-12-16 19:46 . 2010-12-16 19:46 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Absolute Software
    2010-12-16 00:12 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
    2010-12-16 00:12 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
    2010-12-16 00:12 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
    2010-12-16 00:12 . 2010-10-18 13:31 2038272 ----a-w- c:\windows\system32\win32k.sys
    2010-12-16 00:12 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2010-12-16 00:12 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
    2010-12-16 00:12 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
    2010-12-16 00:12 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2010-12-16 00:12 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
    2010-12-16 00:12 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe
    2010-12-14 00:05 . 2010-12-14 00:05 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-01-02 03:06 . 2009-08-23 03:42 17408 ----a-w- c:\windows\system32\rpcnetp.dll
    2011-01-01 21:30 . 2009-08-23 03:39 17408 ----a-w- c:\windows\system32\rpcnetp.exe
    2011-01-01 21:06 . 2009-08-23 01:59 57752 ----a-w- c:\windows\system32\rpcnet.dll
    2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-12 18:46 . 2010-11-12 18:46 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-31 02:50 . 2010-10-31 02:50 29184 ----a-w- c:\windows\system32\CtLoJack.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
    @="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
    @="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "DisableCAD"= 1 (0x1)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    2007-04-17 05:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer"=wdmaud.drv

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
    2009-05-21 14:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
    2010-07-09 20:20 261736 ----a-w- c:\windows\System32\nvhotkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM04Mon.exe]
    2007-12-03 06:05 36864 ----a-w- c:\windows\OEM04Mon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    2007-05-10 07:00 857648 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UfSeAgnt.exe]
    2010-12-31 15:57 1398024 ----a-w- c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
    "DisableMonitoring"=dword:00000001

    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [x]
    R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728]
    S0 rpcnetp;rpcnetp; [x]
    S2 AbsoluteNotifier;Absolute Notifier;c:\program files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2010-10-08 10408]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-24 179712]
    S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-05-29 4233728]
    S3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\DRIVERS\OEM04Vfx.sys [2007-12-03 7424]
    S3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\DRIVERS\OEM04Vid.sys [2007-12-03 234720]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2010-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000Core.job
    - c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]

    2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000UA.job
    - c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
    uInternet Settings,ProxyOverride = *.local
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
    FF - Ext: URL Lister: urllister@binnyva.com - %profile%\extensions\urllister@binnyva.com
    FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
    .
    - - - - ORPHANS REMOVED - - - -

    MSConfigStartUp-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-01-01 22:09
    Windows 6.0.6002 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'Explorer.exe'(3184)
    c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
    c:\program files\Fingerprint Reader Suite\farchns.dll
    c:\program files\Fingerprint Reader Suite\infra.dll
    c:\windows\system32\btncopy.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\WLANExt.exe
    c:\program files\Fingerprint Reader Suite\upeksvr.exe
    c:\windows\System32\rpcnetp.exe
    c:\windows\system32\wbem\unsecapp.exe
    c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
    .
    **************************************************************************
    .
    Completion time: 2011-01-01 22:13:55 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-01-02 03:13

    Pre-Run: 23,792,177,152 bytes free
    Post-Run: 19,893,198,848 bytes free

    - - End Of File - - 5BE7F4A61D5491DECFB965B435C941EB
     
  4. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
    c:\windows\system32\win32k2.sys
    
    Registry::
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
    "DisableMonitoring"=-
    
    
    

    3. Save the above as CFScript.txt

    4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

    5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
     
  5. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    Here's the latest combofix.txt

    ComboFix 11-01-01.01 - Charlie Reece 01/02/2011 10:11:30.2.2 - x86 NETWORK
    Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3581.3135 [GMT -5:00]
    Running from: c:\users\Charlie Reece\Desktop\ComboFix.exe
    Command switches used :: c:\users\Charlie Reece\Desktop\CFScript.txt
    AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
    FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}
    SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
    * Created a new restore point

    FILE ::
    "c:\windows\system32\win32k2.sys"
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\NTAgent.exe
    c:\windows\system32\win32k2.sys

    Infected copy of c:\windows\System32\autochk.exe was found and disinfected
    Restored copy from - c:\windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe

    .
    ((((((((((((((((((((((((( Files Created from 2010-12-02 to 2011-01-02 )))))))))))))))))))))))))))))))
    .

    2011-01-02 15:20 . 2011-01-02 15:21 -------- d-----w- c:\users\Charlie Reece\AppData\Local\temp
    2011-01-02 15:20 . 2011-01-02 15:20 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-01-01 23:53 . 2011-01-01 23:53 -------- d-----w- c:\program files\ESET
    2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Malwarebytes
    2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\programdata\Malwarebytes
    2011-01-01 21:44 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-01-01 21:44 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-31 16:07 . 2010-12-31 16:07 -------- d-----w- c:\windows\system32\log
    2010-12-31 15:57 . 2010-12-31 15:57 66320 ----a-w- c:\windows\system32\drivers\tmtdi.sys
    2010-12-31 15:57 . 2010-12-31 15:57 235024 ----a-w- c:\windows\system32\drivers\tmwfp.sys
    2010-12-31 15:57 . 2010-12-31 15:57 142352 ----a-w- c:\windows\system32\drivers\tmlwf.sys
    2010-12-31 15:57 . 2010-07-30 22:29 249424 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
    2010-12-31 15:57 . 2010-07-30 22:29 36432 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
    2010-12-31 15:57 . 2010-07-30 22:06 1331512 ----a-w- c:\windows\system32\drivers\vsapint.sys
    2010-12-31 15:57 . 2010-07-19 23:03 59472 ----a-w- c:\windows\system32\drivers\tmactmon.sys
    2010-12-31 15:57 . 2010-07-19 23:03 51792 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
    2010-12-31 15:57 . 2010-07-19 23:02 163408 ----a-w- c:\windows\system32\drivers\tmcomm.sys
    2010-12-30 01:59 . 2010-12-31 15:26 -------- d-----w- c:\programdata\MFAData
    2010-12-27 23:44 . 2007-09-18 22:31 92424 ----a-w- c:\program files\Mozilla Firefox\32bit\ncfg.exe
    2010-12-27 23:44 . 2007-09-18 22:31 480784 ----a-w- c:\program files\Mozilla Firefox\32bit\vsapiins.exe
    2010-12-27 23:44 . 2007-09-18 22:31 218376 ----a-w- c:\program files\Mozilla Firefox\32bit\TmEngDrv.dll
    2010-12-27 23:44 . 2007-09-18 22:31 1991944 ----a-w- c:\program files\Mozilla Firefox\32bit\TISSuprt.exe
    2010-12-27 23:44 . 2007-09-18 22:31 156936 ----a-w- c:\program files\Mozilla Firefox\32bit\libexpat.dll
    2010-12-27 23:44 . 2007-09-18 22:31 1332112 ----a-w- c:\program files\Mozilla Firefox\32bit\TSRemove.exe
    2010-12-27 23:44 . 2007-09-18 22:31 124168 ----a-w- c:\program files\Mozilla Firefox\32bit\TmDbg32.dll
    2010-12-27 23:28 . 2010-12-27 23:28 -------- d-----w- C:\found.001
    2010-12-26 03:31 . 2010-12-26 03:31 -------- d-----w- C:\found.000
    2010-12-24 19:33 . 2010-12-24 19:33 -------- d-----w- c:\program files\MEDA MP3 Splitter
    2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\EAC
    2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\AccurateRip
    2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\program files\Exact Audio Copy
    2010-12-23 01:06 . 2010-12-23 01:06 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\NCH Swift Sound
    2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\programdata\NCH Swift Sound
    2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\program files\NCH Software
    2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\programdata\Spybot - Search & Destroy
    2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
    2010-12-16 19:46 . 2010-12-16 19:46 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Absolute Software
    2010-12-16 00:12 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
    2010-12-16 00:12 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
    2010-12-16 00:12 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
    2010-12-16 00:12 . 2010-10-18 13:31 2038272 ----a-w- c:\windows\system32\win32k.sys
    2010-12-16 00:12 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
    2010-12-16 00:12 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
    2010-12-16 00:12 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
    2010-12-16 00:12 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
    2010-12-16 00:12 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
    2010-12-16 00:12 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe
    2010-12-14 00:05 . 2010-12-14 00:05 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-01-02 15:04 . 2009-08-23 03:39 17408 ----a-w- c:\windows\system32\rpcnetp.exe
    2011-01-02 03:06 . 2009-08-23 03:42 17408 ----a-w- c:\windows\system32\rpcnetp.dll
    2011-01-01 21:06 . 2009-08-23 01:59 57752 ----a-w- c:\windows\system32\rpcnet.dll
    2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
    2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
    2010-11-12 18:46 . 2010-11-12 18:46 4280320 ----a-w- c:\windows\system32\GPhotos.scr
    2010-10-31 02:50 . 2010-10-31 02:50 29184 ----a-w- c:\windows\system32\CtLoJack.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
    @="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
    2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
    @="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
    2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
    @="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
    [HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
    2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
    @="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
    [HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
    2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
    @="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
    [HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
    2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "GrpConv"="grpconv -o" [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableLUA"= 0 (0x0)
    "DisableCAD"= 1 (0x1)
    "EnableUIADesktopToggle"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
    2007-04-17 05:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "mixer"=wdmaud.drv

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
    @="Service"

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
    2009-05-21 14:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
    2010-07-09 20:20 261736 ----a-w- c:\windows\System32\nvhotkey.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM04Mon.exe]
    2007-12-03 06:05 36864 ----a-w- c:\windows\OEM04Mon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
    2007-05-10 07:00 857648 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UfSeAgnt.exe]
    2010-12-31 15:57 1398024 ----a-w- c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe

    R2 AbsoluteNotifier;Absolute Notifier;c:\program files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2010-10-08 10408]
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R2 rpcnetp;rpcnetp;c:\windows\System32\rpcnetp.exe [2011-01-02 17408]
    R2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2010-07-19 51792]
    R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2010-07-30 36432]
    R2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [2010-12-31 235024]
    R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [x]
    R3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\DRIVERS\OEM04Vfx.sys [2007-12-03 7424]
    R3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\DRIVERS\OEM04Vid.sys [2007-12-03 234720]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728]
    R4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2010-12-31 488768]
    R4 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2010-12-31 648456]
    S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-12-31 142352]
    S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-24 179712]
    S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-05-29 4233728]


    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    bthsvcs REG_MULTI_SZ BthServ
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    .
    Contents of the 'Scheduled Tasks' folder

    2010-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000Core.job
    - c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]

    2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000UA.job
    - c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
    uInternet Settings,ProxyOverride = *.local
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    FF - ProfilePath - c:\users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
    FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
    FF - Ext: URL Lister: urllister@binnyva.com - %profile%\extensions\urllister@binnyva.com
    FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-RunOnce-<NO NAME> - (no file)



    **************************************************************************
    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files:

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'Explorer.exe'(2008)
    c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
    c:\program files\Fingerprint Reader Suite\farchns.dll
    c:\program files\Fingerprint Reader Suite\infra.dll
    c:\windows\system32\btncopy.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\helppane.exe
    c:\windows\system32\wbem\unsecapp.exe
    .
    **************************************************************************
    .
    Completion time: 2011-01-02 10:26:03 - machine was rebooted
    ComboFix-quarantined-files.txt 2011-01-02 15:25
    ComboFix2.txt 2011-01-02 03:13

    Pre-Run: 23,679,946,752 bytes free
    Post-Run: 23,626,706,944 bytes free

    - - End Of File - - D7FC1FA797CD675F7BA23B1BE4B4450A
     
  6. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    See, if you can start your computer in normal mode and operate it without any problems.

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  7. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    Logs will be posted next

    But I just wanted to let you know that I'm posting these messages from normal mode and I've had no freezing so far. Fingers crossed...
     
  8. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    OTL.txt is too long

    It's about 53k characters, and the post limit is 50k. Suggestions?
     
  9. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    Good news :)

    Split the log between couple of replies.
     
  10. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    aaaand as soon as I posted that last reply, it froze. :(

    Dang. Okay, logs from OTL incoming...
     
  11. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    OTL.txt, part 1

    OTL logfile created on: 1/2/2011 2:33:50 PM - Run 1
    OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Charlie Reece\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6002.18005)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 81.00% Memory free
    7.00 Gb Paging File | 6.00 Gb Available in Paging File | 92.00% Paging File free
    Paging file location(s): [Binary data over 100 bytes]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 173.73 Gb Total Space | 18.56 Gb Free Space | 10.68% Space Free | Partition Type: NTFS
    Drive D: | 10.00 Gb Total Space | 2.64 Gb Free Space | 26.36% Space Free | Partition Type: NTFS

    Computer Name: THENEWERHOTTNES | User Name: Charlie Reece | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
    PRC - [2011/01/02 11:15:14 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe
    PRC - [2010/10/08 09:01:14 | 000,010,408 | ---- | M] (Microsoft) -- C:\Program Files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe
    PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2007/04/17 00:05:52 | 000,021,504 | ---- | M] (UPEK Inc.) -- C:\Program Files\Fingerprint Reader Suite\upeksvr.exe


    ========== Modules (SafeList) ==========

    MOD - [2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
    MOD - [2010/08/31 10:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


    ========== Win32 Services (SafeList) ==========

    SRV - File not found [On_Demand | Stopped] -- c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)
    SRV - [2011/01/02 11:15:14 | 000,057,752 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\System32\rpcnet.exe -- (rpcnet) Remote Procedure Call (RPC)
    SRV - [2010/12/31 10:57:18 | 000,703,008 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe -- (SfCtlCom)
    SRV - [2010/12/31 10:57:18 | 000,648,456 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- (tmproxy)
    SRV - [2010/12/31 10:57:18 | 000,488,768 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmPfw.exe -- (TmPfw)
    SRV - [2010/12/31 10:57:18 | 000,337,160 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer)
    SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
    SRV - [2010/10/08 09:01:14 | 000,010,408 | ---- | M] (Microsoft) [Auto | Running] -- C:\Program Files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe -- (AbsoluteNotifier)
    SRV - [2010/05/14 11:59:44 | 000,455,944 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
    SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
    SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
    SRV - [2009/09/24 20:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
    SRV - [2009/07/16 17:04:16 | 000,316,664 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
    SRV - [2009/05/21 14:28:38 | 000,874,768 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R)
    SRV - [2009/05/21 13:04:14 | 000,473,360 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R)
    SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Disabled | Stopped] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
    SRV - [2008/01/31 18:16:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
    SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
    SRV - [2007/09/13 13:45:38 | 000,102,400 | ---- | M] (IDT, Inc.) [Disabled | Stopped] -- C:\Windows\System32\stacsv.exe -- (STacSV)
    SRV - [2007/09/11 01:45:04 | 000,124,832 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
    SRV - [2007/08/29 16:25:16 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Disabled | Stopped] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
    SRV - [2007/08/27 04:21:36 | 001,471,840 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security 14\PcCtlCom.exe -- (PcCtlCom)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
    DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
    DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
    DRV - [2010/12/31 10:57:26 | 000,235,024 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmwfp.sys -- (tmwfp)
    DRV - [2010/12/31 10:57:26 | 000,142,352 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tmlwf.sys -- (tmlwf)
    DRV - [2010/12/31 10:57:26 | 000,066,320 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tmtdi.sys -- (tmtdi)
    DRV - [2010/07/30 17:29:10 | 000,249,424 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmxpflt.sys -- (tmxpflt)
    DRV - [2010/07/30 17:29:00 | 000,036,432 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmpreflt.sys -- (tmpreflt)
    DRV - [2010/07/30 17:06:08 | 001,331,512 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vsapint.sys -- (vsapint)
    DRV - [2010/07/19 18:03:10 | 000,059,472 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmactmon.sys -- (tmactmon)
    DRV - [2010/07/19 18:03:00 | 000,051,792 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmevtmgr.sys -- (tmevtmgr)
    DRV - [2010/07/19 18:02:54 | 000,163,408 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmcomm.sys -- (tmcomm)
    DRV - [2010/07/09 17:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
    DRV - [2009/05/28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
    DRV - [2009/05/22 18:08:32 | 000,029,696 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VClone.sys -- (VClone)
    DRV - [2008/02/01 01:43:00 | 000,020,152 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
    DRV - [2008/02/01 01:43:00 | 000,019,128 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
    DRV - [2008/02/01 01:43:00 | 000,017,592 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
    DRV - [2008/01/19 00:53:39 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\umpass.sys -- (UMPass)
    DRV - [2007/12/03 01:05:32 | 000,234,720 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM04Vid.sys -- (OEM04Vid)
    DRV - [2007/12/03 01:05:28 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM04Vfx.sys -- (OEM04Vfx)
    DRV - [2007/09/13 13:46:06 | 000,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
    DRV - [2007/08/13 04:44:26 | 002,226,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
    DRV - [2007/05/24 07:35:02 | 000,179,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
    DRV - [2007/05/10 02:00:06 | 000,182,456 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
    DRV - [2007/04/26 00:23:58 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
    DRV - [2007/04/16 23:44:34 | 000,046,992 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tcusb.sys -- (TcUsb)
    DRV - [2007/02/28 06:25:46 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
    DRV - [2007/02/28 06:25:44 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
    DRV - [2007/02/28 06:25:44 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
    DRV - [2006/11/06 20:37:16 | 000,078,128 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
    DRV - [2006/11/06 18:13:52 | 000,016,560 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
    DRV - [2006/11/06 18:13:50 | 000,080,176 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
    DRV - [2006/11/02 04:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
    DRV - [2006/11/02 04:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
    DRV - [2006/11/02 04:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
    DRV - [2006/11/02 04:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
    DRV - [2006/11/02 04:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
    DRV - [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
    DRV - [2006/11/02 04:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
    DRV - [2006/11/02 04:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
    DRV - [2006/11/02 04:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
    DRV - [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
    DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
    DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
    DRV - [2006/11/02 04:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
    DRV - [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
    DRV - [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
    DRV - [2006/11/02 04:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
    DRV - [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
    DRV - [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
    DRV - [2006/11/02 04:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
    DRV - [2006/11/02 04:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
    DRV - [2006/11/02 04:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
    DRV - [2006/11/02 04:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
    DRV - [2006/11/02 04:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
    DRV - [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
    DRV - [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
    DRV - [2006/11/02 04:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
    DRV - [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
    DRV - [2006/11/02 04:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
    DRV - [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
    DRV - [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
    DRV - [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
    DRV - [2006/11/02 04:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
    DRV - [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
    DRV - [2006/11/02 03:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
    DRV - [2006/11/02 03:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
    DRV - [2006/11/02 03:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
    DRV - [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
    DRV - [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
    DRV - [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
    DRV - [2006/11/02 02:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
    DRV - [2006/11/02 02:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
    DRV - [2006/11/02 02:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

    ========== FireFox ==========


    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/13 19:05:56 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/13 19:05:56 | 000,000,000 | ---D | M]

    [2010/06/23 09:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Extensions
    [2010/06/23 09:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Extensions\uploadr@flickr.com
    [2011/01/01 21:22:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions
    [2010/04/28 12:47:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
    [2011/01/01 14:39:54 | 000,000,000 | ---D | M] (Firefox Sync) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
    [2010/08/18 20:27:01 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
    [2010/09/28 22:11:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\nasanightlaunch@example.com
    [2010/04/18 11:38:04 | 000,000,000 | ---D | M] (URL Lister) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\urllister@binnyva.com
    [2011/01/01 21:22:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
    [2010/05/18 22:11:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/05/18 22:11:43 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

    O1 HOSTS File: ([2011/01/02 10:21:35 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
    O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
    O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
    O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
    O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
    O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img8.jpg
    O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img8.jpg
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - File not found
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found

    Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.3IV2 - C:\Windows\System32\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
    Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point
     
     
  12. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    OTL.txt, part 2

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/01/02 14:30:30 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
    [2011/01/02 10:26:05 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011/01/02 10:26:05 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Local\temp
    [2011/01/02 10:21:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/01/02 10:09:35 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
    [2011/01/01 21:54:58 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/01/01 21:54:58 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/01/01 21:54:58 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/01/01 21:54:53 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/01/01 21:54:25 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/01/01 18:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
    [2011/01/01 16:44:50 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\Malwarebytes
    [2011/01/01 16:44:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2011/01/01 16:44:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/01/01 16:44:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/01/01 16:44:43 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2011/01/01 16:44:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/12/31 11:07:39 | 000,000,000 | ---D | C] -- C:\Windows\System32\log
    [2010/12/31 11:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security
    [2010/12/31 10:57:26 | 001,331,512 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\vsapint.sys
    [2010/12/31 10:57:26 | 000,249,424 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmxpflt.sys
    [2010/12/31 10:57:26 | 000,235,024 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmwfp.sys
    [2010/12/31 10:57:26 | 000,163,408 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmcomm.sys
    [2010/12/31 10:57:26 | 000,142,352 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmlwf.sys
    [2010/12/31 10:57:26 | 000,066,320 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmtdi.sys
    [2010/12/31 10:57:26 | 000,059,472 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmactmon.sys
    [2010/12/31 10:57:26 | 000,051,792 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmevtmgr.sys
    [2010/12/31 10:57:26 | 000,036,432 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmpreflt.sys
    [2010/12/31 10:32:52 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2010/12/29 20:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
    [2010/12/27 18:28:05 | 000,000,000 | ---D | C] -- C:\found.001
    [2010/12/25 22:31:47 | 000,000,000 | ---D | C] -- C:\found.000
    [2010/12/25 13:11:04 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\Audio Tools
    [2010/12/24 14:33:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDA MP3 Splitter
    [2010/12/24 14:33:26 | 000,000,000 | ---D | C] -- C:\Program Files\MEDA MP3 Splitter
    [2010/12/24 11:29:32 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\peach2010
    [2010/12/24 00:01:51 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\EAC
    [2010/12/24 00:01:51 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\AccurateRip
    [2010/12/24 00:01:49 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Exact Audio Copy
    [2010/12/24 00:01:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exact Audio Copy
    [2010/12/24 00:01:48 | 000,000,000 | ---D | C] -- C:\Program Files\Exact Audio Copy
    [2010/12/22 20:06:29 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\NCH Swift Sound
    [2010/12/22 20:05:33 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound
    [2010/12/22 20:05:18 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software
    [2010/12/22 15:26:26 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\lisapics
    [2010/12/19 12:41:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
    [2010/12/19 12:41:21 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
    [2010/12/16 16:31:29 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\experiment
    [2010/12/16 16:27:15 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\lauraframe
    [2010/12/16 14:46:52 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\Absolute Software
    [2010/12/13 19:05:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
    [2010/12/11 13:33:08 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\pica2
    [2010/12/11 00:04:44 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\backgs
    [2010/12/09 23:37:14 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Documents\PicabooX
    [2010/12/09 23:32:00 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\elle's pics - Second Wave
    [2010/12/09 23:29:43 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\elle's pics - first wave
    [2010/12/09 23:09:34 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\dec 09
    [2010/12/09 23:09:25 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\2009 misc elle
    [2010/12/09 23:08:11 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\iPhone pics thru nov 15 08
    [2010/12/09 23:07:00 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\elle's pics -- third wave
    [2010/12/09 16:52:21 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\ImageFiles
    [2010/12/09 11:11:14 | 000,000,000 | ---D | C] -- C:\Windows\pss
    [2010/12/09 10:38:35 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\picaboo
    [2010/12/04 12:53:28 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\export

    ========== Files - Modified Within 30 Days ==========

    [2011/01/02 14:32:45 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.exe
    [2011/01/02 14:32:35 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll
    [2011/01/02 14:32:35 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.dll
    [2011/01/02 14:32:33 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/01/02 14:32:32 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/01/02 14:32:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/01/02 14:32:27 | 3756,044,288 | -HS- | M] () -- C:\hiberfil.sys
    [2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
    [2011/01/02 13:27:39 | 000,000,680 | ---- | M] () -- C:\Users\Charlie Reece\AppData\Local\d3d9caps.dat
    [2011/01/02 12:50:39 | 000,791,656 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2011/01/02 12:50:39 | 000,166,776 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2011/01/02 11:15:14 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe
    [2011/01/02 10:28:13 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
    [2011/01/02 10:21:35 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2011/01/01 22:15:05 | 000,002,305 | ---- | M] () -- C:\Users\Charlie Reece\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
    [2011/01/01 21:50:27 | 004,012,260 | R--- | M] () -- C:\Users\Charlie Reece\Desktop\ComboFix.exe
    [2011/01/01 16:44:47 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
    [2011/01/01 16:07:18 | 000,037,685 | ---- | M] () -- C:\ProgramData\nvModes.dat
    [2011/01/01 16:07:18 | 000,037,685 | ---- | M] () -- C:\ProgramData\nvModes.001
    [2011/01/01 14:49:09 | 000,000,940 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000UA.job
    [2010/12/31 11:06:15 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\Trend Micro Internet Security.lnk
    [2010/12/31 10:57:26 | 000,235,024 | ---- | M] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmwfp.sys
    [2010/12/31 10:57:26 | 000,142,352 | ---- | M] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmlwf.sys
    [2010/12/31 10:57:26 | 000,066,320 | ---- | M] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmtdi.sys
    [2010/12/31 10:03:13 | 000,520,288 | ---- | M] () -- C:\Users\Charlie Reece\AVGInstLog.cab
    [2010/12/29 20:04:50 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000Core.job
    [2010/12/27 17:45:19 | 000,284,598 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\Fullscreen capture 12272010 54459 PM.jpg
    [2010/12/25 14:07:03 | 000,000,367 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\Downloads - Shortcut.lnk
    [2010/12/24 12:32:51 | 000,110,592 | ---- | M] () -- C:\Users\Charlie Reece\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
    [2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2010/12/16 14:43:58 | 000,300,256 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2010/12/09 11:10:17 | 000,109,456 | ---- | M] () -- C:\Users\Charlie Reece\Documents\cc_20101209_111007.reg
    [2010/12/08 00:01:34 | 000,049,035 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\statlibrary.dnd4

    ========== Files Created - No Company Name ==========

    [2011/01/02 14:32:27 | 3756,044,288 | -HS- | C] () -- C:\hiberfil.sys
    [2011/01/01 21:54:58 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/01/01 21:54:58 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/01/01 21:54:58 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/01/01 21:54:58 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/01/01 21:54:58 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/01/01 21:50:22 | 004,012,260 | R--- | C] () -- C:\Users\Charlie Reece\Desktop\ComboFix.exe
    [2011/01/01 16:44:47 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/12/31 11:06:15 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\Trend Micro Internet Security.lnk
    [2010/12/31 10:03:52 | 000,946,434 | ---- | C] () -- C:\Users\Charlie Reece\msi-20101231-150009.log
    [2010/12/31 10:03:13 | 000,520,288 | ---- | C] () -- C:\Users\Charlie Reece\AVGInstLog.cab
    [2010/12/27 17:45:19 | 000,284,598 | ---- | C] () -- C:\Users\Charlie Reece\Desktop\Fullscreen capture 12272010 54459 PM.jpg
    [2010/12/25 15:09:20 | 000,000,680 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Local\d3d9caps.dat
    [2010/12/25 14:07:03 | 000,000,367 | ---- | C] () -- C:\Users\Charlie Reece\Desktop\Downloads - Shortcut.lnk
    [2010/12/09 11:10:10 | 000,109,456 | ---- | C] () -- C:\Users\Charlie Reece\Documents\cc_20101209_111007.reg
    [2010/11/28 12:11:56 | 000,023,888 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Roaming\UserTile.png
    [2010/10/08 09:01:06 | 000,000,003 | ---- | C] () -- C:\ProgramData\AbsoluteNotifier.txt
    [2009/10/24 04:26:21 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2009/09/21 21:10:48 | 000,000,391 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Roaming\TweetDeckFast_state.xml
    [2009/09/06 20:05:18 | 000,000,758 | ---- | C] () -- C:\Windows\GMUD32.INI
    [2009/09/05 21:28:53 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
    [2009/09/01 15:43:02 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
    [2009/08/23 20:44:39 | 000,037,685 | ---- | C] () -- C:\ProgramData\nvModes.001
    [2009/08/23 20:42:18 | 000,037,685 | ---- | C] () -- C:\ProgramData\nvModes.dat
    [2009/08/22 22:42:52 | 000,017,408 | ---- | C] () -- C:\Windows\System32\rpcnetp.dll
    [2009/08/22 21:05:28 | 000,110,592 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
    [2008/10/22 04:29:06 | 000,173,550 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
    [2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
    [2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
    [2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
    [2008/02/19 01:33:34 | 000,446,352 | ---- | C] () -- C:\Windows\System32\OpenQuicktimeLib.dll
    [2008/02/01 01:43:25 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
    [2008/02/01 01:43:16 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
    [2008/01/31 18:14:14 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
    [2006/11/07 14:25:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
    [2006/11/03 18:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
    [2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 05:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
    [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/09/17 00:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
    [2006/09/17 00:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
    [2004/07/10 17:55:38 | 000,252,416 | ---- | C] () -- C:\Windows\System32\wsiShared.dll
    [2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

    ========== LOP Check ==========

    [2010/11/10 21:51:16 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\.minecraft
    [2010/12/16 14:46:52 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Absolute Software
    [2010/08/03 22:25:52 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\AdventureTools
    [2009/10/27 20:28:32 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Amazon
    [2010/11/26 18:05:49 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1
    [2010/12/09 21:25:38 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Dropbox
    [2010/12/24 00:01:54 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\EAC
    [2010/06/23 09:06:37 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Flickr
    [2010/03/18 21:32:07 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\gtk-2.0
    [2010/03/18 21:32:59 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\inCombat.1F12F0C296C29611B37F6BD10730D1F4522B6FB9.1
    [2010/12/22 20:06:29 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\NCH Swift Sound
    [2009/09/04 22:03:22 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\OpenOffice.org
    [2010/11/28 12:11:56 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\PeerNetworking
    [2009/11/23 19:57:46 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Picaboo
    [2010/01/27 20:05:08 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\runic games
    [2010/03/11 12:47:18 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Shados-Generator.1F12F0C296C29611B37F6BD10730D1F4522B6FB9.1
    [2009/11/08 11:59:33 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\SystemRequirementsLab
    [2009/08/24 20:41:07 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
    [2010/12/09 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\uTorrent
    [2011/01/01 16:22:50 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\wsInspector
    [2011/01/02 10:28:14 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2009/11/23 12:30:08 | 000,000,000 | ---- | M] () -- C:\AdobeDebug.txt
    [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
    [2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
    [2011/01/02 10:26:03 | 000,015,109 | ---- | M] () -- C:\ComboFix.txt
    [2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
    [2008/02/01 01:43:38 | 000,005,007 | RH-- | M] () -- C:\dell.sdr
    [2008/04/11 10:07:18 | 000,003,820 | ---- | M] () -- C:\eula.1028.txt
    [2008/04/11 10:07:18 | 000,015,428 | ---- | M] () -- C:\eula.1031.txt
    [2008/04/11 10:07:18 | 000,010,058 | ---- | M] () -- C:\eula.1033.txt
    [2008/04/11 10:07:18 | 000,012,246 | ---- | M] () -- C:\eula.1036.txt
    [2008/04/11 10:07:18 | 000,013,912 | ---- | M] () -- C:\eula.1040.txt
    [2008/04/11 10:07:18 | 000,005,868 | ---- | M] () -- C:\eula.1041.txt
    [2008/04/11 10:07:18 | 000,005,970 | ---- | M] () -- C:\eula.1042.txt
    [2008/04/11 10:07:18 | 000,010,134 | ---- | M] () -- C:\eula.1049.txt
    [2008/04/11 10:07:18 | 000,003,814 | ---- | M] () -- C:\eula.2052.txt
    [2008/04/11 10:07:18 | 000,012,936 | ---- | M] () -- C:\eula.3082.txt
    [2008/04/11 10:07:18 | 000,001,110 | ---- | M] () -- C:\globdata.ini
    [2011/01/02 14:32:27 | 3756,044,288 | -HS- | M] () -- C:\hiberfil.sys
    [2008/04/11 10:07:18 | 000,000,843 | ---- | M] () -- C:\install.ini
    [2008/04/11 08:03:48 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
    [2008/04/11 08:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
    [2008/04/11 08:03:48 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
    [2008/04/11 08:03:48 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
    [2008/04/11 08:03:48 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
    [2008/04/11 08:03:48 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
    [2008/04/11 08:03:48 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
    [2008/04/11 10:09:24 | 000,093,200 | ---- | M] (Microsoft Corporation) -- C:\install.res.1049.dll
    [2008/04/11 08:03:48 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
    [2008/04/11 08:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
    [2009/12/27 22:31:28 | 000,001,015 | R--- | M] () -- C:\logFile.xsl
    [2011/01/02 14:32:26 | 3145,728,000 | -HS- | M] () -- C:\pagefile.sys
    [2008/04/11 10:07:18 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
    [2008/04/11 10:09:38 | 003,797,292 | ---- | M] () -- C:\VC_RED.cab
    [2008/04/11 10:11:40 | 000,233,472 | ---- | M] () -- C:\VC_RED.MSI

    < %systemroot%\Fonts\*.com >
    [2006/11/02 07:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2006/11/02 07:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2006/11/02 07:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/11/11 08:30:48 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2006/09/18 16:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2006/11/02 07:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2009/10/23 08:03:22 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
    [2006/11/02 05:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
    [2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
    [2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
    [2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2010/09/03 21:53:14 | 000,000,221 | -HS- | M] () -- C:\Users\Charlie Reece\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/01/01 21:50:27 | 004,012,260 | R--- | M] () -- C:\Users\Charlie Reece\Desktop\ComboFix.exe
    [2010/08/12 07:07:17 | 000,464,896 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\DnD4e Combat Manager.exe
    [2009/06/08 23:04:22 | 000,023,552 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\FrameworkDetect.exe
    [2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/08/22 20:47:04 | 000,000,402 | -HS- | M] () -- C:\Users\Charlie Reece\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2010/10/08 09:01:06 | 000,000,003 | ---- | M] () -- C:\ProgramData\AbsoluteNotifier.txt
    [2011/01/01 16:07:18 | 000,037,685 | ---- | M] () -- C:\ProgramData\nvModes.001

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < End of report >
     
  13. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    And here's Extras.txt

    OTL Extras logfile created on: 1/2/2011 2:33:50 PM - Run 1
    OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Charlie Reece\Desktop
    Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6002.18005)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 81.00% Memory free
    7.00 Gb Paging File | 6.00 Gb Available in Paging File | 92.00% Paging File free
    Paging file location(s): [Binary data over 100 bytes]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 173.73 Gb Total Space | 18.56 Gb Free Space | 10.68% Space Free | Partition Type: NTFS
    Drive D: | 10.00 Gb Total Space | 2.64 Gb Free Space | 26.36% Space Free | Partition Type: NTFS

    Computer Name: THENEWERHOTTNES | User Name: Charlie Reece | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: Current user | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    htmlfile [edit] -- Reg Error: Key error.
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 0
    "DisableNotifications" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{119C2175-0E9B-4D8A-9F19-B5AAAB407003}" = rport=139 | protocol=6 | dir=out | app=system |
    "{18DC3D63-42DB-4C01-8ACF-050C5EF71713}" = lport=138 | protocol=17 | dir=in | app=system |
    "{1CE5D5B4-257A-4944-947C-BB79A2ADD165}" = lport=137 | protocol=17 | dir=in | app=system |
    "{20BB83C3-E676-4D71-9867-7FFF99EE65FD}" = rport=137 | protocol=17 | dir=out | app=system |
    "{32548C29-223B-490A-BA8A-9C00F05F8946}" = rport=445 | protocol=6 | dir=out | app=system |
    "{4AC0E85E-05A5-4A3B-958F-0027DAF9D9AA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{5BD0FCA1-0B78-4F67-AB3C-2914BE36C707}" = lport=139 | protocol=6 | dir=in | app=system |
    "{83FEA092-94A6-4525-99FA-6BBBCFD3CCB7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{8CBBE95C-66A5-4702-9981-70E227CF9E36}" = rport=138 | protocol=17 | dir=out | app=system |
    "{F2675450-5B4D-40AE-85D8-B3EFA4D56344}" = lport=445 | protocol=6 | dir=in | app=system |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{5CAD913B-81C9-4AC1-80B6-DD7127EB6B31}" = protocol=6 | dir=in | app=c:\users\charlie reece\appdata\local\google\google talk plugin\googletalkplugin.exe |
    "{6DE04E62-0E80-4C8D-8345-97F6FB088195}" = protocol=17 | dir=in | app=c:\users\charlie reece\appdata\local\google\google talk plugin\googletalkplugin.exe |
    "{A314D961-FDB8-4412-ADBE-6C28B5D72E85}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{A4F23B6A-6857-4EE5-8AEA-747FBAC1D23F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{BC49BF85-A7D5-4C1B-A765-A4D3C05467F3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{E80939FA-AEF8-4DAD-8DB6-D89C758BB91E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    "{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
    "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
    "{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
    "{0F26618D-6F7B-4216-A7C8-3AF00EBB3AD9}_is1" = FolderSize.Win32 1.0.7.0
    "{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
    "{0F95AA42-0FF6-4D48-9CA1-64C8D0777500}" = QuickSet
    "{16C426FC-B3A4-41B8-9BED-BDAB6836F54D}" = OSU-gt RC8
    "{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
    "{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
    "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
    "{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
    "{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
    "{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
    "{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3C79DC59-6099-323B-B27B-90B45542B270}" = Google Talk Plugin
    "{3E2C691B-B7E6-4053-B5C3-94B8BC407E7A}" = Adobe Premiere Elements 4.0
    "{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
    "{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
    "{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable
    "{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
    "{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
    "{61879398-F35C-4628-AC95-2B84B859FE93}" = nrg2iso
    "{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
    "{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
    "{626C034B-50B8-47BD-AF93-EEFD0FA78FF4}" = Character Builder
    "{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
    "{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
    "{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
    "{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
    "{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
    "{6C91041E-406E-C082-0D03-75D4BC9C6CB0}" = Picaboo X
    "{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{72EEB695-388B-4835-8EA6-0C04545B06B9}" = Intel(R) PROSet/Wireless WiFi Software
    "{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
    "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
    "{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
    "{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
    "{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8C2690CF-5B74-4F93-8139-7B5644CD6A3B}" = MobileMe Control Panel
    "{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
    "{A2289997-10A3-48F2-AA03-99180D761661}" = Fingerprint Reader Suite 5.6
    "{A4552E28-AF1D-4C3E-9991-8112F40265F4}" = Adventure Tools
    "{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
    "{A621B45A-D138-4A95-BE10-7CABA05EF94E}" = Trend Micro Internet Security
    "{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
    "{B1C0D829-FE30-059E-E93F-CDC7A48235C0}" = FlipShare
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
    "{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
    "{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
    "{DE114695-AE58-4B66-8E0F-2505188602FB}_is1" = Uninstall Startup Inspector
    "{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
    "{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
    "{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
    "{E8843212-F0FC-4C3B-BFF3-D51829CB4F19}" = iTunes
    "{E8C06CB3-5DB2-4689-B1DC-4A0220DEA96C}" = Consumer Complete Care Services Agreement
    "{EA8C73AA-3D75-44C9-87A2-8E945FC5FEE6}" = Trend Micro PC-cillin Internet Security
    "{EBE939ED-4612-45FD-A39E-77AC199C4273}" = Absolute Notifier
    "{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
    "{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
    "{F85C7118-F3DC-4ED9-AB27-3E7931EA3D88}" = Adobe Premiere Elements 4.0 Templates
    "{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
    "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
    "3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
    "7-Zip" = 7-Zip 4.65
    "Adobe AIR" = Adobe AIR
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
    "Advanced Audio FX Engine" = Advanced Audio FX Engine
    "Advanced Video FX Engine" = Advanced Video FX Engine
    "Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
    "AudibleDownloadManager" = Audible Download Manager
    "Bejeweled 2 Deluxe" = Bejeweled 2 Deluxe
    "CCleaner" = CCleaner
    "com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1" = Picaboo X
    "Creative OEM004" = Laptop Integrated Webcam Driver (1.03.01.1011)
    "CutePDF Writer Installation" = CutePDF Writer 2.8
    "Defraggler" = Defraggler
    "Dell Webcam Center" = Dell Webcam Center
    "Dell Webcam Manager" = Dell Webcam Manager
    "Ditto_is1" = Ditto
    "ESET Online Scanner" = ESET Online Scanner v3
    "Exact Audio Copy" = Exact Audio Copy 1.0beta1
    "ffdshow_is1" = ffdshow [rev 3055] [2009-08-16]
    "Flickr Uploadr" = Flickr Uploadr 3.2.1
    "Freespace 2_is1" = Freespace 2
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "MEDA MP3 Splitter_is1" = MEDA MP3 Splitter 2.0.1
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
    "NVIDIA Display Control Panel" = NVIDIA Display Control Panel
    "NVIDIA Drivers" = NVIDIA Drivers
    "Picasa 3" = Picasa 3
    "Planescape Torment_is1" = Planescape Torment
    "PremElem40" = Adobe Premiere Elements 4.0
    "PremElem40Templates" = Adobe Premiere Elements 4.0 Templates
    "ProInst" = Intel PROSet Wireless
    "Steam App 22370" = Fallout 3 - Game of the Year Edition
    "Steam App 8930" = Sid Meier's Civilization V
    "SynTPDeinstKey" = Dell Touchpad
    "SystemRequirementsLab" = System Requirements Lab
    "TmPcc" = Trend Micro PC-cillin Internet Security
    "uTorrent" = µTorrent
    "VLC media player" = VLC media player 1.0.1

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Dropbox" = Dropbox
    "f031ef6ac137efc5" = Dell Driver Download Manager

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 1/1/2011 4:42:10 PM | Computer Name = TheNewerHottnes | Source = ESENT | ID = 515
    Description = Windows (3256) Windows: Database C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb:
    Page 1842 (0x00000732) failed verification due to a flush-order dependency mismatch.
    This page should have flushed before page 1841 (0x00000731), but the latter page
    has instead flushed first. Recovery/restore will fail with error -255. If this
    condition persists then please restore the database from a previous backup. This
    problem is likely due to faulty hardware "losing" one or more flushes on one or
    both of these pages sometime in the past. Please contact your hardware vendor for
    further assistance diagnosing the problem.

    Error - 1/1/2011 4:42:13 PM | Computer Name = TheNewerHottnes | Source = ESENT | ID = 454
    Description = Windows (3256) Windows: Database recovery/restore failed with unexpected
    error -255.

    Error - 1/1/2011 4:42:13 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 9000
    Description =

    Error - 1/1/2011 4:42:14 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 7040
    Description =

    Error - 1/1/2011 4:42:14 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 9002
    Description =

    Error - 1/1/2011 4:42:14 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3029
    Description =

    Error - 1/1/2011 4:42:17 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3029
    Description =

    Error - 1/1/2011 4:42:17 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3028
    Description =

    Error - 1/1/2011 4:42:17 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3058
    Description =

    Error - 1/1/2011 4:51:41 PM | Computer Name = TheNewerHottnes | Source = EventSystem | ID = 4609
    Description =

    [ System Events ]
    Error - 1/2/2011 1:46:48 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
    Description =

    Error - 1/2/2011 1:46:51 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
    Description =

    Error - 1/2/2011 1:46:51 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
    Description =

    Error - 1/2/2011 1:47:03 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7001
    Description =

    Error - 1/2/2011 1:47:03 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7026
    Description =

    Error - 1/2/2011 1:48:21 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7001
    Description =

    Error - 1/2/2011 2:27:25 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
    Description =

    Error - 1/2/2011 3:32:17 PM | Computer Name = TheNewerHottnes | Source = volmgr | ID = 262193
    Description = Configuring the Page file for crash dump failed. Make sure there is
    a page file on the boot partition and that is large enough to contain all physical
    memory.

    Error - 1/2/2011 3:32:26 PM | Computer Name = TheNewerHottnes | Source = volmgr | ID = 262193
    Description = Configuring the Page file for crash dump failed. Make sure there is
    a page file on the boot partition and that is large enough to contain all physical
    memory.

    Error - 1/2/2011 3:37:51 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7022
    Description =


    < End of report >
     
  14. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    Update your Java version here: http://www.java.com/en/download/installed.jsp

    Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

    Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

    Now, we need to remove old Java version and its remnants...

    Download JavaRa to your desktop and unzip it to its own folder
    • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
    • Accept any prompts.

    ====================================================================

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      SRV - File not found [On_Demand | Stopped] -- c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)
      O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    =======================================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • IMPORTANT! UN-check Remove found threats
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, push List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  15. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    The latest OTL log:

    All processes killed
    ========== OTL ==========
    Service DAUpdaterSvc stopped successfully!
    Service DAUpdaterSvc deleted successfully!
    File c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe not found.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Charlie Reece
    ->Temp folder emptied: 49560 bytes
    ->Temporary Internet Files folder emptied: 192033 bytes
    ->Java cache emptied: 98116 bytes
    ->FireFox cache emptied: 48367361 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 2578 bytes

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes
    ->Flash cache emptied: 0 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 272097 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 47.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Charlie Reece
    ->Flash cache emptied: 0 bytes

    User: Default
    ->Flash cache emptied: 0 bytes

    User: Default User
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.20.1 log created on 01022011_211334

    Files\Folders moved on Reboot...

    Registry entries deleted on Reboot...
     
  16. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    checkup.txt

    Results of screen317's Security Check version 0.99.7
    Windows Vista Service Pack 2 (UAC is disabled!)
    Internet Explorer 7 Out of date!
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Security Center service is not running! This report may not be accurate!
    Windows Firewall Disabled!
    ESET Online Scanner v3
    Trend Micro PC-cillin Internet Security
    Trend Micro Internet Security
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    Malwarebytes' Anti-Malware
    CCleaner
    Java(TM) 6 Update 23
    Java(TM) SE Runtime Environment 6
    Out of date Java installed!
    Adobe Flash Player 10.1.102.64
    Adobe Reader 8.2.5
    Out of date Adobe Reader installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    ``````````End of Log````````````
     
  17. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    Other steps taken

    I updated Java & ran the JavaRa program to remove the old versions of Java (I did these steps first, as you directed).

    Then I ran OTL.exe with the custom fix you wrote.

    Then I ran the temp file cleaner (it didn't ask me to restart the computer).

    And now I'm running ESET Online Scanner (although I ran that yesterday just prior to my cry for help and found no viruses, but if anything shows up I'll post that log, too).

    Thanks again for all your help.
     
  18. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    Uninstall Java(TM) SE Runtime Environment 6 .

    ======================================================================

    Update Adobe Reader

    You can download it from http://www.adobe.com/products/acrobat/readstep2.html
    After installing the latest Adobe Reader, uninstall all previous versions.
    Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

    Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
    It's a much smaller file to download and uses a lot less resources than Adobe Reader.
    Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
    On this page:

    [​IMG]

    make sure, you have both boxes UN-checked AND (important!) click on Decline button
     
  19. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    I've uninstalled the items you suggested...

    ... and installed Foxit Reader.


    Thanks,
    Charlie
     
  20. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    Oh, OK.

    I'll wait for Eset results then...
     
  21. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    No Eset logs produced...

    ... no infected files found.

    Let me know what comes next, and thanks again,


    Cheers,
    Charlie
     
  22. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    FYI

    Just tried my luck with normal mode and it froze up within a few minutes.

    I'll be at work during the day and unable to access this laptop, but if there's anything else you'd like me to try, I'll get back to it this evening. I really appreciate everything you've tried to do so far.


    Thank you,
    Charlie
     
  23. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    In this forum, we make sure, your computer is free of malware and your computer is clean :)
    Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
    You'll get more attention.
     
  24. carolinacharlie

    carolinacharlie TS Rookie Topic Starter Posts: 16

    Will do

    And thanks, seriously.
     
  25. Broni

    Broni Malware Annihilator Posts: 47,647   +267

    You're very welcome [​IMG]
     
Topic Status:
Not open for further replies.


Add New Comment

TechSpot Members
Login or sign up for free,
it takes about 30 seconds.
You may also...


Get complete access to the TechSpot community. Join thousands of technology enthusiasts that contribute and share knowledge in our forum. Get a private inbox, upload your own photo gallery and more.