Inactive Vista hangs within minutes of startup, works fine safe mode

Status
Not open for further replies.

carolinacharlie

Posts: 16   +0
This began happening a few hours after my father used my laptop to "check his e-mail and stuff" and of course now my system is totally fracked up!

When booting up in normal mode, Vista comes up normally but within a few minutes any running program freezes and I get the eternal spinning blue circle in place of my cursor. The only way to shot down the computer at that point is to remove the battery and unplug the laptop. I still get the same behavior even when disabling all of the non-Windows services on start-up through msconfig. Safe mode works fine, no hanging there.

The problem is that I can only run the programs outlined in the 8-step process in safe mode -- in normal mode, the system hangs before any logs can be generated.

Anyway, I'm pasting the logs from safe mode below. If the logs must be generated in normal mode, I can keep trying -- the time it takes for Vista to get stuck varies, and I might be able to get all of the logs generated eventually.

Thanks in advance for any guidance you can provide.


Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 5438

Windows 6.0.6002 Service Pack 2 (Safe Mode)
Internet Explorer 7.0.6002.18005

1/1/2011 5:51:54 PM
mbam-log-2011-01-01 (17-51-54).txt

Scan type: Quick scan
Objects scanned: 147002
Time elapsed: 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


GMER 1.0.15.15530 - http://www.gmer.net
Rootkit quick scan 2011-01-01 18:23:07
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST920042 rev.3.AD
Running: 0whouzlx.exe; Driver: C:\Users\CHARLI~1\AppData\Local\Temp\kwaiapod.sys


---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 61: copy of MBR
Disk \Device\Harddisk0\DR0 sector 62: copy of MBR

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----



DDS (Ver_10-12-12.02) - NTFSx86 NETWORK
Run by Charlie Reece at 18:24:19.43 on Sat 01/01/2011
Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_20
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3581.2979 [GMT -5:00]

AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Users\Charlie Reece\Downloads\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
uWindow Title = Internet Explorer provided by Dell
uInternet Settings,ProxyOverride = *.local
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
mRun: [<NO NAME>]
mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: DisableCAD = 1 (0x1)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Send image to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
Notify: psfus - c:\windows\system32\psqlpwd.dll
LSA: Notification Packages = scecli psqlpwd

================= FIREFOX ===================

FF - ProfilePath - c:\users\charli~1\appdata\roaming\mozilla\firefox\profiles\wt74y5dz.default\
FF - component: c:\users\charlie reece\appdata\roaming\mozilla\firefox\profiles\wt74y5dz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}\platform\winnt_x86-msvc\components\WeaveCrypto.dll
FF - plugin: c:\program files\google\picasa3\npPicasa3.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\users\charlie reece\appdata\local\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\users\charlie reece\appdata\roaming\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\users\charlie reece\appdata\roaming\mozilla\plugins\npgtpo3dautoplugin.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
FF - Ext: URL Lister: urllister@binnyva.com - %profile%\extensions\urllister@binnyva.com
FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}

============= SERVICES / DRIVERS ===============

R1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\drivers\tmlwf.sys [2010-12-31 142352]
R3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-2-1 179712]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\NETw5v32.sys [2009-5-28 4233728]
S2 AbsoluteNotifier;Absolute Notifier;c:\program files\absolute software\absolute notifier\AbsoluteNotifierService.exe [2010-10-8 10408]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 rpcnetp;rpcnetp;c:\windows\system32\rpcnetp.exe [2009-8-22 17408]
S2 tmevtmgr;tmevtmgr;c:\windows\system32\drivers\tmevtmgr.sys [2010-12-31 51792]
S2 tmpreflt;tmpreflt;c:\windows\system32\drivers\tmpreflt.sys [2010-12-31 36432]
S2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\drivers\tmwfp.sys [2010-12-31 235024]
S3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\steam\steamapps\common\dragon age origins\bin_ship\daupdatersvc.service.exe --> c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [?]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2009-8-29 21504]
S3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\drivers\OEM04Vfx.sys [2008-2-1 7424]
S3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\drivers\OEM04Vid.sys [2008-2-1 234720]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\AEstSrv.exe [2008-1-31 73728]
S4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\trendm~1\intern~2\TmPfw.exe [2010-12-31 488768]
S4 tmproxy;Trend Micro Proxy Service;c:\program files\trend micro\internet security\TmProxy.exe [2010-12-31 648456]

=============== Created Last 30 ================

2011-01-01 21:44:50 -------- d-----w- c:\users\charli~1\appdata\roaming\Malwarebytes
2011-01-01 21:44:46 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-01 21:44:46 -------- d-----w- c:\progra~2\Malwarebytes
2011-01-01 21:44:43 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-01-01 21:44:43 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-12-31 16:07:39 -------- d-----w- c:\windows\system32\log
2010-12-31 15:57:26 66320 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2010-12-31 15:57:26 59472 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2010-12-31 15:57:26 51792 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2010-12-31 15:57:26 36432 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
2010-12-31 15:57:26 249424 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
2010-12-31 15:57:26 235024 ----a-w- c:\windows\system32\drivers\tmwfp.sys
2010-12-31 15:57:26 163408 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-12-31 15:57:26 142352 ----a-w- c:\windows\system32\drivers\tmlwf.sys
2010-12-31 15:57:26 1331512 ----a-w- c:\windows\system32\drivers\vsapint.sys
2010-12-30 01:59:04 -------- d-----w- c:\progra~2\MFAData
2010-12-27 23:44:35 92424 ----a-w- c:\program files\mozilla firefox\32bit\ncfg.exe
2010-12-27 23:44:35 480784 ----a-w- c:\program files\mozilla firefox\32bit\vsapiins.exe
2010-12-27 23:44:35 218376 ----a-w- c:\program files\mozilla firefox\32bit\TmEngDrv.dll
2010-12-27 23:44:35 1991944 ----a-w- c:\program files\mozilla firefox\32bit\TISSuprt.exe
2010-12-27 23:44:35 156936 ----a-w- c:\program files\mozilla firefox\32bit\libexpat.dll
2010-12-27 23:44:35 1332112 ----a-w- c:\program files\mozilla firefox\32bit\TSRemove.exe
2010-12-27 23:44:35 124168 ----a-w- c:\program files\mozilla firefox\32bit\TmDbg32.dll
2010-12-27 23:28:05 -------- d-sh--w- C:\found.001
2010-12-26 03:31:47 -------- d-sh--w- C:\found.000
2010-12-24 19:33:31 23694 ----a-w- c:\windows\system32\win32k2.sys
2010-12-24 19:33:26 -------- d-----w- c:\program files\MEDA MP3 Splitter
2010-12-24 05:01:51 -------- d-----w- c:\users\charli~1\appdata\roaming\EAC
2010-12-24 05:01:51 -------- d-----w- c:\users\charli~1\appdata\roaming\AccurateRip
2010-12-24 05:01:48 -------- d-----w- c:\program files\Exact Audio Copy
2010-12-23 01:05:18 -------- d-----w- c:\program files\NCH Software
2010-12-19 17:41:21 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-12-19 17:41:21 -------- d-----w- c:\progra~2\Spybot - Search & Destroy
2010-12-16 19:46:52 -------- d-----w- c:\users\charli~1\appdata\roaming\Absolute Software
2010-12-16 00:12:06 66048 ----a-w- c:\program files\windows mail\wabmig.exe
2010-12-16 00:12:06 515584 ----a-w- c:\program files\windows mail\wab.exe
2010-12-16 00:12:06 33280 ----a-w- c:\program files\windows mail\wabfind.dll
2010-12-16 00:12:03 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-12-16 00:12:01 601600 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-16 00:12:01 352768 ----a-w- c:\windows\system32\taskschd.dll
2010-12-16 00:12:01 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-16 00:12:01 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-16 00:12:01 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-12-16 00:12:00 81920 ----a-w- c:\windows\system32\consent.exe
2010-12-14 00:05:56 159744 ----a-w- c:\program files\mozilla firefox\plugins\npqtplugin7.dll
2010-12-09 16:11:14 -------- d-----w- c:\windows\pss

==================== Find3M ====================

2011-01-01 21:30:19 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2011-01-01 21:06:56 57752 ----a-w- c:\windows\system32\rpcnet.dll
2011-01-01 21:06:56 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2010-11-29 22:38:30 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 22:38:30 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-12 18:46:58 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-10-31 02:50:15 29184 ----a-w- c:\windows\system32\CtLoJack.dll
2010-10-28 15:44:56 34304 ----a-w- c:\windows\system32\atmlib.dll
2010-10-28 13:27:47 292352 ----a-w- c:\windows\system32\atmfd.dll
2010-10-28 13:20:12 2048 ----a-w- c:\windows\system32\tzres.dll
2010-10-21 20:08:42 834048 ----a-w- c:\windows\system32\wininet.dll
2010-10-21 18:30:50 389632 ----a-w- c:\windows\system32\html.iec
2010-10-20 17:41:28 78336 ----a-w- c:\windows\system32\ieencode.dll

============= FINISH: 18:25:06.51 ===============



UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-12-12.02)

Microsoft® Windows Vista™ Home Premium
Boot Device: \Device\HarddiskVolume3
Install Date: 1/31/2008 5:50:16 PM
System Uptime: 1/1/2011 4:30:05 PM (2 hours ago)

Motherboard: Dell Inc. | |
Processor: Intel(R) Core(TM)2 Duo CPU T7500 @ 2.20GHz | Microprocessor | 2194/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 174 GiB total, 22.6 GiB free.
D: is FIXED (NTFS) - 10 GiB total, 2.636 GiB free.
F: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP190: 12/24/2010 12:45:36 AM - Scheduled Checkpoint
RP191: 12/31/2010 11:08:33 AM - Device Driver Package Install: Trend Micro Network Service
RP192: 12/31/2010 11:08:59 AM - Device Driver Package Install: TrendMicro Network Service
RP193: 12/31/2010 11:09:22 AM - Device Driver Package Install: Trend Micro Network Service

==== Installed Programs ======================

µTorrent
3ivx MPEG-4 5.0.3 (remove only)
7-Zip 4.65
Absolute Notifier
Adobe AIR
Adobe Common File Installer
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop Elements 6.0
Adobe Premiere Elements 4.0
Adobe Premiere Elements 4.0 Templates
Adobe Reader 8.2.5
Advanced Audio FX Engine
Advanced Video FX Engine
Adventure Tools
Amazon MP3 Downloader 1.0.10
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audible Download Manager
Bejeweled 2 Deluxe
Bonjour
Broadcom Management Programs
Browser Address Error Redirector
CCleaner
Character Builder
Consumer Complete Care Services Agreement
CutePDF Writer 2.8
Defraggler
Dell DataSafe Online
Dell Driver Download Manager
Dell Getting Started Guide
Dell Support Center (Support Software)
Dell Touchpad
Dell Webcam Center
Dell Webcam Manager
Ditto
Dropbox
Exact Audio Copy 1.0beta1
Fallout 3 - Game of the Year Edition
ffdshow [rev 3055] [2009-08-16]
Fingerprint Reader Suite 5.6
Flickr Uploadr 3.2.1
FlipShare
FolderSize.Win32 1.0.7.0
Freespace 2
Google Talk Plugin
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Intel PROSet Wireless
Intel(R) PROSet/Wireless WiFi Software
iPhone Configuration Utility
iTunes
Java Auto Updater
Java(TM) 6 Update 20
Java(TM) SE Runtime Environment 6
Laptop Integrated Webcam Driver (1.03.01.1011)
Live! Cam Avatar Creator
Live! Cam Avatar v1.0
Malwarebytes' Anti-Malware
MEDA MP3 Splitter 2.0.1
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft Games for Windows - LIVE Redistributable
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 SP1 English
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
MobileMe Control Panel
Mozilla Firefox (3.6.6)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Music, Photos & Videos Launcher
mWMI
nrg2iso
NVIDIA Display Control Panel
NVIDIA Drivers
NVIDIA PhysX
OGA Notifier 2.0.0048.0
OpenOffice.org 3.2
OSU-gt RC8
Picaboo X
Picasa 3
Planescape Torment
Product Documentation Launcher
QualxServ Service Agreement
QuickSet
QuickTime
Roxio Creator Audio
Roxio Creator BDAV Plugin
Roxio Creator Copy
Roxio Creator Data
Roxio Creator DE
Roxio Creator Tools
Roxio Express Labeler
Roxio MyDVD DE
Roxio Update Manager
Safari
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Sid Meier's Civilization V
SigmaTel Audio
Sonic Activation Module
Steam
System Requirements Lab
Trend Micro Internet Security
Trend Micro PC-cillin Internet Security
Uninstall Startup Inspector
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
User's Guides
VLC media player 1.0.1
WIDCOMM Bluetooth Software 6.0.1.3100
Windows Media Player Firefox Plugin

==== Event Viewer Messages From Past Week ========

12/31/2010 9:58:04 AM, Error: Service Control Manager [7031] - The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/31/2010 9:53:05 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service MSIServer with arguments "" in order to run the server: {000C101C-0000-0000-C000-000000000046}
12/31/2010 9:48:01 AM, Error: EventLog [6008] - The previous system shutdown at 9:45:07 AM on 12/31/2010 was unexpected.
12/31/2010 9:43:15 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B68-F52A-11D8-B9A5-505054503030}
12/31/2010 9:41:15 AM, Error: EventLog [6008] - The previous system shutdown at 9:34:09 AM on 12/31/2010 was unexpected.
12/31/2010 8:59:04 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 192.168.0.195 for the Network Card with network address 001DE072DD7B has been denied by the DHCP server 172.17.1.1 (The DHCP Server sent a DHCPNACK message).
12/31/2010 8:58:09 PM, Error: EventLog [6008] - The previous system shutdown at 2:01:21 PM on 12/31/2010 was unexpected.
12/31/2010 12:10:50 PM, Error: EventLog [6008] - The previous system shutdown at 11:44:45 AM on 12/31/2010 was unexpected.
12/31/2010 11:40:25 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
12/31/2010 11:33:42 AM, Error: EventLog [6008] - The previous system shutdown at 11:25:25 AM on 12/31/2010 was unexpected.
12/31/2010 11:09:38 AM, Error: Service Control Manager [7030] - The Trend Micro Proxy Service service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/31/2010 11:09:33 AM, Error: Service Control Manager [7030] - The Trend Micro Personal Firewall service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
12/31/2010 11:05:26 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
12/31/2010 11:04:54 AM, Error: Service Control Manager [7022] - The Trend Micro Central Control Component service hung on starting.
12/31/2010 10:38:40 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr Wanarpv6
12/31/2010 10:37:43 AM, Error: EventLog [6008] - The previous system shutdown at 10:32:48 AM on 12/31/2010 was unexpected.
12/31/2010 10:36:55 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume C:.
12/31/2010 10:36:52 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume .
12/31/2010 1:18:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wcncsvc with arguments "" in order to run the server: {375FF000-DD27-11D9-8F9C-0002B3988E81}
12/31/2010 1:18:10 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
12/30/2010 9:59:44 PM, Error: EventLog [6008] - The previous system shutdown at 9:55:05 PM on 12/30/2010 was unexpected.
12/30/2010 9:59:24 PM, Error: Application Popup [877] - There was error [DATABASE OPEN FAILED] processing the driver database.
12/29/2010 8:12:56 PM, Error: EventLog [6008] - The previous system shutdown at 8:04:46 PM on 12/29/2010 was unexpected.
12/29/2010 8:04:47 PM, Error: BTHUSB [17] - The local Bluetooth adapter has failed in an undetermined manner and will not be used. The driver has been unloaded.
12/27/2010 9:49:59 PM, Error: iaStor [9] - The device, \Device\Ide\iaStor0, did not respond within the timeout period.
12/27/2010 9:49:21 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Microsoft .NET Framework NGEN v4.0.30319_X86 service to connect.
12/27/2010 9:21:26 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wcncsvc with arguments "" in order to run the server: {375FF001-DD27-11D9-8F9C-0002B3988E81}
12/27/2010 9:17:31 PM, Error: EventLog [6008] - The previous system shutdown at 7:28:21 PM on 12/27/2010 was unexpected.
12/27/2010 7:24:30 PM, Error: EventLog [6008] - The previous system shutdown at 6:47:31 PM on 12/27/2010 was unexpected.
12/27/2010 6:37:56 PM, Error: Service Control Manager [7001] - The Trend Micro Proxy Service service depends on the Trend Micro TDI Driver service which failed to start because of the following error: A device attached to the system is not functioning.
12/27/2010 6:37:15 PM, Error: EventLog [6008] - The previous system shutdown at 6:35:15 PM on 12/27/2010 was unexpected.
12/27/2010 6:30:17 PM, Error: EventLog [6008] - The previous system shutdown at 6:22:17 PM on 12/27/2010 was unexpected.
12/27/2010 6:04:25 PM, Error: Microsoft-Windows-PrintSpooler [19] - The print spooler failed to share printer CutePDF Writer with shared resource name CutePDF Writer. Error 2114. The printer cannot be used by others on the network.
12/27/2010 5:55:20 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx tmtdi Wanarpv6
12/27/2010 5:53:44 PM, Error: EventLog [6008] - The previous system shutdown at 5:49:28 PM on 12/27/2010 was unexpected.
12/27/2010 5:35:01 PM, Error: EventLog [6008] - The previous system shutdown at 5:00:34 PM on 12/27/2010 was unexpected.
12/26/2010 9:53:30 AM, Error: Ntfs [55] - The file system structure on the disk is corrupt and unusable. Please run the chkdsk utility on the volume OS.
12/26/2010 9:22:16 AM, Error: EventLog [6008] - The previous system shutdown at 10:46:31 PM on 12/25/2010 was unexpected.
12/26/2010 6:58:50 PM, Error: EventLog [6008] - The previous system shutdown at 5:45:52 PM on 12/26/2010 was unexpected.
12/26/2010 5:35:57 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\RegBack\COMPONENTS' was corrupted and it has been recovered. Some data might have been lost.
12/26/2010 5:31:21 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\RegBack\SYSTEM' was corrupted and it has been recovered. Some data might have been lost.
12/26/2010 4:50:29 PM, Error: EventLog [6008] - The previous system shutdown at 4:39:52 PM on 12/26/2010 was unexpected.
12/26/2010 4:36:57 PM, Error: EventLog [6008] - The previous system shutdown at 4:02:44 PM on 12/26/2010 was unexpected.
12/26/2010 3:56:52 PM, Error: EventLog [6008] - The previous system shutdown at 2:35:07 PM on 12/26/2010 was unexpected.
12/26/2010 2:20:17 PM, Error: EventLog [6008] - The previous system shutdown at 12:34:23 PM on 12/26/2010 was unexpected.
12/26/2010 11:59:28 AM, Error: EventLog [6008] - The previous system shutdown at 10:17:05 AM on 12/26/2010 was unexpected.
12/26/2010 10:03:13 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Base Filtering Engine service, but this action failed with the following error: An instance of the service is already running.
12/26/2010 10:02:25 AM, Error: Service Control Manager [7034] - The Windows Search service terminated unexpectedly. It has done this 3 time(s).
12/26/2010 10:01:46 AM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
12/26/2010 10:01:13 AM, Error: Service Control Manager [7031] - The Windows Firewall service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/26/2010 10:01:13 AM, Error: Service Control Manager [7031] - The Diagnostic Policy Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/26/2010 10:01:13 AM, Error: Service Control Manager [7031] - The Base Filtering Engine service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
12/25/2010 3:01:13 PM, Error: EventLog [6008] - The previous system shutdown at 2:55:23 PM on 12/25/2010 was unexpected.
12/25/2010 2:51:34 PM, Error: EventLog [6008] - The previous system shutdown at 2:42:28 PM on 12/25/2010 was unexpected.
12/25/2010 10:41:20 PM, Error: Microsoft-Windows-Kernel-General [5] - {Registry Hive Recovered} Registry hive (file): '\SystemRoot\System32\Config\RegBack\SOFTWARE' was corrupted and it has been recovered. Some data might have been lost.
12/25/2010 10:15:41 PM, Error: Service Control Manager [7031] - The Windows Firewall service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
12/25/2010 10:15:41 PM, Error: Service Control Manager [7031] - The Diagnostic Policy Service service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
12/25/2010 10:15:41 PM, Error: Service Control Manager [7031] - The Base Filtering Engine service terminated unexpectedly. It has done this 2 time(s). The following corrective action will be taken in 300000 milliseconds: Restart the service.
12/25/2010 1:55:08 PM, Error: EventLog [6008] - The previous system shutdown at 1:49:48 PM on 12/25/2010 was unexpected.
12/25/2010 1:43:44 PM, Error: EventLog [6008] - The previous system shutdown at 1:36:45 PM on 12/25/2010 was unexpected.
1/1/2011 4:37:13 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service iPod Service with arguments "" in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
1/1/2011 4:32:45 PM, Error: Service Control Manager [7001] - The PnP-X IP Bus Enumerator service depends on the Function Discovery Provider Host service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:31:21 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: spldr tmtdi Wanarpv6
1/1/2011 4:31:21 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:31:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
1/1/2011 4:31:16 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
1/1/2011 4:31:14 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
1/1/2011 4:31:11 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
1/1/2011 4:31:03 PM, Error: Microsoft-Windows-WLAN-AutoConfig [10000] - WLAN Extensibility Module has failed to start. Module Path: C:\Windows\System32\IWMSSvc.dll Error Code: 21
1/1/2011 4:31:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
1/1/2011 4:30:38 PM, Error: EventLog [6008] - The previous system shutdown at 4:27:54 PM on 1/1/2011 was unexpected.
1/1/2011 4:30:22 PM, Error: volmgr [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
1/1/2011 4:25:17 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
1/1/2011 4:25:17 PM, Error: Service Control Manager [7024] - The Windows Search service terminated with service-specific error 2147749155 (0x80040D23).
1/1/2011 4:25:17 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Search service to connect.
1/1/2011 4:25:17 PM, Error: Service Control Manager [7000] - The Windows Search service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/1/2011 4:25:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
1/1/2011 4:25:17 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1053" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
1/1/2011 4:19:45 PM, Error: EventLog [6008] - The previous system shutdown at 4:10:40 PM on 1/1/2011 was unexpected.
1/1/2011 4:06:09 PM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx tmlwf tmtdi Wanarpv6
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
1/1/2011 4:06:06 PM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
1/1/2011 4:05:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
1/1/2011 4:05:31 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
1/1/2011 4:04:58 PM, Error: EventLog [6008] - The previous system shutdown at 4:01:02 PM on 1/1/2011 was unexpected.
1/1/2011 3:52:33 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service PcCtlCom with arguments "-Service" in order to run the server: {5F9DCAF1-2A98-4135-AEFF-8C76B1D7C52C}
1/1/2011 3:51:10 PM, Error: EventLog [6008] - The previous system shutdown at 3:47:07 PM on 1/1/2011 was unexpected.
1/1/2011 3:41:11 PM, Error: EventLog [6008] - The previous system shutdown at 3:16:56 PM on 1/1/2011 was unexpected.

==== End Of File ===========================
 
Welcome aboard
yahooo.gif


Please, observe following rules:
  • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
  • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
  • Please refrain from running tools or applying updates other than those I suggest.
  • Never run more than one scan at a time.
  • Keep updating me regarding your computer behavior, good, or bad.
  • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
  • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
  • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=====================================================================

Yes, you're definitely infected.

Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
  1. Please, never rename Combofix unless instructed.
  2. Close any open browsers.
  3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
    • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
    NOTE1. If Combofix asks you to install Recovery Console, please allow it.
    NOTE 2. If Combofix asks you to update the program, always do so.
    • Close any open browsers.
    • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
    • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
    • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
  4. Double click on combofix.exe & follow the prompts.
  5. When finished, it will produce a report for you.
  6. Please post the "C:\ComboFix.txt"
**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.

Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

There are 4 different versions. If one of them won't run then download and try to run the other one.

Vista and Win7 users need to right click Rkill and choose Run as Administrator

You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

Rkill.com
Rkill.scr
Rkill.exe

  • Double-click on the Rkill desktop icon to run the tool.
  • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
  • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
  • If not, delete the file, then download and use the one provided in Link 2.
  • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
  • Do not reboot until instructed.
  • If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
 
Here's combofix.txt

And thanks for your help!



ComboFix 11-01-01.01 - Charlie Reece 01/01/2011 21:58:10.1.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3581.2717 [GMT -5:00]
Running from: c:\users\Charlie Reece\Desktop\ComboFix.exe
AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}
SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Install.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-02 to 2011-01-02 )))))))))))))))))))))))))))))))
.

2011-01-02 03:08 . 2011-01-02 03:08 0 ----a-w- c:\windows\system32\NTAgent.exe
2011-01-02 03:05 . 2011-01-02 03:08 -------- d-----w- c:\users\Charlie Reece\AppData\Local\temp
2011-01-02 03:05 . 2011-01-02 03:05 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-01 23:53 . 2011-01-01 23:53 -------- d-----w- c:\program files\ESET
2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Malwarebytes
2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\programdata\Malwarebytes
2011-01-01 21:44 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-01 21:44 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-31 16:07 . 2010-12-31 16:07 -------- d-----w- c:\windows\system32\log
2010-12-31 15:57 . 2010-12-31 15:57 66320 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2010-12-31 15:57 . 2010-12-31 15:57 235024 ----a-w- c:\windows\system32\drivers\tmwfp.sys
2010-12-31 15:57 . 2010-12-31 15:57 142352 ----a-w- c:\windows\system32\drivers\tmlwf.sys
2010-12-31 15:57 . 2010-07-30 22:29 249424 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
2010-12-31 15:57 . 2010-07-30 22:29 36432 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
2010-12-31 15:57 . 2010-07-30 22:06 1331512 ----a-w- c:\windows\system32\drivers\vsapint.sys
2010-12-31 15:57 . 2010-07-19 23:03 59472 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2010-12-31 15:57 . 2010-07-19 23:03 51792 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2010-12-31 15:57 . 2010-07-19 23:02 163408 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-12-30 01:59 . 2010-12-31 15:26 -------- d-----w- c:\programdata\MFAData
2010-12-27 23:44 . 2007-09-18 22:31 92424 ----a-w- c:\program files\Mozilla Firefox\32bit\ncfg.exe
2010-12-27 23:44 . 2007-09-18 22:31 480784 ----a-w- c:\program files\Mozilla Firefox\32bit\vsapiins.exe
2010-12-27 23:44 . 2007-09-18 22:31 218376 ----a-w- c:\program files\Mozilla Firefox\32bit\TmEngDrv.dll
2010-12-27 23:44 . 2007-09-18 22:31 1991944 ----a-w- c:\program files\Mozilla Firefox\32bit\TISSuprt.exe
2010-12-27 23:44 . 2007-09-18 22:31 156936 ----a-w- c:\program files\Mozilla Firefox\32bit\libexpat.dll
2010-12-27 23:44 . 2007-09-18 22:31 1332112 ----a-w- c:\program files\Mozilla Firefox\32bit\TSRemove.exe
2010-12-27 23:44 . 2007-09-18 22:31 124168 ----a-w- c:\program files\Mozilla Firefox\32bit\TmDbg32.dll
2010-12-27 23:28 . 2010-12-27 23:28 -------- d-----w- C:\found.001
2010-12-26 03:31 . 2010-12-26 03:31 -------- d-----w- C:\found.000
2010-12-24 19:33 . 2010-12-25 17:26 23694 ----a-w- c:\windows\system32\win32k2.sys
2010-12-24 19:33 . 2010-12-24 19:33 -------- d-----w- c:\program files\MEDA MP3 Splitter
2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\EAC
2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\AccurateRip
2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\program files\Exact Audio Copy
2010-12-23 01:06 . 2010-12-23 01:06 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\NCH Swift Sound
2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\programdata\NCH Swift Sound
2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\program files\NCH Software
2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-12-16 19:46 . 2010-12-16 19:46 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Absolute Software
2010-12-16 00:12 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2010-12-16 00:12 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2010-12-16 00:12 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2010-12-16 00:12 . 2010-10-18 13:31 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-12-16 00:12 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-16 00:12 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2010-12-16 00:12 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-16 00:12 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-16 00:12 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-12-16 00:12 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe
2010-12-14 00:05 . 2010-12-14 00:05 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-02 03:06 . 2009-08-23 03:42 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2011-01-01 21:30 . 2009-08-23 03:39 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2011-01-01 21:06 . 2009-08-23 01:59 57752 ----a-w- c:\windows\system32\rpcnet.dll
2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-12 18:46 . 2010-11-12 18:46 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-10-31 02:50 . 2010-10-31 02:50 29184 ----a-w- c:\windows\system32\CtLoJack.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-17 05:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-05-21 14:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
2010-07-09 20:20 261736 ----a-w- c:\windows\System32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM04Mon.exe]
2007-12-03 06:05 36864 ----a-w- c:\windows\OEM04Mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2007-05-10 07:00 857648 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UfSeAgnt.exe]
2010-12-31 15:57 1398024 ----a-w- c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=dword:00000001

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [x]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728]
S0 rpcnetp;rpcnetp; [x]
S2 AbsoluteNotifier;Absolute Notifier;c:\program files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2010-10-08 10408]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-24 179712]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-05-29 4233728]
S3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\DRIVERS\OEM04Vfx.sys [2007-12-03 7424]
S3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\DRIVERS\OEM04Vid.sys [2007-12-03 234720]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000Core.job
- c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]

2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000UA.job
- c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
FF - Ext: URL Lister: urllister@binnyva.com - %profile%\extensions\urllister@binnyva.com
FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-SigmatelSysTrayApp - %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-01-01 22:09
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3184)
c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLANExt.exe
c:\program files\Fingerprint Reader Suite\upeksvr.exe
c:\windows\System32\rpcnetp.exe
c:\windows\system32\wbem\unsecapp.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2011-01-01 22:13:55 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-02 03:13

Pre-Run: 23,792,177,152 bytes free
Post-Run: 19,893,198,848 bytes free

- - End Of File - - 5BE7F4A61D5491DECFB965B435C941EB
 
1. Please open Notepad
  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:
File::
c:\windows\system32\win32k2.sys

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendFirewall]
"DisableMonitoring"=-


3. Save the above as CFScript.txt

4. Close/disable all anti virus and anti malware programs again, so they do not interfere with the running of ComboFix.

5. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif



6. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
  • Combofix.txt
 
Here's the latest combofix.txt

ComboFix 11-01-01.01 - Charlie Reece 01/02/2011 10:11:30.2.2 - x86 NETWORK
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.3581.3135 [GMT -5:00]
Running from: c:\users\Charlie Reece\Desktop\ComboFix.exe
Command switches used :: c:\users\Charlie Reece\Desktop\CFScript.txt
AV: Trend Micro Internet Security *Disabled/Updated* {48929DFC-7A52-A34F-8351-C4DBEDBD9C50}
FW: Trend Micro Personal Firewall *Disabled* {70A91CD9-303D-A217-A80E-6DEE136EDB2B}
SP: Trend Micro Internet Security *Disabled/Updated* {F3F37C18-5C68-ACC1-B9E1-FFA9963AD6ED}
* Created a new restore point

FILE ::
"c:\windows\system32\win32k2.sys"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\NTAgent.exe
c:\windows\system32\win32k2.sys

Infected copy of c:\windows\System32\autochk.exe was found and disinfected
Restored copy from - c:\windows\winsxs\x86_microsoft-windows-autochk_31bf3856ad364e35_6.0.6001.18000_none_e1f3ed49c1c122ef\autochk.exe

.
((((((((((((((((((((((((( Files Created from 2010-12-02 to 2011-01-02 )))))))))))))))))))))))))))))))
.

2011-01-02 15:20 . 2011-01-02 15:21 -------- d-----w- c:\users\Charlie Reece\AppData\Local\temp
2011-01-02 15:20 . 2011-01-02 15:20 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-01-01 23:53 . 2011-01-01 23:53 -------- d-----w- c:\program files\ESET
2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Malwarebytes
2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\programdata\Malwarebytes
2011-01-01 21:44 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-01-01 21:44 . 2011-01-01 21:44 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-01-01 21:44 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-12-31 16:07 . 2010-12-31 16:07 -------- d-----w- c:\windows\system32\log
2010-12-31 15:57 . 2010-12-31 15:57 66320 ----a-w- c:\windows\system32\drivers\tmtdi.sys
2010-12-31 15:57 . 2010-12-31 15:57 235024 ----a-w- c:\windows\system32\drivers\tmwfp.sys
2010-12-31 15:57 . 2010-12-31 15:57 142352 ----a-w- c:\windows\system32\drivers\tmlwf.sys
2010-12-31 15:57 . 2010-07-30 22:29 249424 ----a-w- c:\windows\system32\drivers\tmxpflt.sys
2010-12-31 15:57 . 2010-07-30 22:29 36432 ----a-w- c:\windows\system32\drivers\tmpreflt.sys
2010-12-31 15:57 . 2010-07-30 22:06 1331512 ----a-w- c:\windows\system32\drivers\vsapint.sys
2010-12-31 15:57 . 2010-07-19 23:03 59472 ----a-w- c:\windows\system32\drivers\tmactmon.sys
2010-12-31 15:57 . 2010-07-19 23:03 51792 ----a-w- c:\windows\system32\drivers\tmevtmgr.sys
2010-12-31 15:57 . 2010-07-19 23:02 163408 ----a-w- c:\windows\system32\drivers\tmcomm.sys
2010-12-30 01:59 . 2010-12-31 15:26 -------- d-----w- c:\programdata\MFAData
2010-12-27 23:44 . 2007-09-18 22:31 92424 ----a-w- c:\program files\Mozilla Firefox\32bit\ncfg.exe
2010-12-27 23:44 . 2007-09-18 22:31 480784 ----a-w- c:\program files\Mozilla Firefox\32bit\vsapiins.exe
2010-12-27 23:44 . 2007-09-18 22:31 218376 ----a-w- c:\program files\Mozilla Firefox\32bit\TmEngDrv.dll
2010-12-27 23:44 . 2007-09-18 22:31 1991944 ----a-w- c:\program files\Mozilla Firefox\32bit\TISSuprt.exe
2010-12-27 23:44 . 2007-09-18 22:31 156936 ----a-w- c:\program files\Mozilla Firefox\32bit\libexpat.dll
2010-12-27 23:44 . 2007-09-18 22:31 1332112 ----a-w- c:\program files\Mozilla Firefox\32bit\TSRemove.exe
2010-12-27 23:44 . 2007-09-18 22:31 124168 ----a-w- c:\program files\Mozilla Firefox\32bit\TmDbg32.dll
2010-12-27 23:28 . 2010-12-27 23:28 -------- d-----w- C:\found.001
2010-12-26 03:31 . 2010-12-26 03:31 -------- d-----w- C:\found.000
2010-12-24 19:33 . 2010-12-24 19:33 -------- d-----w- c:\program files\MEDA MP3 Splitter
2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\EAC
2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\AccurateRip
2010-12-24 05:01 . 2010-12-24 05:01 -------- d-----w- c:\program files\Exact Audio Copy
2010-12-23 01:06 . 2010-12-23 01:06 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\NCH Swift Sound
2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\programdata\NCH Swift Sound
2010-12-23 01:05 . 2010-12-23 01:05 -------- d-----w- c:\program files\NCH Software
2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-12-19 17:41 . 2010-12-31 15:58 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-12-16 19:46 . 2010-12-16 19:46 -------- d-----w- c:\users\Charlie Reece\AppData\Roaming\Absolute Software
2010-12-16 00:12 . 2010-10-12 15:53 33280 ----a-w- c:\program files\Windows Mail\wabfind.dll
2010-12-16 00:12 . 2010-10-12 13:41 66048 ----a-w- c:\program files\Windows Mail\wabmig.exe
2010-12-16 00:12 . 2010-10-12 13:41 515584 ----a-w- c:\program files\Windows Mail\wab.exe
2010-12-16 00:12 . 2010-10-18 13:31 2038272 ----a-w- c:\windows\system32\win32k.sys
2010-12-16 00:12 . 2010-11-04 18:56 345600 ----a-w- c:\windows\system32\wmicmiplugin.dll
2010-12-16 00:12 . 2010-11-04 18:55 352768 ----a-w- c:\windows\system32\taskschd.dll
2010-12-16 00:12 . 2010-11-04 18:55 270336 ----a-w- c:\windows\system32\taskcomp.dll
2010-12-16 00:12 . 2010-11-04 18:55 601600 ----a-w- c:\windows\system32\schedsvc.dll
2010-12-16 00:12 . 2010-11-04 16:34 171520 ----a-w- c:\windows\system32\taskeng.exe
2010-12-16 00:12 . 2010-10-18 13:37 81920 ----a-w- c:\windows\system32\consent.exe
2010-12-14 00:05 . 2010-12-14 00:05 159744 ----a-w- c:\program files\Mozilla Firefox\plugins\npqtplugin7.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-01-02 15:04 . 2009-08-23 03:39 17408 ----a-w- c:\windows\system32\rpcnetp.exe
2011-01-02 03:06 . 2009-08-23 03:42 17408 ----a-w- c:\windows\system32\rpcnetp.dll
2011-01-01 21:06 . 2009-08-23 01:59 57752 ----a-w- c:\windows\system32\rpcnet.dll
2010-11-29 22:38 . 2010-11-29 22:38 94208 ----a-w- c:\windows\system32\QuickTimeVR.qtx
2010-11-29 22:38 . 2010-11-29 22:38 69632 ----a-w- c:\windows\system32\QuickTime.qts
2010-11-12 18:46 . 2010-11-12 18:46 4280320 ----a-w- c:\windows\system32\GPhotos.scr
2010-10-31 02:50 . 2010-10-31 02:50 29184 ----a-w- c:\windows\system32\CtLoJack.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19 94208 ----a-w- c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlay]
@="{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}"
[HKEY_CLASSES_ROOT\CLSID\{F2F31467-B1AC-4df0-AE79-FD5FA085E22B}]
2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\UEAFOverlayOpen]
@="{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}"
[HKEY_CLASSES_ROOT\CLSID\{A3E208F7-0E3A-4182-A7A6-B169D5D691AA}]
2007-04-17 05:13 721408 ----a-w- c:\program files\Fingerprint Reader Suite\farchns.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"GrpConv"="grpconv -o" [X]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"DisableCAD"= 1 (0x1)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
2007-04-17 05:04 86528 ----a-w- c:\windows\System32\psqlpwd.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MSIServer]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dellsupportcenter]
2009-05-21 14:55 206064 ----a-w- c:\program files\Dell Support Center\bin\sprtcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVHotkey]
2010-07-09 20:20 261736 ----a-w- c:\windows\System32\nvhotkey.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OEM04Mon.exe]
2007-12-03 06:05 36864 ----a-w- c:\windows\OEM04Mon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SynTPEnh]
2007-05-10 07:00 857648 ----a-w- c:\program files\Synaptics\SynTP\SynTPEnh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UfSeAgnt.exe]
2010-12-31 15:57 1398024 ----a-w- c:\program files\Trend Micro\Internet Security\UfSeAgnt.exe

R2 AbsoluteNotifier;Absolute Notifier;c:\program files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe [2010-10-08 10408]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 rpcnetp;rpcnetp;c:\windows\System32\rpcnetp.exe [2011-01-02 17408]
R2 tmevtmgr;tmevtmgr;c:\windows\system32\DRIVERS\tmevtmgr.sys [2010-07-19 51792]
R2 tmpreflt;tmpreflt;c:\windows\system32\DRIVERS\tmpreflt.sys [2010-07-30 36432]
R2 tmwfp;Trend Micro WFP Callout Driver;c:\windows\system32\DRIVERS\tmwfp.sys [2010-12-31 235024]
R3 DAUpdaterSvc;Dragon Age: Origins - Content Updater;c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe [x]
R3 OEM04Vfx;Creative Camera OEM004 Video VFX Driver;c:\windows\system32\DRIVERS\OEM04Vfx.sys [2007-12-03 7424]
R3 OEM04Vid;Creative Camera OEM004 Driver;c:\windows\system32\DRIVERS\OEM04Vid.sys [2007-12-03 234720]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 AESTFilters;Andrea ST Filters Service;c:\windows\system32\aestsrv.exe [2007-08-29 73728]
R4 TmPfw;Trend Micro Personal Firewall;c:\progra~1\TRENDM~1\INTERN~2\TmPfw.exe [2010-12-31 488768]
R4 tmproxy;Trend Micro Proxy Service;c:\program files\Trend Micro\Internet Security\TmProxy.exe [2010-12-31 648456]
S1 tmlwf;Trend Micro NDIS 6.0 Filter Driver;c:\windows\system32\DRIVERS\tmlwf.sys [2010-12-31 142352]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\b57nd60x.sys [2007-05-24 179712]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-05-29 4233728]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder

2010-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000Core.job
- c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]

2011-01-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000UA.job
- c:\users\Charlie Reece\AppData\Local\Google\Update\GoogleUpdate.exe [2010-08-26 01:39]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
uInternet Settings,ProxyOverride = *.local
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Send image to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Send page to &Bluetooth Device... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
FF - ProfilePath - c:\users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Stylish: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8} - %profile%\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
FF - Ext: URL Lister: urllister@binnyva.com - %profile%\extensions\urllister@binnyva.com
FF - Ext: Firefox Sync: {340c2bbc-ce74-4362-90b5-7c26312808ef} - %profile%\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
.
- - - - ORPHANS REMOVED - - - -

HKLM-RunOnce-<NO NAME> - (no file)



**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(2008)
c:\users\Charlie Reece\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\program files\Fingerprint Reader Suite\farchns.dll
c:\program files\Fingerprint Reader Suite\infra.dll
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\helppane.exe
c:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2011-01-02 10:26:03 - machine was rebooted
ComboFix-quarantined-files.txt 2011-01-02 15:25
ComboFix2.txt 2011-01-02 03:13

Pre-Run: 23,679,946,752 bytes free
Post-Run: 23,626,706,944 bytes free

- - End Of File - - D7FC1FA797CD675F7BA23B1BE4B4450A
 
See, if you can start your computer in normal mode and operate it without any problems.

Download OTL to your Desktop.

  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • Under the Custom Scan box paste this in:


netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\Fonts\*.com
%systemroot%\Fonts\*.dll
%systemroot%\Fonts\*.ini
%systemroot%\Fonts\*.ini2
%systemroot%\Fonts\*.exe
%systemroot%\system32\spool\prtprocs\w32x86\*.*
%systemroot%\REPAIR\*.bak1
%systemroot%\REPAIR\*.ini
%systemroot%\system32\*.jpg
%systemroot%\*.jpg
%systemroot%\*.png
%systemroot%\*.scr
%systemroot%\*._sy
%APPDATA%\Adobe\Update\*.*
%ALLUSERSPROFILE%\Favorites\*.*
%APPDATA%\Microsoft\*.*
%PROGRAMFILES%\*.*
%APPDATA%\Update\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
%PROGRAMFILES%\bak. /s
%systemroot%\system32\bak. /s
%ALLUSERSPROFILE%\Start Menu\*.lnk /x
%systemroot%\system32\config\systemprofile\*.dat /x
%systemroot%\*.config
%systemroot%\system32\*.db
%APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
%USERPROFILE%\Desktop\*.exe
%PROGRAMFILES%\Common Files\*.*
%systemroot%\*.src
%systemroot%\install\*.*
%systemroot%\system32\DLL\*.*
%systemroot%\system32\HelpFiles\*.*
%systemroot%\system32\rundll\*.*
%systemroot%\winn32\*.*
%systemroot%\Java\*.*
%systemroot%\system32\test\*.*
%systemroot%\system32\Rundll32\*.*
%systemroot%\AppPatch\Custom\*.*
%APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
%PROGRAMFILES%\PC-Doctor\Downloads\*.*
%PROGRAMFILES%\Internet Explorer\*.tmp
%PROGRAMFILES%\Internet Explorer\*.dat
%USERPROFILE%\My Documents\*.exe
%USERPROFILE%\*.exe
%systemroot%\ADDINS\*.*
%systemroot%\assembly\*.bak2
%systemroot%\Config\*.*
%systemroot%\REPAIR\*.bak2
%systemroot%\SECURITY\Database\*.sdb /x
%systemroot%\SYSTEM\*.bak2
%systemroot%\Web\*.bak2
%systemroot%\Driver Cache\*.*
%PROGRAMFILES%\Mozilla Firefox\0*.exe
%ProgramFiles%\Microsoft Common\*.*
%ProgramFiles%\TinyProxy.
%USERPROFILE%\Favorites\*.url /x
%systemroot%\system32\*.bk
%systemroot%\*.te
%systemroot%\system32\system32\*.*
%ALLUSERSPROFILE%\*.dat /x
%systemroot%\system32\drivers\*.rmv
dir /b "%systemroot%\system32\*.exe" | find /i " " /c
dir /b "%systemroot%\*.exe" | find /i " " /c
%PROGRAMFILES%\Microsoft\*.*
%systemroot%\System32\Wbem\proquota.exe
%PROGRAMFILES%\Mozilla Firefox\*.dat
%USERPROFILE%\Cookies\*.txt /x
%SystemRoot%\system32\fonts\*.*
%systemroot%\system32\winlog\*.*
%systemroot%\system32\Language\*.*
%systemroot%\system32\Settings\*.*
%systemroot%\system32\*.quo
%SYSTEMROOT%\AppPatch\*.exe
%SYSTEMROOT%\inf\*.exe
%SYSTEMROOT%\Installer\*.exe
%systemroot%\system32\config\*.bak2
%systemroot%\system32\Computers\*.*
%SystemRoot%\system32\Sound\*.*
%SystemRoot%\system32\SpecialImg\*.*
%SystemRoot%\system32\code\*.*
%SystemRoot%\system32\draft\*.*
%SystemRoot%\system32\MSSSys\*.*
%ProgramFiles%\Javascript\*.*
%systemroot%\pchealth\helpctr\System\*.exe /s
%systemroot%\Web\*.exe
%systemroot%\system32\msn\*.*
%systemroot%\system32\*.tro
%AppData%\Microsoft\Installer\msupdates\*.*
%ProgramFiles%\Messenger\*.*
%systemroot%\system32\systhem32\*.*
%systemroot%\system\*.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
/md5start
/md5stop


  • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
 
Logs will be posted next

But I just wanted to let you know that I'm posting these messages from normal mode and I've had no freezing so far. Fingers crossed...
 
OTL.txt, part 1

OTL logfile created on: 1/2/2011 2:33:50 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Charlie Reece\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 81.00% Memory free
7.00 Gb Paging File | 6.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.73 Gb Total Space | 18.56 Gb Free Space | 10.68% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 2.64 Gb Free Space | 26.36% Space Free | Partition Type: NTFS

Computer Name: THENEWERHOTTNES | User Name: Charlie Reece | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
PRC - [2011/01/02 11:15:14 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe
PRC - [2010/10/08 09:01:14 | 000,010,408 | ---- | M] (Microsoft) -- C:\Program Files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe
PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2007/04/17 00:05:52 | 000,021,504 | ---- | M] (UPEK Inc.) -- C:\Program Files\Fingerprint Reader Suite\upeksvr.exe


========== Modules (SafeList) ==========

MOD - [2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
MOD - [2010/08/31 10:43:52 | 001,686,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [On_Demand | Stopped] -- c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)
SRV - [2011/01/02 11:15:14 | 000,057,752 | ---- | M] (Absolute Software Corp.) [Auto | Running] -- C:\Windows\System32\rpcnet.exe -- (rpcnet) Remote Procedure Call (RPC)
SRV - [2010/12/31 10:57:18 | 000,703,008 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security\SfCtlCom.exe -- (SfCtlCom)
SRV - [2010/12/31 10:57:18 | 000,648,456 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmProxy.exe -- (tmproxy)
SRV - [2010/12/31 10:57:18 | 000,488,768 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security\TmPfw.exe -- (TmPfw)
SRV - [2010/12/31 10:57:18 | 000,337,160 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\BM\TMBMSRV.exe -- (TMBMServer)
SRV - [2010/10/16 00:40:40 | 000,037,664 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2010/10/08 09:01:14 | 000,010,408 | ---- | M] (Microsoft) [Auto | Running] -- C:\Program Files\Absolute Software\Absolute Notifier\AbsoluteNotifierService.exe -- (AbsoluteNotifier)
SRV - [2010/05/14 11:59:44 | 000,455,944 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe -- (FlipShare Service)
SRV - [2010/03/18 12:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)
SRV - [2010/03/18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009/09/24 20:27:04 | 000,793,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)
SRV - [2009/07/16 17:04:16 | 000,316,664 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2009/05/21 14:28:38 | 000,874,768 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) Intel(R)
SRV - [2009/05/21 13:04:14 | 000,473,360 | ---- | M] (Intel(R) Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) Intel(R)
SRV - [2008/08/13 17:32:40 | 000,201,968 | ---- | M] (SupportSoft, Inc.) [Disabled | Stopped] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
SRV - [2008/01/31 18:16:10 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [Disabled | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/01/19 02:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/09/13 13:45:38 | 000,102,400 | ---- | M] (IDT, Inc.) [Disabled | Stopped] -- C:\Windows\System32\stacsv.exe -- (STacSV)
SRV - [2007/09/11 01:45:04 | 000,124,832 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\Adobe\Photoshop Elements 6.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor6.0)
SRV - [2007/08/29 16:25:16 | 000,073,728 | ---- | M] (Andrea Electronics Corporation) [Disabled | Stopped] -- C:\Windows\System32\AEstSrv.exe -- (AESTFilters)
SRV - [2007/08/27 04:21:36 | 001,471,840 | ---- | M] (Trend Micro Inc.) [Disabled | Stopped] -- C:\Program Files\Trend Micro\Internet Security 14\PcCtlCom.exe -- (PcCtlCom)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2010/12/31 10:57:26 | 000,235,024 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmwfp.sys -- (tmwfp)
DRV - [2010/12/31 10:57:26 | 000,142,352 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tmlwf.sys -- (tmlwf)
DRV - [2010/12/31 10:57:26 | 000,066,320 | ---- | M] (Trend Micro Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\tmtdi.sys -- (tmtdi)
DRV - [2010/07/30 17:29:10 | 000,249,424 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmxpflt.sys -- (tmxpflt)
DRV - [2010/07/30 17:29:00 | 000,036,432 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmpreflt.sys -- (tmpreflt)
DRV - [2010/07/30 17:06:08 | 001,331,512 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\vsapint.sys -- (vsapint)
DRV - [2010/07/19 18:03:10 | 000,059,472 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmactmon.sys -- (tmactmon)
DRV - [2010/07/19 18:03:00 | 000,051,792 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmevtmgr.sys -- (tmevtmgr)
DRV - [2010/07/19 18:02:54 | 000,163,408 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2010/07/09 17:37:00 | 011,008,040 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/05/28 22:41:28 | 004,233,728 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\NETw5v32.sys -- (NETw5v32) Intel(R)
DRV - [2009/05/22 18:08:32 | 000,029,696 | ---- | M] (Elaborate Bytes AG) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VClone.sys -- (VClone)
DRV - [2008/02/01 01:43:00 | 000,020,152 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008/02/01 01:43:00 | 000,019,128 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2008/02/01 01:43:00 | 000,017,592 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2008/01/19 00:53:39 | 000,007,680 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\umpass.sys -- (UMPass)
DRV - [2007/12/03 01:05:32 | 000,234,720 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM04Vid.sys -- (OEM04Vid)
DRV - [2007/12/03 01:05:28 | 000,007,424 | ---- | M] (EyePower Games Pte. Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\OEM04Vfx.sys -- (OEM04Vfx)
DRV - [2007/09/13 13:46:06 | 000,330,240 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\stwrt.sys -- (STHDA)
DRV - [2007/08/13 04:44:26 | 002,226,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw4v32.sys -- (NETw4v32) Intel(R)
DRV - [2007/05/24 07:35:02 | 000,179,712 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)
DRV - [2007/05/10 02:00:06 | 000,182,456 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP)
DRV - [2007/04/26 00:23:58 | 000,277,784 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastor.sys -- (iaStor)
DRV - [2007/04/16 23:44:34 | 000,046,992 | ---- | M] (UPEK Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tcusb.sys -- (TcUsb)
DRV - [2007/02/28 06:25:46 | 000,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rixdptsk.sys -- (rismxdp)
DRV - [2007/02/28 06:25:44 | 000,043,520 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimsptsk.sys -- (rimsptsk)
DRV - [2007/02/28 06:25:44 | 000,032,256 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\rimmptsk.sys -- (rimmptsk)
DRV - [2006/11/06 20:37:16 | 000,078,128 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio)
DRV - [2006/11/06 18:13:52 | 000,016,560 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid)
DRV - [2006/11/06 18:13:50 | 000,080,176 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt)
DRV - [2006/11/02 04:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006/11/02 04:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006/11/02 04:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006/11/02 04:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006/11/02 04:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006/11/02 04:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006/11/02 04:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006/11/02 04:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006/11/02 04:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006/11/02 04:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006/11/02 04:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006/11/02 04:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006/11/02 04:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006/11/02 04:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006/11/02 04:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006/11/02 04:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006/11/02 04:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006/11/02 04:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006/11/02 04:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006/11/02 04:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006/11/02 04:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006/11/02 04:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006/11/02 04:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006/11/02 04:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006/11/02 04:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006/11/02 04:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006/11/02 04:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006/11/02 04:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006/11/02 04:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006/11/02 03:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006/11/02 03:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006/11/02 03:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006/11/02 03:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006/11/02 03:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006/11/02 03:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006/11/02 02:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006/11/02 02:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006/11/02 02:30:55 | 000,200,704 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2006/11/02 02:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=2080201
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========


FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/12/13 19:05:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/12/13 19:05:56 | 000,000,000 | ---D | M]

[2010/06/23 09:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Extensions
[2010/06/23 09:06:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Extensions\uploadr@flickr.com
[2011/01/01 21:22:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions
[2010/04/28 12:47:34 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/01 14:39:54 | 000,000,000 | ---D | M] (Firefox Sync) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\{340c2bbc-ce74-4362-90b5-7c26312808ef}
[2010/08/18 20:27:01 | 000,000,000 | ---D | M] (Stylish) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010/09/28 22:11:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\nasanightlaunch@example.com
[2010/04/18 11:38:04 | 000,000,000 | ---D | M] (URL Lister) -- C:\Users\Charlie Reece\AppData\Roaming\Mozilla\Firefox\Profiles\wt74y5dz.default\extensions\urllister@binnyva.com
[2011/01/01 21:22:47 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/18 22:11:50 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/05/18 22:11:43 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/01/02 10:21:35 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll (Dell Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableCAD = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Send image to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Send page to &Bluetooth Device... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (vrlogon.dll) - C:\Windows\System32\vrlogon.dll (UPEK Inc.)
O20 - Winlogon\Notify\psfus: DllName - C:\Windows\system32\psqlpwd.dll - C:\Windows\System32\psqlpwd.dll (UPEK Inc.)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img8.jpg
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - File not found
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.3IV2 - C:\Windows\System32\3ivxVfWCodec.dll (3ivx Technologies Pty. Ltd.)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
OTL.txt, part 2

========== Files/Folders - Created Within 30 Days ==========

[2011/01/02 14:30:30 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
[2011/01/02 10:26:05 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2011/01/02 10:26:05 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Local\temp
[2011/01/02 10:21:40 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011/01/02 10:09:35 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2011/01/01 21:54:58 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2011/01/01 21:54:58 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2011/01/01 21:54:58 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2011/01/01 21:54:53 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2011/01/01 21:54:25 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/01/01 18:53:46 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/01/01 16:44:50 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\Malwarebytes
[2011/01/01 16:44:46 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011/01/01 16:44:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/01/01 16:44:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011/01/01 16:44:43 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011/01/01 16:44:43 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010/12/31 11:07:39 | 000,000,000 | ---D | C] -- C:\Windows\System32\log
[2010/12/31 11:06:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Trend Micro Internet Security
[2010/12/31 10:57:26 | 001,331,512 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\vsapint.sys
[2010/12/31 10:57:26 | 000,249,424 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmxpflt.sys
[2010/12/31 10:57:26 | 000,235,024 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmwfp.sys
[2010/12/31 10:57:26 | 000,163,408 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmcomm.sys
[2010/12/31 10:57:26 | 000,142,352 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmlwf.sys
[2010/12/31 10:57:26 | 000,066,320 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmtdi.sys
[2010/12/31 10:57:26 | 000,059,472 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmactmon.sys
[2010/12/31 10:57:26 | 000,051,792 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmevtmgr.sys
[2010/12/31 10:57:26 | 000,036,432 | ---- | C] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmpreflt.sys
[2010/12/31 10:32:52 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2010/12/29 20:59:04 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2010/12/27 18:28:05 | 000,000,000 | ---D | C] -- C:\found.001
[2010/12/25 22:31:47 | 000,000,000 | ---D | C] -- C:\found.000
[2010/12/25 13:11:04 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\Audio Tools
[2010/12/24 14:33:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\MEDA MP3 Splitter
[2010/12/24 14:33:26 | 000,000,000 | ---D | C] -- C:\Program Files\MEDA MP3 Splitter
[2010/12/24 11:29:32 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\peach2010
[2010/12/24 00:01:51 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\EAC
[2010/12/24 00:01:51 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\AccurateRip
[2010/12/24 00:01:49 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Exact Audio Copy
[2010/12/24 00:01:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Exact Audio Copy
[2010/12/24 00:01:48 | 000,000,000 | ---D | C] -- C:\Program Files\Exact Audio Copy
[2010/12/22 20:06:29 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\NCH Swift Sound
[2010/12/22 20:05:33 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound
[2010/12/22 20:05:18 | 000,000,000 | ---D | C] -- C:\Program Files\NCH Software
[2010/12/22 15:26:26 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\lisapics
[2010/12/19 12:41:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010/12/19 12:41:21 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/12/16 16:31:29 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\experiment
[2010/12/16 16:27:15 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\lauraframe
[2010/12/16 14:46:52 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\AppData\Roaming\Absolute Software
[2010/12/13 19:05:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2010/12/11 13:33:08 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\pica2
[2010/12/11 00:04:44 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\backgs
[2010/12/09 23:37:14 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Documents\PicabooX
[2010/12/09 23:32:00 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\elle's pics - Second Wave
[2010/12/09 23:29:43 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\elle's pics - first wave
[2010/12/09 23:09:34 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\dec 09
[2010/12/09 23:09:25 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\2009 misc elle
[2010/12/09 23:08:11 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\iPhone pics thru nov 15 08
[2010/12/09 23:07:00 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\elle's pics -- third wave
[2010/12/09 16:52:21 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\ImageFiles
[2010/12/09 11:11:14 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010/12/09 10:38:35 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\picaboo
[2010/12/04 12:53:28 | 000,000,000 | ---D | C] -- C:\Users\Charlie Reece\Desktop\export

========== Files - Modified Within 30 Days ==========

[2011/01/02 14:32:45 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.exe
[2011/01/02 14:32:35 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.dll
[2011/01/02 14:32:35 | 000,017,408 | ---- | M] () -- C:\Windows\System32\rpcnetp.dll
[2011/01/02 14:32:33 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011/01/02 14:32:32 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011/01/02 14:32:29 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011/01/02 14:32:27 | 3756,044,288 | -HS- | M] () -- C:\hiberfil.sys
[2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe
[2011/01/02 13:27:39 | 000,000,680 | ---- | M] () -- C:\Users\Charlie Reece\AppData\Local\d3d9caps.dat
[2011/01/02 12:50:39 | 000,791,656 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011/01/02 12:50:39 | 000,166,776 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011/01/02 11:15:14 | 000,057,752 | ---- | M] (Absolute Software Corp.) -- C:\Windows\System32\rpcnet.exe
[2011/01/02 10:28:13 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2011/01/02 10:21:35 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2011/01/01 22:15:05 | 000,002,305 | ---- | M] () -- C:\Users\Charlie Reece\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk
[2011/01/01 21:50:27 | 004,012,260 | R--- | M] () -- C:\Users\Charlie Reece\Desktop\ComboFix.exe
[2011/01/01 16:44:47 | 000,000,908 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/01/01 16:07:18 | 000,037,685 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011/01/01 16:07:18 | 000,037,685 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011/01/01 14:49:09 | 000,000,940 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000UA.job
[2010/12/31 11:06:15 | 000,000,941 | ---- | M] () -- C:\Users\Public\Desktop\Trend Micro Internet Security.lnk
[2010/12/31 10:57:26 | 000,235,024 | ---- | M] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmwfp.sys
[2010/12/31 10:57:26 | 000,142,352 | ---- | M] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmlwf.sys
[2010/12/31 10:57:26 | 000,066,320 | ---- | M] (Trend Micro Inc.) -- C:\Windows\System32\drivers\tmtdi.sys
[2010/12/31 10:03:13 | 000,520,288 | ---- | M] () -- C:\Users\Charlie Reece\AVGInstLog.cab
[2010/12/29 20:04:50 | 000,000,888 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1929193862-4266423895-4264529279-1000Core.job
[2010/12/27 17:45:19 | 000,284,598 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\Fullscreen capture 12272010 54459 PM.jpg
[2010/12/25 14:07:03 | 000,000,367 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\Downloads - Shortcut.lnk
[2010/12/24 12:32:51 | 000,110,592 | ---- | M] () -- C:\Users\Charlie Reece\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/12/20 18:09:00 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/12/20 18:08:40 | 000,020,952 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/12/16 14:43:58 | 000,300,256 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010/12/09 11:10:17 | 000,109,456 | ---- | M] () -- C:\Users\Charlie Reece\Documents\cc_20101209_111007.reg
[2010/12/08 00:01:34 | 000,049,035 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\statlibrary.dnd4

========== Files Created - No Company Name ==========

[2011/01/02 14:32:27 | 3756,044,288 | -HS- | C] () -- C:\hiberfil.sys
[2011/01/01 21:54:58 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
[2011/01/01 21:54:58 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2011/01/01 21:54:58 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
[2011/01/01 21:54:58 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2011/01/01 21:54:58 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2011/01/01 21:50:22 | 004,012,260 | R--- | C] () -- C:\Users\Charlie Reece\Desktop\ComboFix.exe
[2011/01/01 16:44:47 | 000,000,908 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2010/12/31 11:06:15 | 000,000,941 | ---- | C] () -- C:\Users\Public\Desktop\Trend Micro Internet Security.lnk
[2010/12/31 10:03:52 | 000,946,434 | ---- | C] () -- C:\Users\Charlie Reece\msi-20101231-150009.log
[2010/12/31 10:03:13 | 000,520,288 | ---- | C] () -- C:\Users\Charlie Reece\AVGInstLog.cab
[2010/12/27 17:45:19 | 000,284,598 | ---- | C] () -- C:\Users\Charlie Reece\Desktop\Fullscreen capture 12272010 54459 PM.jpg
[2010/12/25 15:09:20 | 000,000,680 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Local\d3d9caps.dat
[2010/12/25 14:07:03 | 000,000,367 | ---- | C] () -- C:\Users\Charlie Reece\Desktop\Downloads - Shortcut.lnk
[2010/12/09 11:10:10 | 000,109,456 | ---- | C] () -- C:\Users\Charlie Reece\Documents\cc_20101209_111007.reg
[2010/11/28 12:11:56 | 000,023,888 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Roaming\UserTile.png
[2010/10/08 09:01:06 | 000,000,003 | ---- | C] () -- C:\ProgramData\AbsoluteNotifier.txt
[2009/10/24 04:26:21 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/09/21 21:10:48 | 000,000,391 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Roaming\TweetDeckFast_state.xml
[2009/09/06 20:05:18 | 000,000,758 | ---- | C] () -- C:\Windows\GMUD32.INI
[2009/09/05 21:28:53 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009/09/01 15:43:02 | 000,087,552 | ---- | C] () -- C:\Windows\System32\cpwmon2k.dll
[2009/08/23 20:44:39 | 000,037,685 | ---- | C] () -- C:\ProgramData\nvModes.001
[2009/08/23 20:42:18 | 000,037,685 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2009/08/22 22:42:52 | 000,017,408 | ---- | C] () -- C:\Windows\System32\rpcnetp.dll
[2009/08/22 21:05:28 | 000,110,592 | ---- | C] () -- C:\Users\Charlie Reece\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
[2008/10/22 04:29:06 | 000,173,550 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2008/10/07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008/10/07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008/10/07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008/02/19 01:33:34 | 000,446,352 | ---- | C] () -- C:\Windows\System32\OpenQuicktimeLib.dll
[2008/02/01 01:43:25 | 000,016,480 | ---- | C] () -- C:\Windows\System32\rixdicon.dll
[2008/02/01 01:43:16 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
[2008/01/31 18:14:14 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2006/11/07 14:25:58 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/11/03 18:25:56 | 000,389,120 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 05:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006/09/17 00:36:50 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/09/17 00:36:50 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2004/07/10 17:55:38 | 000,252,416 | ---- | C] () -- C:\Windows\System32\wsiShared.dll
[2001/11/14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll

========== LOP Check ==========

[2010/11/10 21:51:16 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\.minecraft
[2010/12/16 14:46:52 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Absolute Software
[2010/08/03 22:25:52 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\AdventureTools
[2009/10/27 20:28:32 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Amazon
[2010/11/26 18:05:49 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1
[2010/12/09 21:25:38 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Dropbox
[2010/12/24 00:01:54 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\EAC
[2010/06/23 09:06:37 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Flickr
[2010/03/18 21:32:07 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\gtk-2.0
[2010/03/18 21:32:59 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\inCombat.1F12F0C296C29611B37F6BD10730D1F4522B6FB9.1
[2010/12/22 20:06:29 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\NCH Swift Sound
[2009/09/04 22:03:22 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\OpenOffice.org
[2010/11/28 12:11:56 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\PeerNetworking
[2009/11/23 19:57:46 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Picaboo
[2010/01/27 20:05:08 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\runic games
[2010/03/11 12:47:18 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\Shados-Generator.1F12F0C296C29611B37F6BD10730D1F4522B6FB9.1
[2009/11/08 11:59:33 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\SystemRequirementsLab
[2009/08/24 20:41:07 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
[2010/12/09 21:23:28 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\uTorrent
[2011/01/01 16:22:50 | 000,000,000 | ---D | M] -- C:\Users\Charlie Reece\AppData\Roaming\wsInspector
[2011/01/02 10:28:14 | 000,032,548 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2009/11/23 12:30:08 | 000,000,000 | ---- | M] () -- C:\AdobeDebug.txt
[2006/09/18 16:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2011/01/02 10:26:03 | 000,015,109 | ---- | M] () -- C:\ComboFix.txt
[2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2008/02/01 01:43:38 | 000,005,007 | RH-- | M] () -- C:\dell.sdr
[2008/04/11 10:07:18 | 000,003,820 | ---- | M] () -- C:\eula.1028.txt
[2008/04/11 10:07:18 | 000,015,428 | ---- | M] () -- C:\eula.1031.txt
[2008/04/11 10:07:18 | 000,010,058 | ---- | M] () -- C:\eula.1033.txt
[2008/04/11 10:07:18 | 000,012,246 | ---- | M] () -- C:\eula.1036.txt
[2008/04/11 10:07:18 | 000,013,912 | ---- | M] () -- C:\eula.1040.txt
[2008/04/11 10:07:18 | 000,005,868 | ---- | M] () -- C:\eula.1041.txt
[2008/04/11 10:07:18 | 000,005,970 | ---- | M] () -- C:\eula.1042.txt
[2008/04/11 10:07:18 | 000,010,134 | ---- | M] () -- C:\eula.1049.txt
[2008/04/11 10:07:18 | 000,003,814 | ---- | M] () -- C:\eula.2052.txt
[2008/04/11 10:07:18 | 000,012,936 | ---- | M] () -- C:\eula.3082.txt
[2008/04/11 10:07:18 | 000,001,110 | ---- | M] () -- C:\globdata.ini
[2011/01/02 14:32:27 | 3756,044,288 | -HS- | M] () -- C:\hiberfil.sys
[2008/04/11 10:07:18 | 000,000,843 | ---- | M] () -- C:\install.ini
[2008/04/11 08:03:48 | 000,076,304 | ---- | M] (Microsoft Corporation) -- C:\install.res.1028.dll
[2008/04/11 08:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.1031.dll
[2008/04/11 08:03:48 | 000,091,152 | ---- | M] (Microsoft Corporation) -- C:\install.res.1033.dll
[2008/04/11 08:03:48 | 000,097,296 | ---- | M] (Microsoft Corporation) -- C:\install.res.1036.dll
[2008/04/11 08:03:48 | 000,095,248 | ---- | M] (Microsoft Corporation) -- C:\install.res.1040.dll
[2008/04/11 08:03:48 | 000,081,424 | ---- | M] (Microsoft Corporation) -- C:\install.res.1041.dll
[2008/04/11 08:03:48 | 000,079,888 | ---- | M] (Microsoft Corporation) -- C:\install.res.1042.dll
[2008/04/11 10:09:24 | 000,093,200 | ---- | M] (Microsoft Corporation) -- C:\install.res.1049.dll
[2008/04/11 08:03:48 | 000,075,792 | ---- | M] (Microsoft Corporation) -- C:\install.res.2052.dll
[2008/04/11 08:03:48 | 000,096,272 | ---- | M] (Microsoft Corporation) -- C:\install.res.3082.dll
[2009/12/27 22:31:28 | 000,001,015 | R--- | M] () -- C:\logFile.xsl
[2011/01/02 14:32:26 | 3145,728,000 | -HS- | M] () -- C:\pagefile.sys
[2008/04/11 10:07:18 | 000,005,686 | ---- | M] () -- C:\vcredist.bmp
[2008/04/11 10:09:38 | 003,797,292 | ---- | M] () -- C:\VC_RED.cab
[2008/04/11 10:11:40 | 000,233,472 | ---- | M] () -- C:\VC_RED.MSI

< %systemroot%\Fonts\*.com >
[2006/11/02 07:37:12 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/02 07:37:12 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/02 07:37:12 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2009/11/11 08:30:48 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/18 16:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/02 07:35:48 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\spool\prtprocs\w32x86\jnwppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2009/10/23 08:03:22 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/09/03 21:53:14 | 000,000,221 | -HS- | M] () -- C:\Users\Charlie Reece\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >
[2011/01/01 21:50:27 | 004,012,260 | R--- | M] () -- C:\Users\Charlie Reece\Desktop\ComboFix.exe
[2010/08/12 07:07:17 | 000,464,896 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\DnD4e Combat Manager.exe
[2009/06/08 23:04:22 | 000,023,552 | ---- | M] () -- C:\Users\Charlie Reece\Desktop\FrameworkDetect.exe
[2011/01/02 14:30:33 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Charlie Reece\Desktop\OTL.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/08/22 20:47:04 | 000,000,402 | -HS- | M] () -- C:\Users\Charlie Reece\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2010/10/08 09:01:06 | 000,000,003 | ---- | M] () -- C:\ProgramData\AbsoluteNotifier.txt
[2011/01/01 16:07:18 | 000,037,685 | ---- | M] () -- C:\ProgramData\nvModes.001

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >
 
And here's Extras.txt

OTL Extras logfile created on: 1/2/2011 2:33:50 PM - Run 1
OTL by OldTimer - Version 3.2.20.1 Folder = C:\Users\Charlie Reece\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 81.00% Memory free
7.00 Gb Paging File | 6.00 Gb Available in Paging File | 92.00% Paging File free
Paging file location(s): [Binary data over 100 bytes]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 173.73 Gb Total Space | 18.56 Gb Free Space | 10.68% Space Free | Partition Type: NTFS
Drive D: | 10.00 Gb Total Space | 2.64 Gb Free Space | 26.36% Space Free | Partition Type: NTFS

Computer Name: THENEWERHOTTNES | User Name: Charlie Reece | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{119C2175-0E9B-4D8A-9F19-B5AAAB407003}" = rport=139 | protocol=6 | dir=out | app=system |
"{18DC3D63-42DB-4C01-8ACF-050C5EF71713}" = lport=138 | protocol=17 | dir=in | app=system |
"{1CE5D5B4-257A-4944-947C-BB79A2ADD165}" = lport=137 | protocol=17 | dir=in | app=system |
"{20BB83C3-E676-4D71-9867-7FFF99EE65FD}" = rport=137 | protocol=17 | dir=out | app=system |
"{32548C29-223B-490A-BA8A-9C00F05F8946}" = rport=445 | protocol=6 | dir=out | app=system |
"{4AC0E85E-05A5-4A3B-958F-0027DAF9D9AA}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{5BD0FCA1-0B78-4F67-AB3C-2914BE36C707}" = lport=139 | protocol=6 | dir=in | app=system |
"{83FEA092-94A6-4525-99FA-6BBBCFD3CCB7}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{8CBBE95C-66A5-4702-9981-70E227CF9E36}" = rport=138 | protocol=17 | dir=out | app=system |
"{F2675450-5B4D-40AE-85D8-B3EFA4D56344}" = lport=445 | protocol=6 | dir=in | app=system |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{5CAD913B-81C9-4AC1-80B6-DD7127EB6B31}" = protocol=6 | dir=in | app=c:\users\charlie reece\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{6DE04E62-0E80-4C8D-8345-97F6FB088195}" = protocol=17 | dir=in | app=c:\users\charlie reece\appdata\local\google\google talk plugin\googletalkplugin.exe |
"{A314D961-FDB8-4412-ADBE-6C28B5D72E85}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A4F23B6A-6857-4EE5-8AEA-747FBAC1D23F}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{BC49BF85-A7D5-4C1B-A765-A4D3C05467F3}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{E80939FA-AEF8-4DAD-8DB6-D89C758BB91E}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0F26618D-6F7B-4216-A7C8-3AF00EBB3AD9}_is1" = FolderSize.Win32 1.0.7.0
"{0F756CD9-4A1E-409B-B101-601DDC4C03AA}" = QualxServ Service Agreement
"{0F95AA42-0FF6-4D48-9CA1-64C8D0777500}" = QuickSet
"{16C426FC-B3A4-41B8-9BED-BDAB6836F54D}" = OSU-gt RC8
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1D5E29AD-39A9-4D0A-A8B6-46A6FCD8C995}" = Live! Cam Avatar v1.0
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{308B6AEA-DE50-4666-996D-0FA461719D6B}" = Apple Mobile Device Support
"{3248F0A8-6813-11D6-A77B-00B0D0160000}" = Java(TM) SE Runtime Environment 6
"{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}" = Sonic Activation Module
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C79DC59-6099-323B-B27B-90B45542B270}" = Google Talk Plugin
"{3E2C691B-B7E6-4053-B5C3-94B8BC407E7A}" = Adobe Premiere Elements 4.0
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}" = Dell DataSafe Online
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{59E4543A-D49D-4489-B445-473D763C79AF}" = Microsoft Games for Windows - LIVE Redistributable
"{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}" = User's Guides
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{61879398-F35C-4628-AC95-2B84B859FE93}" = nrg2iso
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{62230596-37E5-4618-A329-0D21F529A86F}" = Browser Address Error Redirector
"{626C034B-50B8-47BD-AF93-EEFD0FA78FF4}" = Character Builder
"{63DB9CCD-2B56-4217-9A3D-507AC78320CA}" = mWMI
"{65D0C510-D7B6-4438-9FC8-E6B91115AB0D}" = Live! Cam Avatar Creator
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6ADD0603-16EF-400D-9F9E-486432835002}" = OpenOffice.org 3.2
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6C91041E-406E-C082-0D03-75D4BC9C6CB0}" = Picaboo X
"{718D791F-F4E8-4aa7-98A6-15FDED17BDD0}" = Trend Micro Internet Security
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EEB695-388B-4835-8EA6-0C04545B06B9}" = Intel(R) PROSet/Wireless WiFi Software
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}" = Roxio Creator BDAV Plugin
"{89CEAE14-DD0F-448E-9554-15781EC9DB24}" = Product Documentation Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C2690CF-5B74-4F93-8139-7B5644CD6A3B}" = MobileMe Control Panel
"{8EDBA74D-0686-4C99-BFDD-F894678E5102}" = Adobe Common File Installer
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}" = WIDCOMM Bluetooth Software 6.0.1.3100
"{A2289997-10A3-48F2-AA03-99180D761661}" = Fingerprint Reader Suite 5.6
"{A4552E28-AF1D-4C3E-9991-8112F40265F4}" = Adventure Tools
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{A621B45A-D138-4A95-BE10-7CABA05EF94E}" = Trend Micro Internet Security
"{AC76BA86-7AD7-1033-7B44-A82000000003}" = Adobe Reader 8.2.5
"{B1C0D829-FE30-059E-E93F-CDC7A48235C0}" = FlipShare
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator DE
"{C99C0593-3B48-41D9-B42F-6E035B320449}" = Broadcom Management Programs
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D639085F-4B6E-4105-9F37-A0DBB023E2FB}" = Roxio MyDVD DE
"{D7769185-9A7C-48D4-8874-5388743A1DE2}" = Music, Photos & Videos Launcher
"{DE114695-AE58-4B66-8E0F-2505188602FB}_is1" = Uninstall Startup Inspector
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E503B4BF-F7BB-3D5F-8BC8-F694B1CFF942}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022.218
"{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}" = Microsoft SQL Server Compact 3.5 SP1 English
"{E8843212-F0FC-4C3B-BFF3-D51829CB4F19}" = iTunes
"{E8C06CB3-5DB2-4689-B1DC-4A0220DEA96C}" = Consumer Complete Care Services Agreement
"{EA8C73AA-3D75-44C9-87A2-8E945FC5FEE6}" = Trend Micro PC-cillin Internet Security
"{EBE939ED-4612-45FD-A39E-77AC199C4273}" = Absolute Notifier
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{F54AC413-D2C6-4A24-B324-370C223C6250}" = Adobe Photoshop Elements 6.0
"{F85C7118-F3DC-4ED9-AB27-3E7931EA3D88}" = Adobe Premiere Elements 4.0 Templates
"{FA54AFB1-5745-4389-B8C1-9F7509672ED1}" = iPhone Configuration Utility
"{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
"3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
"7-Zip" = 7-Zip 4.65
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop Elements 6" = Adobe Photoshop Elements 6.0
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Advanced Video FX Engine" = Advanced Video FX Engine
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.10
"AudibleDownloadManager" = Audible Download Manager
"Bejeweled 2 Deluxe" = Bejeweled 2 Deluxe
"CCleaner" = CCleaner
"com.picaboo.Picaboo.A382D4714709B456C4E0088DFC1F7243AF9EBF75.1" = Picaboo X
"Creative OEM004" = Laptop Integrated Webcam Driver (1.03.01.1011)
"CutePDF Writer Installation" = CutePDF Writer 2.8
"Defraggler" = Defraggler
"Dell Webcam Center" = Dell Webcam Center
"Dell Webcam Manager" = Dell Webcam Manager
"Ditto_is1" = Ditto
"ESET Online Scanner" = ESET Online Scanner v3
"Exact Audio Copy" = Exact Audio Copy 1.0beta1
"ffdshow_is1" = ffdshow [rev 3055] [2009-08-16]
"Flickr Uploadr" = Flickr Uploadr 3.2.1
"Freespace 2_is1" = Freespace 2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"MEDA MP3 Splitter_is1" = MEDA MP3 Splitter 2.0.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.6)" = Mozilla Firefox (3.6.6)
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa 3" = Picasa 3
"Planescape Torment_is1" = Planescape Torment
"PremElem40" = Adobe Premiere Elements 4.0
"PremElem40Templates" = Adobe Premiere Elements 4.0 Templates
"ProInst" = Intel PROSet Wireless
"Steam App 22370" = Fallout 3 - Game of the Year Edition
"Steam App 8930" = Sid Meier's Civilization V
"SynTPDeinstKey" = Dell Touchpad
"SystemRequirementsLab" = System Requirements Lab
"TmPcc" = Trend Micro PC-cillin Internet Security
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.0.1

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"f031ef6ac137efc5" = Dell Driver Download Manager

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/1/2011 4:42:10 PM | Computer Name = TheNewerHottnes | Source = ESENT | ID = 515
Description = Windows (3256) Windows: Database C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb:
Page 1842 (0x00000732) failed verification due to a flush-order dependency mismatch.
This page should have flushed before page 1841 (0x00000731), but the latter page
has instead flushed first. Recovery/restore will fail with error -255. If this
condition persists then please restore the database from a previous backup. This
problem is likely due to faulty hardware "losing" one or more flushes on one or
both of these pages sometime in the past. Please contact your hardware vendor for
further assistance diagnosing the problem.

Error - 1/1/2011 4:42:13 PM | Computer Name = TheNewerHottnes | Source = ESENT | ID = 454
Description = Windows (3256) Windows: Database recovery/restore failed with unexpected
error -255.

Error - 1/1/2011 4:42:13 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 9000
Description =

Error - 1/1/2011 4:42:14 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 7040
Description =

Error - 1/1/2011 4:42:14 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 9002
Description =

Error - 1/1/2011 4:42:14 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3029
Description =

Error - 1/1/2011 4:42:17 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3029
Description =

Error - 1/1/2011 4:42:17 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3028
Description =

Error - 1/1/2011 4:42:17 PM | Computer Name = TheNewerHottnes | Source = Windows Search Service | ID = 3058
Description =

Error - 1/1/2011 4:51:41 PM | Computer Name = TheNewerHottnes | Source = EventSystem | ID = 4609
Description =

[ System Events ]
Error - 1/2/2011 1:46:48 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
Description =

Error - 1/2/2011 1:46:51 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
Description =

Error - 1/2/2011 1:46:51 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
Description =

Error - 1/2/2011 1:47:03 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7001
Description =

Error - 1/2/2011 1:47:03 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7026
Description =

Error - 1/2/2011 1:48:21 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7001
Description =

Error - 1/2/2011 2:27:25 PM | Computer Name = TheNewerHottnes | Source = DCOM | ID = 10005
Description =

Error - 1/2/2011 3:32:17 PM | Computer Name = TheNewerHottnes | Source = volmgr | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 1/2/2011 3:32:26 PM | Computer Name = TheNewerHottnes | Source = volmgr | ID = 262193
Description = Configuring the Page file for crash dump failed. Make sure there is
a page file on the boot partition and that is large enough to contain all physical
memory.

Error - 1/2/2011 3:37:51 PM | Computer Name = TheNewerHottnes | Source = Service Control Manager | ID = 7022
Description =


< End of report >
 
Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder
  • Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
  • Accept any prompts.

====================================================================

Run OTL
  • Under the Custom Scans/Fixes box at the bottom, paste in the following

    Code:
    :OTL
    SRV - File not found [On_Demand | Stopped] -- c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe -- (DAUpdaterSvc)
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    
    :Commands
    [purity]
    [emptytemp]
    [emptyflash]
    [Reboot]
  • Then click the Run Fix button at the top
  • Let the program run unhindered, reboot the PC when it is done
  • You will get a log that shows the results of the fix. Please post it.

=======================================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.
  • Double-click SecurityCheck.exe
  • Follow the onscreen instructions inside of the black box.
  • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

    NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


2. Download Temp File Cleaner (TFC)
  • Double click on TFC.exe to run the program.
  • Click on Start button to begin cleaning process.
  • TFC will close all running programs, and it may ask you to restart computer.


3. Please run a free online scan with the ESET Online Scanner

  • Disable your antivirus program
  • Tick the box next to YES, I accept the Terms of Use
  • Click Start
  • IMPORTANT! UN-check Remove found threats
  • Accept any security warnings from your browser.
  • Check Scan archives
  • Click Start
  • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  • When the scan completes, push List of found threats
  • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  • NOTE. If Eset won't find any threats, it won't produce any log.
 
The latest OTL log:

All processes killed
========== OTL ==========
Service DAUpdaterSvc stopped successfully!
Service DAUpdaterSvc deleted successfully!
File c:\program files\steam\steamapps\common\dragon age origins\bin_ship\DAUpdaterSvc.Service.exe not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Charlie Reece
->Temp folder emptied: 49560 bytes
->Temporary Internet Files folder emptied: 192033 bytes
->Java cache emptied: 98116 bytes
->FireFox cache emptied: 48367361 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 2578 bytes

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Public
->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 272097 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 47.00 mb


[EMPTYFLASH]

User: All Users

User: Charlie Reece
->Flash cache emptied: 0 bytes

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Public

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.20.1 log created on 01022011_211334

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
 
checkup.txt

Results of screen317's Security Check version 0.99.7
Windows Vista Service Pack 2 (UAC is disabled!)
Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:

Windows Security Center service is not running! This report may not be accurate!
Windows Firewall Disabled!
ESET Online Scanner v3
Trend Micro PC-cillin Internet Security
Trend Micro Internet Security
[size=1]WMI entry may not exist for antivirus; attempting automatic update.[/size]
```````````````````````````````
Anti-malware/Other Utilities Check:

Malwarebytes' Anti-Malware
CCleaner
Java(TM) 6 Update 23
Java(TM) SE Runtime Environment 6
Out of date Java installed!
Adobe Flash Player 10.1.102.64
Adobe Reader 8.2.5
Out of date Adobe Reader installed!
````````````````````````````````
Process Check:
objlist.exe by Laurent

``````````End of Log````````````
 
Other steps taken

I updated Java & ran the JavaRa program to remove the old versions of Java (I did these steps first, as you directed).

Then I ran OTL.exe with the custom fix you wrote.

Then I ran the temp file cleaner (it didn't ask me to restart the computer).

And now I'm running ESET Online Scanner (although I ran that yesterday just prior to my cry for help and found no viruses, but if anything shows up I'll post that log, too).

Thanks again for all your help.
 
Uninstall Java(TM) SE Runtime Environment 6 .

======================================================================

Update Adobe Reader

You can download it from https://www.techspot.com/downloads/2083-adobe-reader-dc.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.
On this page:

FoxitReaderInstallation.png


make sure, you have both boxes UN-checked AND (important!) click on Decline button
 
FYI

Just tried my luck with normal mode and it froze up within a few minutes.

I'll be at work during the day and unable to access this laptop, but if there's anything else you'd like me to try, I'll get back to it this evening. I really appreciate everything you've tried to do so far.


Thank you,
Charlie
 
In this forum, we make sure, your computer is free of malware and your computer is clean :)
Because the access to malware forum is very limited, your best option is to create new topic about your current issue, at Windows section.
You'll get more attention.
 
Status
Not open for further replies.
Back