Just about to go to bed!! Anyway I've run the files as requested and here are the results:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\*.update\ deleted successfully.
Invalid CLSID key: *.update
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\*.update\ not found.
Invalid CLSID key: *.update
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\update\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoft.com\update\ not found.
Registry key HKEY_USERS\S-1-5-21-1220945662-1801674531-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\windows,update.com\download\ deleted successfully.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 41085 bytes
User: All Users
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 13689508 bytes
->Flash cache emptied: 41085 bytes
User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 42478 bytes
->Flash cache emptied: 470 bytes
User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
User: Owner
->Temp folder emptied: 728489 bytes
->Temporary Internet Files folder emptied: 30545423 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 61512122 bytes
->Google Chrome cache emptied: 6171858 bytes
->Flash cache emptied: 41519 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Java cache emptied: 0 bytes
->Flash cache emptied: 41085 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 126185094 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 39520 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 1640748 bytes
RecycleBin emptied: 719052 bytes
Total Files Cleaned = 230.00 mb
[EMPTYJAVA]
User: Administrator
->Java cache emptied: 0 bytes
User: All Users
User: Default User
->Java cache emptied: 0 bytes
User: LocalService
User: NetworkService
User: Owner
->Java cache emptied: 0 bytes
User: UpdatusUser
->Java cache emptied: 0 bytes
Total Java Files Cleaned = 0.00 mb
[EMPTYFLASH]
User: Administrator
->Flash cache emptied: 0 bytes
User: All Users
User: Default User
->Flash cache emptied: 0 bytes
User: LocalService
->Flash cache emptied: 0 bytes
User: NetworkService
User: Owner
->Flash cache emptied: 0 bytes
User: UpdatusUser
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0.00 mb
OTL by OldTimer - Version 3.2.31.0 log created on 02092012_225158
Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF30AF.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF48DA.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF61DB.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF68EE.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF692A.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6A5C.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6A9E.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6BC8.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF6C04.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7323.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temp\~DF7648.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.Word\~WRF1684.tmp not found!
File\Folder C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.Word\~WRS3595.tmp not found!
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\cwgtdd_PORTALHomepage_8[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\omnes-medium-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\S0G8RT6R\omnes-regular-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\RDGE5Q6S\helveticaroundedltstd-bd-webfont[1].eot moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\adCAK89V2P.htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\ebay-iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\IA84JDAG\pie[1].htc moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9LN0O4G6\adCAQ94Z2O.htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\9LN0O4G6\play-to-win-iframe[1].htm moved successfully.
C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.
File\Folder C:\WINDOWS\temp\Max\2E11D3B_SDV1.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11D3B_SDV1.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E11D6A_SDV2.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11D6A_SDV2.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E11ED1_SDV3.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E11ED1_SDV3.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV4.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV4.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV5.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1223C_SDV5.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E1227B_SDV7.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E1227B_SDV7.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E12402_SDV8.DB_NM not found!
File\Folder C:\WINDOWS\temp\Max\2E12402_SDV8.DB_SEC not found!
File\Folder C:\WINDOWS\temp\Max\2E16F14_SPDBNM not found!
File\Folder C:\WINDOWS\temp\Max\2E16F14_SPDBSEC not found!
Registry entries deleted on Reboot...
Farbar Service Scanner Version: 08-02-2012
Ran by Owner (administrator) on 09-02-2012 at 23:15:42
Running from "C:\Documents and Settings\Owner\Desktop"
Microsoft Windows XP Home Edition Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************
Internet Services:
============
Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.
Windows Firewall:
=============
Firewall Disabled Policy:
==================
System Restore:
============
System Restore Disabled Policy:
========================
Security Center:
============
Windows Update:
===========
File Check:
========
C:\WINDOWS\system32\dhcpcsvc.dll
[2006-02-28 12:00] - [2006-05-19 12:59] - 0111616 ____A (Microsoft Corporation) EF545E1A4B043DA4C84E230DD471C55F
C:\WINDOWS\system32\Drivers\afd.sys
[2006-02-28 12:00] - [2008-08-14 09:51] - 0138368 ____A (Microsoft Corporation) 55E6E1C51B6D30E54335750955453702
C:\WINDOWS\system32\Drivers\netbt.sys
[2006-02-28 12:00] - [2006-02-28 12:00] - 0162816 ____A (Microsoft Corporation) 0C80E410CD2F47134407EE7DD19CC86B
C:\WINDOWS\system32\Drivers\tcpip.sys
[2006-02-28 12:00] - [2008-06-20 10:45] - 0360320 ____A (Microsoft Corporation) 2A5554FC5B1E04E131230E3CE035C3F9
C:\WINDOWS\system32\Drivers\ipsec.sys
[2006-02-28 12:00] - [2006-02-28 12:00] - 0074752 ____A (Microsoft Corporation) 64537AA5C003A6AFEEE1DF819062D0D1
C:\WINDOWS\system32\dnsrslvr.dll
[2006-02-28 12:00] - [2008-02-20 05:32] - 0045568 ____A (Microsoft Corporation) AAC8FFBFD61E784FA3BAC851D4A0BD5F
C:\WINDOWS\system32\ipnathlp.dll
[2006-02-28 12:00] - [2006-02-28 12:00] - 0331264 ____A (Microsoft Corporation) 36CC8C01B5E50163037BEF56CB96DEFF
C:\WINDOWS\system32\netman.dll
[2006-02-28 12:00] - [2005-08-22 18:29] - 0197632 ____A (Microsoft Corporation) 36739B39267914BA69AD0610A0299732
C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-12-08 16:58] - [2006-02-28 12:00] - 0144896 ____A (Microsoft Corporation) F399242A80C4066FD155EFA4CF96658E
C:\WINDOWS\system32\srsvc.dll
[2008-12-08 17:00] - [2006-02-28 12:00] - 0170496 ____A (Microsoft Corporation) 92BDF74F12D6CBEC43C94D4B7F804838
C:\WINDOWS\system32\Drivers\sr.sys
[2008-12-08 17:00] - [2006-02-28 12:00] - 0073472 ____A (Microsoft Corporation) E41B6D037D6CD08461470AF04500DC24
C:\WINDOWS\system32\wscsvc.dll
[2006-02-28 12:00] - [2006-02-28 12:00] - 0081408 ____A (Microsoft Corporation) 4D59DAA66C60858CDF4F67A900F42D4A
C:\WINDOWS\system32\wbem\WMIsvc.dll
[2008-12-08 16:58] - [2006-02-28 12:00] - 0144896 ____A (Microsoft Corporation) F399242A80C4066FD155EFA4CF96658E
C:\WINDOWS\system32\wuauserv.dll
[2008-12-08 17:01] - [2006-02-28 12:00] - 0006656 ____A (Microsoft Corporation) 13D72740963CBA12D9FF76A7F218BCD8
C:\WINDOWS\system32\qmgr.dll
[2008-12-08 17:01] - [2006-02-28 12:00] - 0382464 ____A (Microsoft Corporation) 2C69EC7E5A311334D10DD95F338FCCEA
C:\WINDOWS\system32\es.dll
[2006-02-28 12:00] - [2008-07-07 20:32] - 0253952 ____A (Microsoft Corporation) 60D1A6342238378BFB7545C81EE3606C
C:\WINDOWS\system32\cryptsvc.dll
[2006-02-28 12:00] - [2006-02-28 12:00] - 0060416 ____A (Microsoft Corporation) 10654F9DDCEA9C46CFB77554231BE73B
C:\WINDOWS\system32\svchost.exe
[2006-02-28 12:00] - [2006-02-28 12:00] - 0014336 ____N (Microsoft Corporation) 8F078AE4ED187AAABC0A305146DE6716
C:\WINDOWS\system32\rpcss.dll
[2006-02-28 12:00] - [2009-02-09 10:20] - 0399360 ____A (Microsoft Corporation) 01095FEBF33BEEA00C2A0730B9B3EC28
C:\WINDOWS\system32\services.exe
[2006-02-28 12:00] - [2009-02-06 17:14] - 0110592 ____A (Microsoft Corporation) 37561F8D4160D62DA86D24AE41FAE8DE
Extra List:
=======
AegisP(23) epfwtdir(15) Gpc(3) IPSec(5) NetBT(6) PSched(7) StreamSurge(11) Tcpip(4)
0x170000000500000001000000020000000300000004000000060000000700000008000000090000000A0000000B0000000C0000000D0000000E0000000F0000001000000011000000120000001300000014000000150000001600000017000000
**** End of log ****
Results of screen317's Security Check version 0.99.24
Windows XP Service Pack 2 x86
Out of date service pack!!
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
ESET NOD32 Antivirus
```````````````````````````````
Anti-malware/Other Utilities Check:
Max Spyware Detector
SUPERAntiSpyware Free Edition
TuneUp Utilities Language Pack (en-GB)
Driver Cleaner.NET
Java(TM) 6 Update 30
Adobe Flash Player 11.1.102.55
Adobe Reader X (10.1.2)
Mozilla Firefox (Firefox, Opera, Netscape only..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
``````````End of Log````````````
F-Secure Scan Report
7 malware found
TrackingCookie.Advertising (spyware)
System (Disinfected)
TrackingCookie.Atdmt (spyware)
System (Disinfected)
TrackingCookie.Doubleclick (spyware)
System (Disinfected)
TrackingCookie.Adbrite (spyware)
System (Disinfected)
TrackingCookie.Mediaplex (spyware)
System (Disinfected)
TrackingCookie.Atwola (spyware)
System (Disinfected)
TrackingCookie.Yieldmanager (spyware)
System (Disinfected)
--------------------------------------------------------------------------------
Statistics
Scanned:
Files: 5181
System: 5181
Not scanned: 0
Actions:
Disinfected: 7
Renamed: 0
Deleted: 0
Not cleaned: 0
Submitted: 0
--------------------------------------------------------------------------------
Options
Scanning engines:
--------------------------------------------------------------------------------
Copyright © 1998-2009 Product support | Send virus sample to F-Secure
F-Secure assumes no responsibility for material created or published by third parties that F-Secure World Wide Web pages have a link to. Unless you have clearly stated otherwise, by submitting material to any of our servers, for example by E-mail or via our F-Secure's CGI E-mail, you agree that the material you make available may be published in the F-Secure World Wide Pages or hard-copy publications. You will reach F-Secure public web site by clicking on underlined links. While doing this, your access will be logged to our private access statistics with your domain name. This information will not be given to any third party. You agree not to take action against us in relation to material that you submit. Unless you have clearly stated otherwise, by submitting material you warrant that F-Secure may incorporate any concepts described in it in the F-Secure products/publications without liability.