Page 3 of 5 FirstFirst 12345 LastLast
Results 21 to 30 of 41

Thread: Can't remove Win32.Autorun.tmp

  1. #21
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    OTL Logs:

    "OTL":


    OTL logfile created on: 9/09/2010 3:40:18 PM - Run 1
    OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\willmonotti\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.2180)
    Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    1,015.00 Mb Total Physical Memory | 470.00 Mb Available Physical Memory | 46.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 74.51 Gb Total Space | 4.24 Gb Free Space | 5.69% Space Free | Partition Type: FAT32
    D: Drive not present or media not loaded
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: WILL
    Current User Name: willmonotti
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Minimal
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
    PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
    PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
    PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
    PRC - C:\Program Files\Last.fm\LastFM.exe (Last.fm)
    PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


    ========== Modules (SafeList) ==========

    MOD - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
    MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\msvcr80.dll (Microsoft Corporation)
    MOD - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    MOD - C:\Program Files\Microsoft Office\Office12\GrooveUtil.dll (Microsoft Corporation)
    MOD - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
    MOD - C:\Program Files\Microsoft Office\Office12\GrooveNew.dll (Microsoft Corporation)
    MOD - C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll (Microsoft Corporation)
    MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
    MOD - C:\WINDOWS\system32\rsaenh.dll (Microsoft Corporation)
    MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


    ========== Win32 Services (SafeList) ==========

    SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
    SRV - (CiscoVpnInstallService) -- C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE File not found
    SRV - (Ati HotKey Poller) -- C:\WINDOWS\System32\Ati2evxx.exe File not found
    SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
    SRV - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
    SRV - (WDSmartWareBackgroundService) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
    SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)


    ========== Driver Services (SafeList) ==========

    DRV - (Lbd) -- C:\WINDOWS\System32\DRIVERS\Lbd.sys File not found
    DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
    DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
    DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
    DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
    DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
    DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
    DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
    DRV - (ESDCR) -- C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
    DRV - (ESMCR) -- C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
    DRV - (Ktp) -- C:\WINDOWS\system32\drivers\Ktp.sys (ELANTECH Devices Corp.)
    DRV - (b57w2k) Broadcom NetLink (TM) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
    DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
    DRV - (EMSCR) -- C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
    DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
    DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
    DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
    DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
    DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
    DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
    DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
    DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://trinity.unimelb.edu.au/portal
    IE - HKCU\..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = wwwproxy.student.unimelb.edu.au:8000

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "AIM Search"
    FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us"
    FF - prefs.js..browser.startup.homepage: "https://www.trinitycollege.vic.edu.au/portal/today/today.php"
    FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.53
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query="
    FF - prefs.js..network.proxy.backup.ftp: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.ftp_port: 8000
    FF - prefs.js..network.proxy.backup.gopher: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.gopher_port: 8000
    FF - prefs.js..network.proxy.backup.socks: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.socks_port: 8000
    FF - prefs.js..network.proxy.backup.ssl: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.ssl_port: 8000
    FF - prefs.js..network.proxy.ftp: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.ftp_port: 8000
    FF - prefs.js..network.proxy.gopher: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.gopher_port: 8000
    FF - prefs.js..network.proxy.http: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.http_port: 8000
    FF - prefs.js..network.proxy.share_proxy_settings: true
    FF - prefs.js..network.proxy.socks: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.socks_port: 8000
    FF - prefs.js..network.proxy.ssl: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.ssl_port: 8000
    FF - prefs.js..network.proxy.type: 1


    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/02/09 18:52:32 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/02/09 18:52:32 | 000,000,000 | ---D | M]

    [2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Extensions
    [2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions
    [2009/06/03 19:00:26 | 000,000,000 | ---D | M] (MediaWrap) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{dd68c513-9296-4b63-8d8b-8f1c991c8a48}
    [2009/12/12 17:56:04 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    [2009/03/25 20:14:48 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\mozilla-add-ons.xml
    [2009/05/22 01:42:46 | 000,004,140 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\youtube.xml
    [2009/02/09 18:52:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/04/23 23:02:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/04/23 23:01:54 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    [2010/03/12 18:57:14 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
    [2010/03/12 18:57:14 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
    [2010/03/12 18:57:14 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
    [2010/03/12 18:57:14 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

    O1 HOSTS File: ([2009/11/20 21:35:48 | 000,000,732 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
    O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
    O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
    O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe File not found
    O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe File not found
    O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
    O4 - HKLM..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe File not found
    O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
    O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
    O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
    O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
    O4 - HKLM..\Run: [SoundMan] File not found
    O4 - HKCU..\Run: [akvwx] C:\WINDOWS\System32\e1vbg3sn.exe File not found
    O4 - HKCU..\Run: [cito0] C:\WINDOWS\System32\chxd60flvr.exe File not found
    O4 - HKCU..\Run: [cydo8] C:\WINDOWS\System32\cttuzf81.exe File not found
    O4 - HKCU..\Run: [dezpq] C:\WINDOWS\System32\w2xyt081alm.exe File not found
    O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe File not found
    O4 - HKCU..\Run: [dzuklg2] C:\WINDOWS\System32\rsnt66k8708.exe File not found
    O4 - HKCU..\Run: [dzuva] C:\WINDOWS\System32\1epqlr8.exe File not found
    O4 - HKCU..\Run: [ezqqlcc] C:\WINDOWS\System32\oojaavmmhy.exe File not found
    O4 - HKCU..\Run: [faawmm] C:\WINDOWS\System32\3wwriid.exe File not found
    O4 - HKCU..\Run: [falhcc] C:\WINDOWS\System32\1qmmhyy.exe File not found
    O4 - HKCU..\Run: [hcyytkk] C:\WINDOWS\System32\qlccxoojaa.exe File not found
    O4 - HKCU..\Run: [hxdtp] C:\WINDOWS\System32\hm2noj081q.exe File not found
    O4 - HKCU..\Run: [lbhc6y] C:\WINDOWS\System32\lr2xd2jk.exe File not found
    O4 - HKCU..\Run: [llmcdi] C:\WINDOWS\System32\bm5hdyuu.exe File not found
    O4 - HKCU..\Run: [mcdi3e] C:\WINDOWS\System32\bm86y3pl.exe File not found
    O4 - HKCU..\Run: [mmiyy6k] C:\WINDOWS\System32\fwwriiduupg.exe File not found
    O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe File not found
    O4 - HKCU..\Run: [nojpk0r] C:\WINDOWS\System32\0jff66w.exe File not found
    O4 - HKCU..\Run: [pkkgww] C:\WINDOWS\System32\ni1eaavmmh.exe File not found
    O4 - HKCU..\Run: [qhxiioj] C:\WINDOWS\System32\1cdi81u.exe File not found
    O4 - HKCU..\Run: [rcc86] C:\WINDOWS\System32\q1gw1ni13p.exe File not found
    O4 - HKCU..\Run: [snoejuf] C:\WINDOWS\System32\86y2ff6.exe File not found
    O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - HKCU..\Run: [teea6r] C:\WINDOWS\System32\w39ee5v1wb.exe File not found
    O4 - HKCU..\Run: [tkkfww] C:\WINDOWS\System32\i1eaavmmhy.exe File not found
    O4 - HKCU..\Run: [upggbs] C:\WINDOWS\System32\dzpplbbxnn.exe File not found
    O4 - HKCU..\Run: [uplbbxc] C:\WINDOWS\System32\pff69m1i.exe File not found
    O4 - HKCU..\Run: [vgr60] C:\WINDOWS\System32\6xc81oz.exe File not found
    O4 - HKCU..\Run: [vqwxin] C:\WINDOWS\System32\60niy1p.exe File not found
    O4 - HKCU..\Run: [wbxxoo3] C:\WINDOWS\System32\0xdyep0.exe File not found
    O4 - HKCU..\Run: [wcxtoeu] C:\WINDOWS\System32\70i1zuv.exe File not found
    O4 - HKCU..\Run: [wrmns] C:\WINDOWS\System32\60xs0zf.exe File not found
    O4 - HKCU..\Run: [xdtyuua] C:\WINDOWS\System32\vlw2nyojzav.exe File not found
    O4 - HKCU..\Run: [xsoo8] C:\WINDOWS\System32\sndu1klq.exe File not found
    O4 - HKCU..\Run: [yuupgg] C:\WINDOWS\System32\ytkkfwwr.exe File not found
    O4 - HKCU..\Run: [yzpf0w] C:\WINDOWS\System32\n20zvfbw.exe File not found
    O4 - HKCU..\Run: [zaflw] C:\WINDOWS\System32\70bxny1.exe File not found
    O4 - HKCU..\Run: [zuvqm] C:\WINDOWS\System32\kkfwwrii.exe File not found
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE File not found
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico ()
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
    O4 - Startup: C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 203.28.240.18 203.28.240.20
    O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
    O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
    O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2005/05/24 15:15:44 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
    O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell - "" = AutoRun
    O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\setup.exe -- [2004/08/04 05:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation)
    O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun\command - "" = F:\WD SmartWare.exe -- File not found
    O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: 6to4 - File not found
    NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: ywyyitdy - C:\WINDOWS\system32\gnhnveo.dll ()

    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point (16902109354000384)

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/09/09 15:37:43 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
    [2010/09/09 15:36:36 | 000,000,000 | --SD | C] -- C:\commy
    [2010/09/08 22:11:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Malwarebytes
    [2010/09/08 22:11:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/09/08 22:11:17 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/09/08 22:10:20 | 006,153,352 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
    [2010/09/08 19:57:45 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2010/09/08 19:54:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/09/08 19:54:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/09/08 19:54:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/09/08 19:54:16 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/09/08 14:35:50 | 000,000,000 | -HSD | C] -- C:\FOUND.031
    [2010/09/08 14:24:32 | 000,000,000 | -HSD | C] -- C:\FOUND.030
    [2010/09/08 13:57:30 | 000,000,000 | -HSD | C] -- C:\FOUND.029
    [2010/09/08 13:43:06 | 000,000,000 | -HSD | C] -- C:\FOUND.028
    [2010/09/06 14:43:12 | 000,000,000 | -HSD | C] -- C:\FOUND.027
    [2010/09/05 12:25:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/09/05 12:24:56 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
    [2010/09/05 12:16:21 | 000,791,393 | ---- | C] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
    [2010/09/03 23:25:36 | 000,000,000 | -HSD | C] -- C:\FOUND.026
    [2010/09/02 22:08:00 | 000,000,000 | -HSD | C] -- C:\FOUND.025
    [2010/09/01 23:56:04 | 000,000,000 | ---D | C] -- C:\Program Files\Safer Networking
    [2010/09/01 23:53:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
    [2010/09/01 14:55:38 | 000,000,000 | -HSD | C] -- C:\FOUND.024
    [2010/08/31 23:58:24 | 000,000,000 | -HSD | C] -- C:\FOUND.023
    [2010/08/31 19:41:40 | 000,000,000 | -HSD | C] -- C:\FOUND.022
    [2010/08/31 18:26:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\My eBooks
    [2010/08/27 21:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.021
    [2010/08/26 23:15:04 | 000,000,000 | -HSD | C] -- C:\FOUND.020
    [2010/08/26 14:56:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Desktop\VPN
    [2010/07/31 13:44:48 | 000,000,000 | -HSD | C] -- C:\FOUND.009
    [2010/07/31 10:40:54 | 000,000,000 | -HSD | C] -- C:\FOUND.008
    [2010/07/31 01:34:08 | 000,000,000 | -HSD | C] -- C:\FOUND.007
    [2010/07/27 01:23:50 | 000,000,000 | -HSD | C] -- C:\FOUND.006
    [2010/07/26 19:15:58 | 000,000,000 | -HSD | C] -- C:\FOUND.005
    [2010/07/24 15:16:26 | 000,000,000 | -HSD | C] -- C:\FOUND.004
    [2010/07/03 11:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.003
    [2010/06/30 17:10:22 | 000,000,000 | ---D | C] -- C:\CyberFoot2007
    [2010/06/30 16:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\SuperSoccerManager 2005
    [2010/06/29 23:56:04 | 000,000,000 | -HSD | C] -- C:\FOUND.002
    [2010/06/29 23:19:22 | 000,000,000 | -HSD | C] -- C:\FOUND.001
    [2010/06/21 16:04:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western_Digital
    [2010/06/21 16:01:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
    [2010/06/21 16:01:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
    [2010/06/21 16:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ServiceTest
    [2010/06/21 16:01:31 | 000,011,520 | ---- | C] (Western Digital Technologies) -- C:\WINDOWS\System32\drivers\wdcsam.sys
    [2010/06/21 16:01:13 | 000,000,000 | ---D | C] -- C:\Program Files\Western Digital
    [2010/06/21 15:58:02 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
    [2010/06/21 15:57:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
    [2010/06/21 15:56:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western Digital
    [2010/06/16 20:12:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\Downloads
    [2010/06/16 20:03:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Temp
    [2010/06/14 23:25:24 | 000,000,000 | -HSD | C] -- C:\FOUND.000
    [2008/08/29 14:00:00 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
    [2008/08/29 14:00:00 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsi.exe

    ========== Files - Modified Within 90 Days ==========

    [2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
    [2010/09/09 15:00:40 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
    [2010/09/09 14:30:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/09/09 14:29:50 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
    [2010/09/09 14:24:22 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
    [2010/09/09 14:23:24 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/09/09 14:23:20 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
    [2010/09/09 10:29:50 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
    [2010/09/09 10:24:02 | 007,340,032 | -H-- | M] () -- C:\Documents and Settings\willmonotti\NTUSER.DAT
    [2010/09/09 10:24:02 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\willmonotti\ntuser.ini
    [2010/09/09 00:47:02 | 000,000,950 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
    [2010/09/08 22:11:22 | 000,000,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/09/08 22:10:24 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
    [2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
    [2010/09/08 12:00:02 | 000,000,374 | ---- | M] () -- C:\WINDOWS\tasks\PerfectOptimizer_home.job
    [2010/09/08 11:57:40 | 000,002,451 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\VPN Client.lnk
    [2010/09/08 00:40:18 | 000,175,616 | ---- | M] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/09/05 12:25:04 | 000,000,675 | ---- | M] () -- C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2010/09/05 12:16:24 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
    [2010/09/05 12:15:44 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
    [2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
    [2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
    [2010/09/01 19:56:14 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/08/30 14:18:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/08/22 20:09:32 | 000,002,238 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
    [2010/08/22 20:09:32 | 000,002,216 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2010/08/03 17:15:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2010/06/30 17:10:24 | 000,000,490 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
    [2010/06/21 16:01:38 | 000,001,026 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
    [2010/06/21 16:01:38 | 000,000,965 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
    [2010/06/21 16:01:00 | 000,411,674 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/06/21 16:01:00 | 000,397,110 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/06/21 16:01:00 | 000,060,514 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/06/16 19:58:30 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk

    ========== Files Created - No Company Name ==========

    [2010/09/09 14:29:48 | 003,840,723 | R--- | C] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
    [2010/09/08 22:11:21 | 000,000,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/09/08 19:54:53 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/09/08 19:54:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/09/08 19:54:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/09/08 19:54:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/09/08 19:54:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/09/08 13:04:13 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
    [2010/09/05 12:25:03 | 000,000,675 | ---- | C] () -- C:\Documents and Settings\willmonotti\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
    [2010/09/05 12:15:46 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
    [2010/09/05 00:42:46 | 000,000,950 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
    [2010/06/30 17:10:22 | 000,000,490 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
    [2010/06/21 16:01:37 | 000,001,026 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
    [2010/06/21 16:01:37 | 000,000,965 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
    [2010/06/16 20:04:19 | 000,002,238 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
    [2010/06/16 20:04:19 | 000,002,216 | ---- | C] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2009/04/19 22:12:37 | 000,001,127 | ---- | C] () -- C:\WINDOWS\wincmd.ini
    [2009/04/03 13:26:13 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2009/03/11 00:07:05 | 000,000,125 | ---- | C] () -- C:\WINDOWS\ds467.dll
    [2009/02/14 22:30:45 | 000,175,616 | ---- | C] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/10/16 11:46:40 | 000,000,700 | ---- | C] () -- C:\Program Files\studentVPN.pcf
    [2008/08/29 14:00:22 | 000,001,073 | ---- | C] () -- C:\Program Files\sig.dat
    [2008/08/29 14:00:20 | 000,001,099 | ---- | C] () -- C:\Program Files\vpnclient_setup.ini
    [2008/08/29 14:00:18 | 000,052,224 | ---- | C] () -- C:\Program Files\vpnclient_jp.mst
    [2008/08/29 14:00:06 | 010,935,808 | ---- | C] () -- C:\Program Files\vpnclient_setup.msi
    [2008/08/29 14:00:04 | 000,051,200 | ---- | C] () -- C:\Program Files\vpnclient_fc.mst
    [2008/08/29 14:00:00 | 000,000,819 | ---- | C] () -- C:\Program Files\vpnclient_setup.sms
    [2008/08/29 14:00:00 | 000,000,640 | ---- | C] () -- C:\Program Files\vpnclient_setup.pdf
    [2008/08/29 13:59:58 | 000,056,832 | ---- | C] () -- C:\Program Files\vpnclient_setup.exe
    [2008/08/29 13:58:26 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
    [2008/08/29 13:58:16 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
    [2008/08/29 13:58:04 | 000,221,315 | ---- | C] () -- C:\Program Files\installservice.exe
    [2008/08/29 13:57:32 | 000,016,505 | ---- | C] () -- C:\Program Files\DelayInst.exe
    [2005/05/26 09:49:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/05/26 09:35:20 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
    [2005/05/26 09:35:18 | 000,000,329 | ---- | C] () -- C:\WINDOWS\uninstall.ini
    [2005/05/26 09:31:07 | 000,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
    [2005/05/24 15:16:04 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
    [2005/05/24 15:02:43 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
    [2005/05/24 15:02:39 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
    [2005/05/24 14:58:31 | 000,037,776 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2005/05/24 14:50:20 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2005/05/24 14:35:43 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
    [2005/05/24 14:35:29 | 000,160,603 | RHS- | C] () -- C:\WINDOWS\System32\gnhnveo.dll
    [2005/05/24 14:35:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
    [2004/12/17 17:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
    [2001/12/26 16:12:30 | 000,065,536 | R--- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
    [2001/09/03 23:46:38 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
    [2001/07/30 16:33:56 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
    [2001/07/23 22:04:36 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
    [1980/01/01 00:00:00 | 000,000,085 | ---- | C] () -- C:\WINDOWS\ALAUNCH.INI

    ========== LOP Check ==========

    [2009/02/12 21:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2009/02/14 21:58:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2009/07/01 00:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2009/12/07 21:45:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
    [2010/03/30 01:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
    [2010/06/21 16:01:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
    [2009/02/14 22:08:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\USM2
    [2009/02/18 22:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\uTorrent
    [2009/07/02 23:01:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\gtk-2.0
    [2009/10/19 19:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Audacity
    [2009/11/22 17:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\foobar2000
    [2009/12/07 21:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\acccore
    [2010/03/07 01:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Windows Search
    [2010/06/21 16:01:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
    [2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
    [2010/09/08 12:00:02 | 000,000,374 | ---- | M] () -- C:\WINDOWS\Tasks\PerfectOptimizer_home.job
    [2010/03/25 00:07:32 | 000,000,516 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2005/05/26 11:33:48 | 000,000,076 | RHS- | M] () -- C:\PRELOAD.AAA
    [2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
    [2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
    [2005/05/24 14:53:22 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2005/05/24 15:15:44 | 000,000,050 | ---- | M] () -- C:\AUTOEXEC.BAT
    [2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2005/05/26 11:34:00 | 000,000,003 | ---- | M] () -- C:\PRELOAD.TAG
    [2010/09/09 14:23:20 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
    [2009/11/30 00:48:10 | 000,012,540 | ---- | M] () -- C:\aaw7boot.log
    [2009/07/12 00:02:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
    [2009/07/12 00:02:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
    [2009/07/17 11:34:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
    [2009/07/17 11:34:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
    [2009/08/03 12:34:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
    [2009/08/03 12:34:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
    [2009/08/19 13:58:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
    [2009/08/19 13:58:24 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
    [2009/08/21 15:15:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
    [2009/08/21 15:15:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
    [2009/08/23 15:08:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
    [2009/08/23 15:08:18 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
    [2009/10/19 19:18:16 | 000,009,312 | ---- | M] () -- C:\Ask & Record Toolbar Setup Log.txt
    [2009/12/07 21:45:34 | 000,000,397 | -H-- | M] () -- C:\IPH.PH
    [2010/09/09 14:23:18 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2005/05/24 14:52:46 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2004/06/14 11:25:16 | 000,187,392 | ---- | M] () -- C:\WINDOWS\Acer.scr

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2008/08/29 14:00:06 | 010,935,808 | ---- | M] () -- C:\Program Files\vpnclient_setup.msi
    [2008/08/29 14:00:00 | 000,000,640 | ---- | M] () -- C:\Program Files\vpnclient_setup.pdf
    [2008/08/29 14:00:00 | 000,000,819 | ---- | M] () -- C:\Program Files\vpnclient_setup.sms
    [2008/08/29 13:57:32 | 000,016,505 | ---- | M] () -- C:\Program Files\DelayInst.exe
    [2008/08/29 13:58:04 | 000,221,315 | ---- | M] () -- C:\Program Files\installservice.exe
    [2008/08/29 14:00:00 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsi.exe
    [2008/08/29 14:00:00 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
    [2008/08/29 14:00:22 | 000,001,073 | ---- | M] () -- C:\Program Files\sig.dat
    [2008/08/29 14:00:04 | 000,051,200 | ---- | M] () -- C:\Program Files\vpnclient_fc.mst
    [2008/08/29 14:00:18 | 000,052,224 | ---- | M] () -- C:\Program Files\vpnclient_jp.mst
    [2008/08/29 13:59:58 | 000,056,832 | ---- | M] () -- C:\Program Files\vpnclient_setup.exe
    [2008/08/29 14:00:20 | 000,001,099 | ---- | M] () -- C:\Program Files\vpnclient_setup.ini
    [2008/10/16 11:46:40 | 000,000,700 | ---- | M] () -- C:\Program Files\studentVPN.pcf

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2005/05/24 14:42:34 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
    [2005/05/24 14:42:34 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2005/05/24 14:42:34 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2005/05/24 14:53:24 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/02/08 06:41:04 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2005/05/24 14:59:42 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
    [2010/09/05 12:16:24 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
    [2010/09/09 14:29:50 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
    [2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
    [2010/09/08 22:10:24 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
    [2010/03/07 01:12:46 | 005,520,400 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\WindowsSearch-KB940157-XP-x86-enu.exe
    [1997/10/06 21:15:48 | 000,045,056 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Join32.exe
    [2010/03/01 22:12:12 | 016,492,320 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\willmonotti\Desktop\jre-6u18-windows-i586-s.exe
    [1997/10/06 21:22:28 | 000,033,024 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\JOIN16.EXE
    [2009/11/30 01:25:04 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\willmonotti\Desktop\spybotsd162.exe
    [2009/11/30 00:55:20 | 000,308,160 | ---- | M] (ALWIL Software) -- C:\Documents and Settings\willmonotti\Desktop\avast_home_setup.exe
    [2009/04/04 18:03:12 | 526,428,264 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\X12-30307.exe
    [2009/04/11 17:26:22 | 001,234,120 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\wrar380.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/02/08 06:41:04 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Favorites\Desktop.ini
    [2009/03/11 00:06:58 | 000,000,579 | ---- | M] () -- C:\Documents and Settings\willmonotti\Favorites\First Principles of Business Law.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/09/09 15:00:42 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\willmonotti\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2004/08/04 05:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.exe >
    [2004/08/04 01:06:34 | 001,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >
    [1998/12/25 08:15:38 | 000,345,983 | ---- | M] () -- C:\WINDOWS\system\RCDsetup.exe

    < %USERPROFILE%\Templates\*.tmp >

    < %SYSTEMDRIVE%\explorexxx.exe\*.* >

    < %Windir%\Installer\*.tmp >
    [2 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

    < %systemroot%\System32\*.xco >

    < %ProgramFiles%\system32\*.* >

    < %systemroot%\System32\windos\*.* >

    < %SystemRoot%\system32\sandbox\*.* >

    < %SystemRoot%\system32\*.amo >

    < %SystemRoot%\system32\Windows Live\*.* >

    < %ProgramFiles%\logs\*.* >

    < %ProgramFiles%\Bifrost\*.* >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
    < End of report >

  2. #22
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    "Extras":


    OTL Extras logfile created on: 9/09/2010 3:40:18 PM - Run 1
    OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\willmonotti\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.2180)
    Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    1,015.00 Mb Total Physical Memory | 470.00 Mb Available Physical Memory | 46.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 80.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 74.51 Gb Total Space | 4.24 Gb Free Space | 5.69% Space Free | Partition Type: FAT32
    D: Drive not present or media not loaded
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: WILL
    Current User Name: willmonotti
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Minimal
    Quick Scan

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

    [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
    .html [@ = ChromeHTML] -- Reg Error: Key error. File not found

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    exefile [open] -- "%1" %*
    htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
    htmlfile [print] -- "C:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [AddToPlaylistVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~2\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
    Directory [PlayWithVLC] -- C:\Program Files\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
    Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "FirstRunDisabled" = 1
    "AntiVirusDisableNotify" = 0
    "FirewallDisableNotify" = 0
    "UpdatesDisableNotify" = 0
    "AntiVirusOverride" = 0
    "FirewallOverride" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DoNotAllowExceptions" = 0
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "3453:TCP" = 3453:TCP:*:Enabled:huxutzgk
    "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
    "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
    "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
    "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
    "3389:TCP" = 3389:TCP:*:Enabled:@xpsp2res.dll,-22009
    "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
    "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)
    "C:\Program Files\DC++\DCPlusPlus.exe" = C:\Program Files\DC++\DCPlusPlus.exe:*:Enabled:DC++ -- ()
    "C:\Documents and Settings\willmonotti\Desktop\utorrent.exe" = C:\Documents and Settings\willmonotti\Desktop\utorrent.exe:*:Enabled:µTorrent -- File not found


    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
    "{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
    "{232DB76D-4751-41A9-9EC2-CDC0DAC1FAB6}" = WD SmartWare
    "{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
    "{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
    "{385979FE-DC4F-4140-8EAD-A59625000D72}" = NTI Backup NOW! 4
    "{3C80C102-40C7-4119-B786-7765936F8472}" = First Principles of Business Law
    "{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}" = Cisco Systems VPN Client 5.0.04.0300
    "{5D601655-6D54-4384-B52C-17EC5385FBBD}" = iTunes
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
    "{8355F970-601D-442D-A79B-1D7DB4F24CAD}" = Apple Mobile Device Support
    "{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Graphics Media Accelerator Driver for Mobile
    "{8B7917E0-AF55-4E8A-9473-017F0AA03AC8}" = QuickTime
    "{8F432F86-A16B-42DA-B5F5-FE4CB7257814}" = Skills-Task 2 Feedback
    "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12
    "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
    "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007
    "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
    "{91120000-002E-0000-0000-0000000FF1CE}" = Microsoft Office Ultimate 2007
    "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    "{A5181519-9F3D-4372-ABC6-C333C2F3A816}_is1" = RunAlyzer
    "{AC76BA86-7AD7-1033-7B44-000000000001}" = Adobe Reader 6.0
    "{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
    "{C5C649A8-1D21-4C83-9B08-7B3752E580F4}" = Safari
    "{E2883E8F-472F-4fb0-9522-AC9BF37916A7}" = Adobe Download Manager
    "{F1B8DB67-D30E-4FF9-A85F-3CEE51825AA2}" = SMSC IrCC V5.1.3600.5 SP2
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
    "{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
    "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player 11.5
    "AIM Search" = AIM Search
    "AIM_7" = AIM 7
    "Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.9 (Unicode)
    "CNXT_MODEM_PCI_VEN_8086&DEV_266D&SUBSYS_00811025" = SoftV90 Data Fax Modem with SmartCP
    "DC++" = DC++ 0.7091
    "Elantech" = KTP Ware PS/2-WDM 5.0.1.2
    "ERUNT_is1" = ERUNT 1.1j
    "foobar2000" = foobar2000 v0.9.6.9
    "InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
    "InstallShield_{385979FE-DC4F-4140-8EAD-A59625000D72}" = NTI Backup NOW! 4
    "LAME for Audacity_is1" = LAME v3.98.2 for Audacity
    "LastFM_is1" = Last.fm 1.5.4.24567
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
    "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3)
    "OGG MP3 Converter" = OGG MP3 Converter 3.2 build 827
    "Protected Music Converter_is1" = Protected Music Converter 1.0.0.21
    "SoftwareUpdUtility" = Download Updater (AOL LLC)
    "Totalcmd" = Total Commander (Remove or Repair)
    "Trillian" = Trillian
    "ULTIMATER" = Microsoft Office Ultimate 2007
    "VLC media player" = VLC media player 0.9.8a
    "WinRAR archiver" = WinRAR archiver
    "WinZip" = WinZip
    "XiphQT" = Xiph QuickTime Components

    ========== HKEY_CURRENT_USER Uninstall List ==========

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Google Chrome" = Google Chrome
    "Universal Soccer Manager 2" = Universal Soccer Manager 2

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 7/09/2010 11:57:51 PM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 12:06:49 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 12:15:49 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 12:24:57 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 12:36:11 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 12:45:32 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 2:30:06 AM | Computer Name = WILL | Source = CiscoVpnInstallService | ID = 0
    Description =

    Error - 8/09/2010 3:04:21 AM | Computer Name = WILL | Source = Application Hang | ID = 1002
    Description = Hanging application SpybotSD.exe, version 1.6.2.46, hang module hungapp,
    version 0.0.0.0, hang address 0x00000000.

    Error - 8/09/2010 3:04:26 AM | Computer Name = WILL | Source = Application Hang | ID = 1001
    Description = Fault bucket 1116954496.

    Error - 8/09/2010 7:44:14 PM | Computer Name = WILL | Source = Google Update | ID = 20
    Description =

    [ OSession Events ]
    Error - 30/06/2009 10:26:25 AM | Computer Name = WILL | Source = Microsoft Office 12 Sessions | ID = 7001
    Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
    12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 216517
    seconds with 240 seconds of active time. This session ended with a crash.

    [ System Events ]
    Error - 8/09/2010 8:28:45 PM | Computer Name = WILL | Source = Service Control Manager | ID = 7000
    Description = The Cisco Systems, Inc. Installer service service failed to start
    due to the following error: %%2

    Error - 8/09/2010 8:28:45 PM | Computer Name = WILL | Source = Service Control Manager | ID = 7023
    Description = The System Monitor service terminated with the following error: %%1114

    Error - 8/09/2010 8:28:45 PM | Computer Name = WILL | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    IntelIde Lbd

    Error - 9/09/2010 12:24:16 AM | Computer Name = WILL | Source = DCOM | ID = 10005
    Description = DCOM got error "%1058" attempting to start the service BITS with arguments
    "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

    Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7000
    Description = The Ati HotKey Poller service failed to start due to the following
    error: %%2

    Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7000
    Description = The Cisco Systems, Inc. Installer service service failed to start
    due to the following error: %%2

    Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7009
    Description = Timeout (30000 milliseconds) waiting for the WD SmartWare Background
    Service service to connect.

    Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7023
    Description = The System Monitor service terminated with the following error: %%1114

    Error - 9/09/2010 12:25:00 AM | Computer Name = WILL | Source = Service Control Manager | ID = 7026
    Description = The following boot-start or system-start driver(s) failed to load:
    Lbd

    Error - 9/09/2010 12:27:42 AM | Computer Name = WILL | Source = MRxSmb | ID = 8003
    Description = The master browser has received a server announcement from the computer
    KAT-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{773F261F-5C09-4150-B9.
    The
    master browser is stopping or an election is being forced.


    < End of report >

  3. #23
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    Hi

    Warning: Please note that this fix is specific for this poster & should not be used by anyone else.

    Backup Your Registry with ERUNT
    • Download ERUNT from here & follow the installation prompts
    • Uncheck Create NTREGOPT desktop icon at the Additional Tasks screen. Click No when prompted to create an ERUNT entry in the startup folder.
    • Double click the Erunt icon on your desktop to open the program then click OK at the prompt
    • Use the default settings unless there is more than one user account. (If more the one user account tick Other open user registries in Backup Options)
    • Click OK

    The following instruction should only be carried out if you need to restore the registry backup:
    Navigate to the folder where the backup is saved
    Double click on ERDNT.exe then OK
    When the program opens click OK

    Run Fix With OTL
    Highlight the following in the code box and press Ctrl+C on the keyboard
    Make sure you include the first colon (:)

    Code:
    :Commands
    [CreateRestorePoint]
    :Files
    C:\WINDOWS\system32\gnhnveo.dll
    :Reg
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
    "3453:TCP" =-
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\Documents and Settings\willmonotti\Desktop\utorrent.exe" =-
    :otl
    SRV - (HidServ) -- C:\WINDOWS\System32\hidserv.dll File not found
    SRV - (CiscoVpnInstallService) -- C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE File not found
    SRV - (Ati HotKey Poller) -- C:\WINDOWS\System32\Ati2evxx.exe File not found
    DRV - (Lbd) -- C:\WINDOWS\System32\DRIVERS\Lbd.sys File not found
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
    O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
    O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe File not found
    O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe File not found
    O4 - HKLM..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe File not found
    O4 - HKLM..\Run: [SoundMan] File not found
    O4 - HKCU..\Run: [akvwx] C:\WINDOWS\System32\e1vbg3sn.exe File not found
    O4 - HKCU..\Run: [cito0] C:\WINDOWS\System32\chxd60flvr.exe File not found
    O4 - HKCU..\Run: [cydo8] C:\WINDOWS\System32\cttuzf81.exe File not found
    O4 - HKCU..\Run: [dezpq] C:\WINDOWS\System32\w2xyt081alm.exe File not found
    O4 - HKCU..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe File not found
    O4 - HKCU..\Run: [dzuklg2] C:\WINDOWS\System32\rsnt66k8708.exe File not found
    O4 - HKCU..\Run: [dzuva] C:\WINDOWS\System32\1epqlr8.exe File not found
    O4 - HKCU..\Run: [ezqqlcc] C:\WINDOWS\System32\oojaavmmhy.exe File not found
    O4 - HKCU..\Run: [faawmm] C:\WINDOWS\System32\3wwriid.exe File not found
    O4 - HKCU..\Run: [falhcc] C:\WINDOWS\System32\1qmmhyy.exe File not found
    O4 - HKCU..\Run: [hcyytkk] C:\WINDOWS\System32\qlccxoojaa.exe File not found
    O4 - HKCU..\Run: [hxdtp] C:\WINDOWS\System32\hm2noj081q.exe File not found
    O4 - HKCU..\Run: [lbhc6y] C:\WINDOWS\System32\lr2xd2jk.exe File not found
    O4 - HKCU..\Run: [llmcdi] C:\WINDOWS\System32\bm5hdyuu.exe File not found
    O4 - HKCU..\Run: [mcdi3e] C:\WINDOWS\System32\bm86y3pl.exe File not found
    O4 - HKCU..\Run: [mmiyy6k] C:\WINDOWS\System32\fwwriiduupg.exe File not found
    O4 - HKCU..\Run: [MsnMsgr] C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe File not found
    O4 - HKCU..\Run: [nojpk0r] C:\WINDOWS\System32\0jff66w.exe File not found
    O4 - HKCU..\Run: [pkkgww] C:\WINDOWS\System32\ni1eaavmmh.exe File not found
    O4 - HKCU..\Run: [qhxiioj] C:\WINDOWS\System32\1cdi81u.exe File not found
    O4 - HKCU..\Run: [rcc86] C:\WINDOWS\System32\q1gw1ni13p.exe File not found
    O4 - HKCU..\Run: [snoejuf] C:\WINDOWS\System32\86y2ff6.exe File not found
    O4 - HKCU..\Run: [teea6r] C:\WINDOWS\System32\w39ee5v1wb.exe File not found
    O4 - HKCU..\Run: [tkkfww] C:\WINDOWS\System32\i1eaavmmhy.exe File not found
    O4 - HKCU..\Run: [upggbs] C:\WINDOWS\System32\dzpplbbxnn.exe File not found
    O4 - HKCU..\Run: [uplbbxc] C:\WINDOWS\System32\pff69m1i.exe File not found
    O4 - HKCU..\Run: [vgr60] C:\WINDOWS\System32\6xc81oz.exe File not found
    O4 - HKCU..\Run: [vqwxin] C:\WINDOWS\System32\60niy1p.exe File not found
    O4 - HKCU..\Run: [wbxxoo3] C:\WINDOWS\System32\0xdyep0.exe File not found
    O4 - HKCU..\Run: [wcxtoeu] C:\WINDOWS\System32\70i1zuv.exe File not found
    O4 - HKCU..\Run: [wrmns] C:\WINDOWS\System32\60xs0zf.exe File not found
    O4 - HKCU..\Run: [xdtyuua] C:\WINDOWS\System32\vlw2nyojzav.exe File not found
    O4 - HKCU..\Run: [xsoo8] C:\WINDOWS\System32\sndu1klq.exe File not found
    O4 - HKCU..\Run: [yuupgg] C:\WINDOWS\System32\ytkkfwwr.exe File not found
    O4 - HKCU..\Run: [yzpf0w] C:\WINDOWS\System32\n20zvfbw.exe File not found
    O4 - HKCU..\Run: [zaflw] C:\WINDOWS\System32\70bxny1.exe File not found
    O4 - HKCU..\Run: [zuvqm] C:\WINDOWS\System32\kkfwwrii.exe File not found
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
    O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
    O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/downlo...8f/wvc1dmo.cab (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_20)
    O32 - AutoRun File - [2005/05/24 15:15:44 | 000,000,050 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ]
    O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell - "" = AutoRun
    O33 - MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\setup.exe -- [2004/08/04 05:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation)
    O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun\command - "" = F:\WD SmartWare.exe -- File not found
    O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell - "" = AutoRun
    O33 - MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell - "" = AutoRun
    O33 - MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\Shell\AutoRun - "" = Auto&Play
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    NetSvcs: 6to4 - File not found
    NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found
    NetSvcs: Ias - File not found
    NetSvcs: Iprip - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: ywyyitdy - C:\WINDOWS\system32\gnhnveo.dll ()
    [2010/09/09 15:36:36 | 000,000,000 | --SD | C] -- C:\commy
    [2010/09/08 14:35:50 | 000,000,000 | -HSD | C] -- C:\FOUND.031
    [2010/09/08 14:24:32 | 000,000,000 | -HSD | C] -- C:\FOUND.030
    [2010/09/08 13:57:30 | 000,000,000 | -HSD | C] -- C:\FOUND.029
    [2010/09/08 13:43:06 | 000,000,000 | -HSD | C] -- C:\FOUND.028
    [2010/09/06 14:43:12 | 000,000,000 | -HSD | C] -- C:\FOUND.027
    [2010/09/03 23:25:36 | 000,000,000 | -HSD | C] -- C:\FOUND.026
    [2010/09/02 22:08:00 | 000,000,000 | -HSD | C] -- C:\FOUND.025
    [2010/09/01 14:55:38 | 000,000,000 | -HSD | C] -- C:\FOUND.024
    [2010/08/31 23:58:24 | 000,000,000 | -HSD | C] -- C:\FOUND.023
    [2010/08/31 19:41:40 | 000,000,000 | -HSD | C] -- C:\FOUND.022
    [2010/08/27 21:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.021
    [2010/08/26 23:15:04 | 000,000,000 | -HSD | C] -- C:\FOUND.020
    [2010/07/31 13:44:48 | 000,000,000 | -HSD | C] -- C:\FOUND.009
    [2010/07/31 10:40:54 | 000,000,000 | -HSD | C] -- C:\FOUND.008
    [2010/07/31 01:34:08 | 000,000,000 | -HSD | C] -- C:\FOUND.007
    [2010/07/27 01:23:50 | 000,000,000 | -HSD | C] -- C:\FOUND.006
    [2010/07/26 19:15:58 | 000,000,000 | -HSD | C] -- C:\FOUND.005
    [2010/07/24 15:16:26 | 000,000,000 | -HSD | C] -- C:\FOUND.004
    [2010/07/03 11:22:10 | 000,000,000 | -HSD | C] -- C:\FOUND.003
    [2010/06/29 23:56:04 | 000,000,000 | -HSD | C] -- C:\FOUND.002
    [2010/06/29 23:19:22 | 000,000,000 | -HSD | C] -- C:\FOUND.001
    [2010/06/14 23:25:24 | 000,000,000 | -HSD | C] -- C:\FOUND.000
    [2010/09/08 12:00:02 | 000,000,374 | ---- | M] () -- C:\WINDOWS\tasks\PerfectOptimizer_home.job
    [2009/03/11 00:07:05 | 000,000,125 | ---- | C] () -- C:\WINDOWS\ds467.dll
    [2009/02/18 22:44:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\uTorrent
    [2009/10/19 19:18:16 | 000,009,312 | ---- | M] () -- C:\Ask & Record Toolbar Setup Log.txt
    [2010/09/05 12:16:24 | 000,791,393 | ---- | M] (Lars Hederer ) -- C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe
    [2010/09/09 14:29:50 | 003,840,723 | R--- | M] () -- C:\Documents and Settings\willmonotti\Desktop\commy.exe
    [2010/09/08 22:10:24 | 006,153,352 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe
    [2010/03/07 01:12:46 | 005,520,400 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\WindowsSearch-KB940157-XP-x86-enu.exe
    [2010/03/01 22:12:12 | 016,492,320 | ---- | M] (Sun Microsystems, Inc.) -- C:\Documents and Settings\willmonotti\Desktop\jre-6u18-windows-i586-s.exe
    [2009/11/30 01:25:04 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Documents and Settings\willmonotti\Desktop\spybotsd162.exe
    [2009/11/30 00:55:20 | 000,308,160 | ---- | M] (ALWIL Software) -- C:\Documents and Settings\willmonotti\Desktop\avast_home_setup.exe
    :Commands
    [Purity]
    [EmptyTemp]
    [Reboot]
    Double-click on the OTL.exe file to start OTL. OK any warning about running OTL.
    Click in the Custom Scans/Fixes box at the bottom of the OTL window
    Press Ctrl+V to paste the above code in the box (check that the code appears)
    Click the Run Fix button
    Post the resulting log in your next reply.

    Re-scan With OTL
    Then run another scan with OTL using the direction previously posted Here
    Last edited by jmw3; 2010-09-09 at 12:30.

  4. #24
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    Hi there.

    I ran the OTL fix, my computer shut down, rebooted, the log posted below came up. There were a few other things that happened though:

    1) First thing I noticed was the appearance - everything had gone back to "Windows Classic" style. I tried to change it but it seems the other options don't exist anymore.

    2) All my network connections had been wiped, and I couldn't set up a new connection (not sure why). Tried to open the Help & Support Centre, but that wouldn't work (said it needed missing programs to run or something). So currently posting this from another comp.

    3) I tried opening iTunes and it told me there were problems with playing audio and video. All my files are there, but nothing plays.

    Anyway, so here's the log, I'll go back and run OTL again, but for now here's what came up after re-boot:



    All processes killed
    ========== COMMANDS ==========
    Restore point Set: OTL Restore Point (0)
    ========== FILES ==========
    File move failed. C:\WINDOWS\system32\gnhnveo.dll scheduled to be moved on reboot.
    ========== REGISTRY ==========
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List\\3453:TCP deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\\C:\Documents and Settings\willmonotti\Desktop\utorrent.exe deleted successfully.
    ========== OTL ==========
    Service HidServ stopped successfully!
    Service HidServ deleted successfully!
    File C:\WINDOWS\System32\hidserv.dll File not found not found.
    Service CiscoVpnInstallService stopped successfully!
    Service CiscoVpnInstallService deleted successfully!
    File C:\DOCUME~1\WILLMO~1\LOCALS~1\TEMP\INSTAL~1.EXE File not found not found.
    Service Ati HotKey Poller stopped successfully!
    Service Ati HotKey Poller deleted successfully!
    File C:\WINDOWS\System32\Ati2evxx.exe File not found not found.
    Service Lbd stopped successfully!
    Service Lbd deleted successfully!
    File C:\WINDOWS\System32\DRIVERS\Lbd.sys File not found not found.
    HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b0cda128-b425-4eef-a174-61a11ac5dbf8}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b0cda128-b425-4eef-a174-61a11ac5dbf8}\ not found.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\HotKeysCmds deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\IgfxTray deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\KTPWare deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\SoundMan deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\akvwx deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cito0 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\cydo8 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\dezpq deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\DW6 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\dzuklg2 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\dzuva deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\ezqqlcc deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\faawmm deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\falhcc deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\hcyytkk deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\hxdtp deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\lbhc6y deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\llmcdi deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mcdi3e deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\mmiyy6k deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\MsnMsgr deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\nojpk0r deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\pkkgww deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\qhxiioj deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\rcc86 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\snoejuf deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\teea6r deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\tkkfww deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\upggbs deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\uplbbxc deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vgr60 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\vqwxin deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wbxxoo3 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wcxtoeu deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\wrmns deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\xdtyuua deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\xsoo8 deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\yuupgg deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\yzpf0w deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\zaflw deleted successfully.
    Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\zuvqm deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
    Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
    Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveAutoRun deleted successfully.
    Starting removal of ActiveX control {31435657-9980-0010-8000-00AA00389B71}
    C:\WINDOWS\Downloaded Program Files\wvc1dmo.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{31435657-9980-0010-8000-00AA00389B71}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{31435657-9980-0010-8000-00AA00389B71}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31435657-9980-0010-8000-00AA00389B71}\ not found.
    Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
    Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
    C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
    Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
    C:\AUTOEXEC.BAT moved successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0198223c-57e9-11de-a977-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0198223c-57e9-11de-a977-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0198223c-57e9-11de-a977-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{095707e1-8304-11de-a97c-b956f7f66bd7}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{095707e1-8304-11de-a97c-b956f7f66bd7}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{095707e1-8304-11de-a97c-b956f7f66bd7}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0cdf25b0-dbc3-11de-a988-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{688fe0c4-ec8b-11de-a99e-0013ce34ce68}\ not found.
    C:\WINDOWS\system32\setup.exe moved successfully.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28224-3f1b-11df-a9cb-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{86e28225-3f1b-11df-a9cb-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1542-7cf9-11df-a9e1-00059a3c7800}\ not found.
    File F:\WD SmartWare.exe not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b3de1543-7cf9-11df-a9e1-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c092c4e6-4125-11df-a9cd-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c7ad71ec-5c09-11de-a978-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ca9e7a78-f678-11dd-a94f-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dbc09e98-fe3a-11dd-a953-0013ce34ce68}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e03ecff4-2297-11de-a963-00059a3c7800}\ not found.
    Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e03ecff4-2297-11de-a963-00059a3c7800}\ not found.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e03ecff4-2297-11de-a963-00059a3c7800}\ not found.
    Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
    6to4 removed from NetSvcs value successfully!
    HidServ removed from NetSvcs value successfully!
    Ias removed from NetSvcs value successfully!
    Iprip removed from NetSvcs value successfully!
    NWCWorkstation removed from NetSvcs value successfully!
    Nwsapagent removed from NetSvcs value successfully!
    WmdmPmSp removed from NetSvcs value successfully!
    ywyyitdy removed from NetSvcs value successfully!
    Service ywyyitdy stopped successfully!
    Service ywyyitdy deleted successfully!
    File move failed. C:\WINDOWS\system32\gnhnveo.dll scheduled to be moved on reboot.
    C:\commy folder moved successfully.
    C:\FOUND.031 folder moved successfully.
    C:\FOUND.030 folder moved successfully.
    C:\FOUND.029 folder moved successfully.
    C:\FOUND.028 folder moved successfully.
    C:\FOUND.027 folder moved successfully.
    C:\FOUND.026 folder moved successfully.
    C:\FOUND.025 folder moved successfully.
    C:\FOUND.024 folder moved successfully.
    C:\FOUND.023 folder moved successfully.
    C:\FOUND.022 folder moved successfully.
    C:\FOUND.021 folder moved successfully.
    C:\FOUND.020 folder moved successfully.
    C:\FOUND.009 folder moved successfully.
    C:\FOUND.008 folder moved successfully.
    C:\FOUND.007 folder moved successfully.
    C:\FOUND.006 folder moved successfully.
    C:\FOUND.005 folder moved successfully.
    C:\FOUND.004 folder moved successfully.
    C:\FOUND.003 folder moved successfully.
    C:\FOUND.002 folder moved successfully.
    C:\FOUND.001 folder moved successfully.
    C:\FOUND.000 folder moved successfully.
    C:\WINDOWS\tasks\PerfectOptimizer_home.job moved successfully.
    C:\WINDOWS\ds467.dll moved successfully.
    C:\Documents and Settings\willmonotti\Application Data\uTorrent folder moved successfully.
    C:\Ask & Record Toolbar Setup Log.txt moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\erunt-setup.exe moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\commy.exe moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\mbam-setup.exe moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\WindowsSearch-KB940157-XP-x86-enu.exe moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\jre-6u18-windows-i586-s.exe moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\spybotsd162.exe moved successfully.
    C:\Documents and Settings\willmonotti\Desktop\avast_home_setup.exe moved successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: All Users

    User: NetworkService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 38286 bytes

    User: LocalService
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 34449 bytes

    User: Administrator
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: willmonotti
    ->Temp folder emptied: 175788 bytes
    ->Temporary Internet Files folder emptied: 33170 bytes
    ->Java cache emptied: 0 bytes
    ->FireFox cache emptied: 3772584 bytes
    ->Google Chrome cache emptied: 215038035 bytes
    ->Apple Safari cache emptied: 0 bytes
    ->Flash cache emptied: 9580 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\dllcache .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 16384 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
    %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 209.00 mb


    OTL by OldTimer - Version 3.2.11.0 log created on 09092010_231100

    Files\Folders moved on Reboot...
    C:\WINDOWS\system32\gnhnveo.dll moved successfully.

    Registry entries deleted on Reboot...

  5. #25
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    OK, here's the log of the OTL Quick Scan:



    OTL logfile created on: 9/09/2010 11:31:51 PM - Run 2
    OTL by OldTimer - Version 3.2.11.0 Folder = C:\Documents and Settings\willmonotti\Desktop
    Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
    Internet Explorer (Version = 6.0.2900.2180)
    Locale: 00000C09 | Country: Australia | Language: ENA | Date Format: d/MM/yyyy

    1,015.00 Mb Total Physical Memory | 461.00 Mb Available Physical Memory | 45.00% Memory free
    2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
    Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
    Drive C: | 74.51 Gb Total Space | 4.31 Gb Free Space | 5.79% Space Free | Partition Type: FAT32
    D: Drive not present or media not loaded
    E: Drive not present or media not loaded
    F: Drive not present or media not loaded
    G: Drive not present or media not loaded
    H: Drive not present or media not loaded
    I: Drive not present or media not loaded

    Computer Name: WILL
    Current User Name: willmonotti
    Logged in as Administrator.

    Current Boot Mode: Normal
    Scan Mode: Current user
    Company Name Whitelist: On
    Skip Microsoft Files: On
    File Age = 90 Days
    Output = Minimal
    Quick Scan

    ========== Processes (SafeList) ==========

    PRC - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
    PRC - C:\Documents and Settings\willmonotti\Local Settings\Application Data\Google\Chrome\Application\chrome.exe (Google Inc.)
    PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
    PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
    PRC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
    PRC - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
    PRC - C:\Program Files\Last.fm\LastFM.exe (Last.fm)
    PRC - C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    PRC - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)
    PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)


    ========== Modules (SafeList) ==========

    MOD - C:\Documents and Settings\willmonotti\Desktop\OTL.exe (OldTimer Tools)
    MOD - C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll (Microsoft Corporation)
    MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)


    ========== Win32 Services (SafeList) ==========

    SRV - (getPlusHelper) getPlus(R) -- C:\Program Files\NOS\bin\getPlus_Helper.dll (NOS Microsystems Ltd.)
    SRV - (WDDMService) -- C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe (WDC)
    SRV - (WDSmartWareBackgroundService) -- C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe (Memeo)
    SRV - (CVPND) -- C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe (Cisco Systems, Inc.)


    ========== Driver Services (SafeList) ==========

    DRV - (WDC_SAM) -- C:\WINDOWS\system32\drivers\wdcsam.sys (Western Digital Technologies)
    DRV - (CVPNDRVA) -- C:\WINDOWS\system32\drivers\CVPNDRVA.sys (Cisco Systems, Inc.)
    DRV - (DNE) -- C:\WINDOWS\system32\drivers\dne2000.sys (Deterministic Networks, Inc.)
    DRV - (vsdatant) -- C:\WINDOWS\system32\vsdatant.sys (Zone Labs, LLC)
    DRV - (CVirtA) -- C:\WINDOWS\system32\drivers\CVirtA.sys (Cisco Systems, Inc.)
    DRV - (NTIDrvr) -- C:\WINDOWS\system32\drivers\NTIDrvr.sys (NewTech Infosystems, Inc.)
    DRV - (ALCXWDM) Service for Realtek AC97 Audio (WDM) -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS (Realtek Semiconductor Corp.)
    DRV - (ESDCR) -- C:\WINDOWS\system32\drivers\ESD7SK.sys (ENE Technology Inc.)
    DRV - (ESMCR) -- C:\WINDOWS\system32\drivers\ESM7SK.sys (ENE Technology Inc.)
    DRV - (Ktp) -- C:\WINDOWS\system32\drivers\Ktp.sys (ELANTECH Devices Corp.)
    DRV - (b57w2k) Broadcom NetLink (TM) -- C:\WINDOWS\system32\drivers\b57xp32.sys (Broadcom Corporation)
    DRV - (ati2mtag) -- C:\WINDOWS\system32\drivers\ati2mtag.sys (ATI Technologies Inc.)
    DRV - (EMSCR) -- C:\WINDOWS\system32\drivers\EMS7SK.sys (ENE Technology Inc.)
    DRV - (BCM43XX) -- C:\WINDOWS\system32\drivers\BCMWL5.SYS (Broadcom Corporation)
    DRV - (UBHelper) -- C:\WINDOWS\System32\drivers\UBHelper.sys ()
    DRV - (HSFHWICH) -- C:\WINDOWS\system32\drivers\HSFHWICH.sys (Conexant Systems, Inc.)
    DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
    DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)
    DRV - (w29n51) Intel(R) -- C:\WINDOWS\system32\drivers\w29n51.sys (Intel® Corporation)
    DRV - (bcm4sbxp) -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys (Broadcom Corporation)
    DRV - (SMCIRDA) -- C:\WINDOWS\system32\drivers\smcirda.sys (SMSC)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

    IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://trinity.unimelb.edu.au/portal
    IE - HKCU\..\URLSearchHook: {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1
    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = wwwproxy.student.unimelb.edu.au:8000

    ========== FireFox ==========

    FF - prefs.js..browser.search.defaultenginename: "AIM Search"
    FF - prefs.js..browser.search.defaulturl: "http://aim.search.aol.com/search/search?query={searchTerms}&invocationType=tb50-ff-aim-chromesbox-en-us"
    FF - prefs.js..browser.startup.homepage: "https://www.trinitycollege.vic.edu.au/portal/today/today.php"
    FF - prefs.js..extensions.enabledItems: {E2883E8F-472F-4fb0-9522-AC9BF37916A7}:1.6.2.53
    FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
    FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
    FF - prefs.js..keyword.URL: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2706&invocationType=tb50-ff-aim-ab-en-us&query="
    FF - prefs.js..network.proxy.backup.ftp: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.ftp_port: 8000
    FF - prefs.js..network.proxy.backup.gopher: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.gopher_port: 8000
    FF - prefs.js..network.proxy.backup.socks: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.socks_port: 8000
    FF - prefs.js..network.proxy.backup.ssl: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.backup.ssl_port: 8000
    FF - prefs.js..network.proxy.ftp: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.ftp_port: 8000
    FF - prefs.js..network.proxy.gopher: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.gopher_port: 8000
    FF - prefs.js..network.proxy.http: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.http_port: 8000
    FF - prefs.js..network.proxy.share_proxy_settings: true
    FF - prefs.js..network.proxy.socks: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.socks_port: 8000
    FF - prefs.js..network.proxy.ssl: "wwwproxy.unimelb.edu.au"
    FF - prefs.js..network.proxy.ssl_port: 8000
    FF - prefs.js..network.proxy.type: 1


    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009/02/09 18:52:32 | 000,000,000 | ---D | M]
    FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/02/09 18:52:32 | 000,000,000 | ---D | M]

    [2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Extensions
    [2009/02/09 18:52:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions
    [2009/06/03 19:00:26 | 000,000,000 | ---D | M] (MediaWrap) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{dd68c513-9296-4b63-8d8b-8f1c991c8a48}
    [2009/12/12 17:56:04 | 000,000,000 | ---D | M] (Adobe DLM (powered by getPlus(R))) -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}
    [2009/03/25 20:14:48 | 000,001,620 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\mozilla-add-ons.xml
    [2009/05/22 01:42:46 | 000,004,140 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Mozilla\Firefox\Profiles\qtrsc0zj.default\searchplugins\youtube.xml
    [2009/02/09 18:52:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
    [2010/04/23 23:02:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
    [2010/04/23 23:01:54 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
    [2010/03/12 18:57:14 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml
    [2010/03/12 18:57:14 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml
    [2010/03/12 18:57:14 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml
    [2010/03/12 18:57:14 | 000,001,135 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

    O1 HOSTS File: ([2009/11/20 21:35:48 | 000,000,732 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O2 - BHO: (AOLSearchHook Class) - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll (America Online, Inc.)
    O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    O2 - BHO: (no name) - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - No CLSID value found.
    O4 - HKLM..\Run: [BluetoothAuthenticationAgent] C:\WINDOWS\System32\bthprops.cpl (Microsoft Corporation)
    O4 - HKLM..\Run: [IMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)
    O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)
    O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()
    O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
    O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)
    O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE File not found
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk = C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico ()
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe (WDC)
    O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe (Western Digital)
    O8 - Extra context menu item: E&xport to Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
    O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
    O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
    O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} Reg Error: Value error. (Reg Error: Key error.)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 203.28.240.18 203.28.240.20
    O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
    O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
    O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
    O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
    O24 - Desktop WallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O24 - Desktop BackupWallPaper: C:\Documents and Settings\willmonotti\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
    O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
    O32 - HKLM CDRom: AutoRun - 1
    O33 - MountPoints2\F\Shell - "" = AutoRun
    O33 - MountPoints2\F\Shell\AutoRun - "" = Auto&Play
    O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\WD SmartWare.exe -- File not found
    O33 - MountPoints2\G\Shell - "" = AutoRun
    O33 - MountPoints2\G\Shell\AutoRun - "" = Auto&Play
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = comfile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*


    Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
    Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
    Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
    Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
    Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
    Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
    Unable to start service SrService!

    ========== Files/Folders - Created Within 90 Days ==========

    [2010/09/09 23:11:00 | 000,000,000 | ---D | C] -- C:\_OTL
    [2010/09/09 23:09:40 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
    [2010/09/09 15:37:43 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
    [2010/09/08 22:11:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Malwarebytes
    [2010/09/08 22:11:18 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
    [2010/09/08 22:11:17 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
    [2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2010/09/08 22:11:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    [2010/09/08 19:57:45 | 000,000,000 | --SD | C] -- C:\ComboFix
    [2010/09/08 19:54:53 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
    [2010/09/08 19:54:53 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
    [2010/09/08 19:54:53 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
    [2010/09/08 19:54:16 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2010/09/05 12:25:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
    [2010/09/01 23:56:04 | 000,000,000 | ---D | C] -- C:\Program Files\Safer Networking
    [2010/09/01 23:53:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
    [2010/08/31 18:26:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\My eBooks
    [2010/08/26 14:56:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Desktop\VPN
    [2010/06/30 17:10:22 | 000,000,000 | ---D | C] -- C:\CyberFoot2007
    [2010/06/30 16:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\SuperSoccerManager 2005
    [2010/06/21 16:04:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western_Digital
    [2010/06/21 16:01:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
    [2010/06/21 16:01:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Western Digital
    [2010/06/21 16:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\ServiceTest
    [2010/06/21 16:01:31 | 000,011,520 | ---- | C] (Western Digital Technologies) -- C:\WINDOWS\System32\drivers\wdcsam.sys
    [2010/06/21 16:01:13 | 000,000,000 | ---D | C] -- C:\Program Files\Western Digital
    [2010/06/21 15:58:02 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
    [2010/06/21 15:57:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
    [2010/06/21 15:56:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Western Digital
    [2010/06/16 20:12:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\My Documents\Downloads
    [2010/06/16 20:03:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\Temp
    [2008/08/29 14:00:00 | 001,822,520 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
    [2008/08/29 14:00:00 | 001,708,856 | ---- | C] (Microsoft Corporation) -- C:\Program Files\instmsi.exe

    ========== Files - Modified Within 90 Days ==========

    [2010/09/09 23:32:36 | 007,602,176 | -H-- | M] () -- C:\Documents and Settings\willmonotti\NTUSER.DAT
    [2010/09/09 23:17:44 | 000,002,155 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\iTunes.lnk
    [2010/09/09 23:13:00 | 000,002,447 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\VPN Client.lnk
    [2010/09/09 23:12:36 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
    [2010/09/09 23:12:36 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
    [2010/09/09 23:11:42 | 000,000,012 | ---- | M] () -- C:\WINDOWS\bthservsdp.dat
    [2010/09/09 23:11:40 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\willmonotti\ntuser.ini
    [2010/09/09 23:09:42 | 000,000,519 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\NTREGOPT.lnk
    [2010/09/09 23:09:42 | 000,000,500 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\ERUNT.lnk
    [2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
    [2010/09/09 14:30:40 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
    [2010/09/09 00:47:02 | 000,000,950 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
    [2010/09/08 22:11:22 | 000,000,604 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
    [2010/09/08 11:57:40 | 000,002,451 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\VPN Client.lnk
    [2010/09/08 00:40:18 | 000,175,616 | ---- | M] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2010/09/05 12:15:44 | 000,525,824 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
    [2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
    [2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
    [2010/09/01 19:56:14 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk
    [2010/08/30 14:18:04 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
    [2010/08/22 20:09:32 | 000,002,238 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
    [2010/08/22 20:09:32 | 000,002,216 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2010/08/03 17:15:28 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
    [2010/06/30 17:10:24 | 000,000,490 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
    [2010/06/21 16:01:38 | 000,001,026 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
    [2010/06/21 16:01:38 | 000,000,965 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
    [2010/06/21 16:01:00 | 000,411,674 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
    [2010/06/21 16:01:00 | 000,397,110 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
    [2010/06/21 16:01:00 | 000,060,514 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
    [2010/06/16 19:58:30 | 000,002,205 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Apple Safari.lnk

    ========== Files Created - No Company Name ==========

    [2010/09/09 23:08:36 | 000,000,519 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\NTREGOPT.lnk
    [2010/09/09 23:08:36 | 000,000,500 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\ERUNT.lnk
    [2010/09/08 22:11:21 | 000,000,604 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
    [2010/09/08 19:54:53 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
    [2010/09/08 19:54:53 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
    [2010/09/08 19:54:53 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
    [2010/09/08 19:54:53 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe
    [2010/09/08 19:54:53 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
    [2010/09/08 13:04:13 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
    [2010/09/05 12:15:46 | 000,525,824 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\dds.scr
    [2010/09/05 00:42:46 | 000,000,950 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-4089067542-3450742136-2425182029-1004Core1cb4c3f70ac632c.job
    [2010/06/30 17:10:22 | 000,000,490 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\CyberFoot 2007.lnk
    [2010/06/21 16:01:37 | 000,001,026 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDSmartWare.lnk
    [2010/06/21 16:01:37 | 000,000,965 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WDDMStatus.lnk
    [2010/06/16 20:04:19 | 000,002,238 | ---- | C] () -- C:\Documents and Settings\willmonotti\Desktop\Google Chrome.lnk
    [2010/06/16 20:04:19 | 000,002,216 | ---- | C] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
    [2009/04/19 22:12:37 | 000,001,127 | ---- | C] () -- C:\WINDOWS\wincmd.ini
    [2009/04/03 13:26:13 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
    [2009/02/14 22:30:45 | 000,175,616 | ---- | C] () -- C:\Documents and Settings\willmonotti\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/10/16 11:46:40 | 000,000,700 | ---- | C] () -- C:\Program Files\studentVPN.pcf
    [2008/08/29 14:00:22 | 000,001,073 | ---- | C] () -- C:\Program Files\sig.dat
    [2008/08/29 14:00:20 | 000,001,099 | ---- | C] () -- C:\Program Files\vpnclient_setup.ini
    [2008/08/29 14:00:18 | 000,052,224 | ---- | C] () -- C:\Program Files\vpnclient_jp.mst
    [2008/08/29 14:00:06 | 010,935,808 | ---- | C] () -- C:\Program Files\vpnclient_setup.msi
    [2008/08/29 14:00:04 | 000,051,200 | ---- | C] () -- C:\Program Files\vpnclient_fc.mst
    [2008/08/29 14:00:00 | 000,000,819 | ---- | C] () -- C:\Program Files\vpnclient_setup.sms
    [2008/08/29 14:00:00 | 000,000,640 | ---- | C] () -- C:\Program Files\vpnclient_setup.pdf
    [2008/08/29 13:59:58 | 000,056,832 | ---- | C] () -- C:\Program Files\vpnclient_setup.exe
    [2008/08/29 13:58:26 | 000,197,408 | ---- | C] () -- C:\WINDOWS\System32\vpnapi.dll
    [2008/08/29 13:58:16 | 000,193,312 | ---- | C] () -- C:\WINDOWS\System32\CSGina.dll
    [2008/08/29 13:58:04 | 000,221,315 | ---- | C] () -- C:\Program Files\installservice.exe
    [2008/08/29 13:57:32 | 000,016,505 | ---- | C] () -- C:\Program Files\DelayInst.exe
    [2005/05/26 09:49:35 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
    [2005/05/26 09:35:20 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Acer.ini
    [2005/05/26 09:35:18 | 000,000,329 | ---- | C] () -- C:\WINDOWS\uninstall.ini
    [2005/05/26 09:31:07 | 000,356,352 | ---- | C] () -- C:\WINDOWS\EMCRI.dll
    [2005/05/24 15:16:04 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIFCD3.dll
    [2005/05/24 15:15:12 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll
    [2005/05/24 15:02:43 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini
    [2005/05/24 15:02:39 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
    [2005/05/24 14:58:31 | 000,037,776 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
    [2005/05/24 14:50:20 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
    [2005/05/24 14:35:43 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys
    [2005/05/24 14:35:27 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
    [2004/12/17 17:14:44 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys
    [2001/12/26 16:12:30 | 000,065,536 | R--- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll
    [2001/09/03 23:46:38 | 000,110,592 | R--- | C] () -- C:\WINDOWS\System32\Hmpg12.dll
    [2001/07/30 16:33:56 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll
    [2001/07/23 22:04:36 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll
    [1980/01/01 00:00:00 | 000,000,085 | ---- | C] () -- C:\WINDOWS\ALAUNCH.INI

    ========== LOP Check ==========

    [2009/02/12 21:49:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
    [2009/02/14 21:58:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
    [2009/07/01 00:19:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
    [2009/12/07 21:45:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AIM
    [2010/03/30 01:38:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
    [2010/06/21 16:01:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Western Digital
    [2009/02/14 22:08:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\USM2
    [2009/07/02 23:01:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\gtk-2.0
    [2009/10/19 19:29:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Audacity
    [2009/11/22 17:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\foobar2000
    [2009/12/07 21:45:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\acccore
    [2010/03/07 01:14:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Windows Search
    [2010/06/21 16:01:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\willmonotti\Application Data\Western Digital
    [2010/09/02 22:28:02 | 000,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
    [2010/03/25 00:07:32 | 000,000,516 | ---- | M] () -- C:\WINDOWS\Tasks\Install_NSS.job

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2005/05/26 11:33:48 | 000,000,076 | RHS- | M] () -- C:\PRELOAD.AAA
    [2004/08/04 05:00:00 | 000,250,032 | RHS- | M] () -- C:\ntldr
    [2004/08/04 05:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
    [2010/09/01 23:57:52 | 000,000,245 | RHS- | M] () -- C:\boot.ini
    [2005/05/24 14:53:22 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
    [2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2005/05/24 14:53:22 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2005/05/26 11:34:00 | 000,000,003 | ---- | M] () -- C:\PRELOAD.TAG
    [2010/09/09 23:12:36 | 1064,812,544 | -HS- | M] () -- C:\hiberfil.sys
    [2009/11/30 00:48:10 | 000,012,540 | ---- | M] () -- C:\aaw7boot.log
    [2009/07/12 00:02:54 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt00.sqm
    [2009/07/12 00:02:54 | 000,000,268 | -H-- | M] () -- C:\sqmdata00.sqm
    [2009/07/17 11:34:36 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt01.sqm
    [2009/07/17 11:34:36 | 000,000,268 | -H-- | M] () -- C:\sqmdata01.sqm
    [2009/08/03 12:34:06 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt02.sqm
    [2009/08/03 12:34:06 | 000,000,268 | -H-- | M] () -- C:\sqmdata02.sqm
    [2009/08/19 13:58:24 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt03.sqm
    [2009/08/19 13:58:24 | 000,000,268 | -H-- | M] () -- C:\sqmdata03.sqm
    [2009/08/21 15:15:00 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt04.sqm
    [2009/08/21 15:15:00 | 000,000,268 | -H-- | M] () -- C:\sqmdata04.sqm
    [2009/08/23 15:08:18 | 000,000,244 | -H-- | M] () -- C:\sqmnoopt05.sqm
    [2009/08/23 15:08:18 | 000,000,268 | -H-- | M] () -- C:\sqmdata05.sqm
    [2009/12/07 21:45:34 | 000,000,397 | -H-- | M] () -- C:\IPH.PH
    [2010/09/09 23:12:34 | 1598,029,824 | -HS- | M] () -- C:\pagefile.sys

    < %systemroot%\Fonts\*.com >

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2005/05/24 14:52:46 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2006/10/26 19:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >
    [2004/06/14 11:25:16 | 000,187,392 | ---- | M] () -- C:\WINDOWS\Acer.scr

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2008/08/29 14:00:06 | 010,935,808 | ---- | M] () -- C:\Program Files\vpnclient_setup.msi
    [2008/08/29 14:00:00 | 000,000,640 | ---- | M] () -- C:\Program Files\vpnclient_setup.pdf
    [2008/08/29 14:00:00 | 000,000,819 | ---- | M] () -- C:\Program Files\vpnclient_setup.sms
    [2008/08/29 13:57:32 | 000,016,505 | ---- | M] () -- C:\Program Files\DelayInst.exe
    [2008/08/29 13:58:04 | 000,221,315 | ---- | M] () -- C:\Program Files\installservice.exe
    [2008/08/29 14:00:00 | 001,708,856 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsi.exe
    [2008/08/29 14:00:00 | 001,822,520 | ---- | M] (Microsoft Corporation) -- C:\Program Files\instmsiw.exe
    [2008/08/29 14:00:22 | 000,001,073 | ---- | M] () -- C:\Program Files\sig.dat
    [2008/08/29 14:00:04 | 000,051,200 | ---- | M] () -- C:\Program Files\vpnclient_fc.mst
    [2008/08/29 14:00:18 | 000,052,224 | ---- | M] () -- C:\Program Files\vpnclient_jp.mst
    [2008/08/29 13:59:58 | 000,056,832 | ---- | M] () -- C:\Program Files\vpnclient_setup.exe
    [2008/08/29 14:00:20 | 000,001,099 | ---- | M] () -- C:\Program Files\vpnclient_setup.ini
    [2008/10/16 11:46:40 | 000,000,700 | ---- | M] () -- C:\Program Files\studentVPN.pcf

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2005/05/24 14:42:34 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav
    [2005/05/24 14:42:34 | 000,659,456 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
    [2005/05/24 14:42:34 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
    [2005/05/24 14:53:24 | 000,000,294 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2009/02/08 06:41:04 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
    [2005/05/24 14:59:42 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\willmonotti\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

    < %USERPROFILE%\Desktop\*.exe >
    [2010/09/08 13:04:16 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\umsywfnu.exe
    [2010/09/09 15:37:44 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\willmonotti\Desktop\OTL.exe
    [1997/10/06 21:15:48 | 000,045,056 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\Join32.exe
    [1997/10/06 21:22:28 | 000,033,024 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\JOIN16.EXE
    [2009/04/04 18:03:12 | 526,428,264 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\willmonotti\Desktop\X12-30307.exe
    [2009/04/11 17:26:22 | 001,234,120 | ---- | M] () -- C:\Documents and Settings\willmonotti\Desktop\wrar380.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >
    [2004/08/04 05:00:00 | 000,000,791 | ---- | M] () -- C:\WINDOWS\addins\fxsext.ecf

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2009/02/08 06:41:04 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\willmonotti\Favorites\Desktop.ini
    [2009/03/11 00:06:58 | 000,000,579 | ---- | M] () -- C:\Documents and Settings\willmonotti\Favorites\First Principles of Business Law.lnk

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >
    [2010/09/09 23:17:46 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\willmonotti\Cookies\index.dat

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >
    [2004/08/04 05:00:00 | 000,208,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.exe >
    [2004/08/04 01:06:34 | 001,667,584 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >
    [1998/12/25 08:15:38 | 000,345,983 | ---- | M] () -- C:\WINDOWS\system\RCDsetup.exe

    < %USERPROFILE%\Templates\*.tmp >

    < %SYSTEMDRIVE%\explorexxx.exe\*.* >

    < %Windir%\Installer\*.tmp >
    [2 C:\WINDOWS\Installer\*.tmp files -> C:\WINDOWS\Installer\*.tmp -> ]

    < %systemroot%\System32\*.xco >

    < %ProgramFiles%\system32\*.* >

    < %systemroot%\System32\windos\*.* >

    < %SystemRoot%\system32\sandbox\*.* >

    < %SystemRoot%\system32\*.amo >

    < %SystemRoot%\system32\Windows Live\*.* >

    < %ProgramFiles%\logs\*.* >

    < %ProgramFiles%\Bifrost\*.* >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
    < End of report >

  6. #26
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    • Click Start >> All Programs >> Accessories >> System Tools then click System Restore
    • On the Welcome to System Restore page, click Restore my computer to an earlier time (if it is not already selected) then click Next
    • On the Select a Restore Point page, click the OTL Restore Point then click Next
    • On the Confirm Restore Point Selection page, click Next
    • System Restore should restore the previous Windows XP configuration & restart the computer
    Let me know what happens.

  7. #27
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    :( :(

    System Restore wouldn't open! I tried clicking on it...got a pop which said:

    "System Restore is not able to protect your computer. Please restart your computer, and then run System Restore again".

    I restarted as instructed, but just got the same message.

    Any ideas? Still not able to create any kind of internet connection on the machine...this is most important! Please help!

  8. #28
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    Hi

    Did you back up the registry as advised with Erunt? If so do this:
    Navigate to the folder where the backup is saved
    Double click on ERDNT.exe then OK
    When the program opens click OK

    Le me know what happens.

    Do you have an XP Installation disc?

  9. #29
    Junior Member
    Join Date
    Sep 2010
    Posts
    21

    Default

    OK, so managed to restore Internet connections etc through ERUNT.

    Any advice as to how to proceed from here?

  10. #30
    Senior Member
    Join Date
    Feb 2010
    Location
    Port Hedland, Western Australia
    Posts
    155

    Default

    We'll try ComboFix again... a little differently.

    Delete the copy of ComboFix you have & download it again:
    Link 1
    Link 2
    Don't run it just yet.
    • Go to Microsoft's website => http://support.microsoft.com/kb/310994
    • Scroll down to Step 1 (where it says: Step 1: Download the Setup disk program) & select the download that's appropriate for your Operating System (Windows XP Service Pack 2 (SP2). Download the file & save it as it's originally named.
      Note: If you have SP3, use the SP2 package.
    • Save the file to the desktop of your computer
    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • Drag the setup package onto ComboFix.exe and drop it
    • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console
    • At the next prompt, click No to exit
    • At the next prompt, click 'Yes' to run the full ComboFix scan.
    • When finished, it will produce a report for you
    Post the C:\ComboFix.txt in your next reply.
    Last edited by jmw3; 2010-09-10 at 17:53.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •