Something sending scam Mails from my Adress [Archive]

Zaradoom

2010-11-15, 22:17

Since yesterday i received 196 "mailer deamon" mails. This is the address that tells you "Sorry, but i could not sent your mail, the address does not exist"

So i can only guess how many mails were sent from my email account.

Spybot did not find any infections.
Norton did not find any infections.
Kaspersky did not find anything.
Changed my Email PW several times, did not help either.
Peerblock did not block anything suspicious either.

So, i am out of ideas.

here is the requested Log:

DDS (Ver_10-11-10.01) - NTFS_AMD64
Run by Marco at 21:05:54,23 on 15.11.2010
Internet Explorer: 8.0.7600.16385
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.4094.2388 [GMT 1:00]

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\nvvsvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe
C:\Windows\SysWOW64\vmnat.exe
C:\Windows\SysWOW64\vmnetdhcp.exe
C:\ProgrammeXL\VMWare\vmware-authd.exe
C:\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe
C:\ProgrammeXL\PeerBlock\peerblock.exe
C:\ProgrammeXL\VMWare\vmware-tray.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\ProgrammeXL\Mozilla Firefox\firefox.exe
C:\ProgrammeXL\Mozilla Firefox\plugin-container.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Marco\Desktop\dds.scr
C:\Windows\system32\conhost.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - C:\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - C:\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\IPSBHO.DLL
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - C:\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\coIEPlg.dll
uRun: [PeerBlock] C:\ProgrammeXL\PeerBlock\peerblock.exe
uRun: [AdobeBridge]
uRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10k_Plugin.exe -update plugin
mRun: [vmware-tray] "C:\ProgrammeXL\VMWare\vmware-tray.exe"
mPolicies-explorer: NoActiveDesktop = 1 (0x1)
mPolicies-explorer: NoActiveDesktopChanges = 1 (0x1)
mPolicies-system: ConsentPromptBehaviorAdmin = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
mPolicies-system: PromptOnSecureDesktop = 0 (0x0)
LSP: C:\ProgrammeXL\VMWare\vsocklib.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Filter: text/xml - {807573E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL
mASetup: {5HK7D34V-TD33-7WMC-EG1Y-SY5U0PM1MM20} - C:\Windows\install\winupdtr.exe Restart
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}
{B4F3A835-0E21-4959-BA22-42B3008E02FF}
TB-X64: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
mRun-x64: [BCSSync] "C:\Program Files\Microsoft Office\Office14\BCSSync.exe" /DelayServices
mRun-x64: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
SEH-X64: {B5A7F190-DDA6-4420-B3BA-52453494E6CD}: Groove GFS Stub Execution Hook
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - C:\Users\Marco\AppData\Roaming\Mozilla\Firefox\Profiles\v6k880yt.default\
FF - prefs.js: keyword.URL - hxxp://go.gmx.net/tb/mff_keyurl_search/?su=
FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\coFFPlgn\components\coFFPlgn.dll
FF - component: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\IPSFFPlgn\components\IPSFFPl.dll
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL
FF - plugin: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL
FF - plugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Opera\program\plugins\np_gp.dll
FF - plugin: C:\ProgrammeXL\Reader 9.0\Reader\browser\nppdf32.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll

---- FIREFOX POLICIES ----
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqz9s", true); // Traditional
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--fiqs8s", true); // Simplified
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--j6w193g", true);
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4a87g", true);
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7c0a67fbc", true);
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbqly7cvafr", true);
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kpry57d", true); // Traditional
C:\ProgrammeXL\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--kprw13d", true); // Simplified

============= SERVICES / DRIVERS ===============

R0 SymDS;Symantec Data Store;C:\Windows\System32\drivers\NISx64\1201000.025\SymDS64.sys [2010-10-2 450096]
R0 SymEFA;Symantec Extended File Attributes;C:\Windows\System32\drivers\NISx64\1201000.025\SymEFA64.sys [2010-10-2 821808]
R1 BHDrvx64;BHDrvx64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\BASHDefs\20101104.001\BHDrvx64.sys [2010-11-4 953904]
R1 IDSVia64;IDSVia64;C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_18.1.0.37\Definitions\IPSDefs\20101112.001\IDSviA64.sys [2010-10-19 476720]
R1 SymIRON;Symantec Iron Driver;C:\Windows\System32\drivers\NISx64\1201000.025\Ironx64.sys [2010-10-2 168496]
R1 SymNetS;Symantec Network Security WFP Driver;C:\Windows\System32\drivers\NISx64\1201000.025\symnets.sys [2010-10-2 381488]
R2 NIS;Norton Internet Security;C:\Program Files (x86)\Norton Internet Security\Engine\18.1.0.37\ccSvcHst.exe [2010-10-2 126904]
R2 VMUSBArbService;VMware USB Arbitration Service;C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator.exe [2010-9-21 539184]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2010-10-3 132656]
R3 pbfilter;pbfilter;C:\ProgrammeXL\PeerBlock\pbfilter.sys [2010-9-5 19544]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2009-3-1 187392]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S3 Microsoft SharePoint Workspace Audit Service;Microsoft SharePoint Workspace Audit Service;C:\Program Files\Microsoft Office\Office14\GROOVE.EXE [2010-3-25 51456888]
S3 ose64;Office 64 Source Engine;C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2010-1-9 174440]
S3 osppsvc;Office Software Protection Platform;C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-1-9 4925184]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S4 KMService;KMService;C:\Windows\system32\srvany.exe --> C:\Windows\system32\srvany.exe [?]
S4 MSSQLServerADHelper100;SQL Server Hilfsdienst für Active Directory;C:\Program Files\Microsoft SQL Server\100\Shared\sqladhlp.exe [2009-7-21 61976]
S4 RsFx0103;RsFx0103 Driver;C:\Windows\System32\drivers\RsFx0103.sys [2009-3-30 311656]
S4 SQLAgent$SQLEXPRESS;SQL Server-Agent (SQLEXPRESS);C:\Program Files\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE [2009-3-30 427880]

=============== Created Last 30 ================

2010-11-15 20:04:03 -------- d-----w- C:\programme XL
2010-11-15 05:59:05 388096 ----a-r- C:\Users\Marco\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-11-12 18:40:09 -------- d-----w- C:\Users\Marco\AppData\Local\Temporary Projects
2010-11-04 02:01:52 -------- d-----w- C:\Users\Marco\AppData\Roaming\Microsoft Corporation
2010-11-03 20:10:15 -------- d-----w- C:\Users\Marco\AppData\Roaming\IrfanView
2010-11-02 12:33:56 78872 ----a-w- C:\Windows\System32\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-11-02 12:33:56 50200 ----a-w- C:\Windows\SysWow64\perf-SQLAgent$SQLEXPRESS-sqlagtctr10.1.2531.0.dll
2010-11-02 12:33:47 79896 ----a-w- C:\Windows\SysWow64\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2010-11-02 12:33:47 111640 ----a-w- C:\Windows\System32\perf-MSSQL$SQLEXPRESS-sqlctr10.1.2531.0.dll
2010-11-02 12:33:09 -------- d-----w- C:\Windows\System32\RsFx
2010-11-02 12:32:16 -------- d-----w- C:\Windows\System32\1033
2010-11-02 12:32:16 -------- d-----w- C:\Windows\System32\1031
2010-11-02 12:32:15 -------- d-----w- C:\Windows\SysWow64\1033
2010-11-02 12:32:15 -------- d-----w- C:\Windows\SysWow64\1031
2010-11-02 12:30:32 -------- d-----w- C:\Program Files\Microsoft SQL Server
2010-11-02 12:29:15 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server
2010-11-02 12:28:57 -------- d-----w- C:\Program Files (x86)\Microsoft Synchronization Services
2010-11-02 12:28:57 -------- d-----w- C:\Program Files (x86)\Microsoft SQL Server Compact Edition
2010-11-02 12:28:43 188896 ----a-w- C:\PROGRA~3\Microsoft\VCSExpress\10.0\1031\ResourceCache.dll
2010-11-02 12:27:31 -------- d-----w- C:\Program Files\Microsoft Visual Studio 10.0
2010-11-02 12:27:31 -------- d-----w- C:\Program Files\Microsoft Help Viewer
2010-11-01 17:34:36 -------- d-----w- C:\Users\Marco\.worldoflogs
2010-10-31 14:10:39 -------- d-----w- C:\Windows\uninstall
2010-10-31 14:10:38 125712 ----a-w- C:\Windows\SysWow64\VB6DE.DLL
2010-10-31 14:10:37 1351392 ----a-w- C:\Windows\SysWow64\COMCTL32.OCX
2010-10-31 14:10:36 152848 ----a-w- C:\Windows\SysWow64\COMDLG32.OCX
2010-10-31 14:10:36 -------- d-----w- C:\Windows\SysWow64\temp
2010-10-27 23:10:08 -------- d-----w- C:\Users\Marco\Tracing
2010-10-27 22:57:26 4068864 ----a-w- C:\Windows\System32\mf.dll
2010-10-27 22:57:26 257024 ----a-w- C:\Windows\System32\mfreadwrite.dll
2010-10-27 22:57:26 206848 ----a-w- C:\Windows\System32\mfps.dll
2010-10-27 22:57:26 196608 ----a-w- C:\Windows\SysWow64\mfreadwrite.dll
2010-10-27 22:57:26 1888256 ----a-w- C:\Windows\System32\WMVDECOD.DLL
2010-10-27 22:57:26 1619456 ----a-w- C:\Windows\SysWow64\WMVDECOD.DLL
2010-10-27 22:57:25 3181568 ----a-w- C:\Windows\SysWow64\mf.dll
2010-10-27 22:56:12 -------- d-----w- C:\Users\Marco\AppData\Local\Windows Live
2010-10-27 22:56:12 -------- d-----w- C:\Program Files (x86)\Common Files\Windows Live
2010-10-26 16:19:23 -------- d-----w- C:\Users\Marco\AppData\Roaming\LolClient
2010-10-24 08:40:21 467984 ----a-w- C:\Windows\SysWow64\d3dx10_39.dll
2010-10-24 08:40:21 1493528 ----a-w- C:\Windows\SysWow64\D3DCompiler_39.dll
2010-10-24 08:40:20 3851784 ----a-w- C:\Windows\SysWow64\D3DX9_39.dll
2010-10-24 07:44:14 -------- d-----w- C:\Program Files (x86)\Pando Networks
2010-10-22 10:29:00 -------- d-----w- C:\Users\Marco\AppData\Local\Apple Computer
2010-10-21 22:47:44 -------- d-----w- C:\Users\Marco\AppData\Roaming\Artisteer

==================== Find3M ====================

2010-10-02 22:57:05 174640 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2010-09-21 01:10:36 30768 ----a-w- C:\Windows\System32\drivers\VMparport.sys
2010-09-21 01:10:32 68656 ----a-w- C:\Windows\System32\drivers\vmx86.sys
2010-09-21 01:10:28 968752 ----a-w- C:\Windows\System32\vnetlib64.dll
2010-09-21 01:10:26 80944 ----a-w- C:\Windows\System32\drivers\vmci.sys
2010-09-21 01:08:56 334384 ----a-w- C:\Windows\SysWow64\vmnetdhcp.exe
2010-09-21 01:08:54 404016 ----a-w- C:\Windows\SysWow64\vmnat.exe
2010-09-21 01:08:26 31792 ----a-w- C:\Windows\System32\drivers\VMkbd.sys
2010-09-21 01:08:16 30256 ----a-w- C:\Windows\System32\drivers\vmnetuserif.sys
2010-09-20 23:42:38 38448 ----a-w- C:\Windows\System32\drivers\hcmon.sys
2010-09-20 23:15:54 252464 ----a-w- C:\Windows\SysWow64\vmnc.dll
2010-09-20 21:18:14 56880 ----a-w- C:\Windows\System32\vmnetbridge.dll
2010-09-20 21:18:14 55344 ----a-w- C:\Windows\System32\vnetinst.dll
2010-09-20 21:18:14 45104 ----a-w- C:\Windows\System32\drivers\vmnetbridge.sys
2010-09-20 21:18:14 37680 ----a-w- C:\Windows\System32\drivers\vmusb.sys
2010-09-20 21:18:14 24112 ----a-w- C:\Windows\System32\drivers\vmnet.sys
2010-09-20 21:18:14 20016 ----a-w- C:\Windows\System32\drivers\vmnetadapter.sys
2010-09-08 05:36:17 1192960 ----a-w- C:\Windows\System32\wininet.dll
2010-09-08 05:34:34 57856 ----a-w- C:\Windows\System32\licmgr10.dll
2010-09-08 04:30:04 978432 ----a-w- C:\Windows\SysWow64\wininet.dll
2010-09-08 04:28:15 44544 ----a-w- C:\Windows\SysWow64\licmgr10.dll
2010-09-08 04:16:38 482816 ----a-w- C:\Windows\System32\html.iec
2010-09-08 03:35:30 1638912 ----a-w- C:\Windows\System32\mshtml.tlb
2010-09-08 03:22:31 386048 ----a-w- C:\Windows\SysWow64\html.iec
2010-09-08 02:48:16 1638912 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2010-09-05 22:14:06 423656 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2010-09-05 21:43:59 419840 ----a-w- C:\Windows\System32\systemcpl.dll
2010-09-01 05:12:09 12625920 ----a-w- C:\Windows\System32\wmploc.DLL
2010-09-01 04:23:49 12625408 ----a-w- C:\Windows\SysWow64\wmploc.DLL
2010-09-01 02:58:34 3123712 ----a-w- C:\Windows\System32\win32k.sys
2010-08-31 04:32:30 954752 ----a-w- C:\Windows\SysWow64\mfc40.dll
2010-08-31 04:32:30 954288 ----a-w- C:\Windows\SysWow64\mfc40u.dll
2010-08-27 06:14:02 236032 ----a-w- C:\Windows\System32\srvsvc.dll
2010-08-27 05:46:48 9728 ----a-w- C:\Windows\SysWow64\sscore.dll
2010-08-27 03:38:04 463360 ----a-w- C:\Windows\System32\drivers\srv.sys
2010-08-27 03:37:48 402944 ----a-w- C:\Windows\System32\drivers\srv2.sys
2010-08-27 03:37:26 161792 ----a-w- C:\Windows\System32\drivers\srvnet.sys
2010-08-26 05:27:28 148992 ----a-w- C:\Windows\System32\t2embed.dll
2010-08-26 04:39:58 109056 ----a-w- C:\Windows\SysWow64\t2embed.dll
2010-08-21 06:38:47 1024512 ----a-w- C:\Windows\System32\wmpmde.dll
2010-08-21 06:36:49 340992 ----a-w- C:\Windows\System32\schannel.dll
2010-08-21 06:31:06 633856 ----a-w- C:\Windows\System32\comctl32.dll
2010-08-21 06:29:47 558592 ----a-w- C:\Windows\System32\spoolsv.exe
2010-08-21 05:36:33 738816 ----a-w- C:\Windows\SysWow64\wmpmde.dll
2010-08-21 05:36:24 224256 ----a-w- C:\Windows\SysWow64\schannel.dll
2010-08-21 05:33:24 530432 ----a-w- C:\Windows\SysWow64\comctl32.dll
2009-06-10 21:23:22 1169224 --sha-r- C:\Windows\install\winupdtr.exe

============= FINISH: 21:06:27,32 ===============

Blade81

2010-11-28, 15:22

Hi,

What is your email provider and do you use account via web interface?

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

µTorrent

I'd like you to read this thread (http://forums.spybot.info/showthread.php?t=282).

Please go and uninstall the programs listed above (in red).

Download OTL (http://oldtimer.geekstogo.com/OTL.exe) to your desktop.
Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Copy-paste following contents into custom scan -area:
netsvcs
drivers32
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\System32\config\*.sav
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

Blade81

2010-12-04, 12:58

Due to inactivity, this thread will now be closed.

Note:If it has been three days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh DDS log and a link to your previous thread. Please do not add any logs that might have been requested in the closed topic, you would be starting fresh.

If it has been less than three days since your last response and you need the thread re-opened, please send me or other MOD a private message (pm). A valid, working link to the closed topic is required.