1. Welcome Guest! In order to create a new topic or reply to an existing one, you must register first. It is easy and free. Click here to sign up now!.
    Dismiss Notice

Malware Or Hardware Issue?

Discussion in 'Malware Removal Help' started by Methodical4u, Feb 14, 2011.

  1. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    just noticed too a BUNCH of icons off of the desktop are gone lol.. I guess that's a good thing?
     
  2. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    well done on getting CF to run.
    if i could have seen the reply earlier i could have given you the link to the AVG uninstaller.

    These would have been 'shortcuts' and may have been bad anyway.
    This is a slow process but we're slowly getting getting rid of things.
    Your system was badly infected but is slowly getting there.
    How is the system running now?
    please let me know of any problems.
    Because we can't do much about the corrupt files at the moment, we're just trying the best we can with what we have.
     
  3. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    it's much better... it's not super fast and the fan is still steadily running (don't know if that is a problem or not ), but I was able to uninstall the old Java versions you had asked me to. Should I install that new version now or wait until later?

    Processes are down to 68 (from over 100 at one point).

    Going through some older programs however there are a bunch of games from "wildtangent" that will not let me uninstall them... it says that the file is missing and asks if I want to remove it from the list... when I click yes, nothing happens, i've tried this probably 10 or more times in the last few days and it just won't go away.

    EDIT: This is happening still with most programs on the list, even more legit ones... not to sure what that's all about.
     
  4. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    Yes you can install it now.
    As there is a newer version out now, follow the previous instructions and the link will go to:
    Java™ 6 Update 24

    Try using Revo Uninstaller:
    30-day fully functional free trial

    http://www.revouninstaller.com/download-professional-version.php

    See if this does the job.

    When done let me have a new set of OTL reports using these instructions:

    Double click on OTL.exe to run it.
    • Under Extra Registry section, select Use SafeList.
    • Don't check the boxes beside 'LOP Check' and 'Purity Check' this time.
    • Click on Run Scan at the top left hand corner.
    • When done, two Notepad files will open. Please post the contents of these 2 Notepad files in your next reply.


    I see you have Killbox on your system:
    2011-02-06 06:15 . 2011-02-06 06:41 -------- d-----w- C:\!KillBox

    What did you remove using this?

    Thanks
     
  5. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    I have THE WORST memory possible, so i'm not really sure what I used that for. I think when I was trying to uninstall some things I was trying to kill some of the processes. Should I get rid of it?
     
  6. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    a quick note... I had to install the revo software in safe mode... the comp said it couldn't find it when I ran it in standard mode.
     
  7. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    No, it's not necessary.
    When we clean off OTL using the cleanup button, it'll also remove a lot of programs we ask you to use .... Killbox is one of these that will be removed.

    Looking back over some of the reports, i seem to have forgotten to address the 'Locked' registry keys.
    We'll do that now.

    Close any open browsers.
    Close/disable all anti virus, firewall and anti malware programs so they do not interfere with the running of ComboFix:

    Open Notepad - it must be Notepad, not Wordpad.
    Copy the text below in the code box by highlighting all the text and pressing Ctrl+C
    Code:
    RegLock::
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
    [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
    
    
    Go to the Notepad window and click Edit >> Paste
    Then click File >> Save
    Name the file "CFScript.txt" (including the quotes)
    Save the file to your Desktop

    The main ComboFix.exe program should be on your Desktop
    Drag the file you just created... CFScript.txt and drop it on the main ComboFix.exe icon
    as below.
    [​IMG]

    Now please wait for ComboFix to finish running.

    Please Note: Do not mouse click in the combofix window while it is running - this may cause your system to hang/crash

    Let me have the new combofix.txt.

    Thanks
     
  8. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    OTL log:


    OTL logfile created on: 2/19/2011 12:00:51 PM - Run 2
    OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Chris\Downloads
    Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6000.17037)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free
    4.00 Gb Paging File | 4.00 Gb Available in Paging File | 91.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 110.32 Gb Total Space | 19.31 Gb Free Space | 17.51% Space Free | Partition Type: NTFS

    Computer Name: GENNIE-PC | User Name: Gennie | Logged in as Administrator.
    Boot Mode: SafeMode with Networking | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - C:\Users\Chris\Downloads\OTL.exe (OldTimer Tools)
    PRC - C:\Users\Chris\AppData\Local\Google\Chrome\Application\chrome.exe (Google Inc.)
    PRC - C:\Windows\explorer.exe (Microsoft Corporation)


    ========== Modules (SafeList) ==========

    MOD - C:\Users\Chris\Downloads\OTL.exe (OldTimer Tools)
    MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll (Microsoft Corporation)


    ========== Win32 Services (SafeList) ==========

    SRV - (GoogleDesktopManager-110309-193829) -- File not found
    SRV - (MotoConnect Service) -- C:\Program Files\Motorola\MotoConnectService\MotoConnectService.exe ()
    SRV - (FlipShare Service) -- C:\Program Files\Flip Video\FlipShare\FlipShareService.exe ()
    SRV - (lxdp_device) -- C:\Windows\System32\lxdpcoms.exe ( )
    SRV - (GameConsoleService) -- C:\Program Files\TOSHIBA Games\TOSHIBA Game Console\GameConsoleService.exe (WildTangent, Inc.)
    SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
    SRV - (TOSHIBA Bluetooth Service) -- C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtSrv.exe (TOSHIBA CORPORATION)
    SRV - (Swupdtmr) -- c:\Toshiba\IVP\swupdate\swupdtmr.exe ()
    SRV - (pinger) -- C:\Toshiba\IVP\ISM\pinger.exe ()
    SRV - (TosCoSrv) -- C:\Program Files\Toshiba\Power Saver\TosCoSrv.exe (TOSHIBA Corporation)
    SRV - (CFSvcs) -- C:\Program Files\Toshiba\ConfigFree\CFSvcs.exe (TOSHIBA CORPORATION)
    SRV - (AgereModemAudio) -- C:\Windows\System32\agrsmsvc.exe (Agere Systems)
    SRV - (UleadBurningHelper) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)
    SRV - (TODDSrv) -- C:\Windows\System32\TODDSrv.exe (TOSHIBA Corporation)


    ========== Driver Services (SafeList) ==========

    DRV - (ssadmdm) -- C:\Windows\System32\drivers\ssadmdm.sys (MCCI Corporation)
    DRV - (ssadbus) SAMSUNG Android USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\ssadbus.sys (MCCI Corporation)
    DRV - (androidusb) -- C:\Windows\System32\drivers\ssadadb.sys (Google Inc)
    DRV - (ssadmdfl) SAMSUNG Android USB Modem (Filter) -- C:\Windows\System32\drivers\ssadmdfl.sys (MCCI Corporation)
    DRV - (sscdmdm) -- C:\Windows\System32\drivers\sscdmdm.sys (MCCI Corporation)
    DRV - (sscdbus) SAMSUNG USB Composite Device driver (WDM) -- C:\Windows\System32\drivers\sscdbus.sys (MCCI Corporation)
    DRV - (sscdmdfl) -- C:\Windows\System32\drivers\sscdmdfl.sys (MCCI Corporation)
    DRV - (Revoflt) -- C:\Windows\System32\drivers\revoflt.sys (VS Revo Group)
    DRV - (LMIRfsClientNP) -- C:\Windows\System32\LMIRfsClientNP.dll (LogMeIn, Inc.)
    DRV - (LMIRfsDriver) -- C:\Windows\System32\drivers\LMIRfsDriver.sys (LogMeIn, Inc.)
    DRV - (BVRPMPR5) -- C:\Windows\System32\drivers\BVRPMPR5.SYS (Avanquest Software)
    DRV - (UsbDiag) -- C:\Windows\System32\drivers\lgusbdiag.sys (LG Electronics Inc.)
    DRV - (USBModem) -- C:\Windows\System32\drivers\lgusbmodem.sys (LG Electronics Inc.)
    DRV - (usbbus) -- C:\Windows\System32\drivers\lgusbbus.sys (LG Electronics Inc.)
    DRV - (SynTP) -- C:\Windows\System32\drivers\SynTP.sys (Synaptics, Inc.)
    DRV - (igfx) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
    DRV - (ialm) -- C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
    DRV - (UVCFTR) -- C:\Windows\System32\drivers\UVCFTR_S.SYS (Chicony Electronics Co., Ltd.)
    DRV - (MRV6X32U) Marvell TOPDOG 802.11n WLAN Driver for Vista x86 (USB8x) -- C:\Windows\System32\drivers\MRVW24B.sys (Marvell Semiconductor, Inc)
    DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) -- C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
    DRV - (NETw4v32) Intel(R) -- C:\Windows\System32\drivers\NETw4v32.sys (Intel Corporation)
    DRV - (AgereSoftModem) -- C:\Windows\System32\drivers\AGRSM.sys (Agere Systems)
    DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
    DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
    DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
    DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
    DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
    DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
    DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
    DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
    DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
    DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
    DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
    DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
    DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
    DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
    DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
    DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
    DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
    DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
    DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
    DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
    DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
    DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
    DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
    DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
    DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
    DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
    DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
    DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
    DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
    DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
    DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
    DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
    DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
    DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
    DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
    DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
    DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
    DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
    DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
    DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
    DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
    DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
    DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
    DRV - (E1G60) Intel(R) -- C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
    DRV - (athr) -- C:\Windows\System32\drivers\athr.sys (Atheros Communications, Inc.)
    DRV - (tdcmdpst) -- C:\Windows\System32\drivers\tdcmdpst.sys (TOSHIBA Corporation.)
    DRV - (TVALZ) -- C:\Windows\system32\DRIVERS\TVALZ_O.SYS (TOSHIBA Corporation)
    DRV - (KR3NPXP) -- C:\Windows\system32\drivers\kr3npxp.sys (TOSHIBA CORPORATION)
    DRV - (LPCFilter) -- C:\Windows\system32\DRIVERS\LPCFilter.sys (COMPAL ELECTRONIC INC.)
    DRV - (tifm21) -- C:\Windows\System32\drivers\tifm21.sys (Texas Instruments)
    DRV - (KR10I) -- C:\Windows\system32\drivers\kr10i.sys (TOSHIBA CORPORATION)
    DRV - (Ser2pl) -- C:\Windows\System32\drivers\ser2pl.sys (Prolific Technology Inc.)
    DRV - (KR10N) -- C:\Windows\system32\drivers\kr10n.sys (TOSHIBA CORPORATION)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

    IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

    FF - HKLM\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/07/06 21:38:00 | 000,000,000 | ---D | M]


    O1 HOSTS File: ([2011/02/18 14:05:27 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_printenhancer.dll (Hewlett-Packard Co.)
    O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
    O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll (Google Inc.)
    O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O3 - HKCU\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
    O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
    O4 - HKLM..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe (TOSHIBA Electronics, Inc.)
    O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
    O4 - HKLM..\Run: [SVPWUTIL] C:\Program Files\TOSHIBA\Utilities\SVPWUTIL.exe (TOSHIBA)
    O4 - HKLM..\RunOnce: [] File not found
    O4 - HKLM..\RunOnce: [GrpConv] C:\Windows\System32\grpconv.exe (Microsoft Corporation)
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra Button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\smart web printing\hpswp_BHO.dll (Hewlett-Packard Co.)
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
    O20 - AppInit_DLLs: (AVGRSSTX.DLL) - File not found
    O20 - AppInit_DLLs: (C:\PROGRA~1\GOOGLE\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *) - File not found
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    ========== Files/Folders - Created Within 30 Days ==========

    [2011/02/19 11:14:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller Pro
    [2011/02/19 11:14:39 | 000,027,192 | ---- | C] (VS Revo Group) -- C:\Windows\System32\drivers\revoflt.sys
    [2011/02/19 11:14:37 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
    [2011/02/19 11:08:53 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
    [2011/02/19 11:07:50 | 000,472,808 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
    [2011/02/19 11:07:50 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
    [2011/02/19 11:07:50 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
    [2011/02/19 11:07:50 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
    [2011/02/18 14:08:02 | 000,000,000 | ---D | C] -- C:\Windows\temp
    [2011/02/18 14:07:10 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2011/02/18 14:07:10 | 000,000,000 | -HSD | C] -- \$RECYCLE.BIN
    [2011/02/18 13:53:47 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
    [2011/02/18 13:53:47 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2011/02/18 13:53:47 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2011/02/18 13:53:47 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2011/02/18 13:53:39 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2011/02/18 13:53:13 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
    [2011/02/18 13:53:13 | 000,000,000 | ---D | C] -- \32788R22FWJFW
    [2011/02/18 13:48:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Perfect Uninstaller
    [2011/02/18 13:48:37 | 000,000,000 | ---D | C] -- C:\Program Files\Perfect Uninstaller
    [2011/02/18 10:55:33 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2011/02/18 10:55:33 | 000,000,000 | ---D | C] -- \Qoobox
    [2011/02/15 11:43:06 | 000,000,000 | ---D | C] -- C:\_OTL
    [2011/02/15 11:43:06 | 000,000,000 | ---D | C] -- \_OTL
    [2011/02/12 20:16:23 | 000,000,000 | ---D | C] -- C:\RMVFLTR.TEMP
    [2011/02/12 20:16:23 | 000,000,000 | ---D | C] -- \RMVFLTR.TEMP
    [2011/02/10 17:52:29 | 001,416,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\WdfCoInstaller01005.dll
    [2011/02/10 17:52:29 | 001,416,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\drivers\WdfCoInstaller01005.dll
    [2011/02/10 17:52:29 | 000,010,216 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadwhnt.sys
    [2011/02/10 17:52:29 | 000,010,216 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadwh.sys
    [2011/02/10 17:52:28 | 000,121,576 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadmdm.sys
    [2011/02/10 17:52:28 | 000,096,488 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadbus.sys
    [2011/02/10 17:52:28 | 000,030,312 | ---- | C] (Google Inc) -- C:\Windows\System32\drivers\ssadadb.sys
    [2011/02/10 17:52:28 | 000,012,776 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadmdfl.sys
    [2011/02/10 17:52:28 | 000,010,344 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadcmnt.sys
    [2011/02/10 17:52:28 | 000,010,344 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\ssadcm.sys
    [2011/02/10 17:44:48 | 000,132,424 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdmdm.sys
    [2011/02/10 17:44:48 | 000,104,648 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdbus.sys
    [2011/02/10 17:44:48 | 000,014,920 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdmdfl.sys
    [2011/02/10 17:44:48 | 000,012,616 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdcmnt.sys
    [2011/02/10 17:44:48 | 000,012,616 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdcm.sys
    [2011/02/10 17:44:48 | 000,012,488 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdwhnt.sys
    [2011/02/10 17:44:48 | 000,012,488 | ---- | C] (MCCI Corporation) -- C:\Windows\System32\drivers\sscdwh.sys
    [2011/02/10 17:30:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinRAR
    [2011/02/10 17:29:56 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR
    [2011/02/10 17:16:56 | 000,000,000 | ---D | C] -- C:\Program Files\SAMSUNG
    [2011/02/10 17:16:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
    [2011/02/06 01:15:26 | 000,000,000 | ---D | C] -- C:\!KillBox
    [2011/02/06 01:15:26 | 000,000,000 | ---D | C] -- \!KillBox
    [2011/02/06 00:40:48 | 000,000,000 | ---D | C] -- C:\Program Files\TrendMicro
    [2011/02/05 20:18:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab Setup Files
    [2011/02/04 20:09:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    [2011/02/04 20:09:33 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2011/02/04 19:21:28 | 000,000,000 | ---D | C] -- C:\Windows\pss
    [2011/02/04 12:32:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDFab 8
    [2011/02/04 12:32:02 | 000,000,000 | ---D | C] -- C:\Program Files\DVDFab 8
    [2009/10/20 17:59:04 | 000,409,600 | ---- | C] ( ) -- C:\Windows\System32\lxdpcoin.dll
    [2007/11/19 22:13:22 | 000,647,168 | ---- | C] ( ) -- C:\Windows\System32\lxdppmui.dll
    [2007/11/19 22:09:44 | 001,101,824 | ---- | C] ( ) -- C:\Windows\System32\lxdpserv.dll
    [2007/11/19 22:06:32 | 000,569,344 | ---- | C] ( ) -- C:\Windows\System32\lxdplmpm.dll
    [2007/11/19 22:06:32 | 000,339,968 | ---- | C] ( ) -- C:\Windows\System32\lxdpiesc.dll
    [2007/11/19 22:06:18 | 000,376,832 | ---- | C] ( ) -- C:\Windows\System32\lxdpcomm.dll
    [2007/11/19 22:05:08 | 000,663,552 | ---- | C] ( ) -- C:\Windows\System32\lxdphbn3.dll
    [2007/11/19 22:04:50 | 000,843,776 | ---- | C] ( ) -- C:\Windows\System32\lxdpusb1.dll
    [2007/11/19 22:04:28 | 000,851,968 | ---- | C] ( ) -- C:\Windows\System32\lxdpcomc.dll
    [2007/11/19 22:03:22 | 000,053,248 | ---- | C] ( ) -- C:\Windows\System32\lxdpprox.dll
    [2007/11/19 22:01:20 | 000,364,544 | ---- | C] ( ) -- C:\Windows\System32\lxdpinpa.dll

    ========== Files - Modified Within 30 Days ==========

    [2011/02/19 11:14:40 | 000,001,100 | ---- | M] () -- C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
    [2011/02/19 11:12:57 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2011/02/19 11:11:09 | 000,003,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2011/02/19 11:11:09 | 000,003,584 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2011/02/19 11:11:07 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
    [2011/02/19 11:09:33 | 000,000,856 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-903708157-4245715410-21210898-1001Core.job
    [2011/02/19 11:07:27 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
    [2011/02/19 11:07:27 | 000,157,472 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
    [2011/02/19 11:07:27 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
    [2011/02/19 11:07:27 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
    [2011/02/19 10:44:00 | 000,000,908 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-903708157-4245715410-21210898-1001UA.job
    [2011/02/19 10:14:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
    [2011/02/18 14:05:27 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2011/02/18 13:48:45 | 000,000,042 | ---- | M] () -- C:\Windows\System32\AK083E209605E394C.lie
    [2011/02/18 13:48:39 | 000,000,806 | ---- | M] () -- C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\Perfect Uninstaller.lnk
    [2011/02/14 20:15:32 | 000,618,648 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2011/02/14 20:15:32 | 000,104,024 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2011/02/14 20:14:03 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf
    [2011/02/04 12:32:14 | 000,000,827 | ---- | M] () -- C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\DVDFab 8.lnk

    ========== Files Created - No Company Name ==========

    [2011/02/19 11:14:40 | 000,001,100 | ---- | C] () -- C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\Revo Uninstaller Pro.lnk
    [2011/02/18 14:08:00 | 000,012,607 | ---- | C] () -- \ComboFix.txt
    [2011/02/18 13:53:47 | 000,256,512 | ---- | C] () -- C:\Windows\PEV.exe
    [2011/02/18 13:53:47 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2011/02/18 13:53:47 | 000,089,088 | ---- | C] () -- C:\Windows\MBR.exe
    [2011/02/18 13:53:47 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2011/02/18 13:53:47 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2011/02/18 13:48:45 | 000,000,042 | ---- | C] () -- C:\Windows\System32\AK083E209605E394C.lie
    [2011/02/18 13:48:39 | 000,000,806 | ---- | C] () -- C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\Perfect Uninstaller.lnk
    [2011/02/14 20:35:48 | 000,000,370 | ---- | C] () -- \rkill.log
    [2011/02/14 20:14:03 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_Kernel_ssadadb_01005.Wdf
    [2011/02/04 12:32:14 | 000,000,827 | ---- | C] () -- C:\Users\Default\Application Data\Microsoft\Internet Explorer\Quick Launch\DVDFab 8.lnk
    [2010/07/06 21:26:22 | 000,002,897 | ---- | C] () -- C:\ProgramData\hpzinstall.log
    [2009/11/22 18:34:39 | 000,000,067 | ---- | C] () -- C:\Windows\swupdate.INI
    [2009/11/01 22:30:44 | 000,001,024 | ---- | C] () -- \.rnd
    [2009/07/14 09:02:58 | 000,208,896 | ---- | C] () -- C:\Windows\System32\lxdpgrd.dll
    [2008/03/31 19:47:44 | 000,040,960 | ---- | C] () -- C:\Windows\System32\lxdpvs.dll
    [2008/02/19 01:33:34 | 000,446,352 | ---- | C] () -- C:\Windows\System32\OpenQuicktimeLib.dll
    [2007/11/07 07:12:28 | 000,232,960 | ---- | C] () -- \VC_RED.MSI
    [2007/11/07 07:09:22 | 001,442,522 | ---- | C] () -- \VC_RED.cab
    [2007/11/07 07:03:18 | 000,097,296 | ---- | C] () -- \install.res.1036.dll
    [2007/11/07 07:03:18 | 000,096,272 | ---- | C] () -- \install.res.3082.dll
    [2007/11/07 07:03:18 | 000,096,272 | ---- | C] () -- \install.res.1031.dll
    [2007/11/07 07:03:18 | 000,095,248 | ---- | C] () -- \install.res.1040.dll
    [2007/11/07 07:03:18 | 000,091,152 | ---- | C] () -- \install.res.1033.dll
    [2007/11/07 07:03:18 | 000,081,424 | ---- | C] () -- \install.res.1041.dll
    [2007/11/07 07:03:18 | 000,079,888 | ---- | C] () -- \install.res.1042.dll
    [2007/11/07 07:03:18 | 000,076,304 | ---- | C] () -- \install.res.1028.dll
    [2007/11/07 07:03:18 | 000,075,792 | ---- | C] () -- \install.res.2052.dll
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.3082.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.2052.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1042.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1040.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1036.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1031.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1028.txt
    [2007/11/07 07:00:40 | 000,010,134 | ---- | C] () -- \eula.1033.txt
    [2007/11/07 07:00:40 | 000,005,686 | ---- | C] () -- \vcredist.bmp
    [2007/11/07 07:00:40 | 000,001,110 | ---- | C] () -- \globdata.ini
    [2007/11/07 07:00:40 | 000,000,843 | ---- | C] () -- \install.ini
    [2007/11/07 07:00:40 | 000,000,118 | ---- | C] () -- \eula.1041.txt
    [2007/09/03 17:33:05 | 000,000,150 | ---- | C] () -- \YServer.txt
    [2007/09/01 14:38:19 | 000,000,825 | ---- | C] () -- \net_save.dna
    [2007/08/20 22:52:12 | 000,651,264 | ---- | C] () -- C:\Windows\System32\libeay32.dll
    [2007/08/20 22:52:12 | 000,147,456 | ---- | C] () -- C:\Windows\System32\ssleay32.dll
    [2007/05/11 00:20:53 | 2451,046,400 | -HS- | C] () --
    [2007/03/08 05:38:28 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll
    [2007/03/02 01:56:11 | 000,000,000 | ---- | C] () -- C:\Windows\NDSTray.INI
    [2007/03/02 01:50:05 | 000,204,800 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
    [2007/03/02 01:50:05 | 000,200,704 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
    [2007/03/02 01:50:05 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
    [2007/03/02 01:50:05 | 000,192,512 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
    [2007/03/02 01:50:05 | 000,188,416 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
    [2007/03/02 01:50:05 | 000,020,480 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
    [2007/03/02 01:11:48 | 000,128,113 | ---- | C] () -- C:\Windows\System32\csellang.ini
    [2007/03/02 01:11:48 | 000,045,056 | ---- | C] () -- C:\Windows\System32\csellang.dll
    [2007/03/02 01:11:48 | 000,010,150 | ---- | C] () -- C:\Windows\System32\tosmreg.ini
    [2007/03/02 01:11:48 | 000,007,671 | ---- | C] () -- C:\Windows\System32\cseltbl.ini
    [2007/03/02 00:27:38 | 000,008,192 | R-S- | C] () -- \BOOTSECT.BAK
    [2007/03/02 00:27:36 | 000,438,840 | RHS- | C] () -- \bootmgr
    [2007/01/31 19:03:26 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1187.dll
    [2006/12/05 16:05:06 | 000,114,688 | ---- | C] () -- C:\Windows\System32\TosBtAcc.dll
    [2006/11/24 10:48:44 | 000,036,864 | ---- | C] () -- C:\Windows\System32\HWS_Ctrl.dll
    [2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
    [2006/11/02 05:25:21 | 000,180,224 | ---- | C] () -- C:\Windows\System32\igfxTMM.dll
    [2006/11/02 05:23:09 | 000,000,024 | ---- | C] () -- \autoexec.bat
    [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 01:25:08 | 000,000,010 | ---- | C] () -- \config.sys
    [2005/11/23 17:55:42 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SPCtl.dll
    [2005/07/23 00:30:20 | 000,065,536 | ---- | C] () -- C:\Windows\System32\TosCommAPI.dll

    < End of report >
     
  9. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    OTL extras:

    OTL Extras logfile created on: 2/19/2011 12:00:51 PM - Run 2
    OTL by OldTimer - Version 3.2.20.6 Folder = C:\Users\Chris\Downloads
    Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
    Internet Explorer (Version = 7.0.6000.17037)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 70.00% Memory free
    4.00 Gb Paging File | 4.00 Gb Available in Paging File | 91.00% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 110.32 Gb Total Space | 19.31 Gb Free Space | 17.51% Space Free | Partition Type: NTFS

    Computer Name: GENNIE-PC | User Name: Gennie | Logged in as Administrator.
    Boot Mode: SafeMode with Networking | Scan Mode: Current user
    Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
    .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 0
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "DisableNotifications" = 0
    "EnableFirewall" = 1

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
    "C:\TOSHIBA\ivp\NetInt\Netint.exe" = C:\TOSHIBA\ivp\NetInt\Netint.exe:*:Enabled:NIE - Toshiba Software Upgrades Engine -- (TOSHIBA Corporation)
    "C:\TOSHIBA\Ivp\ISM\pinger.exe" = C:\TOSHIBA\Ivp\ISM\pinger.exe:*:Enabled:Toshiba Software Upgrades Pinger -- ()


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{02486B0B-006F-40F5-9031-B14EA03C9F37}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{1D269B86-5787-4C59-B4A8-DCCD58EE3580}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{20522D68-F408-451C-996B-8395DF19B888}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{4D44EB57-A3C0-4B1A-A819-667D71B72140}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{65BA47B7-6A54-42D3-BD8D-D454ED3A06EA}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{76F26861-4804-4FFD-AE9F-4228EFFE8575}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{79E1CB24-C3FD-4102-A094-399A8B849E6A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
    "{7D238789-F21C-4153-846B-F1279BCB6CDB}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{A1F9F274-8EBA-48AF-9E90-906E199D7815}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{C8BD375B-AEEF-43A7-B6A0-BCDB46A5D9A8}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{C9729061-FD8B-49E2-92F4-D3368EB2C816}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{222FE6E6-3A37-4DA7-AF7B-FBD98B7885DC}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{22A045F2-0354-4DD4-86E6-215CDE5FABE2}" = protocol=17 | dir=in | app=c:\windows\system32\lxdpcoms.exe |
    "{243971B5-0DB4-412D-BCFC-D1DEE0CA3288}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
    "{266241A5-0037-4DE3-994E-C59D71563F38}" = protocol=17 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
    "{27427CB1-8758-4CD5-BC59-CA7F4CB71CFE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{2E5BC5A7-1B19-4C4A-9F45-41B2E52F5EFC}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{31E5EB34-7C7C-4B59-AD71-76D188D4D897}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{40218C9C-94C6-49EA-8E6F-7ADD9D44E0C5}" = protocol=6 | dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe |
    "{4760EA8C-F232-4ADD-A7AE-3693E37F3B42}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{4BAE7D10-0263-453F-85A5-7676087E1A09}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{4C9C30AD-B478-4DFD-A4A8-87496C364DCF}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{5199C633-893C-4842-8337-E7D69DF1A736}" = protocol=6 | dir=out | app=system |
    "{51B101BA-611A-495A-8750-0932DFF1690A}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
    "{5E42605A-5A13-482D-A4DA-AE5D37EE3AE0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{6193023F-A2FE-4C8C-BADD-2DA5B29AA15F}" = protocol=17 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
    "{77550623-983E-4612-96BE-A20CC8363356}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{7DDB90EB-2DE8-4A2A-BE53-8C0B733C8E53}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
    "{8388C65B-AADB-42DA-93A5-2392173C2F42}" = protocol=6 | dir=in | app=c:\windows\system32\lxdpcoms.exe |
    "{9630CE29-6F89-4A0D-B5A0-83B4B6F41031}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{981CF596-0470-4C9E-AF43-E3A2BC2BC613}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
    "{9BBD31A0-EEF7-4DA3-A946-11401FFC92B6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{A146FF7A-6B6D-4511-9741-6072A7B8ACD5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{A6241025-C433-492B-BFCA-3470F261F93A}" = protocol=6 | dir=in | app=c:\program files\yahoo!\yahoo! music jukebox\yahoomusicengine.exe |
    "{A636D18A-4EDB-41E9-9F5B-92E58FD63721}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{AF4819BE-2CB0-4843-BC62-1B6800B59F00}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
    "{B2518376-0FAB-4250-B589-F8D22971C0D1}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{B7411EFD-1CD7-4DB3-9225-46931C240A1F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{CECE45F1-A234-438A-AFF2-F24ADD59884A}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
    "{D916D971-9786-4106-8F00-2757C57AC332}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{D9F93CD7-2998-42A9-B95C-1D4248D33725}" = dir=in | app=c:\program files\windows live\messenger\livecall.exe |
    "{F4297D65-79A9-4B4E-B56D-08194C75D5B0}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "TCP Query User{42156126-95BF-47C3-BC0A-DDB5E806B5CC}C:\program files\motorola\rsd lite\sdl.exe" = protocol=6 | dir=in | app=c:\program files\motorola\rsd lite\sdl.exe |
    "TCP Query User{6FC95971-3946-4C54-AF3E-51962B5AAF84}C:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe |
    "TCP Query User{C4825712-66B6-45DF-9A9B-8B172661AE03}C:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe" = protocol=6 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe |
    "TCP Query User{D16FFDA8-5253-4D8B-8BEB-2CCFC5A5F7E9}C:\program files\motorola\rsd lite\sdl.exe" = protocol=6 | dir=in | app=c:\program files\motorola\rsd lite\sdl.exe |
    "TCP Query User{EB08A09F-77D1-4470-960C-BB5A58B9E971}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "UDP Query User{1703C8D9-C2FE-4857-934D-253F46E26CF7}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "UDP Query User{2A4DB4A0-AEE8-4A4B-A065-992C14097D4B}C:\program files\motorola\rsd lite\sdl.exe" = protocol=17 | dir=in | app=c:\program files\motorola\rsd lite\sdl.exe |
    "UDP Query User{455AD32F-47E2-4FD9-A948-F2A6EF8851A3}C:\program files\motorola\rsd lite\sdl.exe" = protocol=17 | dir=in | app=c:\program files\motorola\rsd lite\sdl.exe |
    "UDP Query User{C53AA555-AF5D-470D-9B3B-B48535F1D695}C:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe |
    "UDP Query User{E3D27845-CC74-4AB4-AA26-C363CA96DA86}C:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe" = protocol=17 | dir=in | app=c:\windows\system32\spool\drivers\w32x86\3\lxdppswx.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0020FEE2-7CDB-4250-B04B-81D68D3CA18B}" =
    "{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    "{008D69EB-70FF-46AB-9C75-924620DF191A}" = TOSHIBA Speech System SR Engine(U.S.) Version1.0
    "{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}" = TIPCI
    "{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}" = HiJackThis
    "{07FB17D8-7DB6-4F06-80C4-8BE1719CB6A1}" = hpWLPGInstaller
    "{12688FD7-CB92-4A5B-BEE4-5C8E0574434F}" = Utility Common Driver
    "{12B3A009-A080-4619-9A2A-C6DB151D8D67}" = TOSHIBA Assist
    "{175F0111-2968-4935-8F70-33108C6A4DE3}" = MarketResearch
    "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
    "{1C643154-0ADF-4B4C-AF17-E315C946A54B}" = MotoConnect
    "{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for TOSHIBA
    "{21A2F5EE-1DC5-488A-BE7E-E526F8C61488}" = DeviceDiscovery
    "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
    "{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
    "{2EEA7AA4-C203-4b90-A34F-19FB7EF1C81C}" = BufferChm
    "{37C866E4-AA67-4725-9E95-A39968DD7960}" = Camera Assistant Software for Toshiba
    "{3F470FED-77A1-4545-BF6E-AF687FF0B42D}" = RSDLite
    "{3FBF6F99-8EC6-41B4-8527-0A32241B5496}" = TOSHIBA Speech System TTS Engine(U.S.) Version1.0
    "{425A2BC2-AA64-4107-9C29-484245BBEA05}" = TOSHIBA Software Upgrades
    "{43CDF946-F5D9-4292-B006-BA0D92013021}" = WebReg
    "{49C88E44-1B38-4FC6-824E-2BDA3063B0E3}" = Apple Mobile Device Support
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
    "{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
    "{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
    "{5727583F-3530-45FD-B09E-7E1CB6C135AD}" = DJ_SF_06_D1600_SW_Min
    "{5DA0E02F-970B-424B-BF41-513A5018E4C0}" = TOSHIBA Disc Creator
    "{5F00DF7E-418B-4CD9-8EC5-781156BCC49E}" = Microsoft Money Shared Libraries
    "{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
    "{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
    "{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
    "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
    "{67579783-0FB7-4F7B-B881-E5BE47C9DBE0}_is1" = Revo Uninstaller Pro 2.5.1
    "{68A10D12-0D0F-4212-BDE6-D87FAD32A8FA}" = SmartWebPrinting
    "{6B2FFB21-AC88-45C3-9A7D-4BB3E744EC91}" = HPSSupply
    "{6BBA26E9-AB03-4FE7-831A-3535584CA002}" = Toolbox
    "{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
    "{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
    "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{92127AF5-FDD8-4ADF-BC40-C356C9EE0B7D}" = 32 Bit HP CIO Components Installer
    "{9F153AD3-3523-4542-818E-AE2F92249667}" = SAMSUNG USB Driver for Mobile Phones
    "{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}" = CD/DVD Drive Acoustic Silencer
    "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
    "{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
    "{AE8705FB-E13C-40A9-8A2D-68D6733FBFC2}" = Status
    "{B1C0D829-FE30-059E-E93F-CDC7A48235C0}" = FlipShare
    "{B5FDA445-CAC4-4BA6-A8FB-A7212BD439DE}" = Microsoft XML Parser
    "{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}" = TOSHIBA ConfigFree
    "{C3ABE126-2BB2-4246-BFE1-6797679B3579}" = LG USB Modem driver
    "{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
    "{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
    "{C53D16CC-E56F-47B8-906E-70AAF8EABB4F}" = Toshiba Registration
    "{C75CDBA2-3C86-481e-BD10-BDDA758F9DFF}" = hpPrintProjects
    "{CAE4213F-F797-439D-BD9E-79B71D115BE3}" = HPPhotoGadget
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{CEBB6BFB-D708-4F99-A633-BC2600E01EF6}" = Bluetooth Stack for Windows by Toshiba
    "{DAEAFD68-BB4A-4507-A241-C8804D2EA66D}" = Apple Application Support
    "{DC0A5F99-FD66-433F-9D3A-05DCBA64BE42}" = TrayApp
    "{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
    "{E7004147-2CCA-431C-AA05-2AB166B9785D}" = QuickTime
    "{EAE8CF06-28CA-4213-839C-A32817A47E00}" = D1600
    "{EBFF48F5-3CFA-436F-8FD5-94FB01D3A0A7}" = TOSHIBA SD Memory Utilities
    "{ECC3713C-08A4-40E3-95F1-7D0704F1CE5E}" = PL-2303 USB-to-Serial
    "{EE033C1F-443E-41EC-A0E2-559B539A4E4D}" = TOSHIBA Speech System Applications
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F214EAA4-A069-4BAF-9DA4-4DB8BEEDE485}" = DVD MovieFactory for TOSHIBA
    "{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
    "{FF1C31AE-0CDC-40CE-AB85-406F8B70D643}" = Bonjour
    "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    "3ivx MPEG-4 5.0.3" = 3ivx MPEG-4 5.0.3 (remove only)
    "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
    "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
    "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
    "Adobe Shockwave Player" = Adobe Shockwave Player
    "CCleaner" = CCleaner
    "ComcastHSI" = Comcast High-Speed Internet Install Wizard
    "Desktop Dialer" = Desktop Dialer
    "DVDFab 8_is1" = DVDFab 8.0.7.3 (29/01/2011)
    "Google Desktop" = Google Desktop
    "HDMI" = Intel(R) Graphics Media Accelerator Driver
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "InstallShield_{0409969E-BEFB-44D3-90B9-63BE50FBAE5E}" = Texas Instruments PCIxx21/x515/xx12 drivers.
    "InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for TOSHIBA
    "InstallShield_{51B4E156-14A5-4904-9AE4-B1AA2A0E46BE}" = TOSHIBA Supervisor Password
    "InstallShield_{5279374D-87FE-4879-9385-F17278EBB9D3}" = TOSHIBA Hardware Setup
    "InstallShield_{617C36FD-0CBE-4600-84B2-441CEB12FADF}" = TOSHIBA Extended Tiles for Windows Mobility Center
    "InstallShield_{620BBA5E-F848-4D56-8BDA-584E44584C5E}" = TOSHIBA Flash Cards Support Utility
    "InstallShield_{FEDD27A0-B306-45EF-BF58-B527406B42C8}" = TOSHIBA Value Added Package
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Perfect Uninstaller_is1" = Perfect Uninstaller v6.3.3.8
    "SynTPDeinstKey" = Synaptics Pointing Device Driver
    "TOSHIBA Game Console" = TOSHIBA Game Console
    "TOSHIBA Media Center Game Console" = TOSHIBA Media Center Game Console
    "TOSHIBA Software Modem" = TOSHIBA Software Modem
    "Windows Media Encoder 9" = Windows Media Encoder 9 Series
    "winpwn" = winpwn 2.0.0.4
    "WinRAR archiver" = WinRAR 4.00 beta 6 (32-bit)
    "Yahoo! Music Engine" = Yahoo! Music Jukebox

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 2/19/2011 12:29:50 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:30:11 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:30:30 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:30:53 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:31:13 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:31:33 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:31:52 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:32:10 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:33:23 PM | Computer Name = Gennie-PC | Source = System Restore | ID = 8193
    Description =

    Error - 2/19/2011 12:59:50 PM | Computer Name = Gennie-PC | Source = profsvc | ID = 1505
    Description = Windows cannot load the user's profile but has logged you on with
    the default profile for the system. DETAIL - Access is denied.

    [ Media Center Events ]
    Error - 8/28/2008 7:54:40 AM | Computer Name = Gennie-PC | Source = MCUpdate | ID = 0
    Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

    Error - 10/7/2009 7:51:13 PM | Computer Name = Gennie-PC | Source = MCUpdate | ID = 0
    Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

    [ System Events ]
    Error - 2/19/2011 9:19:08 AM | Computer Name = Gennie-PC | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.1.28 for the Network Card with network
    address 0016D4FC1CEF has been denied by the DHCP server 192.168.1.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 2/19/2011 10:55:27 AM | Computer Name = Gennie-PC | Source = Dhcp | ID = 1002
    Description = The IP address lease 192.168.1.29 for the Network Card with network
    address 0016D4FC1CEF has been denied by the DHCP server 192.168.1.1 (The DHCP Server
    sent a DHCPNACK message).

    Error - 2/19/2011 12:13:21 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:13:29 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:13:32 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:13:33 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:16:57 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:18:55 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:33:37 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =

    Error - 2/19/2011 12:33:37 PM | Computer Name = Gennie-PC | Source = DCOM | ID = 10005
    Description =


    < End of report >
     
  10. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    I'll wait until you post the Combofix.txt, then i'll go through all the reports together.

    Thanks
     
  11. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    Oddly... after I ran combofix and then tried to use the browser, it said it was marked for deletion, both google chrome and IE said the same thing. After I restarted it was fine and opened right up... strange...

    Anyway, here's the log.

    ComboFix:


    ComboFix 11-02-17.02 - SYSTEM 02/19/2011 13:51:00.1.2 - x86 NETWORK
    Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2038.1449 [GMT -5:00]
    Running from: c:\users\Chris\Desktop\Combo-Fix.exe
    Command switches used :: c:\users\Chris\Desktop\CFScript.txt
    .

    ((((((((((((((((((((((((( Files Created from 2011-01-19 to 2011-02-19 )))))))))))))))))))))))))))))))
    .

    2011-02-19 18:56 . 2011-02-19 18:56 -------- d-----w- c:\users\TEMP\AppData\Local\temp
    2011-02-19 18:56 . 2011-02-19 18:56 -------- d-----w- c:\users\Gennie\AppData\Local\temp
    2011-02-19 18:56 . 2011-02-19 18:56 -------- d-----w- c:\users\Default\AppData\Local\temp
    2011-02-19 18:56 . 2011-02-19 18:56 -------- d-----w- c:\users\Chris\AppData\Local\temp
    2011-02-19 16:14 . 2011-02-19 16:14 -------- d-----w- c:\users\Default\AppData\Local\VS Revo Group
    2011-02-19 16:14 . 2009-12-30 16:21 27192 ----a-w- c:\windows\system32\drivers\revoflt.sys
    2011-02-19 16:14 . 2011-02-19 16:14 -------- d-----w- c:\program files\VS Revo Group
    2011-02-19 16:08 . 2011-02-19 16:08 -------- d-----w- c:\program files\Common Files\Java
    2011-02-19 16:07 . 2011-02-19 16:07 472808 ----a-w- c:\windows\system32\deployJava1.dll
    2011-02-18 18:48 . 2011-02-18 18:48 -------- d-----w- c:\program files\Perfect Uninstaller
    2011-02-18 16:18 . 2011-01-13 09:41 5890896 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{635A8AE5-A11E-46C4-9CF0-3179AE9E0428}\mpengine.dll
    2011-02-17 15:58 . 2011-02-17 18:34 -------- d-----w- c:\users\Chris\DoctorWeb
    2011-02-15 16:43 . 2011-02-15 16:43 -------- d-----w- C:\_OTL
    2011-02-15 01:57 . 2011-02-15 01:57 -------- d-----w- c:\users\Chris\AppData\Roaming\Malwarebytes
    2011-02-13 01:16 . 2011-02-13 01:16 -------- d-----w- C:\RMVFLTR.TEMP
    2011-02-10 22:52 . 2010-05-25 07:59 1416680 ----a-w- c:\windows\system32\WdfCoInstaller01005.dll
    2011-02-10 22:52 . 2010-05-25 07:59 1416680 ----a-w- c:\windows\system32\drivers\WdfCoInstaller01005.dll
    2011-02-10 22:52 . 2010-05-25 07:59 10216 ----a-w- c:\windows\system32\drivers\ssadwhnt.sys
    2011-02-10 22:52 . 2010-05-25 07:59 10216 ----a-w- c:\windows\system32\drivers\ssadwh.sys
    2011-02-10 22:52 . 2010-05-25 07:59 96488 ----a-w- c:\windows\system32\drivers\ssadbus.sys
    2011-02-10 22:52 . 2010-05-25 07:59 30312 ----a-w- c:\windows\system32\drivers\ssadadb.sys
    2011-02-10 22:52 . 2010-05-25 07:59 12776 ----a-w- c:\windows\system32\drivers\ssadmdfl.sys
    2011-02-10 22:52 . 2010-05-25 07:59 121576 ----a-w- c:\windows\system32\drivers\ssadmdm.sys
    2011-02-10 22:52 . 2010-05-25 07:59 10344 ----a-w- c:\windows\system32\drivers\ssadcmnt.sys
    2011-02-10 22:52 . 2010-05-25 07:59 10344 ----a-w- c:\windows\system32\drivers\ssadcm.sys
    2011-02-10 22:44 . 2010-04-27 02:25 14920 ----a-w- c:\windows\system32\drivers\sscdmdfl.sys
    2011-02-10 22:44 . 2010-04-27 02:25 132424 ----a-w- c:\windows\system32\drivers\sscdmdm.sys
    2011-02-10 22:44 . 2010-04-27 02:25 12616 ----a-w- c:\windows\system32\drivers\sscdcmnt.sys
    2011-02-10 22:44 . 2010-04-27 02:25 12616 ----a-w- c:\windows\system32\drivers\sscdcm.sys
    2011-02-10 22:44 . 2010-04-27 02:25 12488 ----a-w- c:\windows\system32\drivers\sscdwhnt.sys
    2011-02-10 22:44 . 2010-04-27 02:25 12488 ----a-w- c:\windows\system32\drivers\sscdwh.sys
    2011-02-10 22:44 . 2010-04-27 02:25 104648 ----a-w- c:\windows\system32\drivers\sscdbus.sys
    2011-02-10 22:43 . 2011-02-10 22:43 58704 ----a-r- c:\users\Chris\AppData\Roaming\Microsoft\Installer\{9F153AD3-3523-4542-818E-AE2F92249667}\ARPPRODUCTICON.exe
    2011-02-10 22:16 . 2011-02-10 22:16 -------- d-----w- c:\program files\SAMSUNG
    2011-02-10 22:16 . 2011-02-10 22:16 -------- d-----w- c:\programdata\Samsung
    2011-02-06 06:17 . 2011-02-06 06:17 -------- d-----w- c:\users\TEMP\AppData\Local\Google
    2011-02-06 06:17 . 2011-02-06 06:17 -------- d-----w- c:\users\TEMP\AppData\Roaming\Yahoo!
    2011-02-06 06:15 . 2011-02-06 06:41 -------- d-----w- C:\!KillBox
    2011-02-06 05:40 . 2011-02-06 05:40 388096 ----a-r- c:\users\Chris\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
    2011-02-06 05:40 . 2011-02-06 05:40 -------- d-----w- c:\program files\TrendMicro
    2011-02-06 01:18 . 2011-02-06 01:18 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
    2011-02-05 01:09 . 2011-02-05 01:09 -------- d-----w- c:\program files\CCleaner
    2011-02-04 17:32 . 2011-02-04 17:32 -------- d-----w- c:\program files\DVDFab 8

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2010-12-20 23:09 . 2011-01-14 03:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
    2010-12-20 23:08 . 2011-01-14 03:30 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
    2010-12-09 08:20 . 2010-12-09 08:20 749832 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-01-31 131072]
    "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-01-31 151552]
    "Persistence"="c:\windows\system32\igfxpers.exe" [2007-01-31 126976]
    "RtHDVCpl"="RtHDVCpl.exe" [2007-01-18 4349952]
    "HWSetup"="c:\program files\TOSHIBA\Utilities\HWSetup.exe" [2006-11-01 413696]
    "SVPWUTIL"="c:\program files\TOSHIBA\Utilities\SVPWUTIL.exe" [2006-11-01 438272]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-02-02 835584]
    "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-23 116040]
    "SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-10-29 249064]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "GrpConv"="grpconv -o" [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs"=AVGRSSTX.DLL c:\progra~1\GOOGLE\GOOGLE~1\GOEC62~1.DLL

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"=wdmaud.drv

    [HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
    path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
    backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
    backupExtension=.CommonStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
    %ProgramFiles%\Windows Defender\MSASCui.exe -hide [X]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Camera Assistant Software]
    2007-02-13 16:30 405504 ----a-w- c:\program files\Camera Assistant Software for Toshiba\traybar.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    2007-05-08 20:24 54840 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KeNotify]
    2006-11-07 01:14 34352 ----a-w- c:\program files\Toshiba\Utilities\KeNotify.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    2010-09-08 15:17 421888 ----a-w- c:\program files\QuickTime\QTTask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
    "DisableMonitoring"=dword:00000001

    R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-03-14 135664]
    R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\LogMeIn\x86\RaInfo.sys [x]
    R2 lxdp_device;lxdp_device;c:\windows\system32\lxdpcoms.exe [2007-11-20 589824]
    R2 MotoConnect Service;MotoConnect Service;c:\program files\Motorola\MotoConnectService\MotoConnectService.exe [2010-06-24 91456]
    R3 androidusb;SAMSUNG Android Composite ADB Interface Driver;c:\windows\system32\Drivers\ssadadb.sys [2010-05-25 30312]
    R3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [x]
    R3 MRV6X32U;Marvell TOPDOG 802.11n WLAN Driver for Vista x86 (USB8x);c:\windows\system32\DRIVERS\MRVW24B.sys [2007-01-19 312320]
    R3 Revoflt;Revoflt;c:\windows\system32\DRIVERS\revoflt.sys [2009-12-30 27192]
    R3 ssadbus;SAMSUNG Android USB Composite Device driver (WDM);c:\windows\system32\DRIVERS\ssadbus.sys [2010-05-25 96488]
    R3 ssadmdfl;SAMSUNG Android USB Modem (Filter);c:\windows\system32\DRIVERS\ssadmdfl.sys [2010-05-25 12776]
    R3 ssadmdm;SAMSUNG Android USB Modem Drivers;c:\windows\system32\DRIVERS\ssadmdm.sys [2010-05-25 121576]
    R3 TpChoice;Touch Pad Detection Filter driver;c:\windows\system32\DRIVERS\TpChoice.sys [x]
    R3 WPN111;Wireless USB 2.0 Adapter with RangeMax Service;c:\windows\system32\DRIVERS\WPN111.sys [x]


    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - ECACHE

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    Contents of the 'Scheduled Tasks' folder

    2011-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 04:22]

    2011-02-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-03-15 04:22]

    2011-02-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-903708157-4245715410-21210898-1001Core.job
    - c:\users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-26 16:15]

    2011-02-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-903708157-4245715410-21210898-1001UA.job
    - c:\users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [2009-11-26 16:15]
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-RunOnce-<NO NAME> - (no file)



    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-02-19 13:56
    Windows 6.0.6000 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2011-02-19 13:59:00
    ComboFix-quarantined-files.txt 2011-02-19 18:58
    ComboFix2.txt 2011-02-18 19:08

    Pre-Run: 20,725,145,600 bytes free
    Post-Run: 20,487,749,632 bytes free

    - - End Of File - - BBBA770FE11DFECE2F1D900056C5C086
     
  12. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    that's spooky.... just finished watching 'Evan Almighty' on the TV. B)

    I've notice a strange thing on your system, take a look:
    Sometimes a duplicate file or folder is added.
    Maybe this is why the system can't find a program .... it's looking in the wrong place.
    The files/folders are added to the 'C' drive and then in to thin air.
    This is something i've not seen before.
    I'll look into this a bit more over the next couple of days as it's definitely got my attention now.

    Actually i've never had that happen before when helping, but it seems it does happen from time to time when fixing things with CF.
    Some 'Helpers' give a warning about it, but as it's never happened to me i didn't think to mention it.
    As you found though.... a reboot fixes this.

    It's nice to see no locked reg files in the report now. [​IMG]

    Ok, back to business:

    Step 1
    Double click on OTL.exe to run it.
    Copy the lines in bold below. (make sure that :Otl is on the first line )

    :eek:tl
    SRV - (GoogleDesktopManager-110309-193829) -- File not found
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
    O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - File not found
    O4 - HKLM..\RunOnce: [] File not found
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O20 - AppInit_DLLs: (AVGRSSTX.DLL) - File not found
    O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
    [2007/11/07 07:12:28 | 000,232,960 | ---- | C] () -- \VC_RED.MSI
    [2007/11/07 07:09:22 | 001,442,522 | ---- | C] () -- \VC_RED.cab
    [2007/11/07 07:03:18 | 000,097,296 | ---- | C] () -- \install.res.1036.dll
    [2007/11/07 07:03:18 | 000,096,272 | ---- | C] () -- \install.res.3082.dll
    [2007/11/07 07:03:18 | 000,096,272 | ---- | C] () -- \install.res.1031.dll
    [2007/11/07 07:03:18 | 000,095,248 | ---- | C] () -- \install.res.1040.dll
    [2007/11/07 07:03:18 | 000,091,152 | ---- | C] () -- \install.res.1033.dll
    [2007/11/07 07:03:18 | 000,081,424 | ---- | C] () -- \install.res.1041.dll
    [2007/11/07 07:03:18 | 000,079,888 | ---- | C] () -- \install.res.1042.dll
    [2007/11/07 07:03:18 | 000,076,304 | ---- | C] () -- \install.res.1028.dll
    [2007/11/07 07:03:18 | 000,075,792 | ---- | C] () -- \install.res.2052.dll
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.3082.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.2052.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1042.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1040.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1036.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1031.txt
    [2007/11/07 07:00:40 | 000,017,734 | ---- | C] () -- \eula.1028.txt
    [2007/11/07 07:00:40 | 000,010,134 | ---- | C] () -- \eula.1033.txt
    [2007/11/07 07:00:40 | 000,005,686 | ---- | C] () -- \vcredist.bmp
    [2007/11/07 07:00:40 | 000,001,110 | ---- | C] () -- \globdata.ini
    [2007/11/07 07:00:40 | 000,000,843 | ---- | C] () -- \install.ini
    [2007/11/07 07:00:40 | 000,000,118 | ---- | C] () -- \eula.1041.txt
    [2007/09/03 17:33:05 | 000,000,150 | ---- | C] () -- \YServer.txt

    :commands
    [emptytemp]

    • Return to OTL,
    • right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.

      .
    • Click the red Run Fix button.

      [​IMG]
    • OTL will reboot your system once the fix has completed.
    • After the reboot, you may need to double click OTL to launch the program and retrieve the log.

    Copy and paste the contents of the OTL log that comes up after the fix in your next reply.

    if you lose the report, there will be a copy here:
    C:\_OTL\MovedFiles


    Step 2
    I see you haven't added AVG back.
    This is probably a good thing as it's not a program that a lot of us recommend.

    You do need a good AV on the system, so take your pick from this list of free recommended AV's:


    Note*:
    Upon installation MS Security Essentials will check that your OS is a legal copy.


    In your next reply, please submit:
    Otl fix report
    and let me know which AV you installed.


    Thanks.
     
    Last edited by a moderator: Feb 4, 2014
  13. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    OTL log:


    All processes killed
    ========== OTL ==========
    Service GoogleDesktopManager-110309-193829 stopped successfully!
    Service GoogleDesktopManager-110309-193829 deleted successfully!
    File File not found not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\ deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDrives deleted successfully.
    Registry key HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel\ deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:AVGRSSTX.DLL deleted successfully.
    Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully.
    Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found.
    File move failed. \VC_RED.MSI scheduled to be moved on reboot.
    File move failed. \VC_RED.cab scheduled to be moved on reboot.
    File move failed. \install.res.1036.dll scheduled to be moved on reboot.
    File move failed. \install.res.3082.dll scheduled to be moved on reboot.
    File move failed. \install.res.1031.dll scheduled to be moved on reboot.
    File move failed. \install.res.1040.dll scheduled to be moved on reboot.
    File move failed. \install.res.1033.dll scheduled to be moved on reboot.
    File move failed. \install.res.1041.dll scheduled to be moved on reboot.
    File move failed. \install.res.1042.dll scheduled to be moved on reboot.
    File move failed. \install.res.1028.dll scheduled to be moved on reboot.
    File move failed. \install.res.2052.dll scheduled to be moved on reboot.
    File move failed. \eula.3082.txt scheduled to be moved on reboot.
    File move failed. \eula.2052.txt scheduled to be moved on reboot.
    File move failed. \eula.1042.txt scheduled to be moved on reboot.
    File move failed. \eula.1040.txt scheduled to be moved on reboot.
    File move failed. \eula.1036.txt scheduled to be moved on reboot.
    File move failed. \eula.1031.txt scheduled to be moved on reboot.
    File move failed. \eula.1028.txt scheduled to be moved on reboot.
    File move failed. \eula.1033.txt scheduled to be moved on reboot.
    File move failed. \vcredist.bmp scheduled to be moved on reboot.
    File move failed. \globdata.ini scheduled to be moved on reboot.
    File move failed. \install.ini scheduled to be moved on reboot.
    File move failed. \eula.1041.txt scheduled to be moved on reboot.
    File move failed. \YServer.txt scheduled to be moved on reboot.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users
    -> No Temporary Internet Files cache folder defined!

    User: Chris
    -> No Temporary Internet Files cache folder defined!

    User: Default
    -> No Temporary Internet Files cache folder defined!

    User: Default User
    -> No Temporary Internet Files cache folder defined!

    User: Gennie
    -> No Temporary Internet Files cache folder defined!

    User: Public
    -> No Temporary Internet Files cache folder defined!

    User: TEMP
    -> No Temporary Internet Files cache folder defined!

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 0 bytes
    RecycleBin emptied: 0 bytes

    Total Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.20.6 log created on 02192011_202107


    I'm going to go with Avast since I have used it many times before.
     
  14. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    I am trying to clean up the computer and get rid of some old files and some folders with pics in them I try to delete and even though it says they are deleting, they are still there... even after it asks for the admin password... they aren't locked or anything, just like normal files... is that just the malware still screwing things up?
     
  15. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    I'm not sure why this is happening, it may a permissions issue or the locations actually being messed up.

    If you want to get rid of a whole folder, let me have the full location path:
    Navigate to the folder and then right click on the folder.
    Select 'Properties'.
    Then click on the 'Security' tab.
    Let me have the full path next to 'Object Name'.

    .

    If it's a file, navigate to the actual file and do the same.
    Give me the full 'Object Name' including the file extension type.

    .

    You can check the permissions allowed from this property window as well.
    Still on the Security tab.... scroll down and click on Advanced.
    You will now see all the permission settings.

    .

    They should all be set similar to those in the pic.
     
    Last edited by a moderator: Feb 4, 2014
  16. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    well here is just one of probably 20 or so folders... my finace is a picture taker lol.

    Path is C:\Users\Gennie\Pictures\2007-11-19
     
  17. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    by the way, I went ahead and scanned the comp with Avast... I did the complete scan... it didn't find anything, but I realize that doesn't always mean that something isn't there.
     
  18. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    How were the permissions set when you checked?
    Were they ok?

    Files and folders can be removed using OTL if you have problems removing them manually.
    Here's that folder:

    Double click on OTL.exe to run it.
    Copy the lines in bold below.

    :Files
    C:\Users\Gennie\Pictures\2007-11-19

    :commands
    [emptytemp]


    • Return to OTL,
    • right click in the Custom Scans/Fixes window (under the blue bar) and choose Paste.

      .
    • Click the red Run Fix button.

      [​IMG]
    • OTL will reboot your system once the fix has completed.

    The :Files command will remove files or folders. (so both can be added here)
    Obviously you have to be careful with what you add to the :Files command.
    Adding the Empty Temp command will stop any running process's (making the fix easier) and will set the system to reboot after the fix.
     
    Last edited by a moderator: Feb 4, 2014
  19. Methodical4u

    Methodical4u Registered Members

    Joined:
    Feb 14, 2011
    Messages:
    61
    Location:
    Md
    Operating System:
    Windows Vista Enterprise
    the permissions were all the way they were supposed to be, I wound up getting rid of the files by using Advanced Uninstaller, so all the files I needed to remove are gone.

    The computer seems to be less laggy (is that a word? lol) and the fan while still constantly running isn't quite as loud, it gets louder obviously when a lot is being used on the comp at once.

    So the main issues left with it I think are the fact that it won't let me delete stuff without using this program, and I cannot use the CD drive which could have just gone up in the past, but I still cannot install my external DVD drive... it keeps saying for both drives that it needs the drivers... have no idea how to fix that.
     
  20. starbuck

    starbuck Rest In Peace Pete Administrator

    Joined:
    Sep 26, 2009
    Messages:
    3,830
    Location:
    Midlands, UK
    Operating System:
    Windows 10
    CPU:
    AMD Athlon II x2 250 Processor 3.00GHz
    Memory:
    8gb DDR3
    Hard Drive:
    500gb SATA
    Graphics Card:
    ASUS GeForce GTX 960 2gb
    Power Supply:
    650w PowerCool X-Viper
    Hi Evan,

    Have you tried this, for the CD/DVD problem:
    http://support.microsoft.com/kb/929461

    Have you checked the Toshiba site for any updated drivers?
     

Share This Page