Desktop infected? themed32.dll missing

Desperate · June 16, 2010

Hi,

I hope someone out there can help with this.

My desktop, running Windows XP, is failing to run numerous applications. An error message "xxx.exe unable to locate component & The application has failed to start because themed32.dll was not found .... " keeps on appearing. Some will run despite this, but userinit.exe wont so my desktop only shows the wallpaper. This happened yesterday at about the same time as several other threads were started by people with the same problem.

Any help would be much appreciated.

Desperate

sjpritch25 · June 18, 2010

Download OTL.EXE to your desktop.
Double-Click on OTL to run it.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold

netsvcs

%SYSTEMDRIVE%\*.*

%systemroot%\*. /mp /s

CREATERESTOREPOINT

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

=========================================

Download GMER Antirootkit Here, click on Download EXE and save to your Desktop

Disconnect from the internet and disable all active protection so your security program drivers will not conflict with gmer's driver
Double-click Gmer.exe to run the program.
When the program opens, click the "Rootkit" Tab
On the right-side, check all the items to be scanned, but leave "Show All" unchecked
Select all drives that are connected to your system to be scanned
Click the Scan button
When the scan is finished, click Copy to save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
Save the gmer scan log and post it in your next reply.
Close Gmer
Open a command prompt (Start | run |type cmd and hit Enter)
- Type or paste the following to unload the gmer driver:
- net stop gmer
- Hit Enter
- Exit the command prompt.
[*]Re-enable all active protection.

Desperate · June 18, 2010

Sorry to be obtuse over this, but could you tell me how to start up the computer and run explorer.exe. At the moment I have no icons on my desktop at all.

Download OTL.EXE to your desktop.
Double-Click on OTL to run it.
When the window appears, underneath Output at the top change it to Minimal Output.
Under the Standard Registry box change it to All.
Under Custom scan's and fixes section paste in the below in bold
netsvcs
%SYSTEMDRIVE%\*.*
%systemroot%\*. /mp /s
CREATERESTOREPOINT
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\drivers\*.sys /90
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.
When the scan completes, it will open two notepad windows. OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply.

=========================================
Download GMER Antirootkit Here, click on Download EXE and save to your Desktop
Disconnect from the internet and disable all active protection so your security program drivers will not conflict with gmer's driver
Double-click Gmer.exe to run the program.
When the program opens, click the "Rootkit" Tab
On the right-side, check all the items to be scanned, but leave "Show All" unchecked
Select all drives that are connected to your system to be scanned
Click the Scan button
When the scan is finished, click Copy to save the scan log to the Windows clipboard
Open Notepad or a similar text editor
Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
Save the gmer scan log and post it in your next reply.
Close Gmer
Open a command prompt (Start | run |type cmd and hit Enter)
Type or paste the following to unload the gmer driver:
net stop gmer
Hit Enter
Exit the command prompt.

[*]Re-enable all active protection.

sjpritch25 · June 18, 2010

no problem....

press ctrl alt delete simultaneously and windows task manager will appear.

Under processes Tab, look for explorer.exe

If found, click on explorer.exe to highlight

Next, click on End Process.

Click on File ---> New Task (run)

Type the following into the box

C:\WINDOWS\explorer.exe and click on Ok

Let me know if you have any issues. Thanks

Desperate · June 18, 2010

I can open the task manager, despite geting the dialogue that it cannot start, but on typing in the run box C:\WINDOWS.explorer.exe the dialogue appears again that it cannot start because the themed32.dll was not found. Clicking OK, or closing this dialogue, removes explorer.exe from the list of processes runing in the task manager.

no problem....
press ctrl alt delete simultaneously and windows task manager will appear.
Under processes Tab, look for explorer.exe
If found, click on explorer.exe to highlight
Next, click on End Process.
Click on File ---> New Task (run)
Type the following into the box
C:\WINDOWS\explorer.exe and click on Ok
Let me know if you have any issues. Thanks

sjpritch25 · June 20, 2010

Sorry for the delay, i was away for two days. Can you tell me if you are able to get to your desktop yet?

IF not, have you tried booting safe mode?

Again sorry for the delay

Desperate · June 21, 2010

Sorry for the delay, i was away for two days. Can you tell me if you are able to get to your desktop yet?
IF not, have you tried booting safe mode?
Again sorry for the delay

Hi,

I can run Internet Explorer from the Task Manager but still can't see my desktop. One worrying thing that I noticed this morning - When taskmansger was open ther seemed to be two versions of iexplorer.exe running.

I downloaded combofix yesterday. I ran despite the themed32.dll error message constantly halting it. It found and removed several trojans. I ran it again and it founf nothing but the problem remains.

Desperate · June 21, 2010

Hi sjpritch,

I got OTL to run. Here is the log.

OTL logfile created on: 21/06/2010 19:12:07 - Run 1

OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\David\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

512.00 Mb Total Physical Memory | 181.00 Mb Available Physical Memory | 35.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.52 Gb Total Space | 14.66 Gb Free Space | 19.67% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 178.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: RAWLINS

Current User Name: David

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\David\Desktop\OTL.exe (OldTimer Tools)

PRC - C:\Program Files\AVG\AVG8\avgrsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG8\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG8\avgnsx.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

PRC - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe ()

PRC - C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe ()

PRC - C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)

========== Modules (SafeList) ==========

MOD - C:\Documents and Settings\David\Desktop\OTL.exe (OldTimer Tools)

MOD - C:\WINDOWS\system32\msscript.ocx (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (McComponentHostService) -- C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe (McAfee, Inc.)

SRV - (avg8emc) -- C:\Program Files\AVG\AVG8\avgemc.exe (AVG Technologies CZ, s.r.o.)

SRV - (avg8wd) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)

SRV - (LVPrcSrv) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)

SRV - (BlueSoleil Hid Service) -- C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe ()

SRV - (Start BT in service) -- C:\Program Files\IVT Corporation\BlueSoleil\StartSkysolSvc.exe ()

SRV - (WLSetupSvc) -- C:\Program Files\Windows Live\installer\WLSetupSvc.exe (Microsoft Corporation)

SRV - (usnjsvc) -- C:\Program Files\Windows Live\Messenger\usnsvc.exe (Microsoft Corporation)

SRV - (SSScsiSV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe (Sony Corporation)

SRV - (SonicStage Back-End Service) -- C:\Program Files\Common Files\Sony Shared\AVLib\SsBeSvc.exe (Sony Corporation)

SRV - (CCALib8) -- C:\Program Files\Canon\CAL\CALMAIN.exe (Canon Inc.)

SRV - (MSCSPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe (Sony Corporation)

SRV - (SPTISRV) -- C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe (Sony Corporation)

SRV - (PACSPTISVR) -- C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe ()

SRV - (IDriverT) -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe (Macrovision Corporation)

SRV - (UleadBurningHelper) -- C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe (Ulead Systems, Inc.)

SRV - (C-DillaSrv) -- C:\WINDOWS\system32\drivers\CDANTSRV.EXE (C-Dilla Ltd)

========== Driver Services (SafeList) ==========

DRV - (AvgLdx86) -- C:\WINDOWS\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgMfx86) -- C:\WINDOWS\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)

DRV - (AvgTdiX) -- C:\WINDOWS\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)

DRV - (FilterService) -- C:\WINDOWS\system32\drivers\lvuvcflt.sys (Logitech Inc.)

DRV - (LVUVC) Logitech QuickCam E3500(UVC) -- C:\WINDOWS\system32\drivers\lvuvc.sys (Logitech Inc.)

DRV - (LVUSBSta) -- C:\WINDOWS\system32\drivers\LVUSBSta.sys (Logitech Inc.)

DRV - (LVRS) -- C:\WINDOWS\system32\drivers\lvrs.sys (Logitech Inc.)

DRV - (LVPr2Mon) -- C:\WINDOWS\system32\drivers\LVPr2Mon.sys ()

DRV - (uigcrdr) -- C:\WINDOWS\system32\drivers\uigcrdr.SYS (GMX Internet Services Inc.)

DRV - (usbaudio) USB Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\USBAUDIO.sys (Microsoft Corporation)

DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)

DRV - (MotoSwitchService) -- C:\WINDOWS\system32\drivers\motswch.sys (Motorola)

DRV - (Btcsrusb) -- C:\WINDOWS\system32\drivers\btcusb.sys (IVT Corporation.)

DRV - (BlueletSCOAudio) -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys (IVT Corporation.)

DRV - (BlueletAudio) -- C:\WINDOWS\system32\drivers\blueletaudio.sys (IVT Corporation.)

DRV - (motmodem) -- C:\WINDOWS\system32\drivers\motmodem.sys (Motorola)

DRV - (BT) -- C:\WINDOWS\system32\drivers\btnetdrv.sys (IVT Corporation.)

DRV - (BTHidMgr) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys (IVT Corporation.)

DRV - (BTHidEnum) -- C:\WINDOWS\System32\Drivers\vbtenum.sys (IVT Corporation.)

DRV - (VcommMgr) -- C:\WINDOWS\system32\drivers\VcommMgr.sys (IVT Corporation.)

DRV - (VComm) -- C:\WINDOWS\system32\drivers\VComm.sys (IVT Corporation.)

DRV - (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) -- C:\WINDOWS\system32\drivers\alcan5wn.sys (THOMSON)

DRV - (alcaudsl) -- C:\WINDOWS\system32\drivers\alcaudsl.sys (THOMSON)

DRV - (nv) -- C:\WINDOWS\system32\drivers\nv4_mini.sys (NVIDIA Corporation)

DRV - (GT680x) -- C:\WINDOWS\system32\drivers\gt680x.sys ( )

DRV - (DCamUSBSQTECH) Dual-Mode DSC(2770) -- C:\WINDOWS\system32\drivers\SQCaptur.sys (Service & Quality Technology.)

DRV - (SjyPkt) -- C:\WINDOWS\system32\drivers\SjyPkt.sys (Windows ® 2000 DDK provider)

DRV - (ROB_V) -- C:\WINDOWS\system32\drivers\rob_v.sys (Pinnacle Systems GmbH)

DRV - (pctvvbi) -- C:\WINDOWS\system32\drivers\pctvvbi.sys (Pinnacle Systems)

DRV - (ROB_A) -- C:\WINDOWS\system32\drivers\rob_a.sys (Pinnacle Systems GmbH)

DRV - (Pfc) -- C:\WINDOWS\system32\drivers\pfc.sys (Padus, Inc.)

DRV - (Fasttrak) -- C:\WINDOWS\system32\drivers\Fasttrak.sys (Promise Technology, Inc.)

DRV - (cmpci) C-Media PCI Audio Driver (WDM) -- C:\WINDOWS\system32\drivers\cmaudio.sys (C-Media Inc)

DRV - (C-Dilla) -- C:\WINDOWS\system32\drivers\CDANT.SYS (Macrovision)

DRV - (HCF_MSFT) -- C:\WINDOWS\system32\drivers\HCF_MSFT.sys (Conexant)

========== Standard Registry (All) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerm...tf8&oe=utf8

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie

IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = localhost

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Search the Web"

FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429

FF - prefs.js..extensions.enabledItems: {3112ca9c-de6d-4884-a869-9855de68056c}:7.0.20091214Wb1

FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.1.1

FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.7

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG8\Firefox [2009/12/22 10:54:33 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b}: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009/08/08 13:00:51 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{3112ca9c-de6d-4884-a869-9855de68056c}: C:\Documents and Settings\All Users\Application Data\Google\Toolbar for Firefox\{3112ca9c-de6d-4884-a869-9855de68056c} [2010/02/12 09:19:49 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/03/15 13:24:44 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/03/15 13:24:22 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/04/23 08:23:27 | 000,000,000 | ---D | M]

[2009/03/17 09:29:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Mozilla\Extensions

[2009/03/17 09:29:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David\Application Data\Mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}

[2010/06/03 17:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\pfuqip7a.default\extensions

[2010/06/03 17:16:08 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\pfuqip7a.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2010/06/03 17:16:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Mozilla\Firefox\Profiles\pfuqip7a.default\extensions\staged-xpis

[2010/06/14 22:00:05 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/06/21 14:36:05 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}

[2010/02/12 09:19:33 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

[2009/12/22 18:44:05 | 000,023,512 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browserdirprovider.dll

[2009/12/22 18:44:05 | 000,137,176 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\brwsrcmp.dll

[2009/12/22 18:44:05 | 000,064,984 | ---- | M] (mozilla.org) -- C:\Program Files\Mozilla Firefox\plugins\npnul32.dll

[2010/04/04 00:43:36 | 000,103,864 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppdf32.dll

[2010/03/15 13:24:20 | 000,140,864 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nppl3260.dll

[2010/03/15 13:25:12 | 000,008,192 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nprjplug.dll

[2010/03/15 13:24:04 | 000,098,304 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\nprpjplug.dll

[2009/12/22 04:30:24 | 000,001,538 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml

[2009/12/22 04:30:24 | 000,002,193 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\answers.xml

[2009/12/22 04:30:24 | 000,000,947 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml

[2009/12/22 04:30:24 | 000,001,534 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\creativecommons.xml

[2009/12/22 04:30:24 | 000,000,769 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml

[2009/12/22 04:30:24 | 000,002,371 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\google.xml

[2009/12/22 04:30:24 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia.xml

[2009/12/22 04:30:24 | 000,000,831 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2010/06/20 13:54:02 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)

O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (no name) - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - No CLSID value found.

O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - No CLSID value found.

O2 - BHO: (Windows Live Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)

O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll (Google Inc.)

O2 - BHO: (no name) - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - No CLSID value found.

O3 - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKLM\..\Toolbar: (Ask Toolbar) - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)

O3 - HKLM\..\Toolbar: (no name) - SITEguard - No CLSID value found.

O3 - HKCU\..\Toolbar\ShellBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\ShellBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)

O3 - HKCU\..\Toolbar\WebBrowser: (&Address) - {01E04581-4EEE-11D0-BFE9-00AA005B4383} - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {0E5CBF21-D15F-11D0-8301-00AA005B4383} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O3 - HKCU\..\Toolbar\WebBrowser: (&Links) - {F2CF5485-4E02-4F68-819C-B92DE9277049} - C:\WINDOWS\system32\ieframe.dll (Microsoft Corporation)

O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)

O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)

O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKCU..\Run: [GMX_GMX File Storage Manager] C:\Program Files\GMX\GMX File Storage Manager\DAVSRV.EXE (GMX Internet Services Inc.)

O4 - HKCU..\Run: [iLO_Office_Manager] C:\WINDOWS\System32\intedreg.exe ()

O4 - HKLM..\RunOnce: [*Restore] C:\WINDOWS\System32\restore\rstrui.exe (Microsoft Corporation)

O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil10e.exe (Adobe Systems, Inc.)

O4 - HKCU..\RunOnce: [shockwave Updater] C:\WINDOWS\System32\Adobe\Shockwave 11\SwHelper_1150595.exe -Update -1150595 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident\4.0; File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk = C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: RTHDBPL = C:\Documents and Settings\David\Application Data\SystemProc\lsass.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\control panel present

O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\restrictions present

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll (Sun Microsystems, Inc.)

O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe (Microsoft Corporation)

O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\WINDOWS\system32\winrnr.dll (Microsoft Corporation)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000012 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000013 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000014 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000015 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000016 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000019 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000020 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000021 - C:\WINDOWS\system32\mswsock.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000022 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O10 - Protocol_Catalog9\Catalog_Entries\000000000023 - C:\WINDOWS\system32\rsvpsp.dll (Microsoft Corporation)

O15 - HKCU\..Trusted Domains: ([]msn in My Computer)

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/templates/ieawsdc.cab (Microsoft Office Template and Media Control)

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4.../OGAControl.cab (Office Genuine Advantage Validation Tool)

O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} http://www.musicnotes.com/download/mnviewer.cab (Musicnotes Viewer)

O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.1.4.cab (Bebo Uploader Control)

O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} http://musicmix.messenger.msn.com/Medialogic.CAB (CMediaMix Object)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shock...director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://www.update.microsoft.com/windowsupd...b?1198967935390 (WUWebControl Class)

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdat...b?1215844976656 (MUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...ows-i586-jc.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab (MessengerStatsClient Class)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flas...ent/swflash.cab (Shockwave Flash Object)

O16 - DPF: {DC6FEBC5-0A2D-458A-A01B-5DB15EEC4305} http://webc.fenlea.co.uk/controls/IlosoftImageUpload.dll (IlosoftImageUploadCtl Class)

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://www.shockwave.com/content/bejeweled...ploader_v10.cab (PopCapLoader Object)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1

O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\gopher {79eac9e4-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ipp - No CLSID value found

O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\lid {5C135180-9973-46D9-ABF4-148267CBB8BF} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\WINDOWS\system32\inetcomm.dll (Microsoft Corporation)

O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp - No CLSID value found

O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)

O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)

O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\WINDOWS\system32\itss.dll (Microsoft Corporation)

O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.8.5.1302.1018.dll (Microsoft Corporation)

O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)

O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\WINDOWS\system32\Skype4COM.dll (Skype Technologies)

O18 - Protocol\Handler\sysimage {76E67A63-06E9-11D2-A840-006008059382} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\WINDOWS\system32\msvidctl.dll (Microsoft Corporation)

O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\WINDOWS\system32\mshtml.dll (Microsoft Corporation)

O18 - Protocol\Handler\wia {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\system32\wiascr.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\WINDOWS\System32\mscoree.dll (Microsoft Corporation)

O18 - Protocol\Filter\Class Install Handler {32B533BB-EDAE-11d0-BD5A-00AA00B92AF1} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\deflate {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\gzip {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\lzdhtml {8f6b0360-b80d-11d0-a9b3-006097942311} - C:\WINDOWS\system32\urlmon.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/webviewhtml {733AC4CB-F1A4-11d0-B951-00A0C90312E1} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UIHost - (logonui.exe) - C:\WINDOWS\System32\logonui.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (rundll32 shell32) - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (Control_RunDLL "sysdm.cpl") - C:\WINDOWS\System32\sysdm.cpl (Microsoft Corporation)

O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)

O20 - Winlogon\Notify\crypt32chain: DllName - crypt32.dll - C:\WINDOWS\System32\crypt32.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cryptnet: DllName - cryptnet.dll - C:\WINDOWS\System32\cryptnet.dll (Microsoft Corporation)

O20 - Winlogon\Notify\cscdll: DllName - cscdll.dll - C:\WINDOWS\System32\cscdll.dll (Microsoft Corporation)

O20 - Winlogon\Notify\dimsntfy: DllName - %SystemRoot%\System32\dimsntfy.dll - C:\WINDOWS\system32\dimsntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\ScCertProp: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\Schedule: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\sclgntfy: DllName - sclgntfy.dll - C:\WINDOWS\System32\sclgntfy.dll (Microsoft Corporation)

O20 - Winlogon\Notify\SensLogn: DllName - WlNotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\termsrv: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll - C:\WINDOWS\System32\WgaLogon.dll (Microsoft Corporation)

O20 - Winlogon\Notify\wlballoon: DllName - wlnotify.dll - C:\WINDOWS\System32\wlnotify.dll (Microsoft Corporation)

O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\shell32.dll (Microsoft Corporation)

O21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll (Microsoft Corporation)

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll (Microsoft Corporation)

O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {438755C2-A8BA-11D1-B96B-00A0C90312E1} - Browseui preloader - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O22 - SharedTaskScheduler: {8C7461EF-2B13-11d2-BE35-3078302C2030} - Component Categories cache daemon - C:\WINDOWS\system32\browseui.dll (Microsoft Corporation)

O24 - Desktop Components:0 (My Current Home Page) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\David\My Documents\My Pictures\2009_05_05\IMG_0790.BMP

O24 - Desktop BackupWallPaper: C:\Documents and Settings\David\My Documents\My Pictures\2009_05_05\IMG_0790.BMP

O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - C:\WINDOWS\System32\shell32.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msapsspc.dll) - C:\WINDOWS\System32\msapsspc.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (schannel.dll) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (digest.dll) - C:\WINDOWS\System32\digest.dll (Microsoft Corporation)

O29 - HKLM SecurityProviders - (msnsspc.dll) - C:\WINDOWS\System32\msnsspc.dll (Microsoft Corporation)

O30 - LSA: Authentication Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (kerberos) - C:\WINDOWS\System32\kerberos.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (msv1_0) - C:\WINDOWS\System32\msv1_0.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (schannel) - C:\WINDOWS\System32\schannel.dll (Microsoft Corporation)

O30 - LSA: Security Packages - (wdigest) - C:\WINDOWS\System32\wdigest.dll (Microsoft Corporation)

O31 - SafeBoot: AlternateShell - cmd.exe

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2003/05/01 21:01:11 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2008/02/15 17:22:56 | 000,000,031 | R--- | M] () - E:\Autorun.inf -- [ CDFS ]

O33 - MountPoints2\{8aa8cc1d-6034-11dc-adff-00120e6b9d8d}\Shell - "" = AutoRun

O33 - MountPoints2\{8aa8cc1d-6034-11dc-adff-00120e6b9d8d}\Shell\AutoRun - "" = Auto&Play

O33 - MountPoints2\{8aa8cc1d-6034-11dc-adff-00120e6b9d8d}\Shell\AutoRun\command - "" = C:\WINDOWS\System32\shell32.dll -- [2008/06/17 20:02:19 | 008,461,312 | ---- | M] (Microsoft Corporation)

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O34 - HKLM BootExecute: (sprestrt) - C:\WINDOWS\System32\sprestrt.exe (Microsoft Corporation)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found

NetSvcs: Ias - C:\WINDOWS\system32\ias [2007/12/29 21:53:58 | 000,000,000 | ---D | M]

NetSvcs: Iprip - File not found

NetSvcs: Irmon - File not found

NetSvcs: NWCWorkstation - File not found

NetSvcs: Nwsapagent - File not found

NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT

Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2010/06/21 19:08:45 | 000,574,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\David\Desktop\OTL.exe

[2010/06/21 14:36:04 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\David\Application Data\SystemProc

[2010/06/21 14:36:04 | 000,000,000 | ---D | C] -- C:\Avenger

[2010/06/21 14:33:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\System

[2010/06/21 14:33:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\desktop

[2010/06/21 14:33:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\backup

[2010/06/21 14:32:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\Application Data\TmpRecentIcons

[2010/06/20 16:26:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp

[2010/06/20 13:21:53 | 000,000,000 | ---D | C] -- C:\cmdcons

[2010/06/20 12:44:56 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT

[2010/06/20 12:40:01 | 000,000,000 | ---D | C] -- C:\Qoobox

[2010/06/20 12:13:27 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010/06/15 07:29:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Temp

[2010/06/10 17:42:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\My Documents\My Albums

[2010/06/07 22:41:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\David\My Documents\Driving

[2006/04/16 13:20:05 | 000,017,504 | R--- | C] ( ) -- C:\WINDOWS\System32\drivers\gt680x.sys

[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[6 C:\Documents and Settings\David\My Documents\*.tmp files -> C:\Documents and Settings\David\My Documents\*.tmp -> ]

[15 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/06/21 19:08:45 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\David\Desktop\OTL.exe

[2010/06/21 14:45:19 | 061,273,118 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm

[2010/06/21 14:41:29 | 000,000,868 | ---- | M] () -- C:\WINDOWS\tasks\Google Software Updater.job

[2010/06/21 14:41:20 | 000,013,668 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/06/21 14:39:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/06/21 13:35:09 | 000,000,286 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeScheduledTaskS-1-5-21-1644491937-1580818891-725345543-1003.job

[2010/06/21 13:35:09 | 000,000,278 | ---- | M] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-1580818891-725345543-1003.job

[2010/06/20 16:15:27 | 000,000,535 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/06/20 13:54:02 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/06/15 12:42:57 | 007,299,072 | ---- | M] () -- C:\Documents and Settings\David\ntuser.dat

[2010/06/15 12:38:49 | 000,000,278 | -HS- | M] () -- C:\Documents and Settings\David\ntuser.ini

[2010/06/15 12:20:32 | 000,020,992 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Rawlins arms.doc

[2010/06/15 07:31:09 | 000,000,880 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cb0c5457c30198.job

[2010/06/14 23:04:52 | 000,024,064 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Rawlins mottoe.doc

[2010/06/14 22:00:11 | 000,000,009 | ---- | M] () -- C:\confin.sys

[2010/06/13 09:16:17 | 000,033,280 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Hanmer.doc

[2010/06/12 22:51:16 | 000,001,630 | ---- | M] () -- C:\WINDOWS\win.ini

[2010/06/12 22:51:16 | 000,000,082 | ---- | M] () -- C:\WINDOWS\MPLAYER.INI

[2010/06/12 22:51:13 | 000,083,687 | ---- | M] () -- C:\Documents and Settings\David\FTW.ini

[2010/06/11 13:16:56 | 000,021,504 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Information from Traffic Signs Manual.doc

[2010/06/09 12:03:56 | 000,619,755 | ---- | M] () -- C:\Documents and Settings\David\My Documents\DSC04783.JPG

[2010/06/09 11:58:56 | 000,212,992 | ---- | M] () -- C:\Documents and Settings\David\My Documents\PCN letter.doc

[2010/06/08 15:11:34 | 000,521,942 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI

[2010/06/08 15:11:34 | 000,441,124 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/06/08 15:11:34 | 000,071,060 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/06/08 13:31:49 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Mexican Gherkin.doc

[2010/05/30 16:17:35 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Washing Machine Repair.doc

[2010/05/25 17:26:15 | 000,022,528 | ---- | M] () -- C:\Documents and Settings\David\My Documents\plants to grow 2 .doc

[2010/05/24 15:54:29 | 000,020,480 | ---- | M] () -- C:\Documents and Settings\David\My Documents\Melothria scabra.doc

[6 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[6 C:\Documents and Settings\David\My Documents\*.tmp files -> C:\Documents and Settings\David\My Documents\*.tmp -> ]

[15 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\drivers\*.tmp files -> C:\WINDOWS\System32\drivers\*.tmp -> ]

[1 C:\*.tmp files -> C:\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/06/20 13:22:16 | 000,000,211 | ---- | C] () -- C:\Boot.bak

[2010/06/20 13:22:13 | 000,260,272 | ---- | C] () -- C:\cmldr

[2010/06/15 12:42:56 | 007,299,072 | ---- | C] () -- C:\Documents and Settings\David\ntuser.dat

[2010/06/15 12:20:32 | 000,020,992 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Rawlins arms.doc

[2010/06/15 07:31:09 | 000,000,880 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore1cb0c5457c30198.job

[2010/06/14 23:04:52 | 000,024,064 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Rawlins mottoe.doc

[2010/06/14 22:00:11 | 000,000,009 | ---- | C] () -- C:\confin.sys

[2010/06/14 09:11:34 | 000,000,278 | ---- | C] () -- C:\WINDOWS\tasks\RealUpgradeLogonTaskS-1-5-21-1644491937-1580818891-725345543-1003.job

[2010/06/12 22:39:28 | 000,033,280 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Hanmer.doc

[2010/06/10 19:55:04 | 000,619,755 | ---- | C] () -- C:\Documents and Settings\David\My Documents\DSC04783.JPG

[2010/06/09 11:59:14 | 000,021,504 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Information from Traffic Signs Manual.doc

[2010/06/08 13:31:48 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Mexican Gherkin.doc

[2010/06/07 12:26:06 | 000,212,992 | ---- | C] () -- C:\Documents and Settings\David\My Documents\PCN letter.doc

[2010/05/30 16:17:35 | 000,030,208 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Washing Machine Repair.doc

[2010/05/24 15:54:29 | 000,020,480 | ---- | C] () -- C:\Documents and Settings\David\My Documents\Melothria scabra.doc

[2009/03/31 13:47:10 | 000,002,314 | ---- | C] () -- C:\WINDOWS\mfforms.ini

[2009/03/31 13:34:42 | 000,000,034 | ---- | C] () -- C:\WINDOWS\iltwain.ini

[2009/03/31 13:34:16 | 000,000,221 | ---- | C] () -- C:\WINDOWS\pers.ini

[2009/02/05 12:29:37 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\msvcrt10.dll

[2009/02/05 12:29:37 | 000,005,515 | ---- | C] () -- C:\WINDOWS\fmachine.ini

[2008/12/16 22:58:54 | 000,025,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\LVPr2Mon.sys

[2008/12/16 22:50:56 | 000,013,584 | ---- | C] () -- C:\WINDOWS\System32\drivers\iKeyLgFT.dll

[2008/12/06 17:00:02 | 000,081,110 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini

[2008/05/25 15:06:52 | 000,000,036 | ---- | C] () -- C:\WINDOWS\Tiny_Run.ini

[2008/02/04 19:23:10 | 000,693,792 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2007/11/19 21:37:25 | 000,532,480 | ---- | C] () -- C:\WINDOWS\System32\CddbPlaylist2Sony.dll

[2007/09/16 20:51:33 | 000,087,552 | ---- | C] () -- C:\WINDOWS\System32\cpwmon2k.dll

[2006/11/05 18:24:11 | 000,006,656 | ---- | C] () -- C:\WINDOWS\System32\CNMVSyd.DLL

[2006/11/05 18:23:11 | 000,000,599 | ---- | C] () -- C:\WINDOWS\System32\CNCMP51.INI

[2006/09/27 12:35:55 | 000,000,014 | ---- | C] () -- C:\WINDOWS\REPCDRWC.INI

[2006/09/27 12:32:53 | 000,398,336 | ---- | C] () -- C:\WINDOWS\System32\Tx32.dll

[2006/09/27 12:32:53 | 000,139,776 | ---- | C] () -- C:\WINDOWS\System32\UserEdit.dll

[2006/04/17 22:00:08 | 000,000,063 | ---- | C] () -- C:\WINDOWS\mdm.ini

[2006/04/16 13:20:05 | 000,118,784 | R--- | C] () -- C:\WINDOWS\System32\MKCoInstaller.dll

[2006/03/03 12:16:55 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll

[2005/07/12 00:21:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\inter[1].INI

[2005/02/05 16:40:27 | 000,000,000 | ---- | C] () -- C:\WINDOWS\SQInst32.INI

[2005/02/05 16:39:10 | 000,000,139 | ---- | C] () -- C:\WINDOWS\HELICON.INI

[2005/01/01 19:42:17 | 000,000,511 | ---- | C] () -- C:\WINDOWS\QTW.INI

[2004/12/24 20:13:18 | 000,000,041 | ---- | C] () -- C:\WINDOWS\MMResdat.ini

[2004/08/21 21:34:10 | 000,000,082 | ---- | C] () -- C:\WINDOWS\MPLAYER.INI

[2004/08/21 21:30:02 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\LFFPX7.DLL

[2004/08/21 21:30:02 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL

[2004/08/04 01:56:46 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll

[2004/04/03 20:27:32 | 000,000,035 | ---- | C] () -- C:\WINDOWS\A6W.INI

[2004/03/16 22:19:43 | 000,000,000 | ---- | C] () -- C:\WINDOWS\bbcauto.INI

[2004/02/16 01:50:41 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI

[2004/01/05 20:15:32 | 000,001,832 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2003/12/27 18:22:43 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL

[2003/10/03 16:20:09 | 000,000,770 | ---- | C] () -- C:\WINDOWS\Sof2.INI

[2003/09/30 14:53:34 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS4w.DLL

[2003/09/09 07:57:53 | 000,000,823 | ---- | C] () -- C:\WINDOWS\TSC.ini

[2003/09/09 07:57:52 | 000,071,749 | ---- | C] () -- C:\WINDOWS\HCExtOutput.dll

[2003/09/09 07:40:30 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini

[2003/08/28 19:12:36 | 000,000,222 | ---- | C] () -- C:\WINDOWS\CMMPLAY.INI

[2003/08/28 19:09:06 | 000,000,101 | ---- | C] () -- C:\WINDOWS\CMMIXER.INI

[2003/08/14 17:39:35 | 000,001,102 | ---- | C] () -- C:\WINDOWS\WININIT.INI

[2003/07/26 15:47:10 | 000,000,475 | ---- | C] () -- C:\WINDOWS\disney.ini

[2003/06/21 19:00:45 | 000,000,024 | ---- | C] () -- C:\WINDOWS\MSBSETUP.INI

[2003/06/08 20:36:54 | 000,029,696 | ---- | C] () -- C:\WINDOWS\System32\pthread.dll

[2003/06/08 20:36:53 | 000,307,200 | ---- | C] () -- C:\WINDOWS\System32\fxstudio.dll

[2003/05/17 20:13:00 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\libmySQL.dll

[2003/05/17 20:13:00 | 000,102,400 | ---- | C] () -- C:\WINDOWS\System32\TrackerNET.dll

[2003/05/17 18:48:50 | 000,000,157 | ---- | C] () -- C:\WINDOWS\sierra.ini

[2003/05/04 20:17:36 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\xmltok.dll

[2003/05/04 20:17:36 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\xmlparse.dll

[2003/05/04 14:42:44 | 000,000,163 | ---- | C] () -- C:\WINDOWS\KA.INI

[2003/05/01 22:09:17 | 000,000,726 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2003/05/01 21:38:54 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll

[2003/05/01 21:38:52 | 000,003,698 | ---- | C] () -- C:\WINDOWS\mixerdef.ini

[2003/05/01 21:38:19 | 000,000,312 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI

[2003/05/01 21:38:14 | 000,000,040 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI

[2003/05/01 21:38:03 | 000,003,188 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2003/05/01 21:38:02 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2003/05/01 21:23:24 | 000,014,025 | ---- | C] () -- C:\WINDOWS\TWAINCAP.INI

[2003/05/01 21:22:50 | 000,196,096 | ---- | C] () -- C:\WINDOWS\System32\Macd32.dll

[2003/05/01 21:22:50 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\Mase32.dll

[2003/05/01 21:22:50 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\Mamc32.dll

[2003/05/01 21:22:50 | 000,057,856 | ---- | C] () -- C:\WINDOWS\System32\Masd32.dll

[2003/05/01 21:22:50 | 000,027,648 | ---- | C] () -- C:\WINDOWS\System32\Ma32.dll

[2001/09/05 16:48:28 | 000,075,976 | ---- | C] () -- C:\WINDOWS\System32\BASSDEC.dll

[2001/08/23 13:00:00 | 000,001,728 | ---- | C] () -- C:\WINDOWS\System32\w0elnhiu.dll

[2001/04/01 18:16:48 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\fader.dll

[2000/03/29 01:58:40 | 000,280,576 | ---- | C] () -- C:\WINDOWS\System32\pxd_kom.dll

[1999/07/23 14:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini

[1999/07/23 11:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll

[1999/01/22 19:46:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL

[1997/06/14 03:56:08 | 000,056,832 | ---- | C] () -- C:\WINDOWS\System32\iyvu9_32.dll

========== LOP Check ==========

[2009/04/03 20:05:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Bluetooth

[2008/09/17 15:42:21 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ

[2008/10/23 22:20:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\DFX

[2005/12/25 12:38:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Electronic Arts

[2009/01/17 12:01:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\GMX

[2009/03/31 14:25:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Grisoft

[2010/03/30 09:09:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Kontiki

[2010/03/31 08:39:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\NCH Swift Sound

[2010/03/22 21:20:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PopCap

[2010/03/29 16:38:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ScanSoft

[2009/04/07 19:16:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP

[2010/03/15 14:10:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Ulead Systems

[2007/11/19 17:27:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\7Wonders

[2007/02/23 11:01:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\bang

[2009/04/24 19:03:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Canon

[2007/11/25 15:21:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\ForgottenRiddles

[2009/01/17 12:05:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\GMX

[2007/07/01 13:06:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Leadertech

[2007/11/12 08:53:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\My Games

[2010/03/31 08:39:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\NCH Swift Sound

[2008/05/30 08:27:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Part deaf save

[2006/10/17 22:27:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Schoolhouse Technologies

[2008/06/06 16:15:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\SecondLife

[2010/03/11 10:30:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\SmartDraw

[2006/01/15 23:54:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Softplicity

[2008/07/16 11:53:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\SuperAdBlocker.com

[2010/06/21 14:36:04 | 000,000,000 | -HSD | M] -- C:\Documents and Settings\David\Application Data\SystemProc

[2010/06/21 14:32:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\TmpRecentIcons

[2006/05/08 10:52:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Ulead Systems

[2010/03/29 15:32:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\David\Application Data\Uniblue

[2008/05/29 21:32:50 | 000,000,258 | -H-- | M] () -- C:\WINDOWS\Tasks\AF833F7A92A8B88E.job

[2010/04/25 10:11:05 | 000,000,236 | ---- | M] () -- C:\WINDOWS\Tasks\OGALogon.job

[2010/03/29 16:00:05 | 000,000,378 | ---- | M] () -- C:\WINDOWS\Tasks\Registry Reviver-David-Startup.job

[2010/04/02 16:02:33 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{1D9EB272-00C4-4F1F-A8E2-8C2A739B0956}.job

[2009/07/05 17:14:49 | 000,000,422 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{2A220EF1-366B-4CD1-B394-061FCE905A9B}.job

[2010/04/03 00:20:07 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job

[2007/06/30 15:18:01 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\Windows Movie Maker.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >

[2007/05/02 19:38:31 | 000,145,408 | ---- | M] () -- C:\AAD4006 Fine Art.doc

[2009/09/15 17:00:51 | 000,000,000 | ---- | M] () -- C:\AILog.txt

[2003/05/01 21:01:11 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT

[2004/12/17 12:43:02 | 006,972,738 | RHS- | M] () -- C:\AVG6DB_F.DAT

[2008/07/16 15:52:19 | 000,000,211 | ---- | M] () -- C:\Boot.bak

[2008/07/16 15:52:19 | 000,000,211 | -HS- | M] () -- C:\boot.ini

[2004/08/03 23:00:00 | 000,260,272 | ---- | M] () -- C:\cmldr

[2010/06/20 16:26:01 | 000,014,322 | ---- | M] () -- C:\ComboFix.txt

[2006/11/22 18:42:21 | 000,022,016 | ---- | M] () -- C:\Complete Personal Statement (4).doc

[2003/05/01 21:01:11 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS

[2010/06/14 22:00:11 | 000,000,009 | ---- | M] () -- C:\confin.sys

[2007/06/18 21:07:29 | 000,035,840 | ---- | M] () -- C:\guidancenotes.doc

[2004/06/05 16:55:28 | 000,000,067 | ---- | M] () -- C:\inferno.log

[2003/05/01 21:01:11 | 000,000,000 | RHS- | M] () -- C:\IO.SYS

[2006/07/05 11:55:01 | 000,000,960 | -HS- | M] () -- C:\jvmt323v.sys

[2003/06/12 16:45:13 | 004,012,920 | ---- | M] () -- C:\Lemm_log.txt

[2003/05/01 21:01:11 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS

[2004/08/04 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM

[2008/08/02 19:19:28 | 000,250,048 | RHS- | M] () -- C:\ntldr

[2010/06/21 14:39:37 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys

[2006/06/18 20:59:37 | 000,045,568 | ---- | M] () -- C:\Partnership Proposals Jun06.doc

[2007/01/08 20:38:21 | 000,244,224 | ---- | M] () -- C:\PDR Form 2006-7 Jane.doc

[2006/11/21 19:12:13 | 000,023,040 | ---- | M] () -- C:\Personal Statement(2).doc

[2006/11/21 19:15:54 | 000,023,040 | ---- | M] () -- C:\Personal Statement(3).doc

[2010/04/06 15:34:49 | 000,000,268 | ---- | M] () -- C:\rkill.log

[2008/09/30 20:49:30 | 000,230,424 | ---- | M] () -- C:\snp2sxp-001.raw

[2003/07/31 17:07:39 | 000,032,768 | ---- | M] () -- C:\t1uk

[2003/10/24 16:23:23 | 000,036,864 | ---- | M] () -- C:\t2l4

[2003/09/24 17:43:13 | 000,036,864 | ---- | M] () -- C:\t2ng

[2003/12/22 15:27:15 | 000,073,728 | ---- | M] () -- C:\t34k

[2003/12/05 22:08:36 | 000,032,768 | ---- | M] () -- C:\t3g0

[2003/10/24 16:46:34 | 000,032,768 | ---- | M] () -- C:\tr4

[2003/11/10 17:29:40 | 000,032,768 | ---- | M] () -- C:\trs

[2003/10/12 14:07:00 | 000,032,768 | ---- | M] () -- C:\tvc

[2004/05/02 15:55:37 | 000,000,014 | ---- | M] () -- C:\win2.log

[1 C:\*.tmp files -> C:\*.tmp -> ]

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >

[2009/03/08 04:31:44 | 000,348,160 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtmsft.dll

[2009/03/08 04:31:38 | 000,216,064 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\dxtrans.dll

[6 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\System32\config\*.sav >

[2007/12/29 21:19:03 | 000,524,288 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav

[2007/12/29 21:19:02 | 000,524,288 | ---- | M] () -- C:\WINDOWS\system32\config\security.sav

[2007/12/29 21:39:12 | 030,146,560 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav

[2007/12/29 21:39:12 | 004,194,304 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %systemroot%\system32\drivers\*.sys /90 >

[2010/03/29 15:24:46 | 000,020,824 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbam.sys

[2010/03/29 15:24:58 | 000,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys

[1 C:\WINDOWS\system32\drivers\*.tmp files -> C:\WINDOWS\system32\drivers\*.tmp -> ]

========== Alternate Data Streams ==========

@Alternate Data Stream - 145 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:59D05D9A

@Alternate Data Stream - 133 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

@Alternate Data Stream - 129 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:680086AB

@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:51A22C60

@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:FA345B65

@Alternate Data Stream - 105 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:05113FB9

@Alternate Data Stream - 102 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:2CFBE2D1

< End of report >

A second window didn't open. I'll look for Extras.txt with task manager

Desperate · June 21, 2010

Here it is.

OTL Extras logfile created on: 21/06/2010 19:12:08 - Run 1

OTL by OldTimer - Version 3.2.6.1 Folder = C:\Documents and Settings\David\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

512.00 Mb Total Physical Memory | 181.00 Mb Available Physical Memory | 35.00% Memory free

1.00 Gb Paging File | 1.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): c:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 74.52 Gb Total Space | 14.66 Gb Free Space | 19.67% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

Drive E: | 178.50 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: RAWLINS

Current User Name: David

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: Current user

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)

htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [Digital Photo Professional] -- C:\Program Files\Canon\Digital Photo Professional\DPPViewer.exe /path "%1" (CANON INC.)

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0

"FirstRunDisabled" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007

"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player Network Sharing Service

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 1

"DoNotAllowExceptions" = 0

"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002