Solved Unwanted message appears on Desktop on Startup

[Resolved] Unwanted message appears on Desktop on Startup

This has just started appearing on screen when comp is started:

[Could not load or run 'C:\Users\Neil\LOCALS~1\Temp\msryeqek.com' specified in the registry. Make sure the file exists on your computer or remove the reference to it in the registry.]
Had a look in MSE > History and found that:

Rogue: Win32/Winwebsec Removed 21/04/2012

Worm: Win32/Gamarue.F Quarantined 21/04/2012

Exploit: Unix/Lotoor Removed 21/04/2012

Exploit: Unix/Lotoor Removed 21/04/2012

All were marked Severe.

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.22.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Neil :: NEIL-PC [administrator]

24/04/2012 9:21:58 a.m.
mbam-log-2012-04-24 (09-21-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197972
Time elapsed: 6 minute(s), 53 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-24 09:11:50
-----------------------------
09:11:50.885 OS Version: Windows 6.0.6002 Service Pack 2
09:11:50.885 Number of processors: 1 586 0xA00
09:11:50.885 ComputerName: NEIL-PC UserName: Neil
09:12:29.104 Initialize success
09:12:58.659 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
09:12:58.659 Disk 0 Vendor: ST3250312AS JC4B Size: 238475MB BusType: 3
09:12:58.675 Disk 0 MBR read successfully
09:12:58.690 Disk 0 MBR scan
09:12:58.690 Disk 0 Windows VISTA default MBR code
09:12:58.706 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 238464 MB offset 63
09:12:58.722 Disk 0 scanning sectors +488376000
09:12:58.800 Disk 0 scanning C:\Windows\system32\drivers
09:13:09.690 Service scanning
09:13:18.237 Service MpKsl4ad87916 c:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{534EDDC1-C4FC-458B-A0D7-05C36ECCA3E7}\MpKsl4ad87916.sys **LOCKED** 32
09:13:18.378 Service MpNWMon C:\Windows\system32\DRIVERS\MpNWMon.sys **LOCKED** 32
09:13:31.378 Modules scanning
09:13:51.878 Disk 0 trace - called modules:
09:13:51.925 ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS viaide.sys PCIIDEX.SYS atapi.sys
09:13:51.940 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84a63358]
09:13:51.956 3 CLASSPNP.SYS[88c418b3] -> nt!IofCallDriver -> [0x8490b958]
09:13:51.987 5 acpi.sys[825de6bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84932528]
09:13:52.003 Scan finished successfully
09:14:17.527 Disk 0 MBR has been saved successfully to "C:\Users\Neil\Desktop\MBR.dat "
09:14:17.652 The log file has been saved successfully to "C:\Users\Neil\Desktop\aswMBR.txt "

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Database version: v2012.04.22.06

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 9.0.8112.16421
Neil :: NEIL-PC [administrator]

24/04/2012 9:21:58 a.m.
mbam-log-2012-04-24 (09-21-58).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 197972
Time elapsed: 6 minute(s), 53 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)


DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421
Run by Neil at 9:15:41 on 2012-04-24
Microsoft® Windows Vistaâ„¢ Business 6.0.6002.2.1252.64.1033.18.2559.1724 [GMT 12:00]
.
AV: Microsoft Security Essentials *Enabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Spybot - Search & Destroy *Enabled/Updated* {1EAF1D03-5480-F3B2-EB14-11F0F5EE2699}
SP: Microsoft Security Essentials *Enabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vistaâ„¢ Business
Boot Device: \Device\HarddiskVolume1
Install Date: 12/01/2012 8:44:44 p.m.
System Uptime: 24/04/2012 9:08:06 a.m. (0 hours ago)
.
Motherboard: | | KT600
Processor: AMD Athlon(tm) XP 3000+ | Socket A | 2101/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 201.178 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP146: 23/04/2012 5:00:11 p.m. - Windows Update
RP147: 23/04/2012 11:41:13 p.m. - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
7-Zip 9.20
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
Advertising Center
Auslogics Disk Defrag
Auslogics Registry Defrag

I will have to run GMER again as I can't find the saved test I ran last night. Neil.

 

As Requested:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft® Windows Vistaâ„¢ Business
Boot Device: \Device\HarddiskVolume1
Install Date: 12/01/2012 8:44:44 p.m.
System Uptime: 24/04/2012 9:08:06 a.m. (0 hours ago)
.
Motherboard: | | KT600
Processor: AMD Athlon(tm) XP 3000+ | Socket A | 2101/200mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 233 GiB total, 201.178 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP146: 23/04/2012 5:00:11 p.m. - Windows Update
RP147: 23/04/2012 11:41:13 p.m. - Windows Update
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
2007 Microsoft Office system
7-Zip 9.20
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader X (10.1.3)
Advertising Center
Auslogics Disk Defrag
Auslogics Registry Defrag
Belarc Advisor 8.2
Bing Bar
Business Contact Manager for Outlook 2007 SP2
Chinese Simplified Fonts Support For Adobe Reader X
Coupon Printer for Windows
Eudora (8.0b9)
EVEREST Ultimate Edition v4.60
Foxit Reader 5.1
Free YouTube Download version 3.1.22.319
Hewlett-Packard ACLM.NET v1.1.0.0
HiSuite
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Deskjet 2050 J510 series Basic Device Software
HP Deskjet 2050 J510 series Help
HP Deskjet 2050 J510 series Product Improvement Study
HP Photo Creations
HP Product Detection
HP Update
iCD_CoolBeLa4
ImagXpress
Malwarebytes Anti-Malware version 1.61.0.1400
Menu Templates - Starter Kit
Microsoft .NET Framework 3.5 SP1
Microsoft Antimalware
Microsoft Corporation
Microsoft LifeCam
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Hybrid 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Word MUI (English) 2007
Microsoft Security Client
Microsoft Security Essentials
Microsoft Silverlight
Microsoft SQL Server 2005
Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Movie Templates - Starter Kit
Mozilla Firefox 11.0 (x86 en-GB)
Mozilla Thunderbird 11.0.1 (x86 en-US)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 9 Essentials
Nero BurnRights
Nero BurnRights Help
Nero ControlCenter
Nero CoverDesigner
Nero CoverDesigner Help
Nero Disc Copy Gadget
Nero Disc Copy Gadget Help
Nero DiscSpeed
Nero DiscSpeed Help
Nero DriveSpeed
Nero DriveSpeed Help
Nero Express Help
Nero InfoTool
Nero InfoTool Help
Nero Installer
Nero Online Upgrade
Nero Rescue Agent
Nero RescueAgent Help
Nero ShowTime
Nero StartSmart
Nero StartSmart Help
Nero Vision
Nero Vision Help
NeroExpress
neroxml
NVIDIA Control Panel 295.73
NVIDIA Graphics Driver 295.73
NVIDIA Install Application
NVIDIA Update 1.7.11
NVIDIA Update Components
Orbit Downloader
Picasa 3
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Skype Click to Call
Skypeâ„¢ 5.7
Spybot - Search & Destroy 2
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
Update for Microsoft Office 2007 suites (KB2598306) 32-Bit Edition
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Vista Codec Package
VLC media player 2.0.1
Windows Live ID Sign-in Assistant
.
==== Event Viewer Messages From Past Week ========
.
24/04/2012 9:10:41 a.m., Error: Service Control Manager [7022] - The MSCamSvc service hung on starting.
24/04/2012 9:09:16 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
24/04/2012 1:09:33 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
24/04/2012 1:09:33 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
23/04/2012 3:42:35 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
23/04/2012 12:06:51 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
23/04/2012 11:42:34 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
23/04/2012 11:29:47 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
23/04/2012 11:11:43 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 9:49:50 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 9:49:05 p.m., Error: EventLog [6008] - The previous system shutdown at 9:47:33 p.m. on 22/04/2012 was unexpected.
22/04/2012 9:35:15 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 7:04:52 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 6:52:54 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 12:47:09 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD CSC DfsC MpFilter NetBIOS netbt nsiproxy PSched RasAcd rdbss Smb spldr tdx Wanarpv6
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The Network Location Awareness service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
22/04/2012 12:07:41 a.m., Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
22/04/2012 12:07:02 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
22/04/2012 12:06:29 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
22/04/2012 12:06:29 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
22/04/2012 12:06:27 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
22/04/2012 12:06:17 a.m., Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
22/04/2012 12:02:18 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 11:25:13 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
22/04/2012 11:04:46 p.m., Error: PCTCore [280] -
21/04/2012 3:58:04 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
21/04/2012 2:28:42 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
21/04/2012 2:16:59 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
21/04/2012 11:52:43 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
21/04/2012 10:45:44 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
21/04/2012 10:12:42 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
20/04/2012 9:43:12 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
20/04/2012 7:30:41 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
20/04/2012 5:30:51 p.m., Error: volsnap [36] - The shadow copies of volume C: were aborted because the shadow copy storage could not grow due to a user imposed limit.
20/04/2012 12:59:56 a.m., Error: EventLog [6008] - The previous system shutdown at 12:55:49 a.m. on 20/04/2012 was unexpected.
20/04/2012 12:54:37 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
20/04/2012 10:24:00 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
20/04/2012 1:06:32 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
20/04/2012 1:00:32 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
19/04/2012 11:31:05 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
19/04/2012 11:14:22 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
19/04/2012 10:27:46 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
18/04/2012 9:33:09 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
18/04/2012 9:15:31 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
18/04/2012 9:03:53 a.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
17/04/2012 12:56:51 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
17/04/2012 12:36:24 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
17/04/2012 10:32:24 p.m., Error: Microsoft Antimalware [3002] - Microsoft Antimalware Real-Time Protection feature has encountered an error and failed. Feature: Network Inspection System Error Code: 0x8007042c Error description: The dependency service or group failed to start. Reason: The system is missing updates that are required for running Network Inspection System. Install the required updates and restart the computer.
.
==== End Of File ===========================
Do you require the GMER scan info Broni?

 

Can't get Gmer to show any details or give me a Save gmer.log. It takes nearly an hour to run a scan and just shows a small window saying scan finished OK.

The computer is running as sweet as and doesn't appear to have any problems except the message that shows on the Desktop when first started. Neil.

 

Broni, Combofix ran OK.

ComboFix 12-04-24.05 - Neil 25/04/2012 18:22:28.1.1 - x86
Microsoft® Windows Vistaâ„¢ Business 6.0.6002.2.1252.64.1033.18.2559.1552 [GMT 12:00]
Running from: c:\users\Neil\Downloads\ComboFix.exe
AV: Microsoft Security Essentials *Disabled/Updated* {108DAC43-C256-20B7-BB05-914135DA5160}
SP: Microsoft Security Essentials *Disabled/Updated* {ABEC4DA7-E46C-2F39-81B5-AA334E5D1BDD}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\Neil\AppData\Roaming\Mozilla\Firefox\Profiles\tb0h0fdr.default\weave\toFetch
.
.
((((((((((((((((((((((((( Files Created from 2012-03-25 to 2012-04-25 )))))))))))))))))))))))))))))))
.
.
2012-04-24 21:25 . 2012-04-13 07:36 6734704 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{019D6CF0-CB01-4A78-BFE1-A5551813A82F}\mpengine.dll
2012-04-23 07:56 . 2012-04-23 07:56 -------- d-----w- c:\windows\Microsoft Antimalware
2012-04-23 00:54 . 2012-04-23 00:54 -------- d-----w- C:\ProcAlyzer Dumps
2012-04-22 10:59 . 2012-04-22 11:24 -------- d-----w- c:\program files\PC Tools
2012-04-22 10:55 . 2012-02-23 22:36 185560 ----a-w- c:\windows\system32\drivers\PCTSD.sys
2012-04-22 10:55 . 2012-04-22 11:24 -------- d-----w- c:\program files\Common Files\PC Tools
2012-04-22 10:54 . 2012-04-22 11:23 -------- d-----w- c:\programdata\PC Tools
2012-04-22 10:54 . 2012-04-22 10:54 -------- d-----w- c:\users\Neil\AppData\Roaming\TestApp
2012-04-11 05:05 . 2012-02-29 15:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-04-11 05:05 . 2012-02-29 15:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-04-11 05:05 . 2012-02-29 15:09 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-04-11 05:05 . 2012-02-29 13:32 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-04-10 00:30 . 2012-04-10 00:30 -------- d-----w- c:\users\Neil\AppData\Roaming\Malwarebytes
2012-04-10 00:30 . 2012-04-10 00:30 -------- d-----w- c:\programdata\Malwarebytes
2012-04-04 05:53 . 2012-04-04 05:53 182160 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-04-04 02:02 . 2012-04-15 23:28 418464 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-03-30 00:04 . 2012-03-30 00:04 -------- d-----w- c:\program files\StripMail
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-15 23:28 . 2012-01-15 03:14 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-13 07:36 . 2012-01-16 20:33 6734704 ----a-w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2012-03-22 19:12 . 2012-03-22 19:12 4435968 ----a-w- c:\windows\system32\GPhotos.scr
2012-03-06 02:43 . 2012-03-25 03:52 772248 ----a-w- c:\windows\system32\msvcr100.dll
2012-03-06 02:43 . 2012-03-25 03:52 419480 ----a-w- c:\windows\system32\msvcp100.dll
2012-03-06 02:43 . 2012-03-25 03:52 136344 ----a-w- c:\windows\system32\atl100.dll
2012-03-06 02:43 . 2012-03-25 03:52 80024 ----a-w- c:\windows\system32\mfcm100u.dll
2012-03-06 02:43 . 2012-03-25 03:52 4421272 ----a-w- c:\windows\system32\mfc100u.dll
2012-02-14 15:45 . 2012-03-14 09:13 219648 ----a-w- c:\windows\system32\d3d10_1core.dll
2012-02-14 15:45 . 2012-03-14 09:13 160768 ----a-w- c:\windows\system32\d3d10_1.dll
2012-02-13 14:12 . 2012-03-14 09:13 1172480 ----a-w- c:\windows\system32\d3d10warp.dll
2012-02-13 13:47 . 2012-03-14 09:13 683008 ----a-w- c:\windows\system32\d2d1.dll
2012-02-13 13:44 . 2012-03-14 09:13 1068544 ----a-w- c:\windows\system32\DWrite.dll
2012-02-13 11:02 . 2012-02-13 11:03 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\NISBackup\gapaengine.dll
2012-02-10 04:13 . 2012-03-01 03:27 881984 ----a-w- c:\windows\system32\nvgenco32.dll
2012-02-10 04:13 . 2012-03-01 03:27 61248 ----a-w- c:\windows\system32\OpenCL.dll
2012-02-10 04:13 . 2012-03-01 03:27 19443520 ----a-w- c:\windows\system32\nvoglv32.dll
2012-02-10 04:13 . 2012-03-01 03:27 10816832 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-02-10 04:13 . 2012-03-01 03:27 1000256 ----a-w- c:\windows\system32\nvdispco32.dll
2012-02-10 04:13 . 2012-03-01 03:26 5892928 ----a-w- c:\windows\system32\nvcuda.dll
2012-02-10 04:13 . 2012-03-01 03:26 2517312 ----a-w- c:\windows\system32\nvcuvid.dll
2012-02-10 04:13 . 2012-03-01 03:26 2437440 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-02-10 04:13 . 2012-03-01 03:26 2301248 ----a-w- c:\windows\system32\nvapi.dll
2012-02-10 04:13 . 2012-03-01 03:26 17543488 ----a-w- c:\windows\system32\nvcompiler.dll
2012-02-10 04:13 . 2006-11-02 10:25 15009600 ----a-w- c:\windows\system32\nvd3dum.dll
2012-02-10 03:02 . 2012-03-01 03:29 3881792 ----a-w- c:\windows\system32\nvcpl.dll
2012-02-10 03:00 . 2012-03-01 03:29 2719040 ----a-w- c:\windows\system32\nvsvc.dll
2012-02-10 03:00 . 2012-03-01 03:29 645440 ----a-w- c:\windows\system32\nvvsvc.exe
2012-02-10 03:00 . 2012-03-01 03:29 62272 ----a-w- c:\windows\system32\nvshext.dll
2012-02-10 03:00 . 2012-03-01 03:29 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-02-09 00:17 . 2012-02-20 08:59 713784 ------w- c:\programdata\Microsoft\Microsoft Antimalware\Definition Updates\{C72D4BB8-E708-489C-B290-891830B06A4A}\gapaengine.dll
2012-02-02 15:16 . 2012-03-14 09:13 2044416 ----a-w- c:\windows\system32\win32k.sys
2012-01-31 12:44 . 2012-01-12 08:27 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-03-16 22:49 . 2012-01-12 09:13 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar "= "c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1233920]
"HW_OPENEYE_OUC_Hi Suite "= "c:\program files\HiSuite\UpdateDog\ouc.exe" [2011-10-25 206688]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSC "= "c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"HP Software Update "= "c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-05-09 49208]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer1 "=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0\0sdnclean.exe
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@= "Service "
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 13:10 843712 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HW_OPENEYE_OUC_Hi Suite]
2011-10-25 03:28 206688 ----a-w- c:\program files\HiSuite\UpdateDog\ouc.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LifeCam]
2010-05-20 02:27 119152 ----a-w- c:\program files\Microsoft LifeCam\LifeExp.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Mobile Partner]
2012-01-18 00:15 547840 ----a-w- c:\program files\HiSuite\HiSuite.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2012-01-09 22:00 17042056 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2008-01-18 10:38 1008184 ----a-w- c:\program files\Windows Defender\MSASCui.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1691547084-766872198-2867641616-1000]
"EnableNotificationsRef "=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-15 253088]
R4 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-04-25 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 23:28]
.
2012-04-25 c:\windows\Tasks\HP Photo Creations Communicator.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2012-01-12 23:50]
.
.
------- Supplementary Scan -------
.
uDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &Download by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/201
IE: &Grab video by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/204
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Do&wnload selected by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/203
IE: Down&load all by Orbit - c:\program files\Orbitdownloader\orbitmxt.dll/202
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
IE: Free YouTube Download - c:\users\Neil\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\users\Neil\AppData\Roaming\Mozilla\Firefox\Profiles\tb0h0fdr.default\
.
- - - - ORPHANS REMOVED - - - -
.
HKLM-Run-Spybot-S&D Cleaning - c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe
MSConfigStartUp-Bing Bar - c:\program files\MSN Toolbar\Platform\5.0.1449.0\mswinext.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-04-25 18:29
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2012-04-25 18:33:39
ComboFix-quarantined-files.txt 2012-04-25 06:33
.
Pre-Run: 216,451,952,640 bytes free
Post-Run: 216,302,039,040 bytes free
.
- - End Of File - - D81A3E07FC5AFD3C539E230F04804D87

 

Broni, I switched the comp off after Posting the Combofix log and had dinner. I've just come back and switched on and the message is gone!

Anything further to do? Thanks Neil.

 

As Requested Broni:

OTL logfile created on: 26/04/2012 4:35:29 p.m. - Run 1
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Users\Neil\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001409 | Country: New Zealand | Language: ENZ | Date Format: d/MM/yyyy

2.50 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 73.11% Memory free
5.24 Gb Paging File | 4.53 Gb Available in Paging File | 86.45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 201.04 Gb Free Space | 86.33% Space Free | Partition Type: NTFS

Computer Name: NEIL-PC | User Name: Neil | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/04/26 16:29:03 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Neil\Downloads\OTL.exe
PRC - [2012/02/10 16:13:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012/02/10 15:02:27 | 001,820,480 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
PRC - [2012/02/10 15:02:07 | 000,857,408 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
PRC - [2011/06/15 14:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/04/27 14:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2010/05/20 14:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe
PRC - [2009/04/10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2009/02/20 08:46:52 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe


========== Modules (No Company Name) ==========


========== Win32 Services (SafeList) ==========

SRV - [2012/04/16 11:28:25 | 000,253,088 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/02/10 16:13:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012/02/10 11:28:06 | 000,240,408 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Program Files\Microsoft\BingBar\7.1.361.0\SeaPort.EXE -- (BBUpdate)
SRV - [2012/02/10 11:28:06 | 000,193,816 | ---- | M] (Microsoft Corporation.) [Disabled | Stopped] -- C:\Program Files\Microsoft\BingBar\7.1.361.0\BBSvc.EXE -- (BBSvc)
SRV - [2012/01/04 01:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/04/27 14:39:26 | 000,208,944 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft Security Client\Antimalware\NisSrv.exe -- (NisSrv)
SRV - [2011/04/27 14:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2010/05/20 14:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2009/06/18 14:19:30 | 000,935,208 | ---- | M] (Nero AG) [Disabled | Stopped] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0)
SRV - [2009/02/20 08:46:52 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc)
SRV - [2008/01/18 22:38:26 | 000,272,952 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Neil\AppData\Local\Temp\catchme.sys -- (catchme)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2012/02/10 16:13:00 | 010,816,832 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2011/04/27 14:25:24 | 000,065,024 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV - [2011/04/18 12:18:50 | 000,043,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\MpNWMon.sys -- (MpNWMon)
DRV - [2010/05/20 14:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009/04/10 20:42:54 | 000,031,616 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUSB)
DRV - [2006/11/02 19:36:49 | 000,068,096 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ac97via.sys -- (VIAudio)
DRV - [2003/06/04 20:37:00 | 000,077,463 | ---- | M] (3Com Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\el90Xbc5.SYS -- (EL90Xbc)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-nz
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 24 19 76 99 2F 19 CD 01 [binary data]
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\..\SearchScopes,DefaultScope = {87552127-8C47-4260-AC75-A2751D72323C}
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searcerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\..\SearchScopes\{87552127-8C47-4260-AC75-A2751D72323C}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


========== FireFox ==========

FF - prefs.js..browser.search.useDBForOrder: true
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_233.dll ()
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Eudora 8.0b9\extensions\\Components: C:\Program Files\Eudora 8.0 Beta 9\components [2012/03/24 15:48:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Eudora 8.0b9\extensions\\Plugins: C:\Program Files\Eudora 8.0 Beta 9\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/03/17 10:49:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/04/11 18:12:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2012/01/12 21:05:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2012/03/24 15:48:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Neil\AppData\Roaming\Mozilla\Extensions
[2012/03/24 15:48:30 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Neil\AppData\Roaming\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/03/25 15:52:22 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Neil\AppData\Roaming\Mozilla\Firefox\Profiles\tb0h0fdr.default\extensions
[2012/03/03 22:43:48 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Neil\AppData\Roaming\Mozilla\Firefox\Profiles\tb0h0fdr.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7}
[2012/03/25 15:52:22 | 000,000,000 | ---D | M] ( "Free YouTube Download (Free Studio) Menu ") -- C:\Users\Neil\AppData\Roaming\Mozilla\Firefox\Profiles\tb0h0fdr.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012/04/19 22:35:42 | 000,002,112 | ---- | M] () -- C:\Users\Neil\AppData\Roaming\Mozilla\Firefox\Profiles\tb0h0fdr.default\searchplugins\wot-safe-search.xml
[2012/01/21 15:39:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/01/21 15:39:04 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012/01/15 16:01:15 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION
[2012/03/17 10:49:08 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2009/11/07 04:37:19 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npCouponPrinter.dll
[2009/11/07 04:37:20 | 000,091,552 | ---- | M] (Coupons, Inc.) -- C:\Program Files\mozilla firefox\plugins\npMozCouponPrinter.dll
[2011/12/21 17:14:26 | 000,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/12/21 17:02:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2011/12/21 17:14:26 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/12/21 17:14:26 | 000,001,180 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/12/21 17:14:26 | 000,001,135 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2012/04/24 16:45:54 | 000,000,761 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Octh Class) - {000123B4-9B42-4900-B3F7-F4B073EFC214} - C:\Program Files\Orbitdownloader\orbitcth.dll (Orbitdownloader.com)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\7.1.361.0\BingExt.dll (Microsoft Corporation.)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1691547084-766872198-2867641616-1000..\Run: [HW_OPENEYE_OUC_Hi Suite] C:\Program Files\HiSuite\UpdateDog\ouc.exe ()
O4 - HKU\S-1-5-21-1691547084-766872198-2867641616-1004..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-1691547084-766872198-2867641616-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Download by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: &Grab video by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Do&wnload selected by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Down&load all by Orbit - C:\Program Files\Orbitdownloader\orbitmxt.dll (Orbitdownloader.com)
O8 - Extra context menu item: Free YouTube Download - C:\Users\Neil\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O16 - DPF: {73ECB3AA-4717-450C-A2AB-D00DAD9EE203} http://h20614.www2.hp.com/ediags/gmd/Install/Cab/hpdetect118.cab (GMNRev Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{002808F5-5FF0-485C-A552-D04F90EA623E}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{77974415-B3D7-4259-A32C-FF1A1C24E941}: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\belarc {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - C:\Program Files\Belarc\Advisor\System\BAVoilaX.dll (Belarc, Inc.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Waterfall.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Waterfall.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/19 09:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found

Drivers32: - File not found
Drivers32: msacm.ac3acm - C:\Windows\System32\ac3acm.acm (fccHandler)
Drivers32: msacm.ac3filter - C:\Windows\System32\ac3filter.acm ()
Drivers32: msacm.avis - C:\Windows\System32\ff_acm.acm ()
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lameacm - C:\Windows\System32\lameACM.acm (http://www.mp3dev.org/)
Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FFDS - C:\Windows\System32\ff_vfw.dll ()
Drivers32: vidc.x264 - C:\Windows\System32\x264vfw.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2012/04/25 18:33:41 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2012/04/25 18:32:20 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2012/04/25 18:20:05 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2012/04/25 18:20:05 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2012/04/25 18:20:05 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2012/04/25 18:20:01 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2012/04/25 18:20:00 | 000,000,000 | ---D | C] -- C:\ComboFix
[2012/04/25 18:19:56 | 000,000,000 | ---D | C] -- C:\Qoobox
[2012/04/24 23:48:07 | 000,000,000 | ---D | C] -- C:\Users\Neil\Desktop\SD card 8GB
[2012/04/23 19:56:50 | 000,000,000 | ---D | C] -- C:\Windows\Microsoft Antimalware
[2012/04/23 12:54:55 | 000,000,000 | ---D | C] -- C:\ProcAlyzer Dumps
[2012/04/22 22:59:22 | 000,000,000 | ---D | C] -- C:\Program Files\PC Tools
[2012/04/22 22:55:44 | 000,185,560 | ---- | C] (PC Tools) -- C:\Windows\System32\drivers\PCTSD.sys
[2012/04/22 22:55:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2012/04/22 22:54:25 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2012/04/22 22:54:20 | 000,000,000 | ---D | C] -- C:\Users\Neil\AppData\Roaming\TestApp
[2012/04/19 23:10:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\VideoLAN
[2012/04/10 12:30:49 | 000,000,000 | ---D | C] -- C:\Users\Neil\AppData\Roaming\Malwarebytes
[2012/04/10 12:30:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/03/30 12:04:59 | 000,000,000 | ---D | C] -- C:\Program Files\StripMail

========== Files - Modified Within 30 Days ==========

[2012/04/26 16:31:30 | 000,000,506 | ---- | M] () -- C:\Users\Neil\Desktop\OTL - Shortcut.lnk
[2012/04/26 16:28:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/26 16:25:01 | 000,000,322 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/04/26 16:16:46 | 000,651,654 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012/04/26 16:16:46 | 000,124,814 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012/04/26 16:10:20 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012/04/26 16:10:20 | 000,003,552 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012/04/26 16:09:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012/04/26 16:09:35 | 2683,891,712 | -HS- | M] () -- C:\hiberfil.sys
[2012/04/25 18:08:18 | 000,000,518 | ---- | M] () -- C:\Users\Neil\Desktop\rkill - Shortcut.lnk
[2012/04/25 18:07:37 | 000,000,537 | ---- | M] () -- C:\Users\Neil\Desktop\ComboFix - Shortcut.lnk
[2012/04/24 19:24:35 | 000,011,264 | ---- | M] () -- C:\Users\Neil\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/04/24 16:45:54 | 000,000,761 | R--- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2012/04/24 00:12:43 | 000,000,506 | ---- | M] () -- C:\Users\Neil\Desktop\dds - Shortcut.lnk
[2012/04/24 00:01:11 | 000,001,958 | ---- | M] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot-S&D Start Center.lnk
[2012/04/22 22:56:52 | 001,656,833 | ---- | M] () -- C:\Windows\System32\drivers\Cat.DB
[2012/04/22 00:07:27 | 000,000,680 | ---- | M] () -- C:\Users\Neil\AppData\Local\d3d9caps.dat
[2012/04/20 18:42:35 | 000,000,406 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2012/04/20 01:17:16 | 000,000,208 | -H-- | M] () -- C:\Users\Neil\Documents\.picasa.ini
[2012/04/18 00:51:08 | 000,002,139 | ---- | M] () -- C:\Users\Public\Desktop\HP Deskjet 2050 J510 series.lnk
[2012/04/18 00:51:08 | 000,001,097 | ---- | M] () -- C:\Users\Public\Desktop\Shop for Supplies - HP Deskjet 2050 J510 series.lnk
[2012/04/18 00:51:08 | 000,001,092 | ---- | M] () -- C:\Users\Public\Desktop\HP Deskjet 2050 J510 series Scan.lnk
[2012/04/13 17:15:34 | 000,000,862 | ---- | M] () -- C:\Users\Neil\Desktop\HUAWEI%20U8150%20Smartphone%20User%20Guide%28V100R001_01%2CEN%2CNormal%29 - Shortcut.lnk
[2012/04/10 19:27:40 | 013,348,025 | ---- | M] () -- C:\Users\Neil\Documents\AndroidUsersGuide2.2.pdf
[2012/04/06 17:13:38 | 000,000,816 | ---- | M] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\stripmail.exe.lnk
[2012/04/06 17:13:02 | 000,000,788 | ---- | M] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\HiSuite.lnk
[2012/04/06 17:12:45 | 000,002,139 | ---- | M] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Deskjet 2050 J510 series.lnk
[2012/04/06 17:12:38 | 000,001,092 | ---- | M] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Deskjet 2050 J510 series Scan.lnk
[2012/04/06 17:12:22 | 000,001,105 | ---- | M] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\Free YouTube Download.lnk
[2012/03/30 11:49:45 | 000,648,226 | ---- | M] () -- C:\Users\Neil\Documents\Giving up.pdf
[2012/03/30 11:45:39 | 000,494,842 | ---- | M] () -- C:\Users\Neil\Documents\Lawyer Joke.pdf

========== Files Created - No Company Name ==========

[2012/04/26 16:31:30 | 000,000,506 | ---- | C] () -- C:\Users\Neil\Desktop\OTL - Shortcut.lnk
[2012/04/25 18:20:05 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2012/04/25 18:20:05 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2012/04/25 18:20:05 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2012/04/25 18:20:05 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2012/04/25 18:20:05 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2012/04/25 18:08:18 | 000,000,518 | ---- | C] () -- C:\Users\Neil\Desktop\rkill - Shortcut.lnk
[2012/04/25 18:07:36 | 000,000,537 | ---- | C] () -- C:\Users\Neil\Desktop\ComboFix - Shortcut.lnk
[2012/04/24 00:12:43 | 000,000,506 | ---- | C] () -- C:\Users\Neil\Desktop\dds - Shortcut.lnk
[2012/04/24 00:01:11 | 000,001,958 | ---- | C] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\Spybot-S&D Start Center.lnk
[2012/04/22 22:56:01 | 001,656,833 | ---- | C] () -- C:\Windows\System32\drivers\Cat.DB
[2012/04/22 00:46:34 | 2683,891,712 | -HS- | C] () -- C:\hiberfil.sys
[2012/04/20 18:42:35 | 000,000,406 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2012/04/19 23:33:54 | 013,847,704 | ---- | C] () -- C:\Users\Neil\Documents\Ronnie Corbett and Harry Enfield - My Blackberry is Not Working.flv
[2012/04/19 23:33:28 | 002,369,391 | ---- | C] () -- C:\Users\Neil\Documents\Pacific Blue's Happy Flying Advertisement.flv
[2012/04/19 23:32:26 | 000,985,869 | ---- | C] () -- C:\Users\Neil\Documents\ProstateExam.wmv
[2012/04/19 23:27:50 | 003,298,142 | ---- | C] () -- C:\Users\Neil\Documents\Lemonade_Prank.wmv
[2012/04/19 23:27:12 | 006,470,251 | ---- | C] () -- C:\Users\Neil\Documents\Funny Commercials Compilation.mp4
[2012/04/19 23:26:13 | 001,048,016 | ---- | C] () -- C:\Users\Neil\Documents\Curly.wmv
[2012/04/19 22:50:13 | 002,487,249 | ---- | C] () -- C:\Users\Neil\Documents\naked_men_and_balloons.wmv
[2012/04/19 22:48:38 | 048,793,035 | ---- | C] () -- C:\Users\Neil\Documents\Tim Hawkins - The Government Can.mp4
[2012/04/19 22:47:02 | 008,004,268 | ---- | C] () -- C:\Users\Neil\Documents\The difference between women and men.flv
[2012/04/18 00:51:08 | 000,002,139 | ---- | C] () -- C:\Users\Public\Desktop\HP Deskjet 2050 J510 series.lnk
[2012/04/18 00:51:08 | 000,001,097 | ---- | C] () -- C:\Users\Public\Desktop\Shop for Supplies - HP Deskjet 2050 J510 series.lnk
[2012/04/18 00:51:08 | 000,001,092 | ---- | C] () -- C:\Users\Public\Desktop\HP Deskjet 2050 J510 series Scan.lnk
[2012/04/13 17:15:34 | 000,000,862 | ---- | C] () -- C:\Users\Neil\Desktop\HUAWEI%20U8150%20Smartphone%20User%20Guide%28V100R001_01%2CEN%2CNormal%29 - Shortcut.lnk
[2012/04/10 19:27:40 | 013,348,025 | ---- | C] () -- C:\Users\Neil\Documents\AndroidUsersGuide2.2.pdf
[2012/04/06 17:13:38 | 000,000,816 | ---- | C] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\stripmail.exe.lnk
[2012/04/06 17:13:02 | 000,000,788 | ---- | C] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\HiSuite.lnk
[2012/04/06 17:12:45 | 000,002,139 | ---- | C] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Deskjet 2050 J510 series.lnk
[2012/04/06 17:12:38 | 000,001,092 | ---- | C] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\HP Deskjet 2050 J510 series Scan.lnk
[2012/04/06 17:12:22 | 000,001,105 | ---- | C] () -- C:\Users\Neil\Application Data\Microsoft\Internet Explorer\Quick Launch\Free YouTube Download.lnk
[2012/04/04 14:02:51 | 000,000,830 | ---- | C] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/03/30 11:49:43 | 000,648,226 | ---- | C] () -- C:\Users\Neil\Documents\Giving up.pdf
[2012/03/30 11:45:36 | 000,494,842 | ---- | C] () -- C:\Users\Neil\Documents\Lawyer Joke.pdf
[2012/01/20 11:03:02 | 000,000,680 | ---- | C] () -- C:\Users\Neil\AppData\Local\d3d9caps.dat
[2012/01/13 22:08:28 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2012/01/13 22:08:07 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2012/01/13 22:06:37 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2012/01/13 22:06:37 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2012/01/12 23:20:37 | 000,011,264 | ---- | C] () -- C:\Users\Neil\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/01/12 19:42:05 | 000,021,316 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2011/12/07 06:53:24 | 004,770,816 | ---- | C] () -- C:\Windows\System32\x264vfw.dll
[2011/07/12 14:56:50 | 000,074,752 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2011/01/04 12:28:18 | 000,175,616 | ---- | C] () -- C:\Windows\System32\unrar.dll

========== LOP Check ==========

[2012/01/29 16:52:44 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\Auslogics
[2012/03/25 15:53:11 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\DVDVideoSoft
[2012/03/25 15:52:21 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/01/28 15:38:29 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\Foxit Software
[2012/04/21 15:33:50 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\Orbit
[2012/01/26 00:07:41 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\ProgSense
[2012/04/22 22:54:20 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\TestApp
[2012/01/12 20:55:54 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\Thunderbird
[2012/02/13 23:25:11 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\Visan
[2012/03/24 15:44:29 | 000,000,000 | ---D | M] -- C:\Users\Neil\AppData\Roaming\VistaCodecs
[2012/04/26 09:46:05 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2006/09/19 09:43:36 | 000,000,024 | ---- | M] () -- C:\autoexec.bat
[2011/12/26 11:38:36 | 000,000,354 | -HS- | M] () -- C:\Boot.BAK
[2011/12/26 11:49:46 | 000,000,354 | RHS- | M] () -- C:\Boot.ini.saved
[2009/04/10 22:36:38 | 000,333,257 | RHS- | M] () -- C:\bootmgr
[2012/01/13 16:19:54 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
[2012/04/25 18:33:39 | 000,010,537 | ---- | M] () -- C:\ComboFix.txt
[2006/09/19 09:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
[2012/04/26 16:09:35 | 2683,891,712 | -HS- | M] () -- C:\hiberfil.sys
[2012/02/02 20:05:06 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2012/02/02 20:05:06 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2008/04/14 00:13:04 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2008/04/14 02:01:44 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2012/04/26 16:09:33 | 2997,702,656 | -HS- | M] () -- C:\PAGEFILE.SYS
[2012/04/22 22:51:58 | 000,000,366 | ---- | M] () -- C:\rkill.log

< %systemroot%\Fonts\*.com >
[2006/11/03 00:37:19 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
[2006/11/03 00:37:19 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
[2006/11/03 00:37:19 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
[2012/01/13 22:21:43 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2006/09/19 09:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2006/11/03 00:36:30 | 000,022,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\jnwppr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2012/01/13 21:40:30 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2006/11/02 22:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006/11/02 22:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006/11/02 22:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006/11/02 22:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006/11/02 22:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2012/01/14 16:14:27 | 000,000,286 | -HS- | M] () -- C:\Users\Neil\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\tasks\*.* >
[2012/04/26 16:28:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012/04/26 16:25:01 | 000,000,322 | ---- | M] () -- C:\Windows\tasks\HP Photo Creations Communicator.job
[2012/04/26 16:09:48 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2012/04/26 09:46:05 | 000,032,640 | ---- | M] () -- C:\Windows\tasks\SCHEDLGU.TXT

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >
[2006/11/03 00:36:17 | 000,000,802 | ---- | M] () -- C:\Windows\ADDINS\FXSEXT.ecf

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2012/01/12 19:53:16 | 000,000,402 | -HS- | M] () -- C:\Users\Neil\Favorites\desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >
[2012/04/20 18:42:35 | 000,000,406 | RHS- | M] () -- C:\ProgramData\ntuser.pol

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

========== Alternate Data Streams ==========

@Alternate Data Stream - 757 bytes -> C:\Users\Neil\Documents\Here's a handy golf club!.eml:OECustomProperty
@Alternate Data Stream - 645 bytes -> C:\Users\Neil\Documents\Hanny.eml:OECustomProperty
@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84
@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:587EB586
@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMPFC5A2B2

< End of report >
Cheers Neil.

 

Second Report as requested:

OTL Extras logfile created on: 26/04/2012 4:35:29 p.m. - Run 1
OTL by OldTimer - Version 3.2.42.1 Folder = C:\Users\Neil\Downloads
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00001409 | Country: New Zealand | Language: ENZ | Date Format: d/MM/yyyy

2.50 Gb Total Physical Memory | 1.83 Gb Available Physical Memory | 73.11% Memory free
5.24 Gb Paging File | 4.53 Gb Available in Paging File | 86.45% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232.88 Gb Total Space | 201.04 Gb Free Space | 86.33% Space Free | Partition Type: NTFS

Computer Name: NEIL-PC | User Name: Neil | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_USERS\S-1-5-21-1691547084-766872198-2867641616-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1691547084-766872198-2867641616-1000]
"EnableNotificationsRef" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDTray.exe:*:Enabled:Spybot-S&D 2 Tray Icon
"C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDFSSvc.exe:*:Enabled:Spybot-S&D 2 Scanner Service
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdate.exe:*:Enabled:Spybot-S&D 2 Updater
"C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe" = C:\Program Files\Spybot - Search & Destroy 2\SDUpdSvc.exe:*:Enabled:Spybot-S&D 2 Background update service
"C:\Program Files\Orbitdownloader\orbitdm.exe" = C:\Program Files\Orbitdownloader\orbitdm.exe:*:Enabled:Orbit -- (Orbitdownloader.com)
"C:\Program Files\Orbitdownloader\orbitnet.exe" = C:\Program Files\Orbitdownloader\orbitnet.exe:*:Enabled:Orbit -- (Orbitdownloader.com)


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{DC7C1094-2FC1-453B-ACDC-4921836DBBA1}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{053D2E80-1704-4113-A918-27DD1A9E6652}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{15419BDA-3A8F-43D6-8F3D-698508210C1C}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{20A4DA5D-67A1-4B32-ACD9-280C6527F3CE}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{35351FD3-1B7B-46E6-807C-F1207932BCEB}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{518EB43B-7976-4023-B8D0-1A83C7F2A99C}" = protocol=17 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe |
"{5FC960F4-5D50-4A63-9EF2-92E83EE2A7DA}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A390EACE-B17E-44A0-B4C7-9FDA4AEBAB3F}" = protocol=6 | dir=in | app=c:\program files\hp\hp deskjet 2050 j510 series\bin\usbsetup.exe |
"{B9657E6D-A135-46B0-BA8F-153D2C868B38}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{C074284C-0CB1-4682-9890-1DA5BE6E2531}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{D37E1ACB-6609-42DE-8516-A4E4B499704C}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{F0B0B976-E0F7-4BE6-9F7C-9D73B5CD68E0}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"TCP Query User{6E731370-6C38-4ABA-9675-54490DB786D5}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{A4A3BD31-52D5-44D6-8A3A-B7D632351F9B}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"TCP Query User{E415AD77-A39B-40E0-8740-661675B72859}C:\program files\orbitdownloader\orbitnet.exe" = protocol=6 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{1DD87A36-9104-425F-905E-A0A6584632AE}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{67F42A88-EFF4-4E47-BDED-1DA6C35F7B3A}C:\program files\orbitdownloader\orbitnet.exe" = protocol=17 | dir=in | app=c:\program files\orbitdownloader\orbitnet.exe |
"UDP Query User{797C7EFE-6FE5-4910-9872-640B3B5617F1}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool Help
"{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help
"{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{2EFA4E4C-7B5F-48F7-A1C0-1AA882B7A9C3}" = HP Update
"{33cf58f5-48d8-4575-83d6-96f574e4d83a}" = Nero DriveSpeed
"{368ba326-73ad-4351-84ed-3c0a7a52cc53}" = Nero Rescue Agent
"{43e39830-1826-415d-8bae-86845787b54b}" = Nero Vision
"{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies
"{5033F411-4848-49D6-BAC2-DAA06AFA0AFC}" = HP Deskjet 2050 J510 series Basic Device Software
"{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English)
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{595a3116-40bb-4e0f-a2e8-d7951da56270}" = NeroExpress
"{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision Help
"{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help
"{62ac81f6-bdd3-4110-9d36-3e9eaab40999}" = Nero CoverDesigner
"{6F340107-F9AA-47C6-B54C-C3A19F11553F}" = Hewlett-Packard ACLM.NET v1.1.0.0
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7670D32F-DAE6-4E49-8C8B-B3F08B5B1686}" = Microsoft SQL Server Native Client
"{7748ac8c-18e3-43bb-959b-088faea16fb2}" = Nero StartSmart
"{7829db6f-a066-4e40-8912-cb07887c20bb}" = Nero BurnRights
"{7A3DF2E2-CF13-44FB-A93E-F71D5381DB3F}" = HP Deskjet 2050 J510 series Help
"{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help
"{869200db-287a-4dc0-b02b-2b6787fbcd4c}" = Nero DiscSpeed
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007
"{90120000-0015-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
"{90120000-0016-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
"{90120000-0018-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007
"{90120000-0019-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007
"{90120000-001A-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
"{90120000-001B-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_PROHYBRIDR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
"{90120000-001F-0C0A-0000-0000000FF1CE}_PROHYBRIDR_{2314F9A1-126F-45CC-8A5E-DFAF866F3FBC}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
"{90120000-006E-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
"{90120000-0115-0409-0000-0000000FF1CE}_PROHYBRIDR_{98333358-268C-4164-B6D4-C96DF5153727}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007
"{90120000-0117-0409-0000-0000000FF1CE}_PROHYBRIDR_{AAA19365-932B-49BD-8138-BE28CEE9C4B4}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{90A40409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007
"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C344D4A-69B8-430E-B463-BAA1A83D7F68}" = HP Deskjet 2050 J510 series Product Improvement Study
"{A436F67F-687E-4736-BD2B-537121A804CF}" = HP Product Detection
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A939D341-5A04-4E0A-BB55-3E65B386432D}" = Microsoft Office Small Business Connectivity Components
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{AC76BA86-7AD7-2447-0000-A00000000003}" = Chinese Simplified Fonts Support For Adobe Reader X
"{b2ec4a38-b545-4a00-8214-13fe0e915e6d}" = Advertising Center
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 295.73
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B32C4059-6E7A-41EF-AD20-56DF1872B923}" = Business Contact Manager for Outlook 2007 SP2
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{b78120a0-cf84-4366-a393-4d0a59bc546c}" = Menu Templates - Starter Kit
"{bd5ca0da-71ad-43da-b19e-6eee0c9adc9a}" = Nero ControlCenter
"{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed Help
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help
"{D0197E45-D866-44D0-90AF-529F28F15ABA}" = Skypeâ„¢ 5.7
"{D627784F-B3EE-44E8-96B1-9509B991EA34}_is1" = Auslogics Registry Defrag
"{D6C3C9E7-D334-4918-BD57-5B1EF14C207D}" = Bing Bar
"{d9dcf92e-72eb-412d-ac71-3b01276e5f8b}" = Nero ShowTime
"{dba84796-8503-4ff0-af57-1747dd9a166d}" = Nero Online Upgrade
"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag
"{e498385e-1c51-459a-b45f-1721e37aa1a0}" = Movie Templates - Starter Kit
"{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed Help
"{E7084B89-69E0-46B3-A118-8F99D06988CD}" = Microsoft SQL Server VSS Writer
"{e8a80433-302b-4ff1-815d-fcc8eac482ff}" = Nero Installer
"{f1861f30-3419-44db-b2a1-c274825698b3}" = Nero Disc Copy Gadget
"{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter
"{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights Help
"{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}" = Vista Codec Package
"{fbcdfd61-7dcf-4e71-9226-873ba0053139}" = Nero InfoTool
"{fcebb8e1-9276-4e1c-afc5-aa8342f3fb35}" = Nero 9 Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Belarc Advisor" = Belarc Advisor 8.2
"Business Contact Manager" = Business Contact Manager for Outlook 2007 SP2
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"Eudora (8.0b9)" = Eudora (8.0b9)
"EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v4.60
"Foxit Reader_is1" = Foxit Reader 5.1
"Free YouTube Download_is1" = Free YouTube Download version 3.1.22.319
"Hi Suite" = HiSuite
"HP Photo Creations" = HP Photo Creations
"iCD_CoolBeLa44.0" = iCD_CoolBeLa4
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox 11.0 (x86 en-GB)" = Mozilla Firefox 11.0 (x86 en-GB)
"Mozilla Thunderbird 11.0.1 (x86 en-US)" = Mozilla Thunderbird 11.0.1 (x86 en-US)
"Orbit_is1" = Orbit Downloader
"Picasa 3" = Picasa 3
"PROHYBRIDR" = 2007 Microsoft Office system
"VLC media player" = VLC media player 2.0.1

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 25/01/2012 7:50:41 a.m. | Computer Name = Neil-PC | Source = Perflib | ID = 1018
Description =

Error - 25/01/2012 7:50:42 a.m. | Computer Name = Neil-PC | Source = Perflib | ID = 1008
Description =

Error - 20/02/2012 11:48:53 p.m. | Computer Name = Neil-PC | Source = Application Error | ID = 1000
Description = Faulting application TrustedInstaller.exe, version 6.0.6002.18005,
time stamp 0x49e01af1, faulting module ntdll.dll, version 6.0.6002.18541, time
stamp 0x4ec3e3d5, exception code 0xc0000374, fault offset 0x000b06b7, process id
0x560, application start time 0x01ccf04a9e619746.

Error - 2/03/2012 10:24:11 p.m. | Computer Name = Neil-PC | Source = VSS | ID = 12289
Description =

Error - 6/03/2012 8:19:57 a.m. | Computer Name = Neil-PC | Source = Application Error | ID = 1000
Description = Faulting application Foxit Updater.exe, version 1.0.0.818, time stamp
0x4ec4b947, faulting module ntdll.dll, version 6.0.6002.18541, time stamp 0x4ec3e3d5,
exception code 0xc000071c, fault offset 0x000896d5, process id 0x780, application
start time 0x01ccfb9370350e8f.

Error - 21/04/2012 6:53:52 a.m. | Computer Name = Neil-PC | Source = EventSystem | ID = 4609
Description =

Error - 21/04/2012 8:06:27 a.m. | Computer Name = Neil-PC | Source = EventSystem | ID = 4609
Description =

Error - 22/04/2012 5:47:17 a.m. | Computer Name = Neil-PC | Source = Wininit | ID = 1015
Description = A critical system process, C:\Windows\system32\lsm.exe, failed with
status code 1. The machine must now be restarted.

Error - 22/04/2012 6:51:12 a.m. | Computer Name = Neil-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 0.0.0.0, time stamp 0x4d334d98,
faulting module iexplore.exe, version 0.0.0.0, time stamp 0x4d334d98, exception
code 0x40000015, fault offset 0x0008cb40, process id 0x968, application start time
0x01cd2075d4531de2.

Error - 23/04/2012 8:19:23 a.m. | Computer Name = Neil-PC | Source = Perflib | ID = 1010
Description =

[ System Events ]
Error - 27/03/2012 9:07:06 p.m. | Computer Name = Neil-PC | Source = volsnap | ID = 393252
Description = The shadow copies of volume C: were aborted because the shadow copy
storage could not grow due to a user imposed limit.

Error - 28/03/2012 1:28:33 a.m. | Computer Name = Neil-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%886 Error Code: 0x8007042c Error description: The dependency service or group failed
to start. Reason: %%892

Error - 28/03/2012 1:29:57 a.m. | Computer Name = Neil-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 28/03/2012 1:40:19 a.m. | Computer Name = Neil-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%886 Error Code: 0x8007042c Error description: The dependency service or group failed
to start. Reason: %%892

Error - 28/03/2012 4:30:21 a.m. | Computer Name = Neil-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%886 Error Code: 0x8007042c Error description: The dependency service or group failed
to start. Reason: %%892

Error - 28/03/2012 5:08:04 p.m. | Computer Name = Neil-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%886 Error Code: 0x8007042c Error description: The dependency service or group failed
to start. Reason: %%892

Error - 28/03/2012 5:09:41 p.m. | Computer Name = Neil-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 28/03/2012 10:43:17 p.m. | Computer Name = Neil-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%886 Error Code: 0x8007042c Error description: The dependency service or group failed
to start. Reason: %%892

Error - 29/03/2012 4:43:47 a.m. | Computer Name = Neil-PC | Source = Microsoft Antimalware | ID = 3002
Description = %%860 Real-Time Protection feature has encountered an error and failed.

Feature:
%%886 Error Code: 0x8007042c Error description: The dependency service or group failed
to start. Reason: %%892

Error - 29/03/2012 4:45:27 a.m. | Computer Name = Neil-PC | Source = Service Control Manager | ID = 7022
Description =


< End of report >
Cheers Neil.

 

All processes killed
Error: Unable to interpret <@Alternate Data Stream - 757 bytes -> C:\Users\Neil\Documents\Here's a handy golf club!.eml:OECustomProperty> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 645 bytes -> C:\Users\Neil\Documents\Hanny.eml:OECustomProperty> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 127 bytes -> C:\ProgramData\TEMP:430C6D84> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 123 bytes -> C:\ProgramData\TEMP:587EB586> in the current context!
Error: Unable to interpret <@Alternate Data Stream - 109 bytes -> C:\ProgramData\TEMPFC5A2B2> in the current context!
Error: Unable to interpret <[purity]> in the current context!
Error: Unable to interpret <[emptytemp]> in the current context!
Error: Unable to interpret <[emptyjava]> in the current context!
Error: Unable to interpret <[emptyflash]> in the current context!
Error: Unable to interpret <[Reboot]> in the current context!

OTL by OldTimer - Version 3.2.42.1 log created on 04272012_121846

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Will do Security Check next. Neil.

 

Results of screen317's Security Check version 0.99.24
Windows Vista Service Pack 2 x86 (UAC is enabled)
Internet Explorer 9
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Enabled!
Microsoft Security Essentials
WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
Adobe Flash Player 11.2.202.233
Mozilla Firefox (x86 en-GB..)
Mozilla Thunderbird (x86 en-US..)
````````````````````````````````
Process Check:
objlist.exe by Laurent
Windows Defender MSMpEng.exe
Microsoft Security Essentials msseces.exe
Microsoft Small Business Business Contact Manager BcmSqlStartupSvc.exe
``````````End of Log````````````

FSS to follow. Neil.

Farbar Service Scanner Version: 24-04-2012
Ran by Neil (administrator) on 27-04-2012 at 12:34:28
Running from "C:\Users\Neil\Downloads "
Microsoft® Windows Vista™ Business Service Pack 2 (X86)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Yahoo IP is accessible.


Windows Firewall:
=============

Firewall Disabled Policy:
==================


System Restore:
============

System Restore Disabled Policy:
========================


Security Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================


Windows Defender:
==============
WinDefend Service is not running. Checking service configuration:
The start type of WinDefend service is set to Demand. The default start type is Auto.
The ImagePath of WinDefend service is OK.
The ServiceDll of WinDefend service is OK.


Windows Defender Disabled Policy:
==========================
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Defender]
"DisableAntiSpyware "=DWORD:1


File Check:
========
C:\Windows\system32\nsisvc.dll => MD5 is legit
C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
C:\Windows\system32\Drivers\afd.sys => MD5 is legit
C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\system32\dnsrslvr.dll => MD5 is legit
C:\Windows\system32\mpssvc.dll => MD5 is legit
C:\Windows\system32\bfe.dll => MD5 is legit
C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
C:\Windows\system32\SDRSVC.dll => MD5 is legit
C:\Windows\system32\vssvc.exe => MD5 is legit
C:\Windows\system32\wscsvc.dll => MD5 is legit
C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\system32\wuaueng.dll => MD5 is legit
C:\Windows\system32\qmgr.dll => MD5 is legit
C:\Windows\system32\es.dll => MD5 is legit
C:\Windows\system32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\system32\svchost.exe => MD5 is legit
C:\Windows\system32\rpcss.dll => MD5 is legit


**** End of log ****

TFC:
Flash cache emptied: 56475 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 30748 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 362013 bytes

Emptying RecycleBin. Do not interrupt.

RecycleBin emptied: 0 bytes
Process complete!

Total Files Cleaned = 303.00 mb

 

Just finished ESET Online Scanner - no log - clean. Will re-run your test. Neil.

 

OTL test re-run:

All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
ADS C:\Users\Neil\Documents\Here's a handy golf club!.eml:OECustomProperty deleted successfully.
ADS C:\Users\Neil\Documents\Hanny.eml:OECustomProperty deleted successfully.
Unable to delete ADS C:\ProgramData\TEMP:430C6D84 .
Unable to delete ADS C:\ProgramData\TEMP:587EB586 .
Unable to delete ADS C:\ProgramData\TEMPFC5A2B2 .
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Neil
->Temp folder emptied: 31832 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->FireFox cache emptied: 19847041 bytes
->Flash cache emptied: 456 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 19.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Neil

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Neil
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


OTL by OldTimer - Version 3.2.42.1 log created on 04272012_131854

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Hope this is OK now. Neil.

 

OTL Run Fix:

All processes killed
Error: Unable to interpret <Code:> in the current context!
========== OTL ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Neil
->Temp folder emptied: 34614 bytes
->Temporary Internet Files folder emptied: 36935 bytes
->FireFox cache emptied: 21111306 bytes
->Flash cache emptied: 456 bytes

User: Public
->Temp folder emptied: 0 bytes

User: UpdatusUser
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 64386 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 20.00 mb


[EMPTYFLASH]

User: All Users

User: Default
->Flash cache emptied: 0 bytes

User: Default User
->Flash cache emptied: 0 bytes

User: Neil
->Flash cache emptied: 0 bytes

User: Public

User: UpdatusUser
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default

User: Default User

User: Neil

User: Public

User: UpdatusUser

Total Java Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point

OTL by OldTimer - Version 3.2.42.1 log created on 04272012_134434

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Many thanks Broni for your time and expertise. I do know how this happened. My elder brother had been trying to send me an email (forwarded joke) and this was what I thought was a 3rd. attempt.
I had a Brain F---t (Senior moment) and did not pay attention to the email and was fooled by the wording. I thought my brother had decided to send the joke as an attachment.
The rest is now history.
Once again thank you. I do have WOT, but it doesn't work on email attachments that I am aware of. You just need to take more CARE Neil.