Solved Can not access windows update or support microsoft web sites

MOUNTAINBIKER · 2011/03/23

First half of OTL Log

OTL logfile created on: 3/23/2011 11:50:11 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Richard M. Winkler\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 246.00 Mb Available Physical Memory | 48.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536F:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.51 Gb Total Space | 17.33 Gb Free Space | 23.26% Space Free | Partition Type: FAT32
Drive D: | 538.03 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 593.94 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 111.79 Gb Total Space | 103.97 Gb Free Space | 93.00% Space Free | Partition Type: NTFS
Drive G: | 931.28 Gb Total Space | 540.01 Gb Free Space | 57.99% Space Free | Partition Type: FAT32
Drive K: | 114.49 Gb Total Space | 109.51 Gb Free Space | 95.65% Space Free | Partition Type: NTFS

Computer Name: WINXP | User Name: Richard M. Winkler | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/23 11:44:56 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard M. Winkler\My Documents\Downloads\OTL.exe
PRC - [2010/09/29 01:11:08 | 000,157,504 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\TPSrv.exe
PRC - [2010/09/13 01:11:02 | 000,202,048 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\PavFnSvr.exe
PRC - [2010/08/26 03:52:16 | 000,988,480 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\ApVxdWin.exe
PRC - [2010/08/20 14:08:28 | 003,467,096 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Security 360\is360.exe
PRC - [2010/08/16 05:54:46 | 000,028,992 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\psksvc.exe
PRC - [2010/06/11 18:14:24 | 001,280,344 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Security 360\is360tray.exe
PRC - [2010/06/11 18:14:22 | 000,312,152 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Security 360\is360srv.exe
PRC - [2010/06/04 10:37:50 | 000,314,176 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\pavsrvx86.exe
PRC - [2010/05/28 13:42:32 | 000,225,600 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\AVENGINE.EXE
PRC - [2010/04/22 18:29:12 | 000,107,776 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\WebProxy.exe
PRC - [2010/02/23 12:09:34 | 000,111,872 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\PavBckPT.exe
PRC - [2009/11/26 17:03:56 | 000,226,560 | ---- | M] (Panda Security International) -- c:\Program Files\Panda Security\Panda Internet Security 2011\FIREWALL\PSHost.exe
PRC - [2009/08/10 14:46:08 | 000,173,312 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\PsCtrlS.exe
PRC - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe
PRC - [2008/06/27 13:23:00 | 000,091,392 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\SrvLoad.exe
PRC - [2008/06/19 12:59:50 | 000,108,288 | ---- | M] (Panda Security S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\PsImSvc.exe
PRC - [2008/04/13 16:12:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/02/04 17:26:48 | 000,062,768 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Common Files\Panda Security\PavShld\PavPrSrv.exe
PRC - [2004/04/09 14:49:30 | 000,098,304 | ---- | M] (Apple Computer, Inc.) -- C:\WINDOWS\SYSTEM32\qttask.exe
PRC - [2003/07/25 11:15:50 | 000,536,576 | ---- | M] (-) -- C:\Program Files\Eraser\eraser.exe
PRC - [2003/03/07 09:50:00 | 000,019,968 | ---- | M] (Logitech Inc.) -- C:\WINDOWS\LOGI_MWX.EXE
PRC - [2002/06/12 00:23:54 | 001,495,040 | R--- | M] (C-Media Electronic Inc. (www.cmedia.com.tw)) -- C:\WINDOWS\mixer.exe
PRC - [2002/03/14 20:04:54 | 000,028,672 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\SYSTEM32\JupitCo.exe

========== Modules (SafeList) ==========

MOD - [2011/03/23 11:44:56 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Richard M. Winkler\My Documents\Downloads\OTL.exe
MOD - [2010/08/23 09:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2010/07/30 10:18:26 | 000,232,960 | ---- | M] (IObit) -- C:\Program Files\IObit\IObit Security 360\is360mon.dll
MOD - [2009/08/10 13:45:54 | 000,095,488 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Internet Security 2011\PavOEpl.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010/09/29 01:11:08 | 000,157,504 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Internet Security 2011\TPSrv.exe -- (TPSrv)
SRV - [2010/09/13 01:11:02 | 000,202,048 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PavFnSvr.exe -- (PAVFNSVR)
SRV - [2010/08/16 05:54:46 | 000,028,992 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PskSvc.exe -- (PskSvcRetail)
SRV - [2010/06/11 18:14:22 | 000,312,152 | ---- | M] (IObit) [Auto | Running] -- C:\Program Files\IObit\IObit Security 360\is360srv.exe -- (IS360service)
SRV - [2010/06/04 10:37:50 | 000,314,176 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Internet Security 2011\pavsrvx86.exe -- (PAVSRV)
SRV - [2009/11/26 17:03:56 | 000,226,560 | ---- | M] (Panda Security International) [Auto | Running] -- c:\program files\panda security\panda internet security 2011\firewall\PSHOST.EXE -- (PSHost)
SRV - [2009/08/10 14:46:08 | 000,173,312 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PsCtrls.exe -- (Panda Software Controller)
SRV - [2009/03/01 20:25:38 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2008/09/16 12:03:18 | 000,169,312 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Adobe\Photoshop Elements 7.0\PhotoshopElementsFileAgent.exe -- (AdobeActiveFileMonitor7.0)
SRV - [2008/06/19 12:59:50 | 000,108,288 | ---- | M] (Panda Security S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PsImSvc.exe -- (PSIMSVC)
SRV - [2008/05/19 03:35:50 | 000,356,434 | ---- | M] (Atheros Communications, Inc.) [On_Demand | Stopped] -- C:\Program Files\D-Link\RangeBooster G WUA-2340\JSWUtil\jswpsapi.exe -- (jswpsapi)
SRV - [2008/02/04 17:26:48 | 000,062,768 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Common Files\Panda Security\PavShld\pavprsrv.exe -- (PavPrSrv)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (PavTPK.sys)
DRV - [2010/06/22 18:13:00 | 000,026,696 | ---- | M] (Panda Security, S.L.) [File_System | Boot | Running] -- C:\WINDOWS\system32\Drivers\pavboot.sys -- (pavboot)
DRV - [2010/05/21 13:50:26 | 000,059,080 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\amm8651.sys -- (AmFSM)
DRV - [2010/02/18 19:31:20 | 000,199,688 | ---- | M] (Panda Security, S.L.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\neti1642.sys -- (NETIMFLT01060042)
DRV - [2010/02/18 19:31:18 | 000,076,296 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\APPFLT.SYS -- (APPFLT)
DRV - [2009/10/27 12:07:42 | 000,037,896 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\ShlDrv51.sys -- (ShldDrv)
DRV - [2009/09/25 14:54:08 | 000,046,856 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\wnmflt.sys -- (WNMFLT)
DRV - [2009/09/25 14:54:06 | 000,159,112 | ---- | M] (Panda Security, S.L.) [TDI Layer] [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\NETFLTDI.SYS -- (NETFLTDI)
DRV - [2009/09/25 14:54:04 | 000,193,800 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\idsflt.sys -- (IDSFLT)
DRV - [2009/09/25 14:54:04 | 000,022,024 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\fnetmon.sys -- (FNETMON)
DRV - [2009/09/25 14:54:02 | 000,053,256 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\dsaflt.sys -- (DSAFLT)
DRV - [2009/09/14 16:18:22 | 000,163,336 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\PavProc.sys -- (PavProc)
DRV - [2008/06/13 08:50:26 | 000,386,784 | ---- | M] (D-Link Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\A5AGU.sys -- (A5AGU)
DRV - [2008/04/13 10:45:30 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\gameenum.sys -- (gameenum)
DRV - [2008/02/12 18:05:00 | 000,057,440 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\jswscimd.sys -- (JSWSCIMD)
DRV - [2004/05/25 15:58:04 | 000,396,032 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nvapu.sys -- (nvnforce) Service for NVIDIA(R) nForce(TM)
DRV - [2004/05/25 15:58:02 | 000,048,640 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\nvax.sys -- (nvax) Service for NVIDIA(R) nForce(TM)
DRV - [2003/01/21 09:28:28 | 000,005,632 | ---- | M] (Genesys Logic) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\fixustor.sys -- (fixustor)
DRV - [2002/10/30 11:43:22 | 000,016,157 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\ZDNDIS5.sys -- (ZDNDIS5)
DRV - [2002/09/22 19:37:00 | 000,080,896 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\NVENET.sys -- (NVENET)
DRV - [2002/09/05 20:24:00 | 000,013,568 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nv_agp.sys -- (nv_agp)
DRV - [2002/06/11 19:28:50 | 000,379,150 | R--- | M] (C-Media Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\cmaudio.sys -- (cmpci) C-Media PCI Audio Driver (WDM)
DRV - [2002/03/19 14:27:04 | 000,009,312 | ---- | M] (Prolific Technology Inc.
www.prolific.com.tw) [Kernel | Auto | Stopped] -- C:\WINDOWS\SYSTEM32\DRIVERS\Jupiter.sys -- (JUPITER)
DRV - [2001/12/11 14:52:12 | 000,027,776 | ---- | M] (AMD) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdagpxp.sys -- (amdagpxp)
DRV - [2001/08/17 14:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\msmpu401.sys -- (ms_mpu401)
DRV - [2001/04/16 18:44:02 | 000,032,710 | ---- | M] (DAVICOM Semiconductor, Inc. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SYSTEM32\DRIVERS\DM9PCI5.SYS -- (DM9102)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\SYSTEM\blank.htm
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C6 E3 AE 80 BD E6 CB 01 [binary data]
IE - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo "
FF - prefs.js..browser.search.defaulturl: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p= "
FF - prefs.js..browser.search.param.yahoo-fr: "moz2-ytff- "
FF - prefs.js..browser.search.param.yahoo-fr-cjkt: "moz2-ytff- "
FF - prefs.js..browser.search.selectedEngine: "Yahoo "
FF - prefs.js..browser.startup.homepage: "http://www.yahoo.com/ "
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {5835466c-49af-4cbe-b102-a8c8b6313749}:1.0.14
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?ei=UTF-8&fr=ytff-&p= "
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/08/13 20:56:08 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009/04/12 21:55:02 | 000,000,000 | ---D | M]

[2009/04/12 21:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Richard M. Winkler\Application Data\Mozilla\Extensions
[2009/04/12 21:58:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Richard M. Winkler\Application Data\Mozilla\Firefox\Profiles\yona0dqz.default\extensions
[2010/11/07 19:37:48 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Richard M. Winkler\Application Data\Mozilla\Firefox\Profiles\yona0dqz.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/01/23 11:50:06 | 000,000,000 | ---D | M] (Shop to Win) -- C:\Documents and Settings\Richard M. Winkler\Application Data\Mozilla\Firefox\Profiles\yona0dqz.default\extensions\{5835466c-49af-4cbe-b102-a8c8b6313749}
[2010/11/07 19:37:50 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Richard M. Winkler\Application Data\Mozilla\Firefox\Profiles\yona0dqz.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2009/04/12 21:55:02 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/05/21 21:04:44 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010/08/13 16:06:08 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010/10/13 07:47:34 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2009/07/04 06:44:40 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2010/09/15 04:50:38 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2011/03/22 23:34:08 | 000,000,027 | ---- | M]) - C:\WINDOWS\SYSTEM32\DRIVERS\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [APVXDWIN] C:\Program Files\Panda Security\Panda Internet Security 2011\APVXDWIN.EXE (Panda Security, S.L.)
O4 - HKLM..\Run: [C-Media Mixer] C:\WINDOWS\mixer.exe (C-Media Electronic Inc. (www.cmedia.com.tw))
O4 - HKLM..\Run: [Cyber] C:\Program Files\BELKIN\CyberChk.exe ()
O4 - HKLM..\Run: [IObit Security 360] C:\Program Files\IObit\IObit Security 360\IS360tray.exe (IObit)
O4 - HKLM..\Run: [LoadPowerProfile] C:\WINDOWS\System32\powrprof.dll (Microsoft Corporation)
O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\nvcpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NVMCTRAY.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\WINDOWS\System32\qttask.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [SCANINICIO] C:\Program Files\Panda Security\Panda Internet Security 2011\Inicio.exe (Panda Security, S.L.)
O4 - HKLM..\Run: [USB SECURITY DEVICE CoInstaller] C:\WINDOWS\System32\JupitCo.exe (Prolific Technology Inc.)
O4 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003..\Run: [Eraser] C:\Program Files\Eraser\eraser.exe (-)
O4 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003..\Run: [OM2_Monitor] C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe (OLYMPUS IMAGING CORP.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: UseDesktopIniCache = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data]
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data]
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: CDRAutoRun = [binary data]
O7 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O15 - HKU\.DEFAULT\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-20\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\..Trusted Domains: keplers.com ([menlopark] https in Trusted sites)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1239565591640 (WUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {D6376DD2-C2BD-49B2-A1B1-138F869633F3} http://www.pandasoftware.com/ActiveScanpro/as5/ASPROinst.cab (ASPRO Installer Class)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Internet Explorer Classes for Java file://C:\WINDOWS\SYSTEM\iejava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Win32 Classes Reg Error: Key error. (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.76.182 68.87.78.134
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avldr: DllName - avldr.dll - C:\WINDOWS\System32\avldr.dll (On-Access Anti-Malware Scanner Sync)
O24 - Desktop WallPaper: C:\Documents and Settings\Richard M. Winkler\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Richard M. Winkler\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/04/23 10:59:04 | 000,000,138 | ---- | M] () - C:\AutoExec.Bat -- [ FAT32 ]
O32 - AutoRun File - [2002/03/06 15:10:54 | 000,000,277 | RH-- | M] () - D:\AUTORUN.INF -- [ CDFS ]
O32 - AutoRun File - [2006/06/23 12:27:41 | 000,733,184 | R--- | M] (Gas Powered Games) - E:\autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2006/05/30 15:50:34 | 000,021,630 | R--- | M] () - E:\autorun.ico -- [ CDFS ]
O32 - AutoRun File - [2006/05/31 12:00:07 | 000,000,051 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: MSACM.ctadp32 - C:\WINDOWS\System32\CTADP32.ACM (Creative Technology Ltd)
Drivers32: msacm.ctmp3 - C:\WINDOWS\SYSTEM\ctmp3.acm File not found
Drivers32: msacm.iac2 - C:\WINDOWS\SYSTEM32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\SYSTEM32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\WINDOWS\System32\LHACM.ACM (Microsoft Corporation)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: VIDC.IV50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.VDOM - vdowave.drv File not found
Drivers32: vidc.yv12 - DivX.dll File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (63345480511258624)

========== Files/Folders - Created Within 30 Days ==========

[2011/03/23 00:17:06 | 000,000,000 | -HSD | C] -- C:\Recycled
[2011/03/22 23:31:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/03/22 23:22:42 | 000,000,000 | ---D | C] -- C:\ComboFix
[2011/03/22 20:24:13 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/03/22 20:22:12 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/03/22 20:22:07 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/03/22 20:22:06 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/03/22 20:22:06 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/03/22 20:21:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/03/22 20:21:16 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/03/21 22:51:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Adobe
[2011/03/19 23:54:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard M. Winkler\Start Menu\Programs\Google Chrome
[2011/03/19 23:21:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Malwarebytes
[2011/03/19 23:21:25 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/19 23:21:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/19 23:21:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/19 23:21:22 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/03/19 23:21:22 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/19 13:43:36 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Richard M. Winkler\Recent
[2011/03/19 12:55:07 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2011/03/19 11:32:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/03/19 11:15:52 | 000,000,000 | ---D | C] -- C:\FOUND.000
[2011/03/18 23:48:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
[2011/03/18 23:48:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/03/18 23:36:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/02/27 12:00:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Opera
[2011/02/27 12:00:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Richard M. Winkler\Local Settings\Application Data\Opera
[2011/02/27 12:00:44 | 000,000,000 | ---D | C] -- C:\Program Files\Opera
[2004/04/15 21:50:14 | 000,018,244 | ---- | C] ( ) -- C:\WINDOWS\System32\pl2315u.sys

========== Files - Modified Within 30 Days ==========

[2011/03/23 11:34:08 | 000,001,132 | ---- | M] () -- C:\WINDOWS\System32\drivers\APPFLTR.CFG.bck
[2011/03/23 11:34:08 | 000,001,132 | ---- | M] () -- C:\WINDOWS\System32\drivers\APPFLTR.CFG
[2011/03/23 11:32:10 | 000,029,204 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/03/23 11:31:56 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/23 11:28:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/23 00:10:50 | 000,008,627 | ---- | M] () -- C:\WINDOWS\System32\PAV_FOG.OPC
[2011/03/22 22:38:02 | 000,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-1957994488-1383384898-854245398-1003Core1cb6cf3b945d8aa.job
[2011/03/22 20:24:18 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/03/22 15:29:56 | 000,308,376 | ---- | M] () -- C:\WINDOWS\System32\drivers\APPFCONT.DAT.bck
[2011/03/22 15:29:56 | 000,308,376 | ---- | M] () -- C:\WINDOWS\System32\drivers\APPFCONT.DAT
[2011/03/21 22:52:58 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/03/21 22:39:06 | 536,432,640 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP
[2011/03/19 23:55:08 | 000,002,287 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\Desktop\Google Chrome.lnk
[2011/03/19 23:55:08 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/19 23:21:28 | 000,000,688 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/19 13:25:40 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/19 13:20:56 | 000,000,719 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/03/13 10:56:30 | 000,600,528 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/11 23:10:02 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2011/02/27 12:00:50 | 000,001,414 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2011/02/27 12:00:50 | 000,001,396 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk

========== Files Created - No Company Name ==========

[2011/03/22 20:24:17 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/03/22 20:24:15 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/03/22 20:22:12 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/03/22 20:22:07 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/03/22 20:22:07 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/03/22 20:22:07 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/03/22 20:22:07 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/03/19 23:55:07 | 000,002,287 | ---- | C] () -- C:\Documents and Settings\Richard M. Winkler\Desktop\Google Chrome.lnk
[2011/03/19 23:55:07 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2011/03/19 23:21:26 | 000,000,688 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/19 13:20:55 | 000,000,707 | ---- | C] () -- C:\Documents and Settings\Richard M. Winkler\Start Menu\Programs\Internet Explorer.lnk
[2011/03/18 14:33:26 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/02/27 12:00:49 | 000,001,414 | ---- | C] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\Opera.lnk
[2011/02/27 12:00:49 | 000,001,402 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Opera.lnk
[2011/02/27 12:00:49 | 000,001,396 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Opera.lnk
[2010/12/05 03:24:51 | 000,114,084 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/09/22 21:46:06 | 000,000,262 | ---- | C] () -- C:\WINDOWS\System32\PavCPL.dat
[2010/09/22 21:46:02 | 000,308,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\APPFCONT.DAT.bck
[2010/09/22 21:46:02 | 000,308,376 | ---- | C] () -- C:\WINDOWS\System32\drivers\APPFCONT.DAT
[2010/08/30 20:40:10 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009/04/12 21:58:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/03/17 12:01:57 | 000,000,096 | ---- | C] () -- C:\WINDOWS\bizpub32.INI
[2006/09/14 17:20:43 | 000,000,128 | ---- | C] () -- C:\WINDOWS\ModManager.INI
[2006/02/23 16:30:46 | 000,155,624 | ---- | C] () -- C:\WINDOWS\System32\drivers\ar5523.bin
[2005/08/23 20:55:07 | 000,000,091 | ---- | C] () -- C:\WINDOWS\jppc.INI
[2005/08/18 15:52:24 | 000,001,024 | R--- | C] () -- C:\WINDOWS\System32\drivers\jedih2rx.bin
[2005/08/18 15:52:24 | 000,000,122 | R--- | C] () -- C:\WINDOWS\System32\drivers\ramsed.bin
[2005/08/18 14:56:01 | 000,002,938 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2005/08/18 14:56:00 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2005/05/28 08:51:31 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\ZPORT4AS.dll
[2005/05/09 15:44:23 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2005/05/09 14:03:35 | 000,038,946 | R--- | C] () -- C:\WINDOWS\cmijack.dat
[2005/05/09 14:03:35 | 000,021,681 | R--- | C] () -- C:\WINDOWS\cmaudio.dat
[2005/04/01 16:16:00 | 000,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2005/01/29 08:48:09 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2005/01/28 21:13:56 | 000,172,032 | ---- | C] () -- C:\WINDOWS\System32\rsUtil.dll
[2005/01/28 20:02:04 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\ZyDelReg.exe
[2005/01/28 20:02:03 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\ZDTRLib.DLL
[2005/01/28 20:02:03 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ZD12APP.dll
[2005/01/28 20:02:03 | 000,011,776 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll
[2004/09/26 21:24:40 | 000,101,376 | ---- | C] () -- C:\Documents and Settings\Richard M. Winkler\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2004/08/02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/07/05 12:49:57 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
[2004/05/17 20:26:08 | 000,004,620 | ---- | C] () -- C:\WINDOWS\XChange.dat
[2004/04/24 14:44:45 | 000,043,520 | ---- | C] () -- C:\WINDOWS\System32\CmdLineExt03.dll
[2004/04/24 13:02:32 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/04/24 12:57:43 | 000,000,466 | ---- | C] () -- C:\WINDOWS\LnkStub.dat
[2004/04/24 12:57:04 | 000,033,909 | ---- | C] () -- C:\WINDOWS\cmijack.ini
[2004/04/24 12:57:04 | 000,019,458 | ---- | C] () -- C:\WINDOWS\cmaudio.ini
[2004/04/24 12:57:04 | 000,012,327 | ---- | C] () -- C:\WINDOWS\IOS.INI
[2004/04/24 12:57:04 | 000,007,885 | ---- | C] () -- C:\WINDOWS\NETDET.INI
[2004/04/24 12:57:04 | 000,005,068 | ---- | C] () -- C:\WINDOWS\DELETEFI.INI
[2004/04/24 12:57:04 | 000,003,598 | ---- | C] () -- C:\WINDOWS\HTMLHELP.INI
[2004/04/24 12:57:04 | 000,000,865 | ---- | C] () -- C:\WINDOWS\DOSREP.INI
[2004/04/24 12:57:04 | 000,000,787 | ---- | C] () -- C:\WINDOWS\SCANREG.INI
[2004/04/24 12:57:04 | 000,000,613 | ---- | C] () -- C:\WINDOWS\wizards.ini
[2004/04/24 12:57:04 | 000,000,242 | ---- | C] () -- C:\WINDOWS\SBWIN.INI
[2004/04/24 12:57:04 | 000,000,225 | ---- | C] () -- C:\WINDOWS\TELEPHON.INI
[2004/04/24 12:57:04 | 000,000,203 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI
[2004/04/24 12:57:04 | 000,000,201 | ---- | C] () -- C:\WINDOWS\hpfsched.ini
[2004/04/24 12:57:04 | 000,000,120 | ---- | C] () -- C:\WINDOWS\protocol.ini
[2004/04/24 12:57:04 | 000,000,101 | ---- | C] () -- C:\WINDOWS\CMMIXER.INI
[2004/04/24 12:57:04 | 000,000,060 | ---- | C] () -- C:\WINDOWS\POWERPNT.INI
[2004/04/24 12:57:04 | 000,000,054 | ---- | C] () -- C:\WINDOWS\WAVEMIX.INI
[2004/04/24 12:57:04 | 000,000,028 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2004/04/24 12:57:04 | 000,000,026 | ---- | C] () -- C:\WINDOWS\MSOFFICE.INI
[2004/04/24 12:57:04 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI
[2004/04/24 12:57:04 | 000,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini
[2004/04/24 12:57:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\progman.ini
[2004/04/24 12:57:04 | 000,000,000 | ---- | C] () -- C:\WINDOWS\MSINFO32.INI
[2004/04/24 12:54:14 | 000,023,372 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/04/24 12:50:21 | 000,004,346 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/04/24 12:49:38 | 000,600,528 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/04/24 12:41:38 | 000,474,714 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/04/24 12:41:38 | 000,076,842 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/04/24 12:41:14 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/04/23 11:32:11 | 000,454,688 | RH-- | C] () -- C:\WINDOWS\HWINFO.DAT
[2004/04/15 21:50:15 | 000,524,800 | ---- | C] () -- C:\WINDOWS\System32\Jupiter.exe
[2004/04/12 23:09:38 | 000,000,280 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2004/04/10 14:31:23 | 000,087,508 | ---- | C] () -- C:\WINDOWS\CTCM.EXE
[2004/04/09 20:54:56 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\HPFPNP.DLL
[2004/04/09 11:41:17 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\SBIOCTL.EXE
[2004/04/08 12:51:08 | 000,720,896 | RH-- | C] () -- C:\WINDOWS\UserMigratedStore_59R.bin
[2004/04/08 12:51:08 | 000,720,896 | RH-- | C] () -- C:\WINDOWS\DefaultStore_59R.bin
[2004/04/08 11:43:47 | 000,006,550 | ---- | C] () -- C:\WINDOWS\JAUTOEXP.DAT
[2004/04/08 11:39:26 | 000,016,384 | ---- | C] () -- C:\WINDOWS\MSIMGSIZ.DAT
[2004/04/08 11:29:01 | 000,081,920 | ---- | C] () -- C:\WINDOWS\bwUnin-6.1.4.36-8876480L.exe
[2004/04/08 10:32:07 | 000,011,079 | -H-- | C] () -- C:\Program Files\folder.htt
[2003/03/31 12:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2003/03/31 12:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2003/03/31 12:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2003/03/31 12:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2003/03/31 12:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2003/03/31 12:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2003/03/31 12:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2003/03/31 12:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2003/01/07 15:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2000/06/15 11:06:26 | 000,036,864 | ---- | C] () -- C:\WINDOWS\hpfsched.exe
[1998/05/14 00:00:00 | 000,116,736 | ---- | C] () -- C:\WINDOWS\System32\PCDLIB32.DLL
[1996/12/09 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1980/01/01 00:00:00 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\MEMBG.DLL
[1980/01/01 00:00:00 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ICMFILTER.DLL

MOUNTAINBIKER · 2011/03/23

Second Half of OTL Log starting with lop check

========== LOP Check ==========

[2004/09/08 00:56:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BF8051E7-626F-4a11-AF7A-625A7B555862
[2005/10/22 18:20:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Autodesk
[2009/03/01 20:33:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\espionServerData
[2009/03/17 12:03:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/03/17 12:30:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
[2009/04/12 22:46:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\OptiTex
[2010/07/26 19:34:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit
[2010/08/09 21:17:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
[2010/09/22 21:45:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security
[2010/09/22 21:45:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Backup
[2010/12/04 14:19:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MyHeritage
[2010/12/22 22:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Tibo Software
[2004/04/24 12:57:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Business Logic
[2004/07/05 12:43:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\InterVideo
[2005/02/17 12:09:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Broderbund Software
[2005/07/22 23:06:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Zen Puzzle Garden
[2009/07/01 01:35:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\LimeWire
[2010/02/07 12:38:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2010/08/25 22:58:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\IObit
[2010/08/29 09:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\aicon
[2010/09/22 21:45:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Panda Security
[2010/12/04 14:19:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\MyHeritage
[2010/12/07 21:46:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\GrassGames
[2010/12/22 22:45:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Tibo Software
[2011/01/23 11:59:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\FreeFileOpener
[2011/01/23 11:59:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\IsolatedStorage
[2011/02/27 12:00:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Richard M. Winkler\Application Data\Opera

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.* >
[2005/05/29 00:31:40 | 000,004,413 | -HS- | M] () -- C:\ffastun.ffa
[2011/03/23 11:27:58 | 805,306,368 | -HS- | M] () -- C:\pagefile.sys
[2004/04/08 10:24:36 | 000,001,012 | ---- | M] () -- C:\FRUNLOG.TXT
[2008/03/17 15:21:20 | 093,824,893 | ---- | M] () -- C:\s1.zip
[2004/04/08 10:29:48 | 000,001,676 | RHS- | M] () -- C:\MSDOS.SYS
[2004/04/23 10:59:04 | 000,000,138 | ---- | M] () -- C:\AutoExec.Bat
[2004/04/08 11:13:56 | 000,032,768 | -HS- | M] () -- C:\VIDEOROM.BIN
[1999/04/23 22:22:00 | 000,222,390 | RHS- | M] () -- C:\IO.SYS
[2009/04/12 12:22:04 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2005/08/18 15:20:30 | 000,047,564 | RHS- | M] () -- C:\ntdetect.com
[2005/05/29 00:31:40 | 000,368,640 | -HS- | M] () -- C:\ffastun.ffl
[2005/05/30 01:39:48 | 000,368,640 | ---- | M] () -- C:\ffastunT.ffl
[2004/04/23 22:58:42 | 000,006,251 | ---- | M] () -- C:\SCANDISK.LOG
[2004/04/23 11:19:30 | 000,004,037 | ---- | M] () -- C:\SETUPXLG.TXT
[2004/04/08 10:44:34 | 000,000,030 | ---- | M] () -- C:\Config.ctl
[2004/04/23 14:47:48 | 000,000,089 | ---- | M] () -- C:\Config.sys
[2004/04/23 10:48:18 | 000,000,236 | RH-- | M] () -- C:\ASD.LOG
[2005/05/29 00:31:40 | 000,778,240 | -HS- | M] () -- C:\ffastun0.ffx
[2011/03/22 20:24:18 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/03/22 23:19:30 | 000,000,359 | ---- | M] () -- C:\rkill.log
[2005/05/29 00:31:40 | 000,114,688 | -H-- | M] () -- C:\ffastun.ffo
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2004/04/24 12:44:38 | 000,000,512 | -HS- | M] () -- C:\BOOTSECT.DOS
[2007/04/22 19:48:00 | 000,202,240 | ---- | M] () -- C:\ElysDS2Succubus.exe
[2007/04/22 19:47:06 | 000,049,664 | ---- | M] () -- C:\ElysDS2BWSuccubus.dll
[2007/04/22 19:47:34 | 000,049,664 | ---- | M] () -- C:\ElysDS2Succubus.dll
[2007/12/14 14:25:54 | 000,469,549 | ---- | M] () -- C:\btbc Backup.bak
[2007/02/18 16:27:02 | 009,268,647 | ---- | M] () -- C:\dungeonsiegeupdate1.1-1.11.1462_english.exe
[2007/12/12 20:18:26 | 000,000,724 | ---- | M] () -- C:\wpn_elf_arrow.gas
[2007/12/30 01:15:44 | 000,001,517 | ---- | M] () -- C:\wpn_elfy_bow.gas
[2007/04/12 21:56:10 | 000,003,333 | ---- | M] () -- C:\wpn_sword_sara.gas
[2009/03/01 20:33:28 | 000,000,000 | ---- | M] () -- C:\AdobeDebug.txt
[2010/08/11 22:43:22 | 000,003,532 | ---- | M] () -- C:\drmHeader.bin
[2011/03/21 22:51:34 | 000,038,104 | ---- | M] () -- C:\TDSSKiller.2.4.21.0_21.03.2011_22.51.32_log.txt
[2011/01/11 09:24:00 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/03/23 00:00:24 | 000,019,564 | ---- | M] () -- C:\ComboFix.txt

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\FONTS\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2005/08/18 14:50:00 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\FONTS\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 03:50:04 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe
[2008/07/06 05:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2007/04/09 13:23:54 | 000,028,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM32\spool\prtprocs\w32x86\mdippr.dll

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >
[2004/04/08 10:32:08 | 000,011,079 | -H-- | M] () -- C:\Program Files\folder.htt
[2004/04/08 10:32:08 | 000,000,266 | -HS- | M] () -- C:\Program Files\desktop.ini
[2006/04/04 19:58:38 | 000,005,632 | -HS- | M] () -- C:\Program Files\Thumbs.db

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2005/08/18 14:40:00 | 004,718,592 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\system.sav
[2005/08/18 14:40:00 | 014,680,064 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\software.sav
[2005/08/18 14:40:00 | 000,786,432 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\default.sav
[2005/08/18 11:29:30 | 000,262,144 | ---- | M] () -- C:\WINDOWS\SYSTEM32\config\security.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2009/04/12 12:27:02 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2004/04/24 13:31:16 | 000,000,083 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2009/04/12 12:35:00 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Richard M. Winkler\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini

< %USERPROFILE%\Desktop\*.exe >

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >
[2004/04/08 12:32:16 | 008,028,526 | RH-- | M] () -- C:\Program Files\Internet Explorer\ie6bak.DAT

< %USERPROFILE%\My Documents\*.exe >
[2009/04/12 21:25:40 | 063,049,904 | ---- | M] (AVG Technologies) -- C:\Documents and Settings\Richard M. Winkler\My Documents\avg_free_stf_en_85_285a1462.exe
[2010/12/22 15:23:52 | 000,282,224 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\My Documents\Z.exe
[2006/11/13 14:01:08 | 000,501,363 | ---- | M] (Peter B Clements) -- C:\Documents and Settings\Richard M. Winkler\My Documents\QuickPar-0.9.1.0.exe

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2009/04/12 12:35:00 | 000,000,213 | -HS- | M] () -- C:\Documents and Settings\Richard M. Winkler\Favorites\desktop.ini
[2004/04/24 12:57:44 | 000,000,607 | ---- | M] () -- C:\Documents and Settings\Richard M. Winkler\Favorites\My Documents.lnk

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/03/19 22:03:40 | 000,000,067 | -HS- | M] () -- C:\Documents and Settings\Richard M. Winkler\Cookies\desktop.ini
[2011/03/23 11:49:14 | 000,032,768 | -HS- | M] () -- C:\Documents and Settings\Richard M. Winkler\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2007/06/26 22:10:26 | 000,317,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\INF\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2002/08/20 15:08:38 | 000,069,663 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgsin.exe
[2002/12/17 11:23:28 | 000,015,692 | ---- | M] () -- C:\Program Files\Messenger\license.txt
[2002/12/17 11:23:18 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2002/12/17 11:23:18 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2002/12/17 11:23:18 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2002/12/17 11:23:24 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2002/12/17 11:23:22 | 000,004,821 | ---- | M] () -- C:\Program Files\Messenger\logowin.gif
[2002/12/17 11:23:22 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2002/12/17 11:23:28 | 000,000,807 | ---- | M] () -- C:\Program Files\Messenger\mailtmpl.txt
[2010/11/27 11:45:22 | 000,005,120 | -HS- | M] () -- C:\Program Files\Messenger\Thumbs.db
[2004/07/17 11:41:06 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm
[2008/04/13 16:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2008/04/13 09:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 16:11:52 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2008/05/02 06:01:50 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >
[1998/05/14 00:00:00 | 000,003,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SYSTEM\E95THK16.EXE
[1997/11/13 04:03:00 | 000,005,360 | ---- | M] (Seer Systems, Inc.) -- C:\WINDOWS\SYSTEM\WSLAUNCH.EXE

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >

< End of report >

MOUNTAINBIKER · 2011/03/23

OTL Extras Log

OTL Extras logfile created on: 3/23/2011 11:50:11 AM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Richard M. Winkler\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: enu | Date Format: M/d/yyyy

511.00 Mb Total Physical Memory | 246.00 Mb Available Physical Memory | 48.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 78.00% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536F:\pagefile.sys 0 0 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 74.51 Gb Total Space | 17.33 Gb Free Space | 23.26% Space Free | Partition Type: FAT32
Drive D: | 538.03 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive E: | 593.94 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive F: | 111.79 Gb Total Space | 103.97 Gb Free Space | 93.00% Space Free | Partition Type: NTFS
Drive G: | 931.28 Gb Total Space | 540.01 Gb Free Space | 57.99% Space Free | Partition Type: FAT32
Drive K: | 114.49 Gb Total Space | 109.51 Gb Free Space | 95.65% Space Free | Partition Type: NTFS

Computer Name: WINXP | User Name: Richard M. Winkler | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
.js [@ = JSFile] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PAVSCRIP.EXE (Panda Security, S.L.)
.jse [@ = JSEFile] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PAVSCRIP.EXE (Panda Security, S.L.)
.vbe [@ = VBEFile] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PAVSCRIP.EXE (Panda Security, S.L.)
.vbs [@ = VBSFile] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PAVSCRIP.EXE (Panda Security, S.L.)
.wsf [@ = WSFFile] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PAVSCRIP.EXE (Panda Security, S.L.)
.wsh [@ = WSHFile] -- C:\Program Files\Panda Security\Panda Internet Security 2011\PAVSCRIP.EXE (Panda Security, S.L.)

[HKEY_USERS\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1 ",%*
exefile [open] -- "%1" %*
https [open] -- Reg Error: Key error.
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
jsfile [open] -- C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* (Panda Security, S.L.)
jsefile [open] -- C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* (Panda Security, S.L.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1 "
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
vbefile [open] -- C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* (Panda Security, S.L.)
vbsfile [open] -- C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* (Panda Security, S.L.)
wsffile [open] -- C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* (Panda Security, S.L.)
wshfile [open] -- C:\PROGRA~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* (Panda Security, S.L.)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
"DisableMonitoring" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabledxpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:LocalSubNet:Enabledxpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabledxpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabledxpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabledxpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\WINDOWS\System32\DPNSvr.exe" = C:\WINDOWS\System32\DPNSvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation)
"C:\Program Files\2K Games\Dungeon Siege 2 Broken World\DungeonSiege2.exe" = C:\Program Files\2K Games\Dungeon Siege 2 Broken World\DungeonSiege2.exe:*:Enabledungeon Siege II Game Executable -- (Gas Powered Games)
"C:\Program Files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe" = C:\Program Files\Microsoft Games\Dungeon Siege 2\DungeonSiege2.exe:*:Enabledungeon Siege 2 Game Executable -- (Gas Powered Games)
"C:\Program Files\Microsoft Games\Dungeon Siege\DSLOA.exe" = C:\Program Files\Microsoft Games\Dungeon Siege\DSLOA.exe:*:Enabledungeon Siege: Legends of Aranna Game Executable -- (Gas Powered Games)
"C:\WINDOWS\System32\java.exe" = C:\WINDOWS\System32\java.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary -- (Sun Microsystems, Inc.)
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0B7599EA-3C25-11D4-970D-00A0CC3F8931}" = MyDeluxeInvoices & Estimates
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{188CEE76-0503-4910-A845-E1DC45685DA0}" = RangeBooster G WUA-2340
"{2205B8AE-490E-43F2-AB43-C13C2BEC86A7}" = DDS Thumbnail Viewer
"{22A41202-BC5B-402D-A00A-E48906400431}" = Elys DS2 Succubus Manager
"{23F79416-CAD1-41BF-99A3-040F6C814AAA}" = NVIDIA Photoshop Plug-ins
"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 22
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{3248F0A8-6813-11D6-A77B-00B0D0150090}" = J2SE Runtime Environment 5.0 Update 9
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{43DCF766-6838-4F9A-8C91-D92DA586DFA7}" = Microsoft Windows Journal Viewer
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50EEDD72-3087-4DA6-BC87-AA5CBD821962}" = Panda Internet Security 2011
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5809E7CF-4DCF-11D4-9875-00105ACE7734}" = Logitech MouseWare 9.76
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}" = Windows Genuine Advantage v1.3.0254.0
"{64963F0E-03F2-4B59-8D1B-1806545E7092}" = NVIDIA DDS Utilities
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6C6F0968-2B86-42B4-AF34-46A5F06E8FA4}" = MySoftware Fonts
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}" = Avanquest update
"{7926EFB6-7CB4-4A9D-AB01-095F67F9D519}" = Panda Internet Security 2011
"{7EB597B1-9F63-4CA7-9CC5-1DADF9FFC8CD}" = USB-Flash Driver
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{91130409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Basic Edition 2003
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A563C4F4-BE36-4956-BA0B-E02BDD9F70D5}" = Dungeon Siege 2 Broken World
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.2
"{AFBBF30D-ADA9-4313-464E-14458B6BE034}" = PhotoshopdotcomInspirationBrowser
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B1D3568D-BC21-4C50-92A5-2396570DF1DE}_is1" = Panda Secure Vault 5
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C1939820-A945-11D4-86F6-0001031E5712}" = InterVideo WinDVD
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB49B376-1136-44B4-83FA-036334B59937}" = OLYMPUS Master 2
"{CB6075D9-F912-40AE-BEA6-E590DA24F16B}" = Adobe Photoshop Elements 7.0
"{CC263FFC-23D9-4C78-BBA2-61A41DD947C7}" = MyProfessionalBusinessCards
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240B8}" = WinZip 12.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{E9618350-E3C0-450b-828A-33EB3F5A941A}" = Jigs@w Puzzle 2
"{EE6097DD-05F4-4178-9719-D3170BF098E8}" = Apple Application Support
"{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}" = HighMAT Extension to Microsoft Windows XP CD Writing Wizard
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Photoshop 7.0" = Adobe Photoshop 7.0
"Adobe Photoshop Elements 7" = Adobe Photoshop Elements 7.0
"AMD AGP Driver" = AMD AGP Driver
"Autodesk DWF Viewer" = Autodesk DWF Viewer
"Bink and Smacker" = Bink and Smacker
"Corel Uninstaller" = Corel Uninstaller
"Cyber cleaner" = CyberClean CD Laser Lens Cleaner
"DDS Converter 2.1" = DDS Converter 2.1
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX Setup
"DSAbstraction Siegelet " = DSAbstraction Siegelet 0.997
"Dungeon Siege II Tool Kit_is1" = Dungeon Siege II Tool Kit 1.0
"Dungeon Siege Legends of Aranna 1.0" = Dungeon Siege Legends of Aranna
"Dungeon Siege Legends of Aranna Bonus Pack 1.0" = Dungeon Siege Legends of Aranna Bonus Pack
"Dungeon Siege Tool Kit" = Dungeon Siege Tool Kit
"DungeonSiege2" = Dungeon Siege 2
"Eraser_is1" = Eraser
"FastStone Photo Resizer" = FastStone Photo Resizer 2.9
"Free File Opener_is1" = Free File Opener version 2011.6.0
"Free Solitaire 3D_is1" = Free Solitaire 3D 5.01
"HP DeskJet 640C Series" = HP DeskJet 640C Series (Remove only)
"HP PhotoSmart Photo Printing Software" = HP PhotoSmart Photo Printing Software
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"IObit Security 360_is1" = IObit Security 360
"IrfanView" = IrfanView (remove only)
"KDiff3" = KDiff3 (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox (3.6.15)" = Mozilla Firefox (3.6.15)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAnForce" = NVIDIA Windows 2000/XP nForce Drivers
"Opera 11.01.1190" = Opera 11.01
"PCI Audio Driver" = PCI Audio Driver
"PhotoshopdotcomInspirationBrowser.4C35C4D325D350FE0114230CBADCA2DDD0AC8D25.1" = Adobe Photoshop.com Inspiration Browser
"PlayFKiSS" = PlayFKiSS
"Septerra Core" = Septerra Core
"u5lazarus_is1" = v1.20
"VIA PCI IRQ Routing Miniport Driver - V1.3A" = VIA PCI IRQ Routing Miniport Driver - V1.3A
"VLC media player" = VideoLAN VLC media player 0.8.5
"Windows" = Windows XP Uninstall
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinGimp-2.0_is1" = The GIMP 2.2.4
"WinGTK-2_is1" = GTK+ 2.6.4 runtime environment
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"Works" = Microsoft Works 4.5
"Works Calendar" = Microsoft Works Calendar 1.0
"Works99Setup" = Microsoft Works Setup Launcher
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 3/20/2011 11:14:33 PM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/20/2011 11:24:34 PM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/20/2011 11:24:34 PM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/21/2011 1:18:41 AM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/21/2011 4:10:03 PM | Computer Name = WINXP | Source = Sentinel | ID = 251722432
Description = Unexpected failure scanning file C:\PROGRAM FILES\PANDA SECURITY\PANDA
INTERNET SECURITY 2011\AVCIMAN.EXE. If the problem persists, please contact with
support.

Error - 3/21/2011 4:10:04 PM | Computer Name = WINXP | Source = Sentinel | ID = 251722432
Description = Unexpected failure scanning file C:\DOCUMENTS AND SETTINGS\RICHARD
M. WINKLER\RECENT\22032085KWT.JPG.LNK. If the problem persists, please contact with
support.

Error - 3/22/2011 1:42:41 AM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/22/2011 1:42:41 AM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/22/2011 2:07:46 AM | Computer Name = WINXP | Source = Application Error | ID = 1000
Description = Faulting application WebProxy.exe, version 9.1.0.0, faulting module
ntdll.dll, version 5.1.2600.6055, fault address 0x000100e8.

Error - 3/23/2011 2:49:10 PM | Computer Name = WINXP | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ Application Events ]
Error - 3/20/2011 11:14:33 PM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/20/2011 11:24:34 PM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/20/2011 11:24:34 PM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/21/2011 1:18:41 AM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/21/2011 4:10:03 PM | Computer Name = WINXP | Source = Sentinel | ID = 251722432
Description = Unexpected failure scanning file C:\PROGRAM FILES\PANDA SECURITY\PANDA
INTERNET SECURITY 2011\AVCIMAN.EXE. If the problem persists, please contact with
support.

Error - 3/21/2011 4:10:04 PM | Computer Name = WINXP | Source = Sentinel | ID = 251722432
Description = Unexpected failure scanning file C:\DOCUMENTS AND SETTINGS\RICHARD
M. WINKLER\RECENT\22032085KWT.JPG.LNK. If the problem persists, please contact with
support.

Error - 3/22/2011 1:42:41 AM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: The connection with the server was terminated abnormally

Error - 3/22/2011 1:42:41 AM | Computer Name = WINXP | Source = crypt32 | ID = 131080
Description = Failed auto update retrieval of third-party root list sequence number
from: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootseq.txt>
with error: This network connection does not exist.

Error - 3/22/2011 2:07:46 AM | Computer Name = WINXP | Source = Application Error | ID = 1000
Description = Faulting application WebProxy.exe, version 9.1.0.0, faulting module
ntdll.dll, version 5.1.2600.6055, fault address 0x000100e8.

Error - 3/23/2011 2:49:10 PM | Computer Name = WINXP | Source = Application Hang | ID = 1002
Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 3/23/2011 2:34:55 AM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

Error - 3/23/2011 2:36:37 AM | Computer Name = WINXP | Source = BROWSER | ID = 8032
Description = The browser service has failed to retrieve the backup list too many
times on transport \Device\NetBT_Tcpip_{5D52B488-CA0F-431B-99FD-10DF1C634DD0}. The
backup browser is stopping.

Error - 3/23/2011 2:29:00 PM | Computer Name = WINXP | Source = Service Control Manager | ID = 7000
Description = The USB SECURITY DEVICE service failed to start due to the following
error: %%1058

Error - 3/23/2011 2:31:52 PM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

Error - 3/23/2011 2:31:53 PM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

Error - 3/23/2011 2:31:53 PM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

Error - 3/23/2011 2:31:54 PM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

Error - 3/23/2011 2:31:57 PM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

Error - 3/23/2011 2:31:57 PM | Computer Name = WINXP | Source = atapi | ID = 262149
Description = A parity error was detected on \Device\Ide\IdePort0.

Error - 3/23/2011 2:31:57 PM | Computer Name = WINXP | Source = Disk | ID = 262155
Description = The driver detected a controller error on \Device\Harddisk1\D.

< End of report >

broni · 2011/03/23

1. Update your Java version here: http://www.java.com/en/download/installed.jsp

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

2. Now, we need to remove old Java version and its remnants...

Download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.

Accept any prompts.

=====================================================

Run OTL
Under the [color= "#0000FF"]Custom Scans/Fixes[/color] box at the bottom, paste in the following
Code:
:OTL
O15 - HKU\.DEFAULT\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-20\..Trusted Domains: aol.com ([free] http in Trusted sites)
O15 - HKU\S-1-5-21-1957994488-1383384898-854245398-1003\..Trusted Domains: keplers.com ([menlopark] https in Trusted sites)
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab (Reg Error: Key error.)
O16 - DPF: Internet Explorer Classes for Java file://C:\WINDOWS\SYSTEM\iejava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O16 - DPF: Win32 Classes Reg Error: Key error. (Reg Error: Key error.)


:Services

:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
 "DisableMonitoring" =-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
 "DisableMonitoring" =-

:Files

:Commands
[purity]
[emptytemp]
[emptyflash]
[Reboot]
Then click the [color= "#FF0000"]Run Fix[/color] button at the top

Let the program run unhindered, reboot the PC when it is done

You will get a log that shows the results of the fix. Please post it.
====================================================

Last scans....

1. Download Security Check from HERE, and save it to your Desktop.

Double-click SecurityCheck.exe

Follow the onscreen instructions inside of the black box.

A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.

2. Download Temp File Cleaner (TFC)

Double click on TFC.exe to run the program.

Click on Start button to begin cleaning process.

TFC will close all running programs, and it may ask you to restart computer.

3. Please run a free online scan with the ESET Online Scanner

Disable your antivirus program

Tick the box next to YES, I accept the Terms of Use

Click Start

IMPORTANT! UN-check Remove found threats

Accept any security warnings from your browser.

Check Scan archives

Click Start

ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.

When the scan completes, push List of found threats

Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.

NOTE. If Eset won't find any threats, it won't produce any log.

MOUNTAINBIKER · 2011/03/23

OTL Fix Log

All processes killed
========== OTL ==========
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ deleted successfully.
Registry key HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ not found.
Registry key HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ deleted successfully.
Registry key HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\free\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-1957994488-1383384898-854245398-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\keplers.com\menlopark\ deleted successfully.
File Animation Java Classes file://C:\WINDOWS\SYSTEM\dajava.cab not found.
Starting removal of ActiveX control DirectAnimation Java Classes
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\DirectAnimation Java Classes\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\DirectAnimation Java Classes\ not found.
File et Explorer Classes for Java file://C:\WINDOWS\SYSTEM\iejava.cab not found.
Starting removal of ActiveX control Internet Explorer Classes for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Internet Explorer Classes for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Internet Explorer Classes for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Internet Explorer Classes for Java\ not found.
File oft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
Starting removal of ActiveX control Win32 Classes Reg Error: Key error.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Win32 Classes Reg Error: Key error.\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Win32 Classes Reg Error: Key error.\ not found.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus\\DisableMonitoring deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall\\DisableMonitoring deleted successfully.
========== FILES ==========
========== COMMANDS ==========

[EMPTYTEMP]

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Richard M. Winkler
->Temp folder emptied: 10670543 bytes
->Temporary Internet Files folder emptied: 878623 bytes
->Java cache emptied: 3879 bytes
->FireFox cache emptied: 49435985 bytes
->Google Chrome cache emptied: 8192330 bytes
->Apple Safari cache emptied: 0 bytes
->Opera cache emptied: 240 bytes
->Flash cache emptied: 1917 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 2237 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32969 bytes
->Flash cache emptied: 0 bytes

User: RICHAR~1~WIN

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->FireFox cache emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 25154192 bytes
Session Manager Temp folder emptied: 0 bytes
Session Manager Tmp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 90.00 mb

[EMPTYFLASH]

User: Default User

User: All Users

User: Richard M. Winkler
->Flash cache emptied: 0 bytes

User: NetworkService
->Flash cache emptied: 0 bytes

User: LocalService
->Flash cache emptied: 0 bytes

User: RICHAR~1~WIN

User: Administrator

Total Flash Files Cleaned = 0.00 mb

OTL by OldTimer - Version 3.2.22.3 log created on 03232011_144511

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

MOUNTAINBIKER · 2011/03/23

Checkup Txt

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 8
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
Panda Internet Security 2011
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
CyberClean CD Laser Lens Cleaner
Java(TM) 6 Update 24
Out of date Java installed!
Adobe Flash Player 10.2.152.32
Adobe Reader 9.4.2
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.16)
````````````````````````````````
Process Check:
objlist.exe by Laurent
panda security panda internet security 2011 firewall PSHOST.EXE
``````````End of Log````````````

broni · 2011/03/23

Update Firefox to 4.0 version.

Update Adobe Reader

You can download it from http://www.adobe.com/products/acrobat/readstep2.html
After installing the latest Adobe Reader, uninstall all previous versions.
Note. If you already have Adobe Photoshop® Album Starter Edition installed or do not wish to have it installed UNcheck the box which says Also Download Adobe Photoshop® Album Starter Edition.

Alternatively, you can uninstall Adobe Reader (33.5 MB), download and install Foxit PDF Reader(3.5MB) from HERE.
It's a much smaller file to download and uses a lot less resources than Adobe Reader.
Note: When installing FoxitReader, make sure to UN-check any pre-checked toolbar, or other garbage.

...and Eset scan....

MOUNTAINBIKER · 2011/03/23

firefix and adobe reader updated

Firefox 4.0 and updated adobe reader installed moving on to next step

MOUNTAINBIKER · 2011/03/24

ESET Scan Completed

ESET Online Scanner completed, however it did not give me the option of listing threats because it found none. There is one problem however, each time I connect to the Internet I get a pop up window that says: jusched.exe has encountered a problem and needs to close. We are sorry for the inconvenience.

broni · 2011/03/24

Disable jusched.exe as a startup. No need for it: http://www.howtogeek.com/howto/windows-vista/what-is-juschedexe-and-why-is-it-running/

Good luck and stay safe

MOUNTAINBIKER · 2011/03/24

Thank You Broni

Thank you for the help. Staying safe is keeping my room-mate away from my computer I video taped the whole process showing the monitor and a clock and will have her watch it.

Take Care
Rich

broni · 2011/03/24

Hahaha....

Log in or Sign up

Solved Can not access windows update or support microsoft web sites

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Log in or Sign up

Solved Can not access windows update or support microsoft web sites

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

MOUNTAINBIKER Inactive Thread Starter

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

MOUNTAINBIKER Inactive Thread Starter

broni Moderator Malware Analyst

Share This Page

Useful Searches