# Services.exe consuming very high CPU %



## Cobster (Oct 15, 2011)

Hello
Over the past few months I noticed frequent spikes in the usage of my CPU by services.exe.
I have scanned my computer many times using AVG, Microsoft Security Essential and MBAM.
I found one or two trojans and deleting them from the virus vault.
The problem is still there and services.exe spikes to close to 100% usage of CPU very frequently.
However, this issue does not occur all the time.
As I write this cpu usage is minimal for example.
I have run HiJackThis and here is the log I got.
Your help is much appreciated.
Thanks you from NYC
Cobster

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 3:33:29 PM, on 10/15/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\system32\ps2.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\AOL\1127693794\ee\AOLSoftware.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
C:\Program Files\Microsoft Security Client\msseces.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe
C:\Program Files\PictureMover\Bin\PictureMover.exe
C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Common Files\AOL\1127693794\ee\aolsoftware.exe
C:\WINDOWS\wanmpsvc.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
c:\program files\common files\aol\1127693794\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\HiJackThis\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.haaretz.co.il/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Suggest - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Radio G - {889eb3f6-f16b-4bc0-bc81-9c407c8a3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5612.1312\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: Radio G - {f228c6a4-a593-4017-944c-4e7958fb3177} - C:\Program Files\Radio_G\prxtbRad2.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: Radio G Toolbar - {f228c6a4-a593-4017-944c-4e7958fb3177} - C:\Program Files\Radio_G\prxtbRad2.dll
O3 - Toolbar: Radio G Toolbar - {889eb3f6-f16b-4bc0-bc81-9c407c8a3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O3 - Toolbar: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1127693794\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe"
O4 - HKLM\..\Run: [MSC] "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunServices: [RegisterDropHandler] C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [eFax 4.4] "C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe" /R
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL Desktop 9.6\AOL.EXE" -b
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "c:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Bloggie Watcher Utility.lnk = C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe
O4 - Global Startup: Bloggie Watcher Utility.lnk = C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe
O4 - Global Startup: Compaq Connections.lnk = C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe
O4 - Global Startup: PictureMover.lnk = C:\Program Files\PictureMover\Bin\PictureMover.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: ???? - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: RemindU - {B48798CE-A2E0-4918-BC00-0F72FBA708E2} - file://C:\Documents and Settings\Compaq_Owner\Application Data\Upromise__RemindU\uprot\uproC5.htm (HKCU)
O16 - DPF: RGFCPlugin - http://www.robotgalaxy.com/images/plugin/RGFCPlugin.CAB
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} (MetaStreamCtl Class) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} (NeoterisSetup Control) - https://uat.desktop.citigroup.com/dana-cached/setup/NeoterisSetup.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152325382906
O16 - DPF: {83EF1847-D835-490B-8D9D-90B2987D66E8} (AOL Pictures Uploader Class) - http://pictures.aolcdn.com/ap/Resources/1.0.2.19.b//cab/YgpUploader.9.3.2.3.cab
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: getPlus(R) Helper - Unknown owner - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe (file missing)
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\PPRT\bin\ITMRTSVC.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 12523 bytes


----------



## Cobster (Oct 15, 2011)

Bump


----------



## kevinf80 (Mar 21, 2006)

Delete any versions of Combofix that you may have on your Desktop, download a fresh copy from either of the following links :-

*Link 1*
*Link 2*


 Ensure that Combofix is saved directly to the Desktop * <--- Very important*

Before saving Combofix to the Desktop re-name to Gotcha.exe as below:










 Disable all security programs as they will have a negative effect on Combofix, instructions available *Here* if required. Be aware the list may not have all programs listed, if you need more help please ask.

 Close any open browsers and any other programs you might have running

 Double click the







icon to run the tool (Vista or Windows 7 users right click and select "Run as Administrator)

 Instructions for running Combofix available *Here* if required.

 If you are using windows XP It might display a pop up saying that "Recovery console is not installed, do you want to install?" Please select yes & let it download the files it needs to do this. Once the recovery console is installed Combofix will then offer to scan for malware. Select continue or yes.

 When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" for further review

*******Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze* ******

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell us when you reply. Read *Here* why disabling autoruns is recommended.

*EXTRA NOTES*

 If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so.
 If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal
 If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)

Post the log in next reply please...

Kevin


----------



## Cobster (Oct 15, 2011)

Hi Kevin
Thanks so much for your help!! MUCH appreciated.
Here is the CoboFix txt:

ComboFix 11-10-16.03 - Compaq_Owner 10/17/2011 9:55.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2047.1325 [GMT -4:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\Gotcha.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
AV: Microsoft Security Essentials *Disabled/Updated* {EDB4FA23-53B8-4AFA-8C5D-99752CCA7095}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Administrator.DESKTOP1.000\WINDOWS
c:\documents and settings\Administrator.DESKTOP1\WINDOWS
c:\documents and settings\Compaq_Owner\IDHWTSS1.dll
c:\documents and settings\Compaq_Owner\PrtDLL.dll
c:\documents and settings\Compaq_Owner\Recent\JanosP.SpitzerFlooringCompany,Inc..url
c:\documents and settings\Compaq_Owner\Recent\Thumbs.db
c:\documents and settings\Compaq_Owner\WINDOWS
c:\documents and settings\Default User\WINDOWS
c:\windows\patch.exe
c:\windows\system32\config\systemprofile\WINDOWS
c:\windows\system32\ps2.bat
D:\Autorun.inf
.
.
((((((((((((((((((((((((( Files Created from 2011-09-17 to 2011-10-17 )))))))))))))))))))))))))))))))
.
.
2011-10-17 13:21 . 2011-10-17 13:21 56200 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{47762791-95A5-4BEF-92FE-5B1CE6EFC917}\offreg.dll
2011-10-17 06:31 . 2011-09-12 20:14 7269712 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{47762791-95A5-4BEF-92FE-5B1CE6EFC917}\mpengine.dll
2011-10-15 19:32 . 2011-10-15 19:32 388096 ----a-r- c:\documents and settings\Compaq_Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-10-15 14:56 . 2011-10-15 14:56 -------- d--h--w- c:\documents and settings\Compaq_Owner\InstallAnywhere
2011-10-15 14:30 . 2011-10-15 14:30 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\DriverCure
2011-10-15 14:30 . 2011-10-15 14:30 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\ParetoLogic
2011-10-15 14:29 . 2011-10-15 15:06 -------- d-----w- c:\documents and settings\All Users\Application Data\ParetoLogic
2011-10-15 14:29 . 2011-10-15 14:29 -------- d-----w- c:\program files\ParetoLogic
2011-10-08 15:23 . 2011-10-08 15:23 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Sony Corporation
2011-10-08 15:23 . 2011-10-08 15:23 -------- d-----w- c:\documents and settings\Compaq_Owner\Application Data\Sony Corporation
2011-10-08 15:22 . 2010-05-26 15:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2011-10-08 15:22 . 2011-10-08 15:22 -------- d-----w- c:\windows\Logs
2011-10-08 15:22 . 2011-10-08 15:22 -------- d-----w- c:\documents and settings\All Users\Application Data\Temp
2011-10-08 15:22 . 2011-10-08 15:22 -------- d-----w- c:\program files\Sony
2011-10-08 15:12 . 2011-10-08 15:12 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony Corporation
2011-10-08 15:12 . 2011-10-14 12:28 -------- d-----w- c:\documents and settings\Compaq_Owner\Local Settings\Application Data\Temp
2011-10-08 11:06 . 2011-10-08 11:06 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\PCHealth
2011-10-03 06:29 . 2011-09-12 20:14 7269712 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\Backup\mpengine.dll
2011-10-01 15:19 . 2011-09-29 06:53 134104 ----a-w- c:\program files\Mozilla Firefox\components\browsercomps.dll
2011-10-01 15:19 . 2011-09-29 06:53 89048 ----a-w- c:\program files\Mozilla Firefox\libEGL.dll
2011-10-01 15:19 . 2011-09-29 06:53 773080 ----a-w- c:\program files\Mozilla Firefox\mozsqlite3.dll
2011-10-01 15:19 . 2011-09-29 06:53 478168 ----a-w- c:\program files\Mozilla Firefox\libGLESv2.dll
2011-10-01 15:19 . 2011-09-29 06:53 1833944 ----a-w- c:\program files\Mozilla Firefox\mozjs.dll
2011-10-01 15:19 . 2011-09-29 06:53 15832 ----a-w- c:\program files\Mozilla Firefox\mozalloc.dll
2011-10-01 15:19 . 2011-09-29 00:26 2106216 ----a-w- c:\program files\Mozilla Firefox\D3DCompiler_43.dll
2011-10-01 15:19 . 2011-09-29 00:26 1998168 ----a-w- c:\program files\Mozilla Firefox\d3dx9_43.dll
2011-10-01 14:22 . 2011-09-21 13:00 7269712 ----a-w- c:\documents and settings\All Users\Application Data\Microsoft\Windows Defender\Definition Updates\{CF6BD639-DCE6-4E18-A158-FDFCCA542DDD}\mpengine.dll
2011-10-01 14:21 . 2011-06-24 14:10 139656 -c----w- c:\windows\system32\dllcache\rdpwd.sys
2011-10-01 14:18 . 2011-07-08 14:02 10496 -c----w- c:\windows\system32\dllcache\ndistapi.sys
2011-10-01 14:13 . 2011-10-01 14:13 -------- d-----w- c:\windows\system32\wbem\Repository
2011-10-01 14:07 . 2011-10-01 14:08 -------- d-----w- c:\program files\AOL 9.1
2011-10-01 14:07 . 2011-10-01 14:09 -------- d-----w- c:\program files\AOL Desktop 9.6
2011-10-01 14:07 . 2011-10-01 14:07 -------- d-----w- c:\program files\America Online 9.0
2011-09-26 15:41 . 2011-09-26 15:41 611328 ------w- c:\windows\system32\uiautomationcore.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-09-26 15:41 . 2004-11-17 16:27 220160 ----a-w- c:\windows\system32\oleacc.dll
2011-09-26 15:41 . 2004-11-17 16:27 20480 ----a-w- c:\windows\system32\oleaccrc.dll
2011-09-09 09:12 . 2004-11-17 16:26 599040 ----a-w- c:\windows\system32\crypt32.dll
2011-09-06 13:20 . 2004-11-17 16:29 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-09-03 10:17 . 2004-11-17 16:26 599040 ----a-w- c:\windows\system32\crypt32(3).dll
2011-08-22 23:48 . 2004-11-17 16:29 916480 ----a-w- c:\windows\system32\wininet.dll
2011-08-22 23:48 . 2004-11-17 16:27 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-08-22 23:48 . 2004-11-17 16:27 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
2011-08-22 11:56 . 2004-11-17 16:27 385024 ----a-w- c:\windows\system32\html.iec
2011-08-17 13:49 . 2004-11-17 17:15 138496 ----a-w- c:\windows\system32\drivers\afd.sys
2011-07-26 13:06 . 2011-07-26 13:06 3 ----a-w- c:\windows\system32\BSETUP.TMP
2010-01-18 03:48 . 2011-06-19 19:18 1253907 ----a-w- c:\program files\pro-setup.exe
2009-09-15 11:26 . 2011-06-19 19:18 895503 ----a-w- c:\program files\free-wrc.exe
2011-09-29 06:53 . 2011-10-01 15:19 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-01-17 14:54 175912 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f228c6a4-a593-4017-944c-4e7958fb3177}]
2011-01-17 14:54 175912 ----a-w- c:\program files\Radio_G\prxtbRad2.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{f228c6a4-a593-4017-944c-4e7958fb3177}"= "c:\program files\Radio_G\prxtbRad2.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{F228C6A4-A593-4017-944C-4E7958FB3177}"= "c:\program files\Radio_G\prxtbRad2.dll" [2011-01-17 175912]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-01-17 175912]
.
[HKEY_CLASSES_ROOT\clsid\{f228c6a4-a593-4017-944c-4e7958fb3177}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-17 68856]
"eFax 4.4"="c:\program files\eFax Messenger 4.4\J2GDllCmd.exe" [2008-10-07 95744]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-04-06 26102056]
"AOL Fast Start"="c:\program files\AOL Desktop 9.6\AOL.EXE" [2011-01-13 42320]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2004-09-30 4603904]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-21 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-08-21 118784]
"PS2"="c:\windows\system32\ps2.exe" [2003-09-13 98304]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-15 253952]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-19 2048352]
"HostManager"="c:\program files\Common Files\AOL\1127693794\ee\AOLSoftware.exe" [2010-03-08 41800]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"Adobe Photo Downloader"="c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" [2005-06-07 57344]
"MSC"="c:\program files\Microsoft Security Client\msseces.exe" [2011-06-15 997920]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2007-10-23 443968]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Bloggie Watcher Utility.lnk - c:\program files\Sony\Bloggie Software\BGVolumeWatcher.exe [2011-6-9 746856]
.
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Bloggie Watcher Utility.lnk - c:\program files\Sony\Bloggie Software\BGVolumeWatcher.exe [2011-6-9 746856]
Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [N/A]
PictureMover.lnk - c:\program files\PictureMover\Bin\PictureMover.exe [2008-8-13 413696]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 13:44 11952 ----a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
2005-06-07 03:46 57344 ----a-w- c:\program files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG]
2005-03-04 16:01 88209 ----a-w- c:\windows\AGRSMMSG.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
2004-07-21 00:22 57344 ----a-w- c:\windows\ALCMTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
2004-07-29 08:34 2551808 ----a-w- c:\windows\ALCWZRD.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor]
2004-09-08 03:47 57344 ----a-w- c:\windows\ALCXMNTR.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Fast Start]
2007-10-27 17:44 50528 ----a-w- c:\progra~1\AOL9~1.1\aol.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLDialer]
2010-07-13 20:40 70720 ----a-r- c:\program files\Common Files\AOL\ACS\AOLDial.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOLSPScheduler]
2006-11-20 20:42 8784 ----a-w- c:\program files\Common Files\AOL\1127693794\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HostManager]
2010-03-08 07:27 41800 ----a-w- c:\program files\Common Files\AOL\1127693794\ee\aolsoftware.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InstantAccess]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD]
2003-02-12 03:02 61440 ----a-w- c:\hp\KBD\kbd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
2004-09-30 03:23 921600 ----a-w- c:\windows\system32\nwiz.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2007-06-29 10:24 286720 ----a-w- c:\program files\QuickTime\QTTask.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard]
2004-04-15 03:43 233472 ----a-w- c:\windows\SMINST\Recguard.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegisterDropHandler]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sscRun]
2006-11-20 20:42 153168 ----a-w- c:\program files\Common Files\AOL\1127693794\ee\sscRun.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
2003-08-19 15:01 110592 ----a-w- c:\program files\Common Files\Sonic\Update Manager\sgtray.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ITMRTSVC"=2 (0x2)
"AOL ACS"=2 (0x2)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1127693794\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1127693794\\ee\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\America Online 9.0a\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1127693794\\ee\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\AOL 9.0a\\waol.exe"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\AOL Desktop 9.6\\waol.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
.
R1 as6eio;as6eio;c:\windows\system32\drivers\As6eio.sys [10/2/2005 1:56 PM 3616]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/22/2008 9:12 AM 335240]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [6/22/2008 9:12 AM 108552]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/28/2009 9:44 AM 908056]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/28/2009 9:44 AM 297752]
S1 MpKsl0e563469;MpKsl0e563469;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{873B57C5-04A4-4AB7-AB95-51361C3F30EF}\MpKsl0e563469.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{873B57C5-04A4-4AB7-AB95-51361C3F30EF}\MpKsl0e563469.sys [?]
S1 MpKsl5641d4f4;MpKsl5641d4f4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{93EE684A-0DC6-4DB0-AA74-4EC5A868BFBC}\MpKsl5641d4f4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{93EE684A-0DC6-4DB0-AA74-4EC5A868BFBC}\MpKsl5641d4f4.sys [?]
S1 MpKsl76e2cf48;MpKsl76e2cf48;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DAA41FAB-B1A6-44F6-AB8A-A5EF512511F3}\MpKsl76e2cf48.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DAA41FAB-B1A6-44F6-AB8A-A5EF512511F3}\MpKsl76e2cf48.sys [?]
S1 MpKslb3e862ad;MpKslb3e862ad;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{47762791-95A5-4BEF-92FE-5B1CE6EFC917}\MpKslb3e862ad.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{47762791-95A5-4BEF-92FE-5B1CE6EFC917}\MpKslb3e862ad.sys [?]
S1 MpKsleb2c071b;MpKsleb2c071b;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DA357C22-D289-4192-A7E3-A53BCB19E043}\MpKsleb2c071b.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{DA357C22-D289-4192-A7E3-A53BCB19E043}\MpKsleb2c071b.sys [?]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [10/9/2011 8:32 PM 136176]
S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [11/3/2006 7:19 PM 13592]
S3 EraserUtilDrvI9;EraserUtilDrvI9;\??\c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys --> c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilDrvI9.sys [?]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [10/9/2011 8:32 PM 136176]
S3 pc22nd5;Toshiba PCX2200 USB Cable Modem networking driver (NDIS);c:\windows\system32\drivers\pc22nd5.sys [4/16/2005 6:07 PM 17648]
S3 pc22unic;Toshiba PCX2200 USB Cable Modem WDM driver;c:\windows\system32\drivers\pc22unic.sys [4/16/2005 5:38 PM 69744]
S3 PV8630;USB Flatbed Scanner Driver;c:\windows\system32\drivers\A1236.SYS [10/2/2005 3:03 PM 19144]
.
Contents of the 'Scheduled Tasks' folder
.
2011-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-10 00:32]
.
2011-10-17 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-10-10 00:32]
.
2011-10-17 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Client\Antimalware\MpCmdRun.exe [2011-04-27 19:39]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.haaretz.co.il/
mStart Page = hxxp://www.yahoo.com/?.home=ytie
uInternet Connection Wizard,ShellNext = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = <local>
Trusted Zone: mta.ac.il\mtamail
TCP: DhcpNameServer = 192.168.0.1
DPF: RGFCPlugin - hxxp://www.robotgalaxy.com/images/plugin/RGFCPlugin.CAB
DPF: {83EF1847-D835-490B-8D9D-90B2987D66E8} - hxxp://pictures.aolcdn.com/ap/Resources/1.0.2.19.b//cab/YgpUploader.9.3.2.3.cab
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\
FF - prefs.js: browser.startup.homepage - www.globes.co.il
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-Locked - (no file)
MSConfigStartUp-IS CfgWiz - c:\program files\Common Files\Symantec Shared\cfgwiz.exe
MSConfigStartUp-OASClnt - c:\program files\McAfee.com\VSO\oasclnt.exe
MSConfigStartUp-Pure Networks Port Magic - c:\progra~1\PURENE~1\PORTMA~1\PortAOL.exe
MSConfigStartUp-VTTimer - VTTimer.exe
AddRemove-Help and Support Additions - c:\progra~1\HELPAN~1\UNWISE.EXE
AddRemove-QuickTime - c:\windows\unvise32qt.exe
AddRemove-{88D68A69-D247-466B-90DD-575F6BE16230}_is1 - c:\program files\CardRecovery\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-10-17 10:05
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ... 
.
scanning hidden autostart entries ... 
.
scanning hidden files ... 
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
Completion time: 2011-10-17 10:07:52
ComboFix-quarantined-files.txt 2011-10-17 14:07
.
Pre-Run: 93,029,797,888 bytes free
Post-Run: 95,419,740,160 bytes free
.
- - End Of File - - 8B3647526F31024365E3C57C5D5D074A


----------



## kevinf80 (Mar 21, 2006)

Hiya,

You have two AntiVirus programs installed, AVG and Microsoft Security Essentials. That is not good, you must uninstall one of them.
I`d recommend you keep MSE and get rid of AVG, use the removal utility; available here:

http://www.avg.com/us-en/utilities

Next,

*Run ESET Online Scan*

Hold down Control and click on the following link to open ESET OnlineScan in a new window.
*ESET OnlineScan*
Click the







button.
For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)

Click on







to download the ESET Smart Installer. *Save* it to your desktop.
Double click on the







icon on your desktop.

Check








Click the







button.
Accept any security warnings from your browser.
Check








*Leave the tick out of remove found threats*
Push the *Start* button.
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, push








Push







, and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
Push the







button.
Push








You can refer to *this animation* by *neomage* if needed.
Frequently asked questions available *Here* *Please read them before running the scan.*

Also be aware this scan can take several hours to complete depending on the size of your system.

ESET log can be found here *"C:\Program Files\ESET\EsetOnlineScanner\log.txt".*

Let me see the log from ESET, also give an update on current issues/concerns...

Kevin


----------



## Cobster (Oct 15, 2011)

Hi Kevin
Here is the text file I got at the end of the ESET scan:
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\fwrc.exe Win32/Adware.ErrorRepairPro application
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\loaristrojanremover.exe a variant of Win32/1AntiVirus application
C:\Program Files\Spyware Doctor\tools\swpg.DAT probably a variant of Win32/Spy.Agent.LSLDWCL trojan
C:\Program Files\Upromise__RemindU\uprom.dll probably a variant of Win32/Adware.Agent.NCQ application

aS OF RIGHT NOW sERVICES.EXE IS STILL SPIKING cpu % USAGE


----------



## kevinf80 (Mar 21, 2006)

Ok lets upload those files to VirusTotal and get them checked out:

*Upload a File to Virustotal*
Please visit *Virustotal*

 Click the *Browse...* button
 Navigate to the file *C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\fwrc.exe*
 Click the *Open* button
 Click the *Send* button
 If you get a message saying File has already been analyzed: click Reanalyze file now
 Copy and paste the results back here please.
 Repeat the above steps for the following files

*C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\loaristrojanremover.exe
C:\Program Files\Spyware Doctor\tools\swpg.DAT
C:\Program Files\Upromise__RemindU\uprom.dll
C:\Windows\System32\Services.exe*

Let me see the results....

Kevin


----------



## Cobster (Oct 15, 2011)

Here they are Kevin

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. 
File name: 
fwrc.exe
Submission date: 
2011-10-18 02:17:38 (UTC)
Current status: 
finished
Result: 
16/ 41 (39.0%)

VT Community








not reviewed
Safety score: - 
Compact 
Print results ​
AntivirusVersionLast UpdateResultAhnLab-V32011.10.17.002011.10.17-AntiVir7.11.16.292011.10.17SPR/Fake.ErrorRep.AAntiy-AVL2.0.3.72011.10.17-Avast6.0.1289.02011.10.18Win32UP-gen [PUP]AVG10.0.0.11902011.10.17Skodna.Generic.AEBitDefender7.22011.10.18-ByteHero1.0.0.12011.09.23-CAT-QuickHealNone2011.10.17-ClamAV0.97.0.02011.10.17Trojan.Spy-80652Commtouch5.3.2.62011.10.18W32/MalwareF.JPOGComodo104782011.10.18-Emsisoft5.1.0.112011.10.18-eSafe7.0.17.02011.10.17-eTrust-Vet36.1.86242011.10.17-F-Prot4.6.5.1412011.10.17W32/MalwareF.JPOGF-Secure9.0.16440.02011.10.18Adware.Fakealert.AMFortinet4.3.370.02011.10.17Adware/ErrorRepairProGData222011.10.18Adware.Fakealert.AMIkarusT3.1.1.107.02011.10.18-Jiangmin13.0.9002011.10.17-K7AntiVirus9.115.53002011.10.17RiskwareKaspersky9.0.0.8372011.10.18-McAfee5.400.0.11582011.10.18Artemis!CF1D9C180807McAfee-GW-Edition2010.1D2011.10.17Artemis!CF1D9C180807Microsoft1.77022011.10.17-NOD3265512011.10.18-nProtect2011-10-17.012011.10.17-Panda10.0.3.52011.10.17-PCTools8.0.0.52011.10.18-Prevx3.02011.10.18-Rising23.80.00.012011.10.17-Sophos4.70.02011.10.18Error Repair ProSUPERAntiSpyware4.40.0.10062011.10.18-Symantec20111.2.0.822011.10.18WS.Reputation.1TheHacker6.7.0.1.3252011.10.17-TrendMicro9.500.0.10082011.10.17-TrendMicro-HouseCall9.500.0.10082011.10.18-VBA323.12.16.42011.10.17Win32.Adware.ErrorRepairProVIPRE107932011.10.18Trojan.Win32.Generic!BTViRobot2011.10.17.47232011.10.17-VirusBuster14.1.16.02011.10.17-Additional information

MD5 : b1b73f27998f419d98e4beae0df16498SHA1 : 9ad667a1421ab9cc27b554d5548d6e12d4fdc1a6SHA256: 90dc614abe4bf33a5cfe45d72df0da29963e1c257f3ae3b159cbfa423424eabe

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. 
File name: 
loaristrojanremover.exe
Submission date: 
2011-10-18 02:13:04 (UTC)
Current status: 
finished
Result: 
3/ 42 (7.1%)

VT Community








not reviewed
Safety score: - 
Compact 
Print results ​
AntivirusVersionLast UpdateResultAhnLab-V32011.10.17.002011.10.17-AntiVir7.11.16.292011.10.17-Antiy-AVL2.0.3.72011.10.17-Avast6.0.1289.02011.10.18Win32UP-gen [PUP]AVG10.0.0.11902011.10.17-BitDefender7.22011.10.18-ByteHero1.0.0.12011.09.23-CAT-QuickHeal11.002011.10.17-ClamAV0.97.0.02011.10.17-Commtouch5.3.2.62011.10.18-Comodo104802011.10.18-DrWeb5.0.2.033002011.10.18-Emsisoft5.1.0.112011.10.18-eSafe7.0.17.02011.10.17-eTrust-Vet36.1.86242011.10.17-F-Prot4.6.5.1412011.10.17-F-Secure9.0.16440.02011.10.17-Fortinet4.3.370.02011.10.17-GData222011.10.18-IkarusT3.1.1.107.02011.10.18-Jiangmin13.0.9002011.10.17-K7AntiVirus9.115.53002011.10.17-Kaspersky9.0.0.8372011.10.18-McAfee5.400.0.11582011.10.18-McAfee-GW-Edition2010.1D2011.10.17-Microsoft1.77022011.10.17-NOD3265512011.10.18a variant of Win32/1AntiVirusnProtect2011-10-17.012011.10.17-Panda10.0.3.52011.10.17-PCTools8.0.0.52011.10.18-Prevx3.02011.10.18-Rising23.80.00.012011.10.17-Sophos4.70.02011.10.18-SUPERAntiSpyware4.40.0.10062011.10.18-Symantec20111.2.0.822011.10.18WS.Reputation.1TheHacker6.7.0.1.3252011.10.17-TrendMicro9.500.0.10082011.10.17-TrendMicro-HouseCall9.500.0.10082011.10.18-VBA323.12.16.42011.10.17-VIPRE107932011.10.18-ViRobot2011.10.17.47232011.10.17-VirusBuster14.1.16.02011.10.17-Additional information

MD5 : efcc5191441d531486ef5f698b2ee00dSHA1 : 1fcdc366496fb89c0aa0e76355f233e185a59375SHA256: 98a641146f6d8b61469d42da4d24a998d040826790a734d65a551b89a7c1784b

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. 
File name: 
swpg.DAT
Submission date: 
2011-10-18 02:15:14 (UTC)
Current status: 
finished
Result: 
10/ 42 (23.8%)

VT Community








not reviewed
Safety score: - 
Compact 
Print results ​
AntivirusVersionLast UpdateResultAhnLab-V32011.10.17.002011.10.17-AntiVir7.11.16.292011.10.17-Antiy-AVL2.0.3.72011.10.17Monitor/Win32.KeyLogger.genAvast6.0.1289.02011.10.18-AVG10.0.0.11902011.10.17-BitDefender7.22011.10.18-ByteHero1.0.0.12011.09.23-CAT-QuickHeal11.002011.10.17-ClamAV0.97.0.02011.10.17-Commtouch5.3.2.62011.10.18-Comodo104802011.10.18UnclassifiedMalwareDrWeb5.0.2.033002011.10.18-Emsisoft5.1.0.112011.10.18-eSafe7.0.17.02011.10.17-eTrust-Vet36.1.86242011.10.17-F-Prot4.6.5.1412011.10.17-F-Secure9.0.16440.02011.10.18-Fortinet4.3.370.02011.10.17W32/Malware_fam.NBGData222011.10.18-IkarusT3.1.1.107.02011.10.18-Jiangmin13.0.9002011.10.17-K7AntiVirus9.115.53002011.10.17RiskwareKaspersky9.0.0.8372011.10.18-McAfee-GW-Edition2010.1D2011.10.17Generic PWS.yMicrosoft1.77022011.10.17-NOD3265512011.10.18probably a variant of Win32/Spy.Agent.LSLDWCLNorman6.07.112011.10.18W32/Suspicious_Gen2.UQWPnProtect2011-10-17.012011.10.17-Panda10.0.3.52011.10.17-PCTools8.0.0.52011.10.18Application.Keylogger.generic!ctPrevx3.02011.10.18-Rising23.80.00.012011.10.17-Sophos4.70.02011.10.18Mal/Generic-LSUPERAntiSpyware4.40.0.10062011.10.18-Symantec20111.2.0.822011.10.18-TheHacker6.7.0.1.3252011.10.17Aplicacion/KeyLogger.dqTrendMicro9.500.0.10082011.10.17-TrendMicro-HouseCall9.500.0.10082011.10.18-VBA323.12.16.42011.10.17-VIPRE107932011.10.18-ViRobot2011.10.17.47232011.10.17-VirusBuster14.1.16.02011.10.17-Additional information

MD5 : 45fbf78ab2d85a2abd0cb49d5f423d28SHA1 : bd9a5305da6c9be5e6b47bb1831ea9479303762aSHA256: 75168513a6927c8c3450cc9ff6bef7622c297aa3c9ca735d807e4c8ee902f00b

0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. 
File name: 
uprom.dll
Submission date: 
2011-10-18 02:23:31 (UTC)
Current status: 
finished
Result: 
2/ 43 (4.7%)

VT Community








not reviewed
Safety score: - 
Compact 
Print results ​
AntivirusVersionLast UpdateResultAhnLab-V32011.10.17.002011.10.17-AntiVir7.11.16.292011.10.17-Antiy-AVL2.0.3.72011.10.17-Avast6.0.1289.02011.10.18-AVG10.0.0.11902011.10.17-BitDefender7.22011.10.18-ByteHero1.0.0.12011.09.23-CAT-QuickHeal11.002011.10.17-ClamAV0.97.0.02011.10.17-Commtouch5.3.2.62011.10.18-Comodo104782011.10.18-DrWeb5.0.2.033002011.10.18-Emsisoft5.1.0.112011.10.18-eSafe7.0.17.02011.10.17-eTrust-Vet36.1.86242011.10.17-F-Prot4.6.5.1412011.10.17-F-Secure9.0.16440.02011.10.18-Fortinet4.3.370.02011.10.17-GData222011.10.18-IkarusT3.1.1.107.02011.10.18-Jiangmin13.0.9002011.10.17-K7AntiVirus9.115.53002011.10.17-Kaspersky9.0.0.8372011.10.18-McAfee5.400.0.11582011.10.18-McAfee-GW-Edition2010.1D2011.10.17-Microsoft1.77022011.10.17-NOD3265512011.10.18probably a variant of Win32/Adware.Agent.NCQNorman6.07.112011.10.18-nProtect2011-10-17.012011.10.17-Panda10.0.3.52011.10.17-PCTools8.0.0.52011.10.18-Prevx3.02011.10.18-Rising23.80.00.012011.10.17-Sophos4.70.02011.10.18-SUPERAntiSpyware4.40.0.10062011.10.18-Symantec20111.2.0.822011.10.18-TheHacker6.7.0.1.3252011.10.17-TrendMicro9.500.0.10082011.10.17-TrendMicro-HouseCall9.500.0.10082011.10.18-VBA323.12.16.42011.10.17Signed-AdWare.Win32.WebRebates.xVIPRE107932011.10.18-ViRobot2011.10.17.47232011.10.17-VirusBuster14.1.16.02011.10.17-Additional information

MD5 : 219d8e0f7048f266b2948846eb05d705SHA1 : a1e24e5eb7c580920ee105fb1be0ff5e204d044cSHA256: c4e2eae97e290e8abf7b9932b5fd2d48ad9215cb67893541eade36e4449d4e5d

3 VT Community user(s) with a total of 2383 reputation credit(s) say(s) this sample is goodware. 1 VT Community user(s) with a total of 1 reputation credit(s) say(s) this sample is malware. 
File name: 
services.exe
Submission date: 
2011-10-18 02:26:45 (UTC)
Current status: 
finished
Result: 
0/ 40 (0.0%)

VT Community








goodware
Safety score: 100.0% 
Compact 
Print results ​
AntivirusVersionLast UpdateResultAhnLab-V32011.10.17.002011.10.17-AntiVir7.11.16.292011.10.17-Antiy-AVL2.0.3.72011.10.17-Avast6.0.1289.02011.10.18-AVG10.0.0.11902011.10.17-BitDefender7.22011.10.18-ByteHero1.0.0.12011.09.23-CAT-QuickHeal11.002011.10.17-ClamAV0.97.0.02011.10.17-Commtouch5.3.2.62011.10.18-Comodo104802011.10.18-DrWeb5.0.2.033002011.10.18-Emsisoft5.1.0.112011.10.18-eSafe7.0.17.02011.10.17-eTrust-Vet36.1.86242011.10.17-F-Prot4.6.5.1412011.10.17-F-Secure9.0.16440.02011.10.17-Fortinet4.3.370.02011.10.17-GData222011.10.18-IkarusT3.1.1.107.02011.10.18-Jiangmin13.0.9002011.10.17-K7AntiVirus9.115.53002011.10.17-Kaspersky9.0.0.8372011.10.18-McAfee5.400.0.11582011.10.18-McAfee-GW-Edition2010.1D2011.10.17-Microsoft1.77022011.10.17-NOD3265512011.10.18-nProtect2011-10-17.012011.10.17-Panda10.0.3.52011.10.17-PCTools8.0.0.52011.10.18-Prevx3.02011.10.18-Rising23.80.00.012011.10.17-Sophos4.70.02011.10.18-SUPERAntiSpyware4.40.0.10062011.10.18-TheHacker6.7.0.1.3252011.10.17-TrendMicro9.500.0.10082011.10.17-TrendMicro-HouseCall9.500.0.10082011.10.18-VBA323.12.16.42011.10.17-ViRobot2011.10.17.47232011.10.17-VirusBuster14.1.16.02011.10.17-Additional information

MD5 : 65df52f5b8b6e9bbd183505225c37315SHA1 : de3701d2c03d9ae29b2d87eccafbbcadf1bfb7e3SHA256: 59c606977db40a3443dff0be2a4c761824881b22c9fdb3d23f6486db580e92a4

*VT Community*


----------



## kevinf80 (Mar 21, 2006)

OK, we have to deal with those bad entries, services.exe is clean so is good news...

Do this please :-

Please download *OTM by OldTimer*.
*Alternative Mirror 1*
*Alternative Mirror 2* 
Save it to your desktop. 
Double click *OTM.exe* to start the tool. Vista or Windows 7 users right click and select Run as Administrator

*Copy* the text between the dotted lines below to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose *Copy*):

-------------------------------------------------------------------
* 
:Files
ipconfig /flushdns /c
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\fwrc.exe
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\loaristrojanremover.exe
C:\Program Files\Spyware Doctor\tools\swpg.DAT
C:\Program Files\Upromise__RemindU\uprom.dll
:Commands
[EmptyTemp]
[EmptyFlash]
[Reboot]
*
---------------------------------------------------------------------

 Return to OTMoveIt3, right click in the *"Paste Instructions for Items to be Moved"* window (under the yellow bar) and choose *Paste*.
Click the red







button.
*Copy* everything in the Results window (under the green bar) to the clipboard by highlighting *ALL* of them and *pressing CTRL + C* (or, after highlighting, right-click and choose copy), and paste it in your next reply.
Close *OTM*
*Note:* If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose *Yes.*

If the machine reboots, the Results log can be found here:

*c:\_OTMoveIt\MovedFiles\mmddyyyy_hhmmss.log*

Where mmddyyyy_hhmmss is the date of the tool run.

Let me see that log, also give update on issues...

Kevin


----------



## Cobster (Oct 15, 2011)

Hi Kevin
Here it is:
All processes killed
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Compaq_Owner\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Compaq_Owner\Desktop\cmd.txt deleted successfully.
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\fwrc.exe moved successfully.
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\loaristrojanremover.exe moved successfully.
C:\Program Files\Spyware Doctor\tools\swpg.DAT moved successfully.
DllUnregisterServer procedure not found in C:\Program Files\Upromise__RemindU\uprom.dll
C:\Program Files\Upromise__RemindU\uprom.dll moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78924 bytes
->Flash cache emptied: 525 bytes

User: Administrator.DESKTOP1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Administrator.DESKTOP1.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users
->Flash cache emptied: 149 bytes

User: Compaq_Owner
->Temp folder emptied: 1099798 bytes
->Temporary Internet Files folder emptied: 33867409 bytes
->Java cache emptied: 35250780 bytes
->FireFox cache emptied: 60513794 bytes
->Flash cache emptied: 476796 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: LocalService
->Temp folder emptied: 65748 bytes
->Temporary Internet Files folder emptied: 719198 bytes
->Flash cache emptied: 348 bytes

User: NetworkService
->Temp folder emptied: 9156 bytes
->Temporary Internet Files folder emptied: 67 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 20582 bytes
%systemroot%\System32 .tmp files removed: 850452 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 15342 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 127.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: Administrator.DESKTOP1

User: Administrator.DESKTOP1.000

User: All Users
->Flash cache emptied: 0 bytes

User: Compaq_Owner
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

OTM by OldTimer - Version 3.1.19.0 log created on 10182011_073504

Files moved on Reboot...

Registry entries deleted on Reboot...

Looks like the CPU is back to normal..I hope that solved it and thank you from the bottom of my heart in advance.
OOPs..just got a nother spike from Services.exe..lasted about 15 seconds..might be a normal thing..
Let me use the computer for a day and see if the problem resurfaces.
In the mean time, should I re-enable the Microsoft Essential (or re-install AVG) for protection?
Thanks again for your help


----------



## Cobster (Oct 15, 2011)

Services.exe still showing much higher CPU usage than normal spiking frequently and essentially freezing the computer for 10-15 seconds at a time when it happens.
Can a virus mask itself under that name?


----------



## kevinf80 (Mar 21, 2006)

Run the following:

Please download *SystemLook* from one of the links below and save it to your Desktop.
*Download Mirror #1
Download Mirror #2*

Double-click *SystemLook.exe* to run it.
Copy the content of the following codebox into the main textfield:


```
:regfind
services.exe
```

Click the *Look* button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
*Note:* The log can also be found on your Desktop entitled *SystemLook.txt*

Also tell me do you use any of the AOL software..


----------



## Cobster (Oct 15, 2011)

I am using AOL as my email ..can access it online too if you want me to get rid of some of its programmes.
Here is the log:

SystemLook 30.07.11 by jpshortstuff
Log created at 19:47 on 18/10/2011 by Compaq_Owner
Administrator - Elevation successful

========== regfind ==========

Searching for "services.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="services.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"e"="C:\WINDOWS\system32\services.exe"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"a"="C:\WINDOWS\system32\services.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB956572\Filelist\18]
"FileName"="services.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB956572\Filelist\2]
"FileName"="services.exe"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Updates\Windows XP\SP4\KB956572\Filelist\31]
"FileName"="services.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\MUILanguages\RCV2\services.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Control\Nls\MUILanguages\RCV2\services.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Eventlog]
"ImagePath"="%SystemRoot%\system32\services.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\PlugPlay]
"ImagePath"="%SystemRoot%\system32\services.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Control\Nls\MUILanguages\RCV2\services.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\Eventlog]
"ImagePath"="%SystemRoot%\system32\services.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\PlugPlay]
"ImagePath"="%SystemRoot%\system32\services.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Nls\MUILanguages\RCV2\services.exe]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog]
"ImagePath"="%SystemRoot%\system32\services.exe"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\PlugPlay]
"ImagePath"="%SystemRoot%\system32\services.exe"
[HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Search Assistant\ACMru\5603]
"000"="services.exe"
[HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"e"="C:\WINDOWS\system32\services.exe"
[HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\exe]
"a"="C:\WINDOWS\system32\services.exe"

-= EOF =-


----------



## kevinf80 (Mar 21, 2006)

If you only use AOL to access email and do not rely on it for internet connectivity access msconfig and untick all entries related to AOL... Re-boot, you get an alert box about the changes, tick to not show again and accept, see how system now responds...

Also run the following:

Please download VEW by Vino Rosso from HERE and save it to your Desktop.

Double-click VEW.exe. to start, Vista and Windows 7 users Right Click and select "Run as Administrator" 
Under 'Select log to query...check the boxes for both Application and System. 
Under 'Select type to list... select both Error and Critical. 
Click the radio button for 'Number of events...Type 10 in the 1 to 20 box. 
Then click the Run button.
Notepad will open with the output log. It will take a couple of minutes to generate the log, please be patient.

Please post the Output log in your next reply.

Kevin


----------



## Cobster (Oct 15, 2011)

Unticked the AOL and rebooted.
Here is the VEW log (it was quite immediate to generate..very fast) - Services.exe still running high in spikes but will have a better feel for it in an hour or so once I use the computer a bit more

Vino's Event Viewer v01c run on Windows XP in English
Report run at 19/10/2011 7:59:31 AM

Note: All dates below are in the format dd/mm/yyyy

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'Application' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'Application' Date/Time: 17/10/2011 9:31:49 PM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application ps2.exe, version 1.0.2.2, faulting module ps2.exe, version 1.0.2.2, fault address 0x00003343. 

Log: 'Application' Date/Time: 17/10/2011 7:21:30 AM
Type: error Category: 101
Event: 1002 Source: Application Hang
Hanging application firefox.exe, version 7.0.1.4288, hang module hungapp, version 0.0.0.0, hang address 0x00000000. 

Log: 'Application' Date/Time: 15/10/2011 12:41:47 PM
Type: error Category: 0
Event: 1000 Source: Application Error
Faulting application componentlauncher.exe, version 3.0.0.49815, faulting module , version 5.1.2600.6055, fault address 0x00010f1e. 

Log: 'Application' Date/Time: 14/10/2011 2:16:07 AM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

Log: 'Application' Date/Time: 12/10/2011 8:27:52 PM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

Log: 'Application' Date/Time: 12/10/2011 8:23:07 PM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

Log: 'Application' Date/Time: 12/10/2011 2:06:49 AM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

Log: 'Application' Date/Time: 10/10/2011 8:19:11 PM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

Log: 'Application' Date/Time: 08/10/2011 7:06:09 AM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

Log: 'Application' Date/Time: 08/10/2011 2:40:17 AM
Type: error Category: 0
Event: 5000 Source: MPSampleSubmission
EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL. 

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'System' Log - error Type
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Log: 'System' Date/Time: 18/10/2011 7:35:05 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The WAN Miniport (ATW) Service service terminated unexpectedly. It has done this 1 time(s). 

Log: 'System' Date/Time: 18/10/2011 7:35:05 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s). 

Log: 'System' Date/Time: 18/10/2011 7:35:05 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Machine Debug Manager service terminated unexpectedly. It has done this 1 time(s). 

Log: 'System' Date/Time: 18/10/2011 7:35:05 AM
Type: error Category: 0
Event: 7034 Source: Service Control Manager
The Java Quick Starter service terminated unexpectedly. It has done this 1 time(s). 

Log: 'System' Date/Time: 18/10/2011 7:35:05 AM
Type: error Category: 0
Event: 7031 Source: Service Control Manager
The Microsoft Antimalware Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 15000 milliseconds: Restart the service. 

Log: 'System' Date/Time: 17/10/2011 11:49:02 PM
Type: error Category: 0
Event: 7011 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for a transaction response from the JavaQuickStarterService service. 

Log: 'System' Date/Time: 17/10/2011 7:25:17 AM
Type: error Category: 0
Event: 7011 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 

Log: 'System' Date/Time: 17/10/2011 7:15:17 AM
Type: error Category: 0
Event: 7011 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 

Log: 'System' Date/Time: 17/10/2011 7:10:24 AM
Type: error Category: 0
Event: 7011 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service. 

Log: 'System' Date/Time: 17/10/2011 4:53:20 AM
Type: error Category: 0
Event: 7011 Source: Service Control Manager
Timeout (30000 milliseconds) waiting for a transaction response from the stisvc service.


----------



## kevinf80 (Mar 21, 2006)

OK, let me know how it goes..


----------



## Cobster (Oct 15, 2011)

I still get frequent spikes of Services.exe CPU usage that freeze my computer for 10-15 seconds at a time..then it goes down and spikes up again after a few moments


----------



## kevinf80 (Mar 21, 2006)

Uninstall AOL software, reboot. If you still get the issue do the following :-

Download







*OTL* from any of the following links and save to your Desktop:

*Link 1*
*Link 2*
*Link 3*
*Link 4*

 Double click on the icon







to run it, Vista or Windows 7 users right click and select Run as Administartor. Make sure all other windows are closed and to let it run uninterrupted.
 When the window appears, underneath *Output* at the top, make sure *Stadard output* is selected.
 Select *Scan all users*
 Under the *Extra Registry* section, check *Use SafeList*
 In the lower right corner, checkmark *"LOP Check"* and checkmark *"Purity Check".*
 Under the Custom Scan box paste this in:


```
[B]netsvcs
%SYSTEMDRIVE%\*.exe
/md5start
explorer.exe
winlogon.exe
Userinit.exe
svchost.exe
/md5stop
%systemroot%\*. /mp /s
hklm\software\clients\startmenuinternet|command /rs
hklm\software\clients\startmenuinternet|command /64 /rs
CREATERESTOREPOINT
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs[/B]
```

 Click the







button. Do not change any settings unless otherwise told to do so. The scan wont take long.
 When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
 Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them in your reply


----------



## Cobster (Oct 15, 2011)

AOL uninstalled.
Here are the logs:
OTL.txt:
OTL logfile created on: 10/19/2011 8:33:31 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Compaq_Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.14 Gb Available Physical Memory | 56.78% Memory free
3.80 Gb Paging File | 3.10 Gb Available in Paging File | 81.55% Paging File free
Paging file location(s): C:\pagefile.sys 2000 4000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.24 Gb Total Space | 90.09 Gb Free Space | 63.34% Space Free | Partition Type: NTFS
Drive D: | 6.79 Gb Total Space | 2.12 Gb Free Space | 31.29% Space Free | Partition Type: FAT32

Computer Name: DESKTOP1 | User Name: Compaq_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/10/19 20:28:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTL.exe
PRC - [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/06/09 12:28:22 | 000,746,856 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2008/10/07 16:25:48 | 000,095,744 | ---- | M] (j2 Global Communications, Inc.) -- C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe
PRC - [2008/08/13 09:11:00 | 000,413,696 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\PictureMover\Bin\PictureMover.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/06/06 23:46:24 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
PRC - [2003/09/12 23:13:20 | 000,098,304 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\ps2.EXE
PRC - [2003/08/27 11:29:46 | 000,065,536 | ---- | M] (America Online, Inc.) -- C:\WINDOWS\wanmpsvc.exe

========== Modules (No Company Name) ==========

MOD - [2011/09/29 02:53:40 | 001,833,944 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/03/30 10:23:03 | 006,053,536 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2009/11/26 17:13:52 | 012,160,056 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\PictureMover\Bin\Core.dll
MOD - [2009/11/26 17:13:44 | 001,699,384 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\PictureMover\EN-US\Presentation.dll
MOD - [2008/04/13 20:11:59 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 20:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2008/03/25 00:50:40 | 000,355,112 | ---- | M] () -- C:\WINDOWS\system32\msjetoledb40.dll
MOD - [2001/09/28 14:44:58 | 000,257,536 | ---- | M] () -- C:\WINDOWS\BiImg.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (getPlus(R) Helper) getPlus(R)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)
SRV - [2006/10/23 08:50:35 | 000,046,640 | R--- | M] (AOL LLC) [Disabled | Stopped] -- C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe -- (AOL ACS)
SRV - [2004/10/15 16:54:14 | 000,100,016 | ---- | M] (America Online, Inc) [Disabled | Stopped] -- C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe -- (AOL TopSpeedMonitor)
SRV - [2003/08/27 11:29:46 | 000,065,536 | ---- | M] (America Online, Inc.) [Auto | Running] -- C:\WINDOWS\wanmpsvc.exe -- (WANMiniportService) WAN Miniport (ATW)

========== Driver Services (SafeList) ==========

DRV - [2006/10/07 11:23:54 | 000,076,560 | ---- | M] (Trend Micro Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\tmcomm.sys -- (tmcomm)
DRV - [2006/04/02 21:23:03 | 000,022,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)
DRV - [2005/04/20 11:00:56 | 002,317,696 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005/03/04 12:02:20 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2004/09/30 01:55:50 | 000,229,888 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2004/09/24 13:38:40 | 000,012,928 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2004/07/29 23:04:26 | 002,216,128 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/05/08 20:21:44 | 000,035,840 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/04/27 10:31:04 | 000,474,304 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvcd.sys -- (QCDonner) Logitech QuickCam Express(PID_0840)
DRV - [2003/12/02 21:23:20 | 000,142,336 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003/09/19 05:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/07/18 19:58:20 | 000,036,992 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2003/07/12 01:28:56 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)
DRV - [2003/07/02 14:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2003/01/10 17:13:04 | 000,033,588 | ---- | M] (America Online, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)
DRV - [2002/10/04 20:04:10 | 000,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2002/07/30 01:43:50 | 000,023,808 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
DRV - [2001/11/08 15:58:22 | 000,017,648 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pc22nd5.sys -- (pc22nd5) Toshiba PCX2200 USB Cable Modem networking driver (NDIS)
DRV - [2001/11/08 15:58:14 | 000,069,744 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pc22unic.sys -- (pc22unic)
DRV - [2000/06/27 07:14:32 | 000,019,144 | ---- | M] (USB Image.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\A1236.SYS -- (PV8630)
DRV - [1997/12/09 01:32:00 | 000,003,616 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\as6eio.sys -- (as6eio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.haaretz.co.il/
IE - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 95 22 45 D4 15 CA 01 [binary data]
IE - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.globes.co.il"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.1879: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.1939: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.872: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll File not found
FF - HKCU\Software\MozillaPlugins\@sony.com/Some: C:\Program Files\Sony\Bloggie Software\npsome.dll (Sony)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/01 11:19:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/13 10:17:49 | 000,000,000 | ---D | M]

[2008/09/02 08:06:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions
[2011/10/01 11:20:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions
[2011/10/01 10:05:50 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}(2)
[2011/10/01 11:20:21 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/10/01 10:05:44 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2010/10/21 12:58:25 | 000,000,000 | ---D | M] (PSB Plugin) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\[email protected]
[2011/09/29 10:10:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009/08/05 09:51:51 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/29 02:53:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/15 11:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npsnapfish.dll
[2005/04/27 17:31:10 | 000,225,280 | ---- | M] (Asgard Software Inc.) -- C:\Program Files\mozilla firefox\plugins\NPUploader.dll
[2011/09/28 20:26:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/10/17 10:05:40 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Yahoo! IE Suggest) - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll (Yahoo! Inc.)
O2 - BHO: (UberButton Class) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (YahooTaggedBM Class) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll (Yahoo! Inc.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Radio G Toolbar) - {889eb3f6-f16b-4bc0-bc81-9c407c8a3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll (Conduit Ltd.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O2 - BHO: (Radio G Toolbar) - {f228c6a4-a593-4017-944c-4e7958fb3177} - C:\Program Files\Radio_G\prxtbRad2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Radio G Toolbar) - {889eb3f6-f16b-4bc0-bc81-9c407c8a3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKLM\..\Toolbar: (Radio G Toolbar) - {f228c6a4-a593-4017-944c-4e7958fb3177} - C:\Program Files\Radio_G\prxtbRad2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (no name) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - No CLSID value found.
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Radio G Toolbar) - {889EB3F6-F16B-4BC0-BC81-9C407C8A3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Radio G Toolbar) - {F228C6A4-A593-4017-944C-4E7958FB3177} - C:\Program Files\Radio_G\prxtbRad2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKU\.DEFAULT..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-18..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (Google Inc.)
O4 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009..\Run: [eFax 4.4] C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe (j2 Global Communications, Inc.)
O4 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - HKLM..\RunOnce: [AOLDeskbarDirRemoval] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [AOLToolbarDirRemoval] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk = C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe (Sony Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PictureMover.lnk = C:\Program Files\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk = C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_15.dll (Sun Microsystems, Inc.)
O15 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O15 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..Trusted Domains: mta.ac.il ([mtamail] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://active.macromedia.com/director/cabs/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (MetaStreamCtl Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} https://uat.desktop.citigroup.com/dana-cached/setup/NeoterisSetup.cab (NeoterisSetup Control)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,84/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152325382906 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {83EF1847-D835-490B-8D9D-90B2987D66E8} http://pictures.aolcdn.com/ap/Resources/1.0.2.19.b//cab/YgpUploader.9.3.2.3.cab (AOL Pictures Uploader Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterfly.com/downloads/Uploader.cab (Shutterfly Picture Upload Plugin)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,21/mcgdmgr.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-160-windows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: RGFCPlugin http://www.robotgalaxy.com/images/plugin/RGFCPlugin.CAB (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{65ADC95C-A4EE-4103-918F-8E8E9BD42698}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - (avgrsstx.dll) - File not found
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/10/21 05:59:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: AppMgmt - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

CREATERESTOREPOINT
Restore point Set: OTL Restore Point

========== Files/Folders - Created Within 30 Days ==========

[2011/10/19 20:28:57 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTL.exe
[2011/10/19 07:58:37 | 000,061,440 | ---- | C] ( ) -- C:\Documents and Settings\Compaq_Owner\Desktop\VEW.exe
[2011/10/18 07:37:03 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/10/18 07:35:04 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/10/18 07:33:11 | 000,523,264 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTM.exe
[2011/10/17 18:33:02 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/10/17 09:54:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/10/17 09:54:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/10/17 09:54:00 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/10/17 09:54:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/10/17 09:53:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/10/17 09:53:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/10/17 09:52:20 | 004,262,966 | R--- | C] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\Gotcha.exe
[2011/10/15 15:32:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\HiJackThis
[2011/10/15 15:32:31 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis
[2011/10/15 10:56:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Compaq_Owner\InstallAnywhere
[2011/10/15 10:30:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\DriverCure
[2011/10/15 10:30:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic
[2011/10/15 10:29:19 | 000,000,000 | ---D | C] -- C:\Program Files\ParetoLogic
[2011/10/15 10:29:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/10/09 20:33:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/10/08 11:23:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Sony Corporation
[2011/10/08 11:23:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\Bloggie Library
[2011/10/08 11:23:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\Sony Corporation
[2011/10/08 11:22:52 | 001,998,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_43.dll
[2011/10/08 11:22:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Bloggie Software
[2011/10/08 11:22:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2011/10/08 11:22:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Temp
[2011/10/08 11:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2011/10/08 11:12:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sony Corporation
[2011/10/08 11:12:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Temp
[2011/10/08 07:06:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
[2011/10/01 10:21:04 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011/10/01 10:18:35 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/10/01 10:07:59 | 000,000,000 | ---D | C] -- C:\Program Files\AOL 9.1
[2011/10/01 10:07:50 | 000,000,000 | ---D | C] -- C:\Program Files\AOL Desktop 9.6
[2011/10/01 10:07:41 | 000,000,000 | ---D | C] -- C:\Program Files\America Online 9.0a
[2011/10/01 10:07:25 | 000,000,000 | ---D | C] -- C:\Program Files\America Online 9.0
[2011/09/26 11:41:20 | 000,611,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\uiautomationcore.dll
[2011/06/19 15:18:11 | 000,895,503 | ---- | C] (free-windows-registry-cleaner.com ) -- C:\Program Files\free-wrc.exe
[2005/10/02 15:03:13 | 000,018,120 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\GT680X.SYS

========== Files - Modified Within 30 Days ==========

[2011/10/19 20:37:00 | 000,000,898 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/19 20:37:00 | 000,000,894 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/19 20:28:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTL.exe
[2011/10/19 20:20:29 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/10/19 20:16:25 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/10/19 20:15:31 | 000,007,883 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/10/19 20:15:30 | 000,000,188 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT
[2011/10/19 20:15:21 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/10/19 20:15:20 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2011/10/19 20:10:09 | 000,000,518 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\AOL Saved Files.lnk
[2011/10/19 20:10:08 | 000,000,004 | ---- | M] () -- C:\WINDOWS\msoffice.ini
[2011/10/19 07:58:37 | 000,061,440 | ---- | M] ( ) -- C:\Documents and Settings\Compaq_Owner\Desktop\VEW.exe
[2011/10/19 07:52:48 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2011/10/19 07:49:43 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2011/10/18 07:33:11 | 000,523,264 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTM.exe
[2011/10/17 10:05:40 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/10/17 09:53:33 | 004,262,966 | R--- | M] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\Gotcha.exe
[2011/10/15 15:32:32 | 000,002,020 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\HiJackThis.lnk
[2011/10/15 14:46:44 | 000,012,150 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\Lanvin4HMblkdress.jpg
[2011/10/15 13:29:29 | 000,022,879 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\LanvinLeopardBoots.jpg
[2011/10/15 11:16:56 | 000,361,728 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/10/15 11:14:25 | 000,000,932 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\My Sharing Folders.lnk
[2011/10/14 21:44:15 | 000,002,672 | ---- | M] () -- C:\WINDOWS\Ausba3.ini
[2011/10/14 21:44:13 | 000,011,604 | ---- | M] () -- C:\WINDOWS\Dusb3ar.ini
[2011/10/14 18:25:14 | 000,030,600 | ---- | M] () -- C:\WINDOWS\EWhiteu12.dat
[2011/10/14 18:25:14 | 000,000,004 | ---- | M] () -- C:\WINDOWS\AErroru3.dat
[2011/10/14 18:25:11 | 000,030,600 | ---- | M] () -- C:\WINDOWS\EDarku12.dat
[2011/10/14 18:25:09 | 000,000,006 | ---- | M] () -- C:\WINDOWS\EExpou.dat
[2011/10/14 18:25:04 | 000,000,001 | ---- | M] () -- C:\WINDOWS\EOffsetu.dat
[2011/10/13 10:17:50 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/10/13 03:09:33 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/10/09 20:33:35 | 000,001,923 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/10/08 11:22:51 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:44 | 000,000,870 | R--- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:38 | 000,000,858 | R--- | M] () -- C:\Documents and Settings\All Users\Desktop\Bloggie Software.lnk
[2011/10/03 04:35:11 | 005,971,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll
[2011/10/01 16:44:38 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/10/01 11:19:20 | 000,000,750 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/10/01 11:19:20 | 000,000,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2011/09/26 11:41:20 | 000,611,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\uiautomationcore.dll
[2011/09/26 11:41:20 | 000,220,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oleacc.dll
[2011/09/26 11:41:14 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\oleaccrc.dll
[2011/09/26 11:41:14 | 000,020,480 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\oleaccrc.dll

========== Files Created - No Company Name ==========

[2011/10/19 20:09:35 | 000,000,518 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\AOL Saved Files.lnk
[2011/10/19 20:09:35 | 000,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2011/10/17 09:54:00 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/10/17 09:54:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/10/17 09:54:00 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/10/17 09:54:00 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/10/17 09:54:00 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/10/15 15:32:32 | 000,002,020 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\HiJackThis.lnk
[2011/10/15 14:46:42 | 000,012,150 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\Lanvin4HMblkdress.jpg
[2011/10/15 13:29:28 | 000,022,879 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\LanvinLeopardBoots.jpg
[2011/10/13 10:17:49 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/10/13 10:17:49 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/10/09 20:33:35 | 000,001,923 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/10/09 20:32:25 | 000,000,898 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/09 20:32:24 | 000,000,894 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/08 11:22:51 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:44 | 000,000,870 | R--- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:38 | 000,000,858 | R--- | C] () -- C:\Documents and Settings\All Users\Desktop\Bloggie Software.lnk
[2011/10/01 16:49:26 | 000,000,424 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/10/01 16:42:35 | 000,001,688 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/10/01 11:19:20 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/06/19 15:18:11 | 001,253,907 | ---- | C] () -- C:\Program Files\pro-setup.exe
[2010/06/22 09:20:59 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2010/04/28 17:35:04 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/12/28 20:00:32 | 000,898,929 | ---- | C] () -- C:\WINDOWS\Israeli-Tv Uninstaller.exe.bak
[2008/12/27 11:56:37 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/04/29 19:50:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\compedia.ini
[2007/06/28 14:12:15 | 000,072,192 | ---- | C] () -- C:\WINDOWS\SSEUninstaller.exe
[2007/05/16 17:25:42 | 000,000,736 | ---- | C] () -- C:\WINDOWS\DigimaxMaster.INI
[2007/05/16 17:23:55 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/16 17:23:54 | 000,552,960 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/05/16 17:23:54 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\vidccleaner.exe
[2007/02/19 10:57:27 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
[2006/12/12 13:24:20 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\PGPsdk.dll.sig
[2006/10/08 08:55:14 | 000,002,158 | ---- | C] () -- C:\WINDOWS\System32\ssmute.ini
[2006/07/03 22:17:38 | 000,000,101 | ---- | C] () -- C:\WINDOWS\upst.ini
[2006/04/01 10:13:25 | 000,000,024 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/02/23 17:38:53 | 000,000,078 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/01/30 20:19:39 | 000,000,134 | ---- | C] () -- C:\WINDOWS\qtw.ini
[2005/11/26 13:10:56 | 000,000,095 | ---- | C] () -- C:\WINDOWS\tb96.ini
[2005/11/23 09:39:22 | 000,013,012 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft Excel.CAL
[2005/10/02 18:06:42 | 000,000,004 | ---- | C] () -- C:\WINDOWS\AErroru3.dat
[2005/10/02 18:06:41 | 000,030,600 | ---- | C] () -- C:\WINDOWS\EWhiteu12.dat
[2005/10/02 18:06:40 | 000,030,600 | ---- | C] () -- C:\WINDOWS\EDarku12.dat
[2005/10/02 18:06:38 | 000,000,006 | ---- | C] () -- C:\WINDOWS\EExpou.dat
[2005/10/02 18:06:33 | 000,000,001 | ---- | C] () -- C:\WINDOWS\EOffsetu.dat
[2005/10/02 15:03:13 | 000,184,320 | ---- | C] () -- C:\WINDOWS\Ausba3.dll
[2005/10/02 15:03:13 | 000,011,604 | ---- | C] () -- C:\WINDOWS\Dusb3ar.ini
[2005/10/02 15:03:13 | 000,002,672 | ---- | C] () -- C:\WINDOWS\Ausba3.ini
[2005/10/02 15:03:13 | 000,001,226 | ---- | C] () -- C:\WINDOWS\ScnPanel.ini
[2005/10/02 15:03:07 | 000,001,701 | ---- | C] () -- C:\WINDOWS\Ultima292.ini
[2005/10/02 13:57:06 | 000,000,100 | ---- | C] () -- C:\WINDOWS\Tb98.ini
[2005/10/02 13:57:00 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
[2005/10/02 13:57:00 | 000,004,528 | ---- | C] () -- C:\WINDOWS\System32\SETBROWS.EXE
[2005/10/02 13:56:59 | 000,046,512 | ---- | C] () -- C:\WINDOWS\System32\EPSN.DLL
[2005/10/02 13:56:59 | 000,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL
[2005/10/02 13:56:59 | 000,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL
[2005/10/02 13:56:19 | 000,158,720 | ---- | C] () -- C:\WINDOWS\System32\LFCMP62N.DLL
[2005/10/02 13:56:19 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\LFTIF62N.DLL
[2005/10/02 13:56:19 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\LTFIL62N.DLL
[2005/10/02 13:56:19 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\LFPCX62N.DLL
[2005/10/02 13:56:19 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFEPS62N.DLL
[2005/10/02 13:56:19 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFPCT62N.DLL
[2005/10/02 13:56:19 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFGIF62N.DLL
[2005/10/02 13:56:19 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFBMP62N.DLL
[2005/10/02 13:56:19 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LFPSD62N.DLL
[2005/10/02 13:56:19 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFWMF62N.DLL
[2005/10/02 13:56:19 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFTGA62N.DLL
[2005/10/02 13:56:19 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWPG62N.DLL
[2005/10/02 13:56:19 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\LFIMG62N.DLL
[2005/10/02 13:56:19 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFRAS62N.DLL
[2005/10/02 13:56:19 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFMSP62N.DLL
[2005/10/02 13:56:19 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\LFMAC62N.DLL
[2005/10/02 13:56:19 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\LFPCD62N.DLL
[2005/10/02 13:56:08 | 000,133,632 | ---- | C] () -- C:\WINDOWS\AUSBA1.DLL
[2005/10/02 13:56:08 | 000,000,986 | ---- | C] () -- C:\WINDOWS\AUSBA1.INI
[2005/10/02 13:56:08 | 000,000,194 | ---- | C] () -- C:\WINDOWS\DUSB1AR.INI
[2005/10/02 13:56:06 | 000,003,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\As6eio.sys
[2005/07/05 10:08:51 | 000,099,965 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005/07/05 10:08:42 | 000,002,872 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/06/21 15:47:57 | 000,008,192 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/06/10 19:52:41 | 000,000,111 | ---- | C] () -- C:\WINDOWS\ka.ini
[2005/05/10 11:02:54 | 000,000,037 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2005/04/16 13:09:53 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2005/04/16 10:13:09 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2005/03/15 20:05:45 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2005/03/15 20:05:45 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2005/03/15 20:05:45 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2005/03/15 20:05:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\EReg515.dat
[2005/03/15 20:05:26 | 000,000,034 | ---- | C] () -- C:\WINDOWS\Disney.ini
[2005/03/03 02:19:21 | 000,257,536 | ---- | C] () -- C:\WINDOWS\BiImg.dll
[2005/03/03 02:19:21 | 000,110,592 | ---- | C] () -- C:\WINDOWS\JPEG32.DLL
[2005/03/03 02:19:21 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\BiMResNT.dll
[2005/03/03 02:19:21 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\BiMAppNT.exe
[2005/01/31 09:49:19 | 000,290,816 | ---- | C] () -- C:\WINDOWS\System32\PBHTML.dll
[2005/01/30 15:55:51 | 000,002,150 | ---- | C] () -- C:\WINDOWS\System32\mshrml.ini
[2005/01/21 02:30:14 | 000,071,749 | ---- | C] () -- C:\WINDOWS\hcextoutput.dll
[2005/01/21 02:30:14 | 000,000,823 | ---- | C] () -- C:\WINDOWS\tsc.ini
[2005/01/21 02:29:58 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005/01/20 23:16:41 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/01/20 21:26:14 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\fusioncache.dat
[2004/11/17 12:27:52 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/11/17 12:27:52 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/11/17 12:27:49 | 000,004,490 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/11/17 12:27:45 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/11/17 12:27:39 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/11/17 12:27:16 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/11/17 12:27:15 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/11/17 12:27:09 | 000,755,200 | ---- | C] () -- C:\WINDOWS\System32\ir50_32.dll
[2004/11/17 12:27:09 | 000,338,432 | ---- | C] () -- C:\WINDOWS\System32\ir41_qcx.dll
[2004/11/17 12:27:09 | 000,200,192 | ---- | C] () -- C:\WINDOWS\System32\ir50_qc.dll
[2004/11/17 12:27:09 | 000,183,808 | ---- | C] () -- C:\WINDOWS\System32\ir50_qcx.dll
[2004/11/17 12:27:09 | 000,120,320 | ---- | C] () -- C:\WINDOWS\System32\ir41_qc.dll
[2004/11/17 12:26:47 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/11/17 12:26:18 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/10/21 11:34:09 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/10/21 07:49:55 | 000,118,784 | R--- | C] () -- C:\WINDOWS\bwUnin-6.3.2.62.exe
[2004/10/21 07:48:08 | 000,013,948 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/10/21 07:47:59 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/10/21 07:33:09 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/10/21 07:20:51 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/10/21 07:20:51 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/10/21 07:20:51 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/10/21 07:20:51 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/10/21 07:20:51 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/10/21 07:20:51 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/10/21 07:04:06 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/10/21 06:53:26 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\RTCOMDLL.dll
[2004/10/21 06:53:26 | 000,156,160 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/10/21 06:52:02 | 000,001,040 | ---- | C] () -- C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/10/21 06:48:17 | 000,017,191 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2004/10/21 06:46:49 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\sis760.bin
[2004/10/21 06:46:49 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\sis741.bin
[2004/10/21 06:46:49 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sis660.bin
[2004/10/21 06:15:39 | 000,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/10/21 06:15:39 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/10/21 06:14:17 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/10/21 06:04:42 | 000,000,802 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/10/21 06:01:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/10/21 05:56:45 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/10/21 05:42:37 | 000,000,572 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/10/21 05:42:17 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/10/21 05:42:16 | 000,384,926 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/10/21 05:42:16 | 000,054,484 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/10/20 22:50:07 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/10/20 22:49:04 | 000,361,728 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/09/14 02:35:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/20 06:14:46 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/20 06:14:46 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/11 02:04:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/01/08 01:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[1999/07/23 14:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 11:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll

========== LOP Check ==========

[2004/10/21 07:21:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Application Data\Intervideo
[2004/10/21 07:21:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.DESKTOP1\Application Data\Intervideo
[2004/10/21 08:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.DESKTOP1\Application Data\SampleView
[2004/10/21 07:21:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.DESKTOP1.000\Application Data\Intervideo
[2004/10/21 08:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.DESKTOP1.000\Application Data\SampleView
[2010/06/23 00:56:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/09/28 14:19:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.4 Output
[2009/01/17 23:57:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hiro-Media
[2004/10/21 07:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterVideo
[2011/10/15 11:06:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2009/10/01 19:07:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PictureMover
[2011/10/01 10:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/10/08 11:22:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2007/06/01 02:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Upromise__RemindU
[2011/10/15 11:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2006/04/01 10:19:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\acccore
[2011/10/15 10:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\DriverCure
[2009/09/28 14:28:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\eFax Messenger
[2010/05/22 10:42:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\GARMIN
[2007/01/20 01:05:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\GetRightToGo
[2006/10/08 08:59:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\InterMute
[2005/11/06 19:21:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Intervideo
[2009/09/28 14:20:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\j2 Global
[2005/12/02 09:01:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Juniper Networks
[2005/02/05 20:24:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Leadertech
[2008/07/25 01:26:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\MSNInstaller
[2009/03/29 22:37:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Paltalk
[2011/10/15 10:30:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic
[2007/01/19 02:35:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\PGP Corporation
[2009/06/04 20:08:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\PictureMover
[2009/06/05 06:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\SampleView
[2009/11/12 08:12:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\School Zone Preferences
[2006/05/12 16:19:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Snapfish
[2007/02/19 10:57:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Template
[2010/09/23 19:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Unity
[2008/06/21 21:54:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Upromise__RemindU
[2008/07/25 07:34:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint
[2011/03/09 19:50:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\VirtualStore
[2008/12/14 20:12:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\VSRevoGroup
[2004/10/21 07:21:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\Intervideo
[2004/10/21 08:16:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Application Data\SampleView
[2007/06/11 07:55:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Viewpoint
[2011/10/19 20:20:29 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Custom Scans ==========

< %SYSTEMDRIVE%\*.exe >
[2005/12/05 22:48:29 | 000,010,920 | ---- | M] () -- C:\aolconnfix.exe

< MD5 for: EXPLORER.EXE >
[2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ERDNT\cache\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
[2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
[2007/06/13 07:26:03 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
[2007/06/13 06:23:07 | 001,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
[2004/08/04 08:00:00 | 001,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe

< MD5 for: SVCHOST.EXE >
[2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ERDNT\cache\svchost.exe
[2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
[2008/04/13 20:12:36 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
[2004/08/04 08:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe

< MD5 for: USERINIT.EXE >
[2004/08/04 08:00:00 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
[2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ERDNT\cache\userinit.exe
[2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
[2008/04/13 20:12:38 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe

< MD5 for: WINLOGON.EXE >
[2004/08/04 08:00:00 | 000,502,272 | ---- | M] (Microsoft Corporation) MD5=01C3346C241652F43AED8E2149881BFE -- C:\WINDOWS\$NtServicePackUninstall$\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ERDNT\cache\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\ServicePackFiles\i386\winlogon.exe
[2008/04/13 20:12:39 | 000,507,904 | ---- | M] (Microsoft Corporation) MD5=ED0EF0A136DEC83DF69F04118870003E -- C:\WINDOWS\system32\winlogon.exe

< %systemroot%\*. /mp /s >

< hklm\software\clients\startmenuinternet|command /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/09/29 02:53:40 | 000,713,016 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/09/29 02:53:40 | 000,713,016 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/09/29 02:53:40 | 000,713,016 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/08/22 07:56:56 | 000,174,080 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/08/22 07:56:56 | 000,174,080 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/08/22 07:56:56 | 000,174,080 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< hklm\software\clients\startmenuinternet|command /64 /rs >
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\HideIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /HideShortcuts [2011/09/29 02:53:40 | 000,713,016 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ShowIconsCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /ShowShortcuts [2011/09/29 02:53:40 | 000,713,016 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\InstallInfo\\ReinstallCommand: "C:\Program Files\Mozilla Firefox\uninstall\helper.exe" /SetAsDefaultAppGlobal [2011/09/29 02:53:40 | 000,713,016 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\open\command\\: C:\Program Files\Mozilla Firefox\firefox.exe [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\properties\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -preferences [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\FIREFOX.EXE\shell\safemode\command\\: "C:\Program Files\Mozilla Firefox\firefox.exe" -safe-mode [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ReinstallCommand: "C:\WINDOWS\system32\ie4uinit.exe" -reinstall [2011/08/22 07:56:56 | 000,174,080 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\HideIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -hide [2011/08/22 07:56:56 | 000,174,080 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\InstallInfo\\ShowIconsCommand: "C:\WINDOWS\system32\ie4uinit.exe" -show [2011/08/22 07:56:56 | 000,174,080 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\naom\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" -extoff [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)
HKEY_LOCAL_MACHINE\software\clients\startmenuinternet\IEXPLORE.EXE\shell\open\command\\: "C:\Program Files\Internet Explorer\iexplore.exe" [2009/03/08 14:09:26 | 000,638,816 | ---- | M] (Microsoft Corporation)

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-10-13 07:33:17

========== Files - Unicode (All) ==========
[2007/02/11 11:56:34 | 000,329,628 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??????? - ????? -????.mht) -- C:\Documents and Settings\Compaq_Owner\My Documents\היורשים - חדשות -הארץ.mht
[2007/02/11 11:56:25 | 000,329,628 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??????? - ????? -????.mht) -- C:\Documents and Settings\Compaq_Owner\My Documents\היורשים - חדשות -הארץ.mht
[2006/11/18 17:46:52 | 000,039,936 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ???? ??? ???? ???.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\על כגון אלה היתה אמי.doc
[2006/11/18 17:46:52 | 000,039,936 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ???? ??? ???? ???.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\על כגון אלה היתה אמי.doc
[2006/09/15 07:46:31 | 000,020,992 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?????? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\קובקוב אהלן.doc
[2006/09/15 07:46:31 | 000,020,992 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?????? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\קובקוב אהלן.doc
[2006/08/05 23:02:58 | 000,026,112 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??? ????? ?? ????????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הכי מפריע זה הדיסוננס.doc
[2006/08/05 23:02:58 | 000,026,112 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??? ????? ?? ????????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הכי מפריע זה הדיסוננס.doc
[2006/08/04 07:39:33 | 000,027,136 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ?? ??? ???? ?? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\גם מי שלא תומך של ביבי.doc
[2006/08/04 07:39:32 | 000,027,136 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ?? ??? ???? ?? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\גם מי שלא תומך של ביבי.doc
[2006/06/21 08:31:10 | 000,000,000 | ---D | M](C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????_files) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן_files
[2006/06/18 08:00:56 | 000,030,098 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????.htm) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן.htm
[2006/06/18 08:00:55 | 000,030,098 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????.htm) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן.htm
[2006/06/18 08:00:55 | 000,000,000 | ---D | C](C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????_files) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן_files
[2006/03/27 12:29:49 | 000,024,064 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הורים פולנים.doc
[2006/03/27 12:29:49 | 000,024,064 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הורים פולנים.doc
[2006/02/14 09:00:01 | 000,044,032 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ????? ? ? ? ? ?.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אפרים קישון ה ג ד ו ל.doc
[2006/02/14 09:00:01 | 000,044,032 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ????? ? ? ? ? ?.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אפרים קישון ה ג ד ו ל.doc
[2005/09/25 19:34:57 | 000,024,064 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ??????? ?? ??????? ??? ??? ????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אל תתייראי מן הפרושים ולא ממי שאינם פרושים.doc
[2005/09/25 19:34:56 | 000,024,064 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ??????? ?? ??????? ??? ??? ????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אל תתייראי מן הפרושים ולא ממי שאינם פרושים.doc
< End of report >

Extras.Txt:

OTL Extras logfile created on: 10/19/2011 8:33:31 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Compaq_Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.14 Gb Available Physical Memory | 56.78% Memory free
3.80 Gb Paging File | 3.10 Gb Available in Paging File | 81.55% Paging File free
Paging file location(s): C:\pagefile.sys 2000 4000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.24 Gb Total Space | 90.09 Gb Free Space | 63.34% Space Free | Partition Type: NTFS
Drive D: | 6.79 Gb Total Space | 2.12 Gb Free Space | 31.29% Space Free | Partition Type: FAT32

Computer Name: DESKTOP1 | User Name: Compaq_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP" = 3389:TCP:*:Enabledxpsp2res.dll,-22009
"1900:UDP" = 1900:UDP:LocalSubNetisabledxpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNetisabledxpsp2res.dll,-22008

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%ProgramFiles%\iTunes\iTunes.exe" = %ProgramFiles%\iTunes\iTunes.exe:*:enabled:iTunes
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- (America Online, Inc.)
"C:\Program Files\MSN Messenger\msnmsgr.exe" = C:\Program Files\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1
"C:\Program Files\MSN Messenger\livecall.exe" = C:\Program Files\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- (America Online)
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- (AOL LLC)
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:America Online 9.0 -- (America Online, Inc.)
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Enabled:RealPlayer -- (RealNetworks, Inc.)
"C:\Program Files\Common Files\AOL\Loader\aolload.exe" = C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader -- (AOL Inc.)
"C:\Program Files\Common Files\AOL\1127693794\ee\aolsoftware.exe" = C:\Program Files\Common Files\AOL\1127693794\ee\aolsoftware.exe:*:Enabled:AOL Services -- (AOL Inc.)
"C:\Program Files\Common Files\AOL\1127693794\ee\aim6.exe" = C:\Program Files\Common Files\AOL\1127693794\ee\aim6.exe:*:Enabled:AIM -- (America Online, Inc.)
"C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe" = C:\Program Files\Common Files\AOL\TopSpeed\3.0\aoltpsd3.exe:*:Enabled:AOL TopSpeed
"C:\Program Files\America Online 9.0a\waol.exe" = C:\Program Files\America Online 9.0a\waol.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe" = C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe:*:Enabled:AOLTsMon -- (America Online, Inc)
"C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe" = C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe:*:Enabled:AOLTopSpeed -- (America Online Inc)
"C:\Program Files\Common Files\AOL\1127693794\ee\AOLServiceHost.exe" = C:\Program Files\Common Files\AOL\1127693794\ee\AOLServiceHost.exe:*:Enabled:AOL -- (America Online, Inc.)
"C:\Program Files\Common Files\AOL\System Information\sinf.exe" = C:\Program Files\Common Files\AOL\System Information\sinf.exe:*:Enabled:AOL -- (AOL Inc.)
"C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe" = C:\Program Files\Common Files\AolCoach\en_en\player\AOLNySEV.exe:*:Enabled:AOL
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" = C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger -- (Yahoo! Inc.)
"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL
"C:\Program Files\AOL 9.0a\waol.exe" = C:\Program Files\AOL 9.0a\waol.exe:*:Enabled:AOL9~1.0A
"C:\Program Files\AOL 9.1\waol.exe" = C:\Program Files\AOL 9.1\waol.exe:*:Enabled:AOL -- (AOL, LLC.)
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Program Files\AOL Desktop 9.6\waol.exe" = C:\Program Files\AOL Desktop 9.6\waol.exe:*:Enabled:AOL Desktop 9.6 -- (AOL Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0303CD4A-D909-4F03-9799-E25D84D7EC9F}" = ARTEC
"{05BFB060-4F22-4710-B0A2-2801A1B606C5}" = Microsoft Antimalware
"{09DA4F91-2A09-4232-AB8C-6BC740096DE3}" = Sonic Update Manager
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{1B4AA674-F5CA-4BB5-831A-CD37B4021959}" = ImageMixer for Sony
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216015FF}" = Java(TM) 6 Update 15
"{287ECFA4-719A-2143-A09B-D6A12DE54E40}" = Acrobat.com
"{2FCE4FC5-6930-40E7-A4F1-F862207424EF}" = InterVideo WinDVD Creator
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3BD0196C-6553-460c-A0C4-90D8AE5D60D2}" = Norton Personal Firewall
"{40C1F0EE-FDF7-4974-9761-169D7BA738DE}_is1" = Free Windows Registry Cleaner 2.0
"{416D80BA-6F6D-4672-B7CF-F54DA2F80B44}" = Microsoft Works
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}" = Adobe® Photoshop® Album Starter Edition 3.0
"{54B6DC7D-8C5B-4DFB-BC15-C010A3326B2B}" = Microsoft Security Client
"{55937F00-A69B-4049-8D3A-1C7729742B6F}" = BUM
"{564A8DD3-70BC-4018-A5C3-7CEB10BBB6E9}" = Image Transfer
"{5C29CB8B-AC1E-4114-8D68-9CD080140D4A}" = Sony USB Driver
"{65F9E1F3-A2C1-4AA9-9F33-A3AEB0255F0E}" = Garmin USB Drivers
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{797EE0CA-8165-405C-B5CE-F11EC20F1BB0}" = Microsoft VC9 runtime libraries
"{7EF0FAC3-C07D-4859-B5CA-CC31BF963C5C}" = Bloggie Software
"{86D6A20D-3910-4441-A3E5-EB6977251C86}" = Samsung USB Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{9011040D-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{901E0409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 English User Interface Pack
"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD Player
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9541FED0-327F-4DF0-8B96-EF57EF622F19}" = Sonic RecordNow!
"{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime
"{98BAC573-DBE2-49de-9A23-597CFD95E474}" = PictureMover
"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A5CC2A09-E9D3-49EC-923D-03874BBD4C2C}" = Windows Defender Signatures
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9D79832-82B4-4FA1-90E6-8B4AEDA1B736}" = WebTV
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.1)
"{AEC0CEBC-0FC7-4716-8222-1C4A742719B1}" = Digimax Master
"{B7F98125-4955-41E3-8A71-4CE11CE9C198}" = KODAK Gallery Upload Software
"{BAD8CA9C-77C0-4663-B00B-A8D3B13C341B}" = Motorola Phone Tools
"{C2F82FFB-3230-41DB-959F-F38B29ABE69D}" = IPTV
"{C3F058C0-A21C-452D-8D99-95B1A45F417D}" = InterVideo DiscLabel
"{C7DD94A8-F775-426C-B56C-8E555A59F9E2}" = Garmin Communicator Plugin
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CFCD2A80-EC16-11E0-A273-B8AC6F97B88E}" = Google Earth
"{D0122362-6333-4DE4-93F6-A5A2F3CC101A}" = Compaq Organize
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype 4.2
"{D17111CB-C992-42A9-9D56-C19395102AAA}" = Garmin WebUpdater
"{DB518BA6-CB74-4EB6-9ABD-880B6D6E1F38}" = HpSdpAppCoreApp
"{DF6DA606-904D-4C18-823F-A4CFC3035E53}" = eFax Messenger
"{F87A8E11-02A4-4875-A3A5-5961081B0E4E}" = OpenOffice.org 2.4
"1236USB" = 1236USB
"49CF605F02C7954F4E139D18828DE298CD59217C" = Windows Driver Package - Garmin (grmnusb) GARMIN Devices (06/03/2009 2.3.0.0)
"áåøñä-âøó" = áåøñä-âøó
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Agere Systems Soft Modem" = Agere Systems PCI Soft Modem
"BackWeb-6750491 Uninstaller" = Compaq Connections
"BloggieSoftware" = Bloggie Software
"conduitEngine" = Conduit Engine 
"ESET Online Scanner" = ESET Online Scanner v3
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"LiveReg" = LiveReg (Symantec Corporation)
"MGI_PHOTOSUITE_SE_V10" = MGI PhotoSuite SE (Remove Only)
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft Security Client" = Microsoft Security Essentials
"Mozilla Firefox 7.0.1 (x86 en-US)" = Mozilla Firefox 7.0.1 (x86 en-US)
"MyConnection PC Lite Edition" = MyConnection PC Lite Edition
"MySpeed PC Lite Edition" = MySpeed PC Lite Edition
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"Picasa2" = Picasa 2
"PS2" = PS2
"Python 2.2 combined Win32 extensions" = Python 2.2 combined Win32 extensions
"Radio_G Toolbar" = Radio_G Toolbar
"Radio_Israel Toolbar" = Radio_Israel Toolbar
"RealPlayer 6.0" = RealPlayer
"Revo Uninstaller" = Revo Uninstaller 1.75
"Shutterfly Plugin" = Shutterfly Plugin
"StreetPlugin" = Learn2 Player (Uninstall Only)
"TextBridge Classic 2.0" = TextBridge Classic 2.0
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows Media Player" = Windows Media Player 10
"Windows XP Service Pack" = Windows XP Service Pack 3
"Winmail Reader_is1" = Winmail Reader 1.1.12
"WinZip" = WinZip
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Customizations" = Yahoo! extras
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! IE Suggest" = Yahoo! IE Search Suggest
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Toolbar" = Yahoo! Toolbar

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{9863F141-7A33-4c9a-A5F2-96996461B216}" = KODAK EASYSHARE Gallery Easy Upload, v2.1
"UnityWebPlayer" = Unity Web Player

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 10/8/2011 2:40:17 AM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0,
P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.

Error - 10/8/2011 7:06:09 AM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 8024402c, P2 endsearch, P3 search, P4 3.0.8402.0,
P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials (edb4fa23-53b8-4afa-8c5d-99752cca7094),
P8 NIL, P9 NIL, P10 NIL.

Error - 10/10/2011 8:19:11 PM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 
download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials
(edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL.

Error - 10/12/2011 2:06:49 AM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 
download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials
(edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL.

Error - 10/12/2011 8:23:07 PM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 
download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials
(edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL.

Error - 10/12/2011 8:27:52 PM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 
download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials
(edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL.

Error - 10/14/2011 2:16:07 AM | Computer Name = DESKTOP1 | Source = MPSampleSubmission | ID = 5000
Description = EventType mptelemetry, P1 80240022, P2 processdownloadresults, P3 
download, P4 3.0.8402.0, P5 mpsigdwn.dll, P6 3.0.8402.0, P7 microsoft security essentials
(edb4fa23-53b8-4afa-8c5d-99752cca7094), P8 NIL, P9 NIL, P10 NIL.

Error - 10/15/2011 12:41:47 PM | Computer Name = DESKTOP1 | Source = Application Error | ID = 1000
Description = Faulting application componentlauncher.exe, version 3.0.0.49815, faulting
module , version 5.1.2600.6055, fault address 0x00010f1e.

Error - 10/17/2011 7:21:30 AM | Computer Name = DESKTOP1 | Source = Application Hang | ID = 1002
Description = Hanging application firefox.exe, version 7.0.1.4288, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 10/17/2011 9:31:49 PM | Computer Name = DESKTOP1 | Source = Application Error | ID = 1000
Description = Faulting application ps2.exe, version 1.0.2.2, faulting module ps2.exe,
version 1.0.2.2, fault address 0x00003343.

[ System Events ]
Error - 10/17/2011 4:53:20 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 10/17/2011 7:10:24 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 10/17/2011 7:15:17 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 10/17/2011 7:25:17 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the stisvc service.

Error - 10/17/2011 11:49:02 PM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7011
Description = Timeout (30000 milliseconds) waiting for a transaction response from
the JavaQuickStarterService service.

Error - 10/18/2011 7:35:05 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7031
Description = The Microsoft Antimalware Service service terminated unexpectedly.
It has done this 1 time(s). The following corrective action will be taken in 
15000 milliseconds: Restart the service.

Error - 10/18/2011 7:35:05 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7034
Description = The Java Quick Starter service terminated unexpectedly. It has done
this 1 time(s).

Error - 10/18/2011 7:35:05 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7034
Description = The Machine Debug Manager service terminated unexpectedly. It has
done this 1 time(s).

Error - 10/18/2011 7:35:05 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7034
Description = The NVIDIA Display Driver Service service terminated unexpectedly.
It has done this 1 time(s).

Error - 10/18/2011 7:35:05 AM | Computer Name = DESKTOP1 | Source = Service Control Manager | ID = 7034
Description = The WAN Miniport (ATW) Service service terminated unexpectedly. It
has done this 1 time(s).

< End of report >


----------



## kevinf80 (Mar 21, 2006)

OK run the following:

Re-Run







by double left click, Vista and Widows 7 users right click and select Run as Administrator.

Under the







box at the bottom, paste in the following


```
:OTL
FF - HKLM\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1: C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll File not found
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (no name) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - No CLSID value found.
O2 - BHO: (Radio G Toolbar) - {889eb3f6-f16b-4bc0-bc81-9c407c8a3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll (Conduit Ltd.)
O2 - BHO: (Radio G Toolbar) - {f228c6a4-a593-4017-944c-4e7958fb3177} - C:\Program Files\Radio_G\prxtbRad2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Radio G Toolbar) - {889eb3f6-f16b-4bc0-bc81-9c407c8a3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Radio G Toolbar) - {f228c6a4-a593-4017-944c-4e7958fb3177} - C:\Program Files\Radio_G\prxtbRad2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found.
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (no name) - {06E58E5E-F8CB-4049-991E-A41C03BD419E} - No CLSID value found.
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Radio G Toolbar) - {889EB3F6-F16B-4BC0-BC81-9C407C8A3240} - C:\Program Files\Radio_Israel\prxtbRad2.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..\Toolbar\WebBrowser: (Radio G Toolbar) - {F228C6A4-A593-4017-944C-4E7958FB3177} - C:\Program Files\Radio_G\prxtbRad2.dll (Conduit Ltd.)
O4 - HKLM..\RunOnce: [AOLDeskbarDirRemoval] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - HKLM..\RunOnce: [AOLToolbarDirRemoval] C:\WINDOWS\System32\cmd.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk = File not found
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O15 - HKU\S-1-5-21-581693593-1015511138-3403617319-1009\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} http://download.mcafee.com/molbin/sh...4/mcinsctl.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} http://download.mcafee.com/molbin/sh...21/mcgdmgr.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/products/plugin/...ndows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0_15)
O16 - DPF: RGFCPlugin http://www.robotgalaxy.com/images/plugin/RGFCPlugin.CAB (Reg Error: Key error.)
O20 - Winlogon\Notify\avgrsstarter: DllName - (avgrsstx.dll) - File not found
[2011/10/15 10:30:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\DriverCure
[2011/10/15 10:30:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic
[2011/10/15 10:29:19 | 000,000,000 | ---D | C] -- C:\Program Files\ParetoLogic
[2011/10/15 10:29:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/10/01 10:07:59 | 000,000,000 | ---D | C] -- C:\Program Files\AOL 9.1
[2011/10/01 10:07:50 | 000,000,000 | ---D | C] -- C:\Program Files\AOL Desktop 9.6
[2011/10/01 10:07:41 | 000,000,000 | ---D | C] -- C:\Program Files\America Online 9.0a
[2011/10/01 10:07:25 | 000,000,000 | ---D | C] -- C:\Program Files\America Online 9.0
[2011/10/15 11:06:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\ParetoLogic
[2011/10/15 11:13:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011/10/15 10:30:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\DriverCure
[2011/10/15 10:30:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic
[2008/07/25 07:34:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint
:Services
tmcomm
wanatw
:Reg
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command]
""=""%1" %*"
:Files
ipconfig /flushdns /c
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Common Files\AOL
C:\WINDOWS\system32\drivers\tmcomm.sys
C:\WINDOWS\system32\drivers\wanatw4.sys
C:\aolconnfix.exe
:Commands
[purity]
[resethosts]
[emptytemp]
[EMPTYFLASH]
[CREATERESTOREPOINT]
[Reboot]
```

Then click







button at the top
Let the program run unhindered, reboot the PC when it is done
Post the log it produces in your next reply.

Next,

Rerun OTL again, this time make no changes whatsoever, just hit the Quick Scan button, let it run unhindered. Post the new log.

Let me see the logs from OTL fix and OTL quick scan, also give update....

Kevin


----------



## Cobster (Oct 15, 2011)

Kevi,
Thanks again for your help, will send an update on status once I have used the machine for an hour or two.
Shall I re-enable the MS Security Essentials?

Here is the OTL fix log:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\[email protected]/YahooActiveXPluginBridge;version=1.0.0.1\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ deleted successfully.
C:\Program Files\ConduitEngine\prxConduitEngine.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{889eb3f6-f16b-4bc0-bc81-9c407c8a3240}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{889eb3f6-f16b-4bc0-bc81-9c407c8a3240}\ deleted successfully.
C:\Program Files\Radio_Israel\prxtbRad2.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{f228c6a4-a593-4017-944c-4e7958fb3177}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f228c6a4-a593-4017-944c-4e7958fb3177}\ deleted successfully.
C:\Program Files\Radio_G\prxtbRad2.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{889eb3f6-f16b-4bc0-bc81-9c407c8a3240} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{889eb3f6-f16b-4bc0-bc81-9c407c8a3240}\ not found.
File C:\Program Files\Radio_Israel\prxtbRad2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{f228c6a4-a593-4017-944c-4e7958fb3177} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f228c6a4-a593-4017-944c-4e7958fb3177}\ not found.
File C:\Program Files\Radio_G\prxtbRad2.dll not found.
Registry value HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}\ not found.
Registry value HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{06E58E5E-F8CB-4049-991E-A41C03BD419E} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{06E58E5E-F8CB-4049-991E-A41C03BD419E}\ not found.
Registry value HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
File C:\Program Files\ConduitEngine\prxConduitEngine.dll not found.
Registry value HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{889EB3F6-F16B-4BC0-BC81-9C407C8A3240} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{889EB3F6-F16B-4BC0-BC81-9C407C8A3240}\ not found.
File C:\Program Files\Radio_Israel\prxtbRad2.dll not found.
Registry value HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{F228C6A4-A593-4017-944C-4E7958FB3177} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F228C6A4-A593-4017-944C-4E7958FB3177}\ not found.
File C:\Program Files\Radio_G\prxtbRad2.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\AOLDeskbarDirRemoval deleted successfully.
C:\WINDOWS\system32\cmd.exe moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce\\AOLToolbarDirRemoval deleted successfully.
File C:\WINDOWS\System32\cmd.exe not found.
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Compaq Connections.lnk moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel\ not found.
Registry key HKEY_USERS\S-1-5-21-581693593-1015511138-3403617319-1009\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
Starting removal of ActiveX control {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}
C:\WINDOWS\Downloaded Program Files\mcinsctl.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
C:\WINDOWS\Downloaded Program Files\erma.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}\ not found.
Starting removal of ActiveX control {BCC0FF27-31D9-4614-A68E-C18E1ADA4389}
C:\WINDOWS\Downloaded Program Files\McGDMgr.inf moved successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BCC0FF27-31D9-4614-A68E-C18E1ADA4389}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control RGFCPlugin
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\RGFCPlugin\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\RGFCPlugin\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\RGFCPlugin\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\avgrsstarter\ deleted successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\DriverCure folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic\PC Health Advisor folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic folder moved successfully.
C:\Program Files\ParetoLogic\PCHA folder moved successfully.
C:\Program Files\ParetoLogic folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic\PC Health Advisor folder moved successfully.
C:\Documents and Settings\All Users\Application Data\ParetoLogic folder moved successfully.
C:\Program Files\AOL 9.1\tool folder moved successfully.
C:\Program Files\AOL 9.1\sounds\us folder moved successfully.
C:\Program Files\AOL 9.1\sounds folder moved successfully.
C:\Program Files\AOL 9.1\media\nmpxchat\plugins folder moved successfully.
C:\Program Files\AOL 9.1\media\nmpxchat folder moved successfully.
C:\Program Files\AOL 9.1\media\nmpx\plugins folder moved successfully.
C:\Program Files\AOL 9.1\media\nmpx folder moved successfully.
C:\Program Files\AOL 9.1\media folder moved successfully.
C:\Program Files\AOL 9.1\Jiti folder moved successfully.
C:\Program Files\AOL 9.1\download folder moved successfully.
C:\Program Files\AOL 9.1\components folder moved successfully.
C:\Program Files\AOL 9.1\backup\restore folder moved successfully.
C:\Program Files\AOL 9.1\backup folder moved successfully.
C:\Program Files\AOL 9.1 folder moved successfully.
C:\Program Files\AOL Desktop 9.6\tool folder moved successfully.
C:\Program Files\AOL Desktop 9.6\sounds\us folder moved successfully.
C:\Program Files\AOL Desktop 9.6\sounds folder moved successfully.
C:\Program Files\AOL Desktop 9.6\media\nmpxchat\plugins folder moved successfully.
C:\Program Files\AOL Desktop 9.6\media\nmpxchat folder moved successfully.
C:\Program Files\AOL Desktop 9.6\media\nmpx\plugins folder moved successfully.
C:\Program Files\AOL Desktop 9.6\media\nmpx folder moved successfully.
C:\Program Files\AOL Desktop 9.6\media folder moved successfully.
C:\Program Files\AOL Desktop 9.6\Jiti folder moved successfully.
C:\Program Files\AOL Desktop 9.6\download folder moved successfully.
C:\Program Files\AOL Desktop 9.6\components folder moved successfully.
C:\Program Files\AOL Desktop 9.6\backup\restore folder moved successfully.
C:\Program Files\AOL Desktop 9.6\backup folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme\toolkit\images\TabScroll folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme\toolkit\images\InputFields folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme\toolkit\images folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme\toolkit folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme\sounds folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme\images folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\theme folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\resources\en-US\toolkit folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\resources\en-US folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\resources folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\toolkit\windowingPack folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\toolkit\tabPack folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\toolkit\menuPack folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\toolkit\core folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\toolkit folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\standalone folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content\embedded folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser\content folder moved successfully.
C:\Program Files\AOL Desktop 9.6\AOLBrowser folder moved successfully.
C:\Program Files\AOL Desktop 9.6 folder moved successfully.
C:\Program Files\America Online 9.0a\tool folder moved successfully.
C:\Program Files\America Online 9.0a\sounds\us folder moved successfully.
C:\Program Files\America Online 9.0a\sounds folder moved successfully.
C:\Program Files\America Online 9.0a\MyCalendar\help folder moved successfully.
C:\Program Files\America Online 9.0a\MyCalendar folder moved successfully.
C:\Program Files\America Online 9.0a\media\nmpxchat\plugins folder moved successfully.
C:\Program Files\America Online 9.0a\media\nmpxchat folder moved successfully.
C:\Program Files\America Online 9.0a\media\nmpx\plugins folder moved successfully.
C:\Program Files\America Online 9.0a\media\nmpx folder moved successfully.
C:\Program Files\America Online 9.0a\media folder moved successfully.
C:\Program Files\America Online 9.0a\Jiti folder moved successfully.
C:\Program Files\America Online 9.0a\download folder moved successfully.
C:\Program Files\America Online 9.0a\cool folder moved successfully.
C:\Program Files\America Online 9.0a\components folder moved successfully.
C:\Program Files\America Online 9.0a\backup\restore folder moved successfully.
C:\Program Files\America Online 9.0a\backup folder moved successfully.
C:\Program Files\America Online 9.0a folder moved successfully.
C:\Program Files\America Online 9.0\vim\resources\videoprogress folder moved successfully.
C:\Program Files\America Online 9.0\vim\resources\images folder moved successfully.
C:\Program Files\America Online 9.0\vim\resources\audioprogress folder moved successfully.
C:\Program Files\America Online 9.0\vim\resources folder moved successfully.
C:\Program Files\America Online 9.0\vim\funclips\aol folder moved successfully.
C:\Program Files\America Online 9.0\vim\funclips folder moved successfully.
C:\Program Files\America Online 9.0\vim folder moved successfully.
C:\Program Files\America Online 9.0\tool folder moved successfully.
C:\Program Files\America Online 9.0\spool folder moved successfully.
C:\Program Files\America Online 9.0\sounds folder moved successfully.
C:\Program Files\America Online 9.0\MyCalendar\help folder moved successfully.
C:\Program Files\America Online 9.0\MyCalendar folder moved successfully.
C:\Program Files\America Online 9.0\modems folder moved successfully.
C:\Program Files\America Online 9.0\media\nmpxchat\plugins folder moved successfully.
C:\Program Files\America Online 9.0\media\nmpxchat folder moved successfully.
C:\Program Files\America Online 9.0\media\nmpx\plugins folder moved successfully.
C:\Program Files\America Online 9.0\media\nmpx folder moved successfully.
C:\Program Files\America Online 9.0\media folder moved successfully.
C:\Program Files\America Online 9.0\Jiti folder moved successfully.
C:\Program Files\America Online 9.0\download folder moved successfully.
C:\Program Files\America Online 9.0\csl folder moved successfully.
C:\Program Files\America Online 9.0\cool folder moved successfully.
C:\Program Files\America Online 9.0\components folder moved successfully.
C:\Program Files\America Online 9.0\backup\restore folder moved successfully.
C:\Program Files\America Online 9.0\backup folder moved successfully.
C:\Program Files\America Online 9.0 folder moved successfully.
Folder C:\Documents and Settings\All Users\Application Data\ParetoLogic\ not found.
C:\Documents and Settings\All Users\Application Data\Viewpoint\AxMetaStream_Win folder moved successfully.
C:\Documents and Settings\All Users\Application Data\Viewpoint folder moved successfully.
Folder C:\Documents and Settings\Compaq_Owner\Application Data\DriverCure\ not found.
Folder C:\Documents and Settings\Compaq_Owner\Application Data\ParetoLogic\ not found.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_03 folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_02 folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_01 folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint\Viewpoint Experience Technology\Resources\ResourceFolder_00 folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint\Viewpoint Experience Technology\Resources folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint\Viewpoint Experience Technology folder moved successfully.
C:\Documents and Settings\Compaq_Owner\Application Data\Viewpoint folder moved successfully.
========== SERVICES/DRIVERS ==========
Service tmcomm stopped successfully!
Service tmcomm deleted successfully!
Error: Unable to stop service wanatw!
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wanatw deleted successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\\""|""%1" %*" /E : value set successfully!
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Documents and Settings\Compaq_Owner\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\Compaq_Owner\Desktop\cmd.txt deleted successfully.
C:\WINDOWS\wanmpsvc.exe moved successfully.
C:\Program Files\Common Files\AOL\TopSpeed\2.0 folder moved successfully.
C:\Program Files\Common Files\AOL\TopSpeed folder moved successfully.
C:\Program Files\Common Files\AOL\System Information folder moved successfully.
C:\Program Files\Common Files\AOL\Screensaver folder moved successfully.
C:\Program Files\Common Files\AOL\Proofreader folder moved successfully.
C:\Program Files\Common Files\AOL\Loader folder moved successfully.
C:\Program Files\Common Files\AOL\Launch folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\System Information folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Rollback\US folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Rollback\Suite\comps folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Rollback\Suite folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Rollback\EU folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Rollback folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current(2)\Suite folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current(2) folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current\US folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current\Suite\comps folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current\Suite folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current\EU folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS\Current folder moved successfully.
C:\Program Files\Common Files\AOL\Backup\ACS folder moved successfully.
C:\Program Files\Common Files\AOL\Backup folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\pt folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\ja folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\fr-CA folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\fr folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\es-US folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\es folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\en-GB folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\en-CA folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\en folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale\de folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag\locale folder moved successfully.
C:\Program Files\Common Files\AOL\AOLDiag folder moved successfully.
C:\Program Files\Common Files\AOL\AOL Spyware Protection\Update folder moved successfully.
C:\Program Files\Common Files\AOL\AOL Spyware Protection folder moved successfully.
C:\Program Files\Common Files\AOL\ACS\vista folder moved successfully.
C:\Program Files\Common Files\AOL\ACS\US folder moved successfully.
C:\Program Files\Common Files\AOL\ACS\EU folder moved successfully.
C:\Program Files\Common Files\AOL\ACS folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\urldispatcher\ver5_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\urldispatcher folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\urlData\ver1_6_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\urlData folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\topspeed\ver4_0_3_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\topspeed\ver4_0_3_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\topspeed\ver4_0_3_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\topspeed folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver5_1_8_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver5_1_8_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver5_1_8_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver5_1_8_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver5_1_8_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver4_2_8_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver4_2_8_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver4_2_8_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver4_2_8_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver4_2_8_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Window pane folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Main window folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\List view window folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\History content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Fwd_Back button folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\drop-down button folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Content window folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Column folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Button folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Browser controls_small folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\Browser controls folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui\3 pieces button folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US\ui folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster\ver2_29_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\toaster folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\SYSTRAY\ver1_1_10_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\SYSTRAY folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui\locale\script folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui\locale\images folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui\locale\html folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui\locale folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui\core\script folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui\core folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US\ui folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo\ver2_6_3_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sysinfo folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sync\ver3_2_1_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sync\ver3_2_1_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sync\ver3_2_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\sync folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework\ver5_1_4_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework\ver5_1_4_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework\ver5_1_4_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework\ver3_1_3_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework\ver3_1_3_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework\ver3_1_3_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\suiteframework folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate\ver3_3_8_1\theme\images folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate\ver3_3_8_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate\ver3_3_8_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate\ver3_3_8_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate\ver3_3_8_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate\ver3_3_8_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\softwareUpdate folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\security\ver4_0_7_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\security folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\script\ver2_3_4_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\script folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\SafetyShell folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\preferences\ver6_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\preferences folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\theme\images folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\content\wizard folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\content\util folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\content\import folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\content\gadget folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp\ver0_4_2 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxoApp folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxo\ver2_5_10_6 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\plaxo folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\osInfo\ver2_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\osInfo folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\os\ver5_2_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\os folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\onlineAlerts\ver1_0_2_0\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\onlineAlerts\ver1_0_2_0\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\onlineAlerts\ver1_0_2_0 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\onlineAlerts folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\notification\ver7_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\notification folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\miniXML\ver2_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\miniXML folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\metrics\ver4_1_11_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\metrics folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\localStorage\ver8_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\localStorage\ver4_5_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\localStorage\ver3_0_0_0 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\localStorage folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\iphSend\ver3_0_8_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\iphSend folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\im\ver_0_9_3_714 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\im folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityinformation\ver4_5_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityinformation folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1\content\helix folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1\content\aam folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver2_19_4_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver1_2_17_2\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver1_2_17_2\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver1_2_17_2\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver1_2_17_2\content\aam folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver1_2_17_2\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget\ver1_2_17_2 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\identityAuthGadget folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\http\ver3_1_9_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\http folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\htmlRenderer\ver2_0_6_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\htmlRenderer folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\feeds\ver2_0_2_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\feeds folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\favoritesexporter\ver2_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\favoritesexporter folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\enhancedfavorites\ver1_3_3_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\enhancedfavorites folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\dialerTray\ver4_9_13_3\resources\es-us folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\dialerTray\ver4_9_13_3\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\dialerTray\ver4_9_13_3\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\dialerTray\ver4_9_13_3 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\dialerTray folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver2_2_3_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver2_2_3_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver2_2_3_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver2_2_3_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver2_2_3_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver1_5_0_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp\ver1_5_0_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\defaultauthenticationhandlerapp folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\Connectivity\ver4_9_13_3 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\Connectivity\ver4_8_8_4 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\Connectivity\ver4_7_14_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\Connectivity\ver4_6_61_3 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\Connectivity\ver4_1_35_3 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\Connectivity folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\connection\ver7_1_2_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\connection\ver7_1_2_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\connection\ver7_1_2_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\connection folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\compression\ver4_1_1_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\compression folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme\images\TabScroll folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme\images\SuperTwisty folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme\images\InputFields folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme\images\FontToolbar folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme\images\DarkTwisty folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme\images folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\resources\he-IL folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\resources\de-DE folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\windowingPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\tabPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\menuPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\listPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\inputPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\extrasPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\editorPack folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\dialog folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\core folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content\aolHelpBox folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit\ver3_13_7_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyToolkit folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver3_13_7_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver3_13_7_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver3_13_7_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver1_5_19_2\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver1_5_19_2\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver1_5_19_2 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver1_4_29_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer\ver1_4_11_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\boxelyrenderer folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts\ver3_1_11_1\theme\images folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts\ver3_1_11_1\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts\ver3_1_11_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts\ver3_1_11_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts\ver3_1_11_1\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts\ver3_1_11_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\bfts folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\basics\ver8_0_4_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\basics folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\authorization\ver3_2_4_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\authorization folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\authentication\ver7_1_6_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\authentication\ver7_1_6_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\authentication\ver7_1_6_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\authentication folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\applicationdetect\ver2_1_9_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\applicationdetect folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice\ver4_1_2_1\resources\en-US\ssc folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice\ver4_1_2_1\resources\en-US\aol folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice\ver4_1_2_1\resources\en-US\aim folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice\ver4_1_2_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice\ver4_1_2_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice\ver4_1_2_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\aolsystrayservice folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\antispyware\ver2_4_9_1\resources\en-US\dat folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\antispyware\ver2_4_9_1\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\antispyware\ver2_4_9_1\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\antispyware\ver2_4_9_1 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\antispyware folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookPrint\ver1_3_0_3\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookPrint\ver1_3_0_3\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookPrint\ver1_3_0_3 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookPrint folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\theme\images folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\theme folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\content\gadgets folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\content\dialogs folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2\content folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp\ver0_3_2 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBookApp folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBook\ver1_7_5_2\resources\en-US folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBook\ver1_7_5_2\resources folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBook\ver1_7_5_2 folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services\addressBook folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee\services folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794\ee folder moved successfully.
C:\Program Files\Common Files\AOL\1127693794 folder moved successfully.
C:\Program Files\Common Files\AOL folder moved successfully.
C:\WINDOWS\system32\drivers\tmcomm.sys moved successfully.
C:\WINDOWS\system32\drivers\wanatw4.sys moved successfully.
C:\aolconnfix.exe moved successfully.
========== COMMANDS ==========
C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Administrator.DESKTOP1
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: Administrator.DESKTOP1.000
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users
->Flash cache emptied: 0 bytes

User: Compaq_Owner
->Temp folder emptied: 831627 bytes
->Temporary Internet Files folder emptied: 13638047 bytes
->Java cache emptied: 1549675 bytes
->FireFox cache emptied: 91508067 bytes
->Flash cache emptied: 3130 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 16786 bytes
->Flash cache emptied: 0 bytes

User: NetworkService
->Temp folder emptied: 17842 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 31036 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 744 bytes

Total Files Cleaned = 103.00 mb

[EMPTYFLASH]

User: Administrator
->Flash cache emptied: 0 bytes

User: Administrator.DESKTOP1

User: Administrator.DESKTOP1.000

User: All Users
->Flash cache emptied: 0 bytes

User: Compaq_Owner
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService
->Flash cache emptied: 0 bytes

User: NetworkService

Total Flash Files Cleaned = 0.00 mb

Restore point Set: OTL Restore Point (0)

OTL by OldTimer - Version 3.2.31.0 log created on 10202011_080630

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF3FCE.tmp not found!
File\Folder C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF405E.tmp not found!
File\Folder C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF40EA.tmp not found!
File\Folder C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF41F8.tmp not found!
File\Folder C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF430E.tmp not found!
File\Folder C:\Documents and Settings\Compaq_Owner\Local Settings\Temp\~DF4322.tmp not found!

Registry entries deleted on Reboot...

And here is the OTL quick scan log:

OTL logfile created on: 10/20/2011 8:15:07 AM - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Compaq_Owner\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.05 Gb Available Physical Memory | 52.27% Memory free
3.80 Gb Paging File | 3.00 Gb Available in Paging File | 78.77% Paging File free
Paging file location(s): C:\pagefile.sys 2000 4000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 142.24 Gb Total Space | 90.09 Gb Free Space | 63.34% Space Free | Partition Type: NTFS
Drive D: | 6.79 Gb Total Space | 2.12 Gb Free Space | 31.29% Space Free | Partition Type: FAT32

Computer Name: DESKTOP1 | User Name: Compaq_Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/10/19 20:28:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTL.exe
PRC - [2011/09/29 02:53:40 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011/06/15 15:16:48 | 000,997,920 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Client\msseces.exe
PRC - [2011/06/09 12:28:22 | 000,746,856 | ---- | M] (Sony Corporation) -- C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe
PRC - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe
PRC - [2008/10/07 16:25:48 | 000,095,744 | ---- | M] (j2 Global Communications, Inc.) -- C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe
PRC - [2008/08/13 09:11:00 | 000,413,696 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\PictureMover\Bin\PictureMover.exe
PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2005/06/06 23:46:24 | 000,057,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
PRC - [2003/09/12 23:13:20 | 000,098,304 | ---- | M] (Hewlett-Packard Company) -- C:\WINDOWS\system32\ps2.EXE

========== Modules (No Company Name) ==========

MOD - [2011/09/29 02:53:40 | 001,833,944 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011/03/30 10:23:03 | 006,053,536 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2009/11/26 17:13:52 | 012,160,056 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\PictureMover\Bin\Core.dll
MOD - [2009/11/26 17:13:44 | 001,699,384 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\PictureMover\EN-US\Presentation.dll
MOD - [2008/04/13 20:11:59 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll
MOD - [2008/04/13 20:11:51 | 000,059,904 | ---- | M] () -- C:\WINDOWS\system32\devenum.dll
MOD - [2008/03/25 00:50:40 | 000,355,112 | ---- | M] () -- C:\WINDOWS\system32\msjetoledb40.dll
MOD - [2001/09/28 14:44:58 | 000,257,536 | ---- | M] () -- C:\WINDOWS\BiImg.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (WANMiniportService) WAN Miniport (ATW)
SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - File not found [On_Demand | Stopped] -- -- (getPlus(R) Helper) getPlus(R)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - File not found [Disabled | Stopped] -- -- (AOL TopSpeedMonitor)
SRV - File not found [Disabled | Stopped] -- -- (AOL ACS)
SRV - [2011/04/27 15:39:26 | 000,011,736 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe -- (MsMpSvc)
SRV - [2006/11/03 19:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

========== Driver Services (SafeList) ==========

DRV - [2006/04/02 21:23:03 | 000,022,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbsermpt.sys -- (usbsermpt)
DRV - [2005/04/20 11:00:56 | 002,317,696 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2005/03/04 12:02:20 | 001,066,278 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2004/09/30 01:55:50 | 000,229,888 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2004/09/24 13:38:40 | 000,012,928 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2004/07/29 23:04:26 | 002,216,128 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2004/05/08 20:21:44 | 000,035,840 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2004/04/27 10:31:04 | 000,474,304 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\lvcd.sys -- (QCDonner) Logitech QuickCam Express(PID_0840)
DRV - [2003/12/02 21:23:20 | 000,142,336 | ---- | M] (Promise Technology, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\fasttx2k.sys -- (fasttx2k)
DRV - [2003/09/19 05:47:00 | 000,010,368 | ---- | M] (Padus, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pfc.sys -- (Pfc)
DRV - [2003/07/18 19:58:20 | 000,036,992 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SISAGPX.sys -- (SISAGP)
DRV - [2003/07/12 01:28:56 | 000,032,768 | ---- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC)
DRV - [2003/07/02 14:42:00 | 000,027,904 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\viaagp1.sys -- (viaagp1)
DRV - [2002/10/04 20:04:10 | 000,046,976 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\R8139n51.sys -- (rtl8139)
DRV - [2002/07/30 01:43:50 | 000,023,808 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\PS2.sys -- (Ps2)
DRV - [2001/11/08 15:58:22 | 000,017,648 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pc22nd5.sys -- (pc22nd5) Toshiba PCX2200 USB Cable Modem networking driver (NDIS)
DRV - [2001/11/08 15:58:14 | 000,069,744 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pc22unic.sys -- (pc22unic)
DRV - [2000/06/27 07:14:32 | 000,019,144 | ---- | M] (USB Image.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\A1236.SYS -- (PV8630)
DRV - [1997/12/09 01:32:00 | 000,003,616 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\as6eio.sys -- (as6eio)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.haaretz.co.il/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-us
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = E8 95 22 45 D4 15 CA 01 [binary data]
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "www.globes.co.il"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.3.20100310105313
FF - prefs.js..extensions.enabledItems: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E}:3.0.1

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@garmin.com/GpsControl: C:\Program Files\Garmin GPS Plugin\npGarmin.dll (GARMIN Corp.)
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.11.1879: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=1.0.2.1939: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.872: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.69\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@sony.com/Some: C:\Program Files\Sony\Bloggie Software\npsome.dll (Sony)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/10/01 11:19:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 7.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/10/13 10:17:49 | 000,000,000 | ---D | M]

[2008/09/02 08:06:14 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Extensions
[2011/10/01 11:20:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions
[2011/10/01 10:05:50 | 000,000,000 | ---D | M] (Garmin Communicator) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}(2)
[2011/10/01 11:20:21 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011/10/01 10:05:44 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2010/10/21 12:58:25 | 000,000,000 | ---D | M] (PSB Plugin) -- C:\Documents and Settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\6pfq08et.default\extensions\[email protected]
[2011/09/29 10:10:12 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009/08/05 09:51:51 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/09/29 02:53:40 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2008/09/15 11:52:06 | 000,376,832 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npsnapfish.dll
[2005/04/27 17:31:10 | 000,225,280 | ---- | M] (Asgard Software Inc.) -- C:\Program Files\mozilla firefox\plugins\NPUploader.dll
[2011/09/28 20:26:50 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml

O1 HOSTS File: ([2011/10/20 08:08:20 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O2 - BHO: (Yahoo! IE Suggest) - {5A263CF7-56A6-4D68-A8CF-345BE45BC911} - C:\Program Files\Yahoo!\Search\YSearchSuggest.dll (Yahoo! Inc.)
O2 - BHO: (UberButton Class) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll (Yahoo! Inc.)
O2 - BHO: (YahooTaggedBM Class) - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\Common\YIeTagBm.dll (Yahoo! Inc.)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O3 - HKLM\..\Toolbar: (&Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (&Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll (Yahoo! Inc.)
O4 - HKLM..\Run: [Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [LSBWatcher] c:\hp\drivers\hplsbwatcher\LSBurnWatcher.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [PS2] C:\WINDOWS\system32\ps2.EXE (Hewlett-Packard Company)
O4 - HKCU..\Run: [eFax 4.4] C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe (j2 Global Communications, Inc.)
O4 - HKCU..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe (Yahoo! Inc.)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk = C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe (Sony Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\PictureMover.lnk = C:\Program Files\PictureMover\Bin\PictureMover.exe (Hewlett-Packard Company)
O4 - Startup: C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk = C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe (Sony Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_15.dll (Sun Microsystems, Inc.)
O15 - HKCU\..Trusted Domains: mta.ac.il ([mtamail] https in Trusted sites)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://active.macromedia.com/director/cabs/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/downl...-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1B00725B-C455-4DE6-BFB6-AD540AD427CD} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (MetaStreamCtl Class)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {3E68E405-C6DE-49FF-83AE-41EE9F4C36CE} http://office.microsoft.com/officeupdate/content/opuc3.cab (Office Update Installation Engine)
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} http://www1.snapfish.com/SnapfishActivia.cab (Snapfish Activia)
O16 - DPF: {4CC35DAD-40EA-4640-ACC2-A1A3B6FB3E06} https://uat.desktop.citigroup.com/dana-cached/setup/NeoterisSetup.cab (NeoterisSetup Control)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1152325382906 (MUWebControl Class)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (OnlineScanner Control)
O16 - DPF: {83EF1847-D835-490B-8D9D-90B2987D66E8} http://pictures.aolcdn.com/ap/Resources/1.0.2.19.b//cab/YgpUploader.9.3.2.3.cab (AOL Pictures Uploader Class)
O16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} http://web1.shutterfly.com/downloads/Uploader.cab (Shutterfly Picture Upload Plugin)
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab (MsnMessengerSetupDownloadControl Class)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{65ADC95C-A4EE-4103-918F-8E8E9BD42698}: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - (igfxsrvc.dll) - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/10/21 05:59:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2001/07/28 06:07:38 | 000,000,000 | -HS- | M] () - D:\AUTOEXEC.BAT -- [ FAT32 ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/10/20 08:06:30 | 000,000,000 | ---D | C] -- C:\_OTL
[2011/10/19 20:28:57 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTL.exe
[2011/10/19 07:58:37 | 000,061,440 | ---- | C] ( ) -- C:\Documents and Settings\Compaq_Owner\Desktop\VEW.exe
[2011/10/18 07:37:03 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/10/18 07:35:04 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/10/18 07:33:11 | 000,523,264 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTM.exe
[2011/10/17 18:33:02 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2011/10/17 09:54:00 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/10/17 09:54:00 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/10/17 09:54:00 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/10/17 09:54:00 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/10/17 09:53:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/10/17 09:53:18 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/10/17 09:52:20 | 004,262,966 | R--- | C] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\Gotcha.exe
[2011/10/15 15:32:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\HiJackThis
[2011/10/15 15:32:31 | 000,000,000 | ---D | C] -- C:\Program Files\HiJackThis
[2011/10/15 10:56:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Compaq_Owner\InstallAnywhere
[2011/10/09 20:33:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Earth
[2011/10/08 11:23:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Sony Corporation
[2011/10/08 11:23:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\My Documents\Bloggie Library
[2011/10/08 11:23:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Application Data\Sony Corporation
[2011/10/08 11:22:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Bloggie Software
[2011/10/08 11:22:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\Logs
[2011/10/08 11:22:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Temp
[2011/10/08 11:22:04 | 000,000,000 | ---D | C] -- C:\Program Files\Sony
[2011/10/08 11:12:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sony Corporation
[2011/10/08 11:12:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\Temp
[2011/10/08 07:06:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\PCHealth
[2011/06/19 15:18:11 | 000,895,503 | ---- | C] (free-windows-registry-cleaner.com ) -- C:\Program Files\free-wrc.exe
[2005/10/02 15:03:13 | 000,018,120 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\GT680X.SYS

========== Files - Modified Within 30 Days ==========

[2011/10/20 08:15:11 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/10/20 08:11:07 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/10/20 08:10:12 | 000,007,883 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2011/10/20 08:10:11 | 000,000,188 | ---- | M] () -- C:\WINDOWS\System\hpsysdrv.DAT
[2011/10/20 08:10:08 | 000,000,894 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/20 08:10:01 | 2147,012,608 | -HS- | M] () -- C:\hiberfil.sys
[2011/10/20 08:10:01 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/10/20 08:08:20 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/10/20 07:37:00 | 000,000,898 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/19 20:28:59 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTL.exe
[2011/10/19 20:10:09 | 000,000,518 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\AOL Saved Files.lnk
[2011/10/19 20:10:08 | 000,000,004 | ---- | M] () -- C:\WINDOWS\msoffice.ini
[2011/10/19 07:58:37 | 000,061,440 | ---- | M] ( ) -- C:\Documents and Settings\Compaq_Owner\Desktop\VEW.exe
[2011/10/19 07:52:48 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn
[2011/10/19 07:49:43 | 000,000,281 | RHS- | M] () -- C:\boot.ini
[2011/10/18 07:33:11 | 000,523,264 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Compaq_Owner\Desktop\OTM.exe
[2011/10/17 09:53:33 | 004,262,966 | R--- | M] (Swearware) -- C:\Documents and Settings\Compaq_Owner\Desktop\Gotcha.exe
[2011/10/15 15:32:32 | 000,002,020 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Desktop\HiJackThis.lnk
[2011/10/15 14:46:44 | 000,012,150 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\Lanvin4HMblkdress.jpg
[2011/10/15 13:29:29 | 000,022,879 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\LanvinLeopardBoots.jpg
[2011/10/15 11:16:56 | 000,361,728 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/10/15 11:14:25 | 000,000,932 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\My Documents\My Sharing Folders.lnk
[2011/10/14 21:44:15 | 000,002,672 | ---- | M] () -- C:\WINDOWS\Ausba3.ini
[2011/10/14 21:44:13 | 000,011,604 | ---- | M] () -- C:\WINDOWS\Dusb3ar.ini
[2011/10/14 18:25:14 | 000,030,600 | ---- | M] () -- C:\WINDOWS\EWhiteu12.dat
[2011/10/14 18:25:14 | 000,000,004 | ---- | M] () -- C:\WINDOWS\AErroru3.dat
[2011/10/14 18:25:11 | 000,030,600 | ---- | M] () -- C:\WINDOWS\EDarku12.dat
[2011/10/14 18:25:09 | 000,000,006 | ---- | M] () -- C:\WINDOWS\EExpou.dat
[2011/10/14 18:25:04 | 000,000,001 | ---- | M] () -- C:\WINDOWS\EOffsetu.dat
[2011/10/13 10:17:50 | 000,001,742 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/10/13 03:09:33 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/10/09 20:33:35 | 000,001,923 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/10/08 11:22:51 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:44 | 000,000,870 | R--- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:38 | 000,000,858 | R--- | M] () -- C:\Documents and Settings\All Users\Desktop\Bloggie Software.lnk
[2011/10/01 16:44:38 | 000,001,945 | ---- | M] () -- C:\WINDOWS\epplauncher.mif
[2011/10/01 11:19:20 | 000,000,750 | ---- | M] () -- C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2011/10/01 11:19:20 | 000,000,732 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

========== Files Created - No Company Name ==========

[2011/10/19 20:09:35 | 000,000,518 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\AOL Saved Files.lnk
[2011/10/19 20:09:35 | 000,000,004 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2011/10/17 09:54:00 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/10/17 09:54:00 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/10/17 09:54:00 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/10/17 09:54:00 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/10/17 09:54:00 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/10/15 15:32:32 | 000,002,020 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Desktop\HiJackThis.lnk
[2011/10/15 14:46:42 | 000,012,150 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\Lanvin4HMblkdress.jpg
[2011/10/15 13:29:28 | 000,022,879 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\My Documents\LanvinLeopardBoots.jpg
[2011/10/13 10:17:49 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader X.lnk
[2011/10/13 10:17:49 | 000,001,742 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader X.lnk
[2011/10/09 20:33:35 | 000,001,923 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Earth.lnk
[2011/10/09 20:32:25 | 000,000,898 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2011/10/09 20:32:24 | 000,000,894 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2011/10/08 11:22:51 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:44 | 000,000,870 | R--- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bloggie Watcher Utility.lnk
[2011/10/08 11:22:38 | 000,000,858 | R--- | C] () -- C:\Documents and Settings\All Users\Desktop\Bloggie Software.lnk
[2011/10/01 16:49:26 | 000,000,424 | -H-- | C] () -- C:\WINDOWS\tasks\MP Scheduled Scan.job
[2011/10/01 16:42:35 | 000,001,688 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Security Essentials.lnk
[2011/10/01 11:19:20 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2011/06/19 15:18:11 | 001,253,907 | ---- | C] () -- C:\Program Files\pro-setup.exe
[2010/06/22 09:20:59 | 000,044,544 | ---- | C] () -- C:\WINDOWS\System32\Gif89.dll
[2010/04/28 17:35:04 | 000,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
[2008/12/28 20:00:32 | 000,898,929 | ---- | C] () -- C:\WINDOWS\Israeli-Tv Uninstaller.exe.bak
[2008/12/27 11:56:37 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat
[2008/04/29 19:50:06 | 000,000,010 | ---- | C] () -- C:\WINDOWS\compedia.ini
[2007/06/28 14:12:15 | 000,072,192 | ---- | C] () -- C:\WINDOWS\SSEUninstaller.exe
[2007/05/16 17:25:42 | 000,000,736 | ---- | C] () -- C:\WINDOWS\DigimaxMaster.INI
[2007/05/16 17:23:55 | 000,159,744 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007/05/16 17:23:54 | 000,552,960 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2007/05/16 17:23:54 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\vidccleaner.exe
[2007/02/19 10:57:27 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\wklnhst.dat
[2006/12/12 13:24:20 | 000,000,280 | ---- | C] () -- C:\WINDOWS\System32\PGPsdk.dll.sig
[2006/10/08 08:55:14 | 000,002,158 | ---- | C] () -- C:\WINDOWS\System32\ssmute.ini
[2006/07/03 22:17:38 | 000,000,101 | ---- | C] () -- C:\WINDOWS\upst.ini
[2006/04/01 10:13:25 | 000,000,024 | ---- | C] () -- C:\WINDOWS\atid.ini
[2006/02/23 17:38:53 | 000,000,078 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
[2006/01/30 20:19:39 | 000,000,134 | ---- | C] () -- C:\WINDOWS\qtw.ini
[2005/11/26 13:10:56 | 000,000,095 | ---- | C] () -- C:\WINDOWS\tb96.ini
[2005/11/23 09:39:22 | 000,013,012 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Application Data\Microsoft Excel.CAL
[2005/10/02 18:06:42 | 000,000,004 | ---- | C] () -- C:\WINDOWS\AErroru3.dat
[2005/10/02 18:06:41 | 000,030,600 | ---- | C] () -- C:\WINDOWS\EWhiteu12.dat
[2005/10/02 18:06:40 | 000,030,600 | ---- | C] () -- C:\WINDOWS\EDarku12.dat
[2005/10/02 18:06:38 | 000,000,006 | ---- | C] () -- C:\WINDOWS\EExpou.dat
[2005/10/02 18:06:33 | 000,000,001 | ---- | C] () -- C:\WINDOWS\EOffsetu.dat
[2005/10/02 15:03:13 | 000,184,320 | ---- | C] () -- C:\WINDOWS\Ausba3.dll
[2005/10/02 15:03:13 | 000,011,604 | ---- | C] () -- C:\WINDOWS\Dusb3ar.ini
[2005/10/02 15:03:13 | 000,002,672 | ---- | C] () -- C:\WINDOWS\Ausba3.ini
[2005/10/02 15:03:13 | 000,001,226 | ---- | C] () -- C:\WINDOWS\ScnPanel.ini
[2005/10/02 15:03:07 | 000,001,701 | ---- | C] () -- C:\WINDOWS\Ultima292.ini
[2005/10/02 13:57:06 | 000,000,100 | ---- | C] () -- C:\WINDOWS\Tb98.ini
[2005/10/02 13:57:00 | 000,009,136 | ---- | C] () -- C:\WINDOWS\System32\INETWH16.DLL
[2005/10/02 13:57:00 | 000,004,528 | ---- | C] () -- C:\WINDOWS\System32\SETBROWS.EXE
[2005/10/02 13:56:59 | 000,046,512 | ---- | C] () -- C:\WINDOWS\System32\EPSN.DLL
[2005/10/02 13:56:59 | 000,012,126 | ---- | C] () -- C:\WINDOWS\System32\PIXPCZ.DLL
[2005/10/02 13:56:59 | 000,011,934 | ---- | C] () -- C:\WINDOWS\System32\PIXPNR.DLL
[2005/10/02 13:56:19 | 000,158,720 | ---- | C] () -- C:\WINDOWS\System32\LFCMP62N.DLL
[2005/10/02 13:56:19 | 000,047,616 | ---- | C] () -- C:\WINDOWS\System32\LFTIF62N.DLL
[2005/10/02 13:56:19 | 000,043,008 | ---- | C] () -- C:\WINDOWS\System32\LTFIL62N.DLL
[2005/10/02 13:56:19 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\LFPCX62N.DLL
[2005/10/02 13:56:19 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\LFEPS62N.DLL
[2005/10/02 13:56:19 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFPCT62N.DLL
[2005/10/02 13:56:19 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFGIF62N.DLL
[2005/10/02 13:56:19 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\LFBMP62N.DLL
[2005/10/02 13:56:19 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\LFPSD62N.DLL
[2005/10/02 13:56:19 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFWMF62N.DLL
[2005/10/02 13:56:19 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\LFTGA62N.DLL
[2005/10/02 13:56:19 | 000,019,456 | ---- | C] () -- C:\WINDOWS\System32\LFWPG62N.DLL
[2005/10/02 13:56:19 | 000,018,944 | ---- | C] () -- C:\WINDOWS\System32\LFIMG62N.DLL
[2005/10/02 13:56:19 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFRAS62N.DLL
[2005/10/02 13:56:19 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\LFMSP62N.DLL
[2005/10/02 13:56:19 | 000,017,920 | ---- | C] () -- C:\WINDOWS\System32\LFMAC62N.DLL
[2005/10/02 13:56:19 | 000,017,408 | ---- | C] () -- C:\WINDOWS\System32\LFPCD62N.DLL
[2005/10/02 13:56:08 | 000,133,632 | ---- | C] () -- C:\WINDOWS\AUSBA1.DLL
[2005/10/02 13:56:08 | 000,000,986 | ---- | C] () -- C:\WINDOWS\AUSBA1.INI
[2005/10/02 13:56:08 | 000,000,194 | ---- | C] () -- C:\WINDOWS\DUSB1AR.INI
[2005/10/02 13:56:06 | 000,003,616 | ---- | C] () -- C:\WINDOWS\System32\drivers\As6eio.sys
[2005/07/05 10:08:51 | 000,099,965 | ---- | C] () -- C:\WINDOWS\UninstallFirefox.exe
[2005/07/05 10:08:42 | 000,002,872 | ---- | C] () -- C:\WINDOWS\mozver.dat
[2005/06/21 15:47:57 | 000,008,192 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2005/06/10 19:52:41 | 000,000,111 | ---- | C] () -- C:\WINDOWS\ka.ini
[2005/05/10 11:02:54 | 000,000,037 | ---- | C] () -- C:\WINDOWS\iltwain.ini
[2005/04/16 13:09:53 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
[2005/04/16 10:13:09 | 000,002,560 | ---- | C] () -- C:\WINDOWS\_MSRSTRT.EXE
[2005/03/15 20:05:45 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll
[2005/03/15 20:05:45 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll
[2005/03/15 20:05:45 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll
[2005/03/15 20:05:33 | 000,000,310 | ---- | C] () -- C:\WINDOWS\EReg515.dat
[2005/03/15 20:05:26 | 000,000,034 | ---- | C] () -- C:\WINDOWS\Disney.ini
[2005/03/03 02:19:21 | 000,257,536 | ---- | C] () -- C:\WINDOWS\BiImg.dll
[2005/03/03 02:19:21 | 000,110,592 | ---- | C] () -- C:\WINDOWS\JPEG32.DLL
[2005/03/03 02:19:21 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\BiMResNT.dll
[2005/03/03 02:19:21 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\BiMAppNT.exe
[2005/01/31 09:49:19 | 000,290,816 | ---- | C] () -- C:\WINDOWS\System32\PBHTML.dll
[2005/01/30 15:55:51 | 000,002,150 | ---- | C] () -- C:\WINDOWS\System32\mshrml.ini
[2005/01/21 02:30:14 | 000,071,749 | ---- | C] () -- C:\WINDOWS\hcextoutput.dll
[2005/01/21 02:30:14 | 000,000,823 | ---- | C] () -- C:\WINDOWS\tsc.ini
[2005/01/21 02:29:58 | 000,000,170 | ---- | C] () -- C:\WINDOWS\GetServer.ini
[2005/01/20 23:16:41 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/01/20 21:26:14 | 000,000,135 | ---- | C] () -- C:\Documents and Settings\Compaq_Owner\Local Settings\Application Data\fusioncache.dat
[2004/11/17 12:27:52 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/11/17 12:27:52 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/11/17 12:27:49 | 000,004,490 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/11/17 12:27:45 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/11/17 12:27:39 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/11/17 12:27:16 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/11/17 12:27:15 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/11/17 12:26:47 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/11/17 12:26:18 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/10/21 11:34:09 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2004/10/21 07:49:55 | 000,118,784 | R--- | C] () -- C:\WINDOWS\bwUnin-6.3.2.62.exe
[2004/10/21 07:48:08 | 000,013,948 | ---- | C] () -- C:\WINDOWS\System32\CHODDI.SYS
[2004/10/21 07:47:59 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\hpreg.dll
[2004/10/21 07:33:09 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2004/10/21 07:20:51 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll
[2004/10/21 07:20:51 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll
[2004/10/21 07:20:51 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll
[2004/10/21 07:20:51 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll
[2004/10/21 07:20:51 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll
[2004/10/21 07:20:51 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll
[2004/10/21 07:04:06 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/10/21 06:53:26 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\RTCOMDLL.dll
[2004/10/21 06:53:26 | 000,156,160 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2004/10/21 06:52:02 | 000,001,040 | ---- | C] () -- C:\WINDOWS\System32\drivers\alcxinit.dat
[2004/10/21 06:48:17 | 000,017,191 | ---- | C] () -- C:\WINDOWS\System32\lvcoinst.ini
[2004/10/21 06:46:49 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\sis760.bin
[2004/10/21 06:46:49 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\sis741.bin
[2004/10/21 06:46:49 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\sis660.bin
[2004/10/21 06:15:39 | 000,299,073 | ---- | C] () -- C:\WINDOWS\System32\PythonCOM22.dll
[2004/10/21 06:15:39 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\PyWinTypes22.dll
[2004/10/21 06:14:17 | 000,016,896 | ---- | C] () -- C:\WINDOWS\System32\bcbmm.dll
[2004/10/21 06:04:42 | 000,000,802 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/10/21 06:01:50 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/10/21 05:56:45 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/10/21 05:42:37 | 000,000,572 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2004/10/21 05:42:17 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/10/21 05:42:16 | 000,384,926 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/10/21 05:42:16 | 000,054,484 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/10/20 22:50:07 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/10/20 22:49:04 | 000,361,728 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/09/14 02:35:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/20 06:14:46 | 000,086,016 | ---- | C] () -- C:\WINDOWS\System32\PcdrKernelModeServices.dll
[2004/08/20 06:14:46 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\ProgressTrace.dll
[2003/04/11 02:04:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\JAWTAccessBridge.dll
[2003/01/08 01:05:08 | 000,002,695 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[1999/07/23 14:46:48 | 000,000,116 | ---- | C] () -- C:\WINDOWS\AuHCcup1.ini
[1999/07/23 11:53:20 | 000,129,536 | ---- | C] () -- C:\WINDOWS\AuHCcup1.dll

========== LOP Check ==========

[2010/06/23 00:56:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\BVRP Software
[2009/09/28 14:19:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.4 Output
[2009/01/17 23:57:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Hiro-Media
[2004/10/21 07:20:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\InterVideo
[2009/10/01 19:07:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PictureMover
[2011/10/01 10:12:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SecTaskMan
[2011/10/08 11:22:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Temp
[2007/06/01 02:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Upromise__RemindU
[2006/04/01 10:19:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\acccore
[2009/09/28 14:28:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\eFax Messenger
[2010/05/22 10:42:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\GARMIN
[2007/01/20 01:05:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\GetRightToGo
[2006/10/08 08:59:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\InterMute
[2005/11/06 19:21:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Intervideo
[2009/09/28 14:20:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\j2 Global
[2005/12/02 09:01:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Juniper Networks
[2005/02/05 20:24:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Leadertech
[2008/07/25 01:26:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\MSNInstaller
[2009/03/29 22:37:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Paltalk
[2007/01/19 02:35:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\PGP Corporation
[2009/06/04 20:08:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\PictureMover
[2009/06/05 06:26:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\SampleView
[2009/11/12 08:12:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\School Zone Preferences
[2006/05/12 16:19:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Snapfish
[2007/02/19 10:57:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Template
[2010/09/23 19:06:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Unity
[2008/06/21 21:54:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\Upromise__RemindU
[2011/03/09 19:50:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\VirtualStore
[2008/12/14 20:12:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Compaq_Owner\Application Data\VSRevoGroup
[2011/10/20 08:15:11 | 000,000,424 | -H-- | M] () -- C:\WINDOWS\Tasks\MP Scheduled Scan.job

========== Purity Check ==========

========== Files - Unicode (All) ==========
[2007/02/11 11:56:34 | 000,329,628 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??????? - ????? -????.mht) -- C:\Documents and Settings\Compaq_Owner\My Documents\היורשים - חדשות -הארץ.mht
[2007/02/11 11:56:25 | 000,329,628 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??????? - ????? -????.mht) -- C:\Documents and Settings\Compaq_Owner\My Documents\היורשים - חדשות -הארץ.mht
[2006/11/18 17:46:52 | 000,039,936 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ???? ??? ???? ???.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\על כגון אלה היתה אמי.doc
[2006/11/18 17:46:52 | 000,039,936 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ???? ??? ???? ???.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\על כגון אלה היתה אמי.doc
[2006/09/15 07:46:31 | 000,020,992 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?????? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\קובקוב אהלן.doc
[2006/09/15 07:46:31 | 000,020,992 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?????? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\קובקוב אהלן.doc
[2006/08/05 23:02:58 | 000,026,112 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??? ????? ?? ????????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הכי מפריע זה הדיסוננס.doc
[2006/08/05 23:02:58 | 000,026,112 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\??? ????? ?? ????????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הכי מפריע זה הדיסוננס.doc
[2006/08/04 07:39:33 | 000,027,136 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ?? ??? ???? ?? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\גם מי שלא תומך של ביבי.doc
[2006/08/04 07:39:32 | 000,027,136 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ?? ??? ???? ?? ????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\גם מי שלא תומך של ביבי.doc
[2006/06/21 08:31:10 | 000,000,000 | ---D | M](C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????_files) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן_files
[2006/06/18 08:00:56 | 000,030,098 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????.htm) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן.htm
[2006/06/18 08:00:55 | 000,030,098 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????.htm) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן.htm
[2006/06/18 08:00:55 | 000,000,000 | ---D | C](C:\Documents and Settings\Compaq_Owner\My Documents\????? - ????? ???? ?????_files) -- C:\Documents and Settings\Compaq_Owner\My Documents\גלובס - רוכשי דירה מקבלן_files
[2006/03/27 12:29:49 | 000,024,064 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הורים פולנים.doc
[2006/03/27 12:29:49 | 000,024,064 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\הורים פולנים.doc
[2006/02/14 09:00:01 | 000,044,032 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ????? ? ? ? ? ?.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אפרים קישון ה ג ד ו ל.doc
[2006/02/14 09:00:01 | 000,044,032 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\????? ????? ? ? ? ? ?.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אפרים קישון ה ג ד ו ל.doc
[2005/09/25 19:34:57 | 000,024,064 | ---- | M] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ??????? ?? ??????? ??? ??? ????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אל תתייראי מן הפרושים ולא ממי שאינם פרושים.doc
[2005/09/25 19:34:56 | 000,024,064 | ---- | C] ()(C:\Documents and Settings\Compaq_Owner\My Documents\?? ??????? ?? ??????? ??? ??? ????? ??????.doc) -- C:\Documents and Settings\Compaq_Owner\My Documents\אל תתייראי מן הפרושים ולא ממי שאינם פרושים.doc

< End of report >


----------



## Cobster (Oct 15, 2011)

Kevin
Alas, no change..still very high Services.exe CPU usage in spikes for 10-15 seconds at a time
Frustrating.


----------



## kevinf80 (Mar 21, 2006)

I`m convinced this is down to 3rd party software and nothing malicious....

Go into MSconfig and stop (untick) the following entries *if present*, apply then OK. Reboot accept the alert when OS starts by ticking never to show again...

*[KernelFaultCheck]
[HostManager]
[QuickTime Task]
[Adobe ARM]
[RegisterDropHandler]
[Yahoo! Pager]
[eFax 4.4]
[Skype]
[AOL Fast Start]
[Picasa Media Detector]
[DWQueuedReporting]
[Picasa Media Detector]*


----------



## Cobster (Oct 15, 2011)

Adobe ARM and Skype were the only ones there.
I Unclicked them and rebooted..
Problems still here


----------



## Cobster (Oct 15, 2011)

Should I re-enable MS Security Essentials?


----------



## kevinf80 (Mar 21, 2006)

Yes definitely, do not do any browsing without an active AV...

Go back into MSConfig, untick all entries except for your security, reboot and see how your system responds.


----------



## Cobster (Oct 15, 2011)

Will do..I require a bit of guidance here though.
When I go to msconfig, do I untick the entries in the services tab?
Most of them are by Microsoft.
The ones that are not are mostly by Unknown:

Windows Defender
Wan Miniport (ATW) Service
Office Source engine
NVIDIA Display Driver Engine by NVIDIA
Microsoft Anti Malware Service
Machine Debug Manager
Java Quick Starter
Google Updater Service (by Unknown)
I unticked them
Google Updater Service (gupdatem) by Google
Google Updater Service (gupdate) by Google
GetPlus (R) Helper


----------



## Cobster (Oct 15, 2011)

I removed the above services, left all of Microsoft services because I wasn't sure it it was safe to remove them.
Services.exe still running high CPU % in spikes
Let me know if it is ok to remove the Microsoft services (not sure which ones are essential and which not)
Thanks again


----------



## kevinf80 (Mar 21, 2006)

Download and install *CCleaner*

Use either one of the two free links below the Premium version. If you are offered any Toolbars etc such as Yahoo just decline the offer.

Run CCleaner, select tools > start up > in the bottom righthand corner hit the "save to text file" tab. Post that log for me to see...


----------



## Cobster (Oct 15, 2011)

Here is the CCleaner log:HHere is the log from CCleaner:

Yes	HKCU:Run	swg	C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Yes	HKCU:Run	Yahoo! Pager	"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet Yes	HKCU:Run	eFax 4.4	"C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe" /R Yes	HKCU:Run	ctfmon.exe	C:\WINDOWS\system32\ctfmon.exe No	HKCU:Run	AOL	"C:\Program Files\AOL Desktop 9.6\AOL.EXE" -b No	HKCU:Run	Skype	"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized No	HKCU:Run	YAHOOM~1	"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet Yes	HKLM:Run	NvCplDaemon	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup Yes	HKLM:Run	hpsysdrv	c:\windows\system\hpsysdrv.exe Yes	HKLM:Run	IgfxTray	C:\WINDOWS\system32\igfxtray.exe Yes	HKLM:Run	HotKeysCmds	C:\WINDOWS\system32\hkcmd.exe Yes	HKLM:Run	PS2	C:\WINDOWS\system32\ps2.exe Yes	HKLM:Run	LSBWatcher	c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe Yes	HKLM:Run	QuickTime Task	"C:\Program Files\QuickTime\qttask.exe" -atboottime Yes	HKLM:Run	Adobe Photo Downloader	"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" Yes	HKLM:Run	MSC	"c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey No	HKLM:Run	AdobeARM	"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" No	HKLM:Run	apdproxy	"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" No	HKLM:Run	AGRSMMSG	AGRSMMSG.exe No	HKLM:Run	ALCMTR	ALCMTR.EXE No	HKLM:Run	ALCWZRD	ALCWZRD.EXE No	HKLM:Run	ALCXMNTR	ALCXMNTR.EXE No	HKLM:Run	AOLDial	C:\Program Files\Common Files\AOL\ACS\AOLDial.exe No	HKLM:Run	AOLSP Scheduler	C:\Program Files\Common Files\AOL\1127693794\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe No	HKLM:Run	AOLSoftware	C:\Program Files\Common Files\AOL\1127693794\ee\AOLSoftware.exe No	HKLM:Run	INSTAN~1	C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h No	HKLM:Run	KBD	C:\HP\KBD\KBD.EXE No	HKLM:Run	nwiz	nwiz.exe /installquiet /keeploaded /nodetect No	HKLM:Run	qttask	"C:\Program Files\QuickTime\qttask.exe" -atboottime No	HKLM:Run	RECGUARD	C:\WINDOWS\SMINST\RECGUARD.EXE No	HKLM:Run	REGIST~1	C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE No	HKLM:Run	SSCRun	C:\Program Files\Common Files\AOL\1127693794\ee\SSCRun.exe No	HKLM:Run	sgtray	"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r Yes	Startup Common	Bloggie Watcher Utility.lnk	C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe Yes	Startup Common	PictureMover.lnk	C:\Program Files\PictureMover\Bin\PictureMover.exe Yes	Startup User	Bloggie Watcher Utility.lnk	C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe


----------



## Cobster (Oct 15, 2011)

This might be better
Yes	HKCU:Run	swg	C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe Yes	HKCU:Run	Yahoo! Pager	"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet Yes	HKCU:Run	eFax 4.4	"C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe" /R Yes	HKCU:Run	ctfmon.exe	C:\WINDOWS\system32\ctfmon.exe No	HKCU:Run	AOL	"C:\Program Files\AOL Desktop 9.6\AOL.EXE" -b No	HKCU:Run	Skype	"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized No	HKCU:Run	YAHOOM~1	"C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet Yes	HKLM:Run	NvCplDaemon	RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup Yes	HKLM:Run	hpsysdrv	c:\windows\system\hpsysdrv.exe Yes	HKLM:Run	IgfxTray	C:\WINDOWS\system32\igfxtray.exe Yes	HKLM:Run	HotKeysCmds	C:\WINDOWS\system32\hkcmd.exe Yes	HKLM:Run	PS2	C:\WINDOWS\system32\ps2.exe Yes	HKLM:Run	LSBWatcher	c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe Yes	HKLM:Run	QuickTime Task	"C:\Program Files\QuickTime\qttask.exe" -atboottime Yes	HKLM:Run	Adobe Photo Downloader	"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" Yes	HKLM:Run	MSC	"c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey No	HKLM:Run	AdobeARM	"C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" No	HKLM:Run	apdproxy	"C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" No	HKLM:Run	AGRSMMSG	AGRSMMSG.exe No	HKLM:Run	ALCMTR	ALCMTR.EXE No	HKLM:Run	ALCWZRD	ALCWZRD.EXE No	HKLM:Run	ALCXMNTR	ALCXMNTR.EXE No	HKLM:Run	AOLDial	C:\Program Files\Common Files\AOL\ACS\AOLDial.exe No	HKLM:Run	AOLSP Scheduler	C:\Program Files\Common Files\AOL\1127693794\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe No	HKLM:Run	AOLSoftware	C:\Program Files\Common Files\AOL\1127693794\ee\AOLSoftware.exe No	HKLM:Run	INSTAN~1	C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h No	HKLM:Run	KBD	C:\HP\KBD\KBD.EXE No	HKLM:Run	nwiz	nwiz.exe /installquiet /keeploaded /nodetect No	HKLM:Run	qttask	"C:\Program Files\QuickTime\qttask.exe" -atboottime No	HKLM:Run	RECGUARD	C:\WINDOWS\SMINST\RECGUARD.EXE No	HKLM:Run	REGIST~1	C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE No	HKLM:Run	SSCRun	C:\Program Files\Common Files\AOL\1127693794\ee\SSCRun.exe No	HKLM:Run	sgtray	"C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r Yes	Startup Common	Bloggie Watcher Utility.lnk	C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe Yes	Startup Common	PictureMover.lnk	C:\Program Files\PictureMover\Bin\PictureMover.exe Yes	Startup User	Bloggie Watcher Utility.lnk	C:\Program F


----------



## kevinf80 (Mar 21, 2006)

Re-open CCleaner > Select Tools > Start up. Look at the list below it should mirror your start up list. I`ve added some colors to the text lines.

*Red* lines, select by clicking on that line, it will highlight, at top right hand corner Select > *disable* Do that for all *Red* lines.

*Green* lines, leave unchanged

*Purple* lines, Highlight then select *delete*

Yes HKCU:Run swg C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe 
Yes HKCU:Run Yahoo! Pager "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet 
Yes HKCU:Run eFax 4.4 "C:\Program Files\eFax Messenger 4.4\J2GDllCmd.exe" /R 
Yes HKCU:Run ctfmon.exe C:\WINDOWS\system32\ctfmon.exe 
No HKCU:Run AOL "C:\Program Files\AOL Desktop 9.6\AOL.EXE" -b 
No HKCU:Run Skype "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized 
No HKCU:Run YAHOOM~1 "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet 
Yes HKLM:Run NvCplDaemon RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup 
Yes HKLM:Run hpsysdrv c:\windows\system\hpsysdrv.exe 
Yes HKLM:Run IgfxTray C:\WINDOWS\system32\igfxtray.exe 
Yes HKLM:Run HotKeysCmds C:\WINDOWS\system32\hkcmd.exe 
Yes HKLM:Run PS2 C:\WINDOWS\system32\ps2.exe 
Yes HKLM:Run LSBWatcher c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe 
Yes HKLM:Run QuickTime Task "C:\Program Files\QuickTime\qttask.exe" -atboottime 
Yes HKLM:Run Adobe Photo Downloader "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" 
Yes HKLM:Run MSC "c:\Program Files\Microsoft Security Client\msseces.exe" -hide -runkey 
No HKLM:Run AdobeARM "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" 
No HKLM:Run apdproxy "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe" 
No HKLM:Run AGRSMMSG AGRSMMSG.exe 
No HKLM:Run ALCMTR ALCMTR.EXE 
No HKLM:Run ALCWZRD ALCWZRD.EXE 
No HKLM:Run ALCXMNTR ALCXMNTR.EXE 
No HKLM:Run AOLDial C:\Program Files\Common Files\AOL\ACS\AOLDial.exe 
No HKLM:Run AOLSP Scheduler C:\Program Files\Common Files\AOL\1127693794\ee\services\safetyCore\ver210_5_2_1\AOLSP Scheduler.exe 
No HKLM:Run AOLSoftware C:\Program Files\Common Files\AOL\1127693794\ee\AOLSoftware.exe 
No HKLM:Run INSTAN~1 C:\PROGRA~1\TEXTBR~1.0\Bin\INSTAN~1.EXE /h 
No HKLM:Run KBD C:\HP\KBD\KBD.EXE No HKLM:Run nwiz nwiz.exe /installquiet /keeploaded /nodetect 
No HKLM:Run qttask "C:\Program Files\QuickTime\qttask.exe" -atboottime 
No HKLM:Run RECGUARD C:\WINDOWS\SMINST\RECGUARD.EXE 
No HKLM:Run REGIST~1 C:\PROGRA~1\TEXTBR~1.0\Bin\REGIST~1.EXE 
No HKLM:Run SSCRun C:\Program Files\Common Files\AOL\1127693794\ee\SSCRun.exe 
No HKLM:Run sgtray "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r Yes Startup Common Bloggie Watcher Utility.lnk C:\Program Files\Sony\Bloggie Software\BGVolumeWatcher.exe 
Yes Startup Common PictureMover.lnk C:\Program Files\PictureMover\Bin\PictureMover.exe Yes Startup User Bloggie Watcher Utility.lnk C:\Program F

Re-boot, any change....


----------



## Cobster (Oct 15, 2011)

Looks like we got it this time 
System working fine with services.exe not spiking at all. Do I need to restore/re-enable anything?
I see some spikes from plugin-container.exe when firefox is on..is that normal?
There are several (6-7) processes of plugin-container.exe opened when I launch firefox browser.
Thanks a bunch for your patience and help.
Much appreciated


----------



## kevinf80 (Mar 21, 2006)

I dont think there should be that many entries for plug-in container, Ok, lets clean up first then look at the other issue after:

*Step 1*

Remove Combofix now that we're done with it

Please press the Windows Key and R on your keyboard. This will bring up the Run... command.
Now type in Combofix /Uninstall in the runbox and click OK. (Notice the space between the "x" and "/")









 Please follow the prompts to uninstall Combofix.
 You will then recieve a message saying Combofix was uninstalled successfully once it's done uninstalling itself.
The above procedure will delete the following:

 ComboFix and its associated files and folders.
 VundoFix backups, if present
 The C:_OtMoveIt folder, if present
 Reset the clock settings.
 Hide file extensions, if required.
 Hide System/Hidden files, if required.
 Reset System Restore.
*It is very important that you get a successful uninstall because of the extra functions done at the same time, let me know if this does not happen.*

*Step 2*


Download *OTC* by OldTimer and save it to your *desktop.* *Alternative mirror*
Double click







icon to start the program. 
If you are using Vista or Windows 7, please right-click and choose run as administrator
Then Click the big







button.
You will get a prompt saying "_Begining Cleanup Process_". Please select *Yes*.
Restart your computer when prompted.
This will remove tools we have used and itself. *Any tools/logs remaining on the Desktop can be deleted.*

*Step 3*

We need to remove ESET Online Scanner.


 Click Start, click Run, type *control appwiz.cpl* in the Open box, and then press ENTER.
 Click to select *ESET Online Scanner* from the application list, and then click Remove. Only re-boot if prompted

*Step 4*

You will have several programs installed, these maybe outdated and vulnerable to exploits also. To be certain, please run the free online scan by *Secunia*, available *Here* Before clicking the *Start* scan button, please check the box for the option *Enable thorough system inspection*. Just below the "Scan Options:" section, you'll see the status of what's currently processing....








...when the scan completes, the message "Detection completed successfully" will appear in the *Programs/Result* section. For each problem detected, Secunia will offer a "Solution" option. Please follow those instructions to download updated versions of the programs as recommended by Secunia.

Let me know if the above complete OK, tell me if secunia offers any updates, especially Firefox.

Kevin


----------



## Cobster (Oct 15, 2011)

Secunia offered the following updates:
Adobe Reader 8.x
Apple QuickTime 7.x
Skype for Windows 4.x
WinZip 9.x
Yahoo! Messenger 8.x
Adobe Flash Player 10.x (listed 3 times)
Sun Java JRE 1.6.x / 6.x
Macromedia Flash Player 6.x
Macromedia Flash Player 7.x
Microsoft Internet Explorer 8.x


----------



## kevinf80 (Mar 21, 2006)

In stall all of those updates that Secunia has offered except for Java, update Java as follows:

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update.

Download the latest version of Java Runtime Environment 7 update 1 *JRE 7*
Scroll down to where it says JRE. Java SE 7 
Check the box to: "Accept License Agreement".
Find the download that applies to your operating system. (Please ask if you have any questions.)
Click the "Download JRE" button to the right.

NOTE: As always during installations, beware of any pre-checked option to install a toolbar. If you do not want it, UNcheck it.

Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check any item with Java Runtime Environment (JRE or J2SE) in the name.
Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each of the Old Java versions.

 In Windows Explorer, navigate to C:\Program Files\Java\ Delete the contents such as any subfolders, but *NOT*the main folder.
 Do NOT delete C:\Program Files\JavaVM if found!
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-7-windows-i586.exe to install the newest version.

Delete the downloaded installation file after completing the above procedure and reboot if not prompted to do so.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications.

To disable the JQS service if you don't want to use it:

 Go to Start-->Control Panel-->Java-->Advanced-->Miscellaneous and uncheck the box for Java Quick Starter.

 Click Ok and reboot your computer.

Let me know if the above completes OK....

Kevin


----------



## Cobster (Oct 15, 2011)

Doing the updates now Kevin.
However, regarding the Java upgrade to JRE 7..in the download options I see Windows x64 but my OS is Windows XP Home Edition which is 32 bit if I remember correctly.
I looked at my System configuration and it does not show it 64 bit enabled.
So will this work with my system? or do I need to update to a different version of JRE that can work with my 32 bit system
Thanks


----------



## kevinf80 (Mar 21, 2006)

You need the 32 bit option, it will show as X 86 in the list as per the attached picture..


----------



## Cobster (Oct 15, 2011)

Ok..installed all the updates..when tried to remove Java (TM)n6 update 15 the system gives me this msg.:"nFatal eror during installation)
I deleted the 2 subfolders from the Java folder in the programs folder in C drive before installing Java (TM) 7 - is it all right or do I need to remove that Java (TM) 6, cause any time I try it won't do it.


----------



## kevinf80 (Mar 21, 2006)

You should have uninstalled Java 6 update 15, before installing Java 7. Ok try the following:

Reboot to Safe Mode, re-boot continuously tap the F8 key until you see the Windows advanced menu. From the options select "Safe Mode"
When you are in safe mode uninstall Java6 update 15, let me know if that goes OK,

Kevin


----------



## Cobster (Oct 15, 2011)

I tried un-installing the Java 6 but to no avail.
I deleted the sub folders as instructed.
Just tried the safe mode but not working either, getting this msg.:" The Windows Installer could not be accessed. This can occur if you are running Windows in Safe Mode, or if the Windows Installer is not correctly installed..."
The installer was able to un-install other programs before so not sure what is wrong now.
BTW, I got a prompt to update Java 7 an di that, so now it is Java 7 update 1.


----------



## kevinf80 (Mar 21, 2006)

OK, download and install the free version of Revo Uninstaller from *Here* you can use that to uninstall Java 6, Once installed it will open automatically the first time. Highlight Java 6 in the main interface and select the "Uninstall" tab from the tool bar, Confirm the uninstall, in the next window select the second option "Safe" then follow the prompts...... It should remove Java for us...

I`ve attached a couple of screenshots so you get the general idea, if you get stuck let me know


----------



## Cobster (Oct 15, 2011)

After runnung Revo it scanned and came up with "Found leftover Registry items" msg
Only two of the items were bolded and a msg. asked to verify the bolded items as only checked bolded items and their sub-items will be deleted.
I did not check them and delete them for fear I'd cause damage..
Also, the system fail to create a system restore point


----------



## kevinf80 (Mar 21, 2006)

You must tick the bolded items for Revo to remove registry remnants, it is very safe as long as you follow the instructions.

What is wrong with system restore, is it not working? is it turned on? do the following:

Left click start > Right click My Computer > Left click Properties > Select System restore tab. Is it on or off?

Kevin...


----------



## Cobster (Oct 15, 2011)

System restore was off, I turned it on and ran Revo again deleting the 2 bolded items.
Revo said it completed the un-install.
However, I still see Java 6 15 in the list of programs for some rason.
Anyway, with this I completed the updates and uninstall of Java 6 and have Java 7 now in the system


----------



## Cobster (Oct 15, 2011)

I re-booted and checked list of programs in the Add/delete programs list and java 6 15 is still there but does not show an option to uninstall. It looks like Revo un-installed it but it is still on the list.
Other programs that were un-installed were taken off this list.


----------



## kevinf80 (Mar 21, 2006)

Ok navigate to Start > My Computer > C:\Program Files\Java > Double left click on the Java Folder to open it. Inside should be two sub folders Java 6 and Java 7. They maybe name JRE 6 and JRE 7 Delete the one numbered 6, re-boot your PC and check in Add/Remove,


----------



## Cobster (Oct 15, 2011)

I did the delete of java 6 yesterday , nothing but Java 7 now and Java 6 still appears in the list of programs in the add/delete function BUT when I click on it it does not show me an option to remove it.
The name is there but no way to remove it from that list, but there are no java 6 folders in the programs folder either.
System seems to be working fine now


----------



## kevinf80 (Mar 21, 2006)

OK, that entry will not cause you any issues, but if you want to remove it follow the instructions here :-

http://windowsxp.mvps.org/AddRemove.htm

After that you should be good to go, all recent logs are clean and you say your system is running well.... Son here are some tips to reduce the potential for malware infection in the future:

*Make proper use of your antivirus and firewall*

Antivirus and Firewall programs are integral to your computer security. However, just having them installed isn't enough. The definitions of these programs are frequently updated to detect the latest malware, if you don't keep up with these updates then you'll be vulnerable to infection. Many antivirus and firewall programs have automatic update features, make use of those if you can. If your program doesn't, then get in the habit of routinely performing manual updates, because it's important.

You should keep your antivirus and firewall guard enabled at all times, *NEVER* turn them off unless there's a specific reason to do so. Also, regularly performing a full system scan with your antivirus program is a good idea to make sure you're system remains clean. Once a week should be adequate. You can set the scan to run during a time when you don't plan to use the computer and just leave it to complete on its own.

Install and use *WinPatrol* This will inform you of any attempted unauthorized changes to your system.

WinPatrol features explained *Here*

You will have several programs installed, these maybe outdated and vulnerable to exploits also. To be certain, please run the free online scan by *Secunia*, available *Here* Before clicking the *Start* scan button, please check the box for the option *Enable thorough system inspection*. Just below the "Scan Options:" section, you'll see the status of what's currently processing....








...when the scan completes, the message "Detection completed successfully" will appear in the *Programs/Result* section. For each problem detected, Secunia will offer a "Solution" option. Please follow those instructions to download updated versions of the programs as recommended by Secunia.

*Use a safer web browser*

Internet Explorer is not the most secure tool for browsing the web. It has been known to be very susceptible to infection, and there are a few good free alternatives:

*Firefox*,

*Opera*, and

*Chrome*.

All of these are excellent faster, safer, more powerful and functional free alternatives to Internet Explorer. It's definitely worth the short period of adjustment to start using one of these. If you wish to continue using Internet Explorer, it would be a good idea to follow the tutorial *HERE* which will help you to make IE *MUCH* safer.

These *browser add-ons* will help to make your browser safer:

*Web of Trust* warns you about risky websites that try to scam visitors, deliver malware or send spam. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous ones:

Available for *Firefox* and *Internet Explorer*.

*Green* to go, 
*Yellow* for caution, and 
*Red* to stop.

Available for *Firefox* only. *NoScript* helps to block malicious scripts and in general gives you much better control over what types of things webpages can do to your computer while you're browsing.

These are just a couple of the most popular add-ons, if you're interested in more, take a look at *THIS* article.

Here a couple of links by two security experts that will give some excellent tips and advice.

*So how did I get infected in the first place by Tony Klein*

*How to prevent Malware by Miekiemoes*

Finally this link *HERE* will give a comprehensive upto date list of free Security programs. To include - Antivirus, Antispyware, Firewall, Antimalware, Online scanners and rescue CD`s.

Don`t forget, the best form of defense is common sense. If you don`t recognize it, don`t open it. If something looks to good to be true, then it aint.

If no remaining issues hit the Mark Solved tab at the top of the thread,

Take care,

Kevin


----------



## Cobster (Oct 15, 2011)

Kevin
Thanks so much again!!
I tried removing the Java 6 15 from the add/delete program screen to no avail, using your instructions and deleting the registry keys I found for it.
Do I need to keep on the programs I downloaded as diagnostic tools that you asked me to do during the fixing process? (Like CCleaner, ESET, VEW, rtc..)
Will use Firefox from now.
Best
Cobster


----------



## kevinf80 (Mar 21, 2006)

Hiya Cobster,

If you look at reply #34, steps 2 and 3 it tells you to delete any tools/logs left on the Desktop. Also instructions how to uninstall ESET.

Regarding CCleaner, i`d recommend that you keep that one. CC is a very handy utility to have. Open CC, in the bottom left hand corner click the following "Online Help" that will take you to the Piriform Website, you will find all the instructions you need for this tool by taking the quick tour...

If no more issues hit the Mark Solved tab at the top of thread...

Best regards,

Kevin....


----------



## Cobster (Oct 15, 2011)

I did those steps you instructed in comment 34 , just saw the icons on the desktop and deleted them now.
Will keep CCleaner as advised.
Thanks again for all your help
Best
Cobster


----------



## kevinf80 (Mar 21, 2006)

You`re welcome...

Take care,

Kevin


----------

