# cant update or restore



## kanachoe (Apr 20, 2007)

I cant use the System Restore it does not work i cant update the xp service 3 pack proffessional my computer is acting really weird like i cant get certain emails .could someone please help.my search on the start wont work either.


----------



## Saga Lout (Sep 15, 2004)

*Do any shortcuts work or have they all failed? If you click on any executable file, does it start the relevant programme or do nothing?
*


----------



## kanachoe (Apr 20, 2007)

hi the desktop shortcuts work when i click on a extension on a web site on opera it doesnt work it shuts down the shortcuts on the start section work but the search on there doesnt work at all doesnt pop up.


----------



## kanachoe (Apr 20, 2007)

hi this is what it says if i open a pdf page it also says just error then closes the whole opera browser.

HLOG V1 desktop 10.10 1893 windows
Opera.exe 1893 caused exception C0000005 at address 131C37FA (Base: 400000)

Registers:
EAX=131C35B8 EBX=1381EDC0 ECX=00000000 EDX=7C90E514 ESI=13AB9014
EDI=0F89E8F0 EBP=0F89E8CC ESP=0F89E8C8 EIP=131C37FA FLAGS=00010216
CS=001B DS=0023 SS=0023 ES=0023 FS=003B GS=0000
FPU stack:
7FFF8000000000000000 00000000000000000000 00080013E81402080000
F4A87C814E9A7C80ACAF E814130300017C814E7F FFFF7C9128707C90E920
E7A80013DA88000046CF 00007C9103230013E7B4 SW=0000 CW=027F


----------



## Saga Lout (Sep 15, 2004)

kanachoe said:


> hi this is what it says if i open a pdf page it also says just error then closes the whole opera browser.
> 
> HLOG V1 desktop 10.10 1893 windows
> Opera.exe 1893 caused exception C0000005 at address 131C37FA (Base: 400000)


*
In Opera, hit Control and Function 12 then click the Advanced tab. Is .pdf mentioned in the list, if not add it, and is there a valid path to a file for it? Was PDF files just an example or the only thing Opera cannot open?
*


----------



## kanachoe (Apr 20, 2007)

its in the list as downloads in the advanced tab and it just says path pdf now when i click on the item to see its all in funny writing


----------



## Megabite (Apr 5, 2008)

Try doing a free Online Scan

Go here http://housecall.trendmicro.com/uk/

Download the Download HouseCall 7.1 (32-bit) to your desktop and run it update it and scan

Let us know what happens


----------



## kanachoe (Apr 20, 2007)

hi ni just done the quik scan and it found nothing im doing the full scan now


----------



## kanachoe (Apr 20, 2007)

It found one spyware HKTL NIRCMD IN nir cmd.exe file


----------



## kanachoe (Apr 20, 2007)

I went to click fix and a box came up from opera saying trend microm housecall has encountered a problem and needs to close so it couldnt be fixed.


----------



## Megabite (Apr 5, 2008)

Can you use Explorer and see


----------



## kanachoe (Apr 20, 2007)

I will try that


----------



## kanachoe (Apr 20, 2007)

I fixed that one on ie so im full scanning it again


----------



## kanachoe (Apr 20, 2007)

theres no more threats it found


----------



## kanachoe (Apr 20, 2007)

Nothing is still working


----------



## Megabite (Apr 5, 2008)

Looking at your log many things are not running


----------



## kanachoe (Apr 20, 2007)

what can i do to fix it here

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:45:33 AM, on 23/01/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\windows\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\windows\RTHDCPL.EXE
C:\Program Files\Dodo Speed Accelerator\slipcore.exe
C:\Program Files\Dell AIO Printer 948\dldfmon.exe
C:\Program Files\Dell AIO Printer 948\memcard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2008 Deluxe\Planner\PLNRnote.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\windows\system32\dldfcoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\windows\system32\svchost.exe
C:\windows\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O2 - BHO: (no name) - {038cb5c7-48ea-4af9-94e0-a1646542e62b} - (no file)
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\VIDEOD~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - (no file)
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Dodo Speed Accelerator\PBHelper.dll
O2 - BHO: (no name) - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - (no file)
O2 - BHO: ToolbarBHO Class - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Dodo Speed Accelerator\components\NOWImaging.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTSING~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: RAW Thumbnail Viewer - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O3 - Toolbar: Yahoo!7 Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Dodo Speed Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [dldfmon.exe] "C:\Program Files\Dell AIO Printer 948\dldfmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell AIO Printer 948\memcard.exe"
O4 - HKLM\..\Run: [Dell AIO Printer 948 Fax Server] "C:\Program Files\Dell AIO Printer 948\fm3032.exe" /s
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\Avast4\ashWebSv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKLM\..\RunOnce: [TSC] "C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\HouseCall\tsc.exe" /HD
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [Adware_ProMFCT] C:\Program Files\Adware_Pro\Adware_Pro.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dodo Speed Accelerator.lnk = C:\Program Files\Dodo Speed Accelerator\slipgui.exe
O4 - Global Startup: Event Planner Reminder 2008.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - 
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1225368199591
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240125841343
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} (Java Plug-in 1.6.0_11) - 
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} (Java Plug-in 1.6.0_13) - 
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} (Java Plug-in 1.6.0_14) - 
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B7EBAEF-6B19-4424-805B-46FC78632DAF}: Domain = nsw.bigpond.net.au
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: dldfCATSCustConnectService - Unknown owner - C:\windows\System32\spool\DRIVERS\W32X86\3\\dldfserv.exe
O23 - Service: dldf_device - - C:\windows\system32\dldfcoms.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\windows\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 11255 bytes


----------



## kanachoe (Apr 20, 2007)

how can i fix it?


----------



## Megabite (Apr 5, 2008)

If you cannot restore maybe you have no restore points

Did you recently also post another Hijack This log and did the problem you where having then get fixed?


----------



## kanachoe (Apr 20, 2007)

there was restore points but its saying there isnt any and no the problem is still there and yes i did post a new hijack log. i dont know what to do


----------



## Megabite (Apr 5, 2008)

Apart from no restore points what is the other problems?


----------



## kanachoe (Apr 20, 2007)

1 computer is going slow
2 pdf files wont work with opera
3 i cant update my windows xp for some reason 
4 i have a scf file down on my tool bar that i dont know what it is and it wont open .


----------



## Megabite (Apr 5, 2008)

When you go to Windows Updates and click on it what exactly happens?


----------



## kanachoe (Apr 20, 2007)

it says its installing but doesnt


----------



## kanachoe (Apr 20, 2007)

It eventually let me install one of the upgrades but nothing else still works and the search on the start menu wont work i click on it and it wont pop up the search button.


----------



## kanachoe (Apr 20, 2007)

ere is a copy of whats happening when i put a pdf file up in opera this is what it looks like.

%PDF-1.2
%Çì�¢
6 0 obj
<</Length 7 0 R/Filter /FlateDecode>>
stream
xœí}[Óä¶'å{ÿŠïig6b¶† x�ˆ}�d]¬»Õm{½±/²îãþ$OK-íùõË* "‰C€(V%JK-EG7/EÜ‡	œÌê`ê‡êø?ýã‹Çgÿõìß?k¾ùñ™yøfúóÝ³v8ØºL;lóÐõÍCÛÆq^}õìëgÕtß=L7ÿ;=Eþû‹Ç‡7_L�º‡_O<ž4Ç½}¨«CÓTýÃ‹Çgÿú›ÿùâ?Ÿ5kÆ±Ÿnzñå³ýãñTçÌñÀ,·p\ÁqÇ‡ã±9tƒ?~î®�tý]÷~¾Ž÷¾ÚäŽG:þž‡¿Gü[¯×pÝfÊ�ÏÃãÓýo¿xøÝ©©›zjÞÚNík†c;ÛþØæcµ¥'�96hÕÈ-nÍ¡5Cÿ0˜êÐÖæÔÒ§f�^ÃUõöé„�ëöãÓ‰fú…?ñât¢>Ô�ìòŸœN´:þ,ûˆ÷ðŽ‡ã‰v>þa½�¿X¼äƒÜ3ßÍÁ\ÔÅŸðÄs<�ïXÜðùé„9zëO§�uèé†¿aÝ¼:žèÔ÷¾Äë‹'þót¢â_ ¦`ñÄ~Qá
&÷‹Å
a'KÖMÿ�ºø0t}¿Ù-MÝ|€^Nöl¨Ìa\/áìUÈ·`.¾rÇM#+lªáÀÜ´‡žÊòüþ¹»žúùÿ€Ÿã[email protected]÷Fø´73¿þÀ|×]÷I]þÉwM¢.¾„Çãë?‡û¿Èãóÿ
ÏG<ø¾ïáþ2ø^9SkRmýc>ß�¿Çúýs¦y^Âq®}þéžW
‰ò~
÷#~¬ü=ÖÞ�Ç¹çcýü¼ß�ÏËt_||®9¶6g^®:±û£éÁáƒx¾É˜ª^,?>ïÇî†xsõ¿õý[»+t¬>„¿µù™Þ	¶/_;8¡´¹ÇåÆfæqïCeæú&þ~„ûû`ÊÌqÊoº¦9}½4C¶ï‡‰¹Ù~Á¹´í4¡¯QC‡^»/ÛYMèíÔ¡<ô,%ýSXU×G`·‚kŽô=®žÙ9püîßMß¦œ(}úëª¡9¾ýñYmºàÌK>ÓŽÝèÎÐ¯æ3ß>ûž?qñª�*Æ˜vci¦ ŠR¿MÌøÐŸ¾Q#ìçñÊõÝ. 5‚•ç†±}¿ÿ
îõº®.¬+*]?X÷ÜööX:S·¹o/qw`×¶§O„‡~¬&�®ŒŸB™Þ€ãwCÃÿ6\~Ç§¡bfS‰÷ÿŽñúÇîu½Ï"„Ÿ™+Ïÿ]÷÷ð¸ßºŸÓÝXø�Üí]ª´[ÑaíàýXÙdjŸ�óÀÃÇÿ®çß6-ûec�n@fú{ã¨kp2 NÙ·‡ÁÏ8�×i>¬ÂÃ7êØ	sšìM}hf?ßÿ"úL�pû�A%˜¾îNÆËWBc�J¨«þ`Ú1¨„>Äq€bB¥ôë•rêéãlš>ú"Š;¬mO¾-~*áP_`GÇhíŽ}Èê-gØ¹Çy:\„R<ÿñÐv‰ãÿp¿o�p†¼n®Ç/ûŽ¿‚c|øgP˜"¡7ý.¾-/â"BûAœmbWÆ'I×:Þ/¢mÕœk•�ËšÎõ†vü´:èÌªf<´§1õöÖÏª�ë¨Õ±…ã!vÌPmÝ{¨®¦ÚFËG8
ïº‡jÂ¯™ß¹&®ae?|
‚ð·ð´�ÜÓ¸¤ŸÀÓñíŸÁÛð~xÝÛa×õp"†ÃdqŽS"u•Öm_,2fÙÐÍÔ,ãxª¼¾Ž7tâiºZâ©+£…ez`Ó‡X2là·0»ÿogtØ¡†}4½fh*Y;µˆNQêéûp°aQ;2$nŸöŸ WáñWpÿ+w½²¸î
�÷äuÕœQ5Uë-™9U�iªVaévbw��ÌX7Ž#?Öìüqõpm\:õõ†ä-�ýÈfnñ¿`NÏ-ãý
\Ç¥á,ß+xþ_$ø�ÌÃpÝÁæ
�ëÀXø>¬üïÜõÐ›Kà‚ç
"«ùè¢óÊýX9XØ«Zæß¯©™§Ö¬ÿï_3U‡U�û	°éð÷ÿïÆÍIïü'ýèçwÇF¥fb�<íßÁØ†¼!<¦ðšqš
^ð>|ÒpFÂÑl¼v8Œ-À¡ÞYCoc|Ð»ºjÖµ'ßc


----------



## Saga Lout (Sep 15, 2004)

*Try this from the Opera Tools>Preferences menu, Advanced tab. Select Programmes from the left hand pane and click on Add. in the Protocol box, type .pdf and then click on Open with another application. Navigate through the file system to the relevant Adobe exe file and click to Save. Download another file of type .pdf and see if Opera can now open it properly.
*


----------



## kanachoe (Apr 20, 2007)

nope it wont work i done what you said and it wont work


----------



## kanachoe (Apr 20, 2007)

im having more problems the computer keeps flicking and i couldnt click on the start to restart it then when i did the log in wouldnt come up and now im trying to install updates for the windows it has been downloading for nothing to happen for about 3 hours.


----------



## Megabite (Apr 5, 2008)

Can you try SafeMode with Networking

*How to Start in Safemode with Networking*

*1*. Restart your computer. 
*2*. Before the windows logo you should gently tap the *F8* key repeatedly until you are presented with a Windows XP Advanced Options menu. 
*3*. Select the option for Safe Mode with Networking using the arrow keys. 
*4*. Then press enter on your keyboard to boot into Safe Mode. 
*5*. Do whatever tasks you require and when you are done reboot to boot back into normal mode..


----------



## kanachoe (Apr 20, 2007)

Its not flicking anymore but i still cant update windows and on the start button the search wont come up and it seems like opera browser or something has taken all my passwords away and wont load a lot of pages.


----------



## rainforest123 (Dec 29, 2004)

Is there an error code displayed with the Win Update failure notice. Look for teeny tiny font.

some troubleshooting
http://support.microsoft.com/kb/949104

How to access the windows update log. 
http://support.microsoft.com/kb/902093

Try to obtain updates, again. 
start > run
eventvwr.exe
OK
maximize screen
On the left, left click "applications".
On the right, look for errors. at the time you tried to update Windows. 
RIGHT click said error > properties
Left click the button, right margin, with 2 pieces of paper. That will copy information to your computer's clipboard.

Paste into notepad, save file; then attach it to a reply; or into a reply.

RF123


----------



## kanachoe (Apr 20, 2007)

how do i get to the clipboard? and there is a lot of errors and warnings


----------



## Phantom010 (Mar 9, 2009)

Never mind the clipboard. Simply paste what you've copied into Notepad.


----------



## kanachoe (Apr 20, 2007)

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 23/01/2010
Time: 5:48:25 AM
User: N/A
Computer:	TRACY-PC
Description:
Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 66 69 72 65 66 6f firefo
0018: 78 2e 65 78 65 20 31 2e x.exe 1.
0020: 39 2e 31 2e 33 36 34 32 9.1.3642
0028: 20 69 6e 20 68 75 6e 67 in hung
0030: 61 70 70 20 30 2e 30 2e app 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 30 30 30 30 30 000000

is this it


----------



## rainforest123 (Dec 29, 2004)

You do not go to the clipboard. That which is copied is placed on your computer's clipboard, by Windows. Although I have seen utilities that show the contents of one's clipboard.

I suggested notepad, because, on occasion, & it seems to be the case with your problem, more than 1 error is present.



> is this it


Depends. Were you using FireFox? Was FF open? If yes, open FF in FF's safe mode, which is not the same as Windows' safe mode. 
start > programs > all programs > mozilla > FF [ safe mode ].

Which version of FF are you using?

RF123


----------



## Phantom010 (Mar 9, 2009)

Your computer is infected. I would click on the *Report* button and kindly ask to be moved to the *Malware Removal & HijackThis Logs* forum. From there, be patient. You should get an answer within the next 48 hours. These guys are really busy!​


----------



## rainforest123 (Dec 29, 2004)

*Try to obtain updates, again. *
Note the time.

If the computer problem occurs, return to event viewer and look for errors *or warnings* that are recorded at the time of the computer problem.

I have never been able to configure FF so that it functions like IE & thus will allow one to obtain Windows updates. In XP, I have never been able to do that. I haven't taken the time to configure FF to emulate IE.

RF123


----------



## rainforest123 (Dec 29, 2004)

> Your computer is infected.


That would account for the problems noted.

RF123


----------



## kanachoe (Apr 20, 2007)

I have 3 browsers but i mainly use opera and thats where all the problems started it is opera 10.5 version it wont let me open a lot of sites or pdfs,
so when i cant open the pdfs i use mozilla version 3.6
and the internet explorer doesnt work at all and its version ie 8
do youse think i should delete some of the browsers


----------



## Phantom010 (Mar 9, 2009)

> Your computer is infected. Please click on the *Report* button and kindly ask to be moved to the *Malware Removal & HijackThis Logs* forum. From there, be patient. You should get an answer within the next 48 hours. These guys are really busy!​


​


----------



## kanachoe (Apr 20, 2007)

ok thankyou to both of you


----------



## Phantom010 (Mar 9, 2009)

You're welcome!


----------



## rainforest123 (Dec 29, 2004)

You are welcome!!

:up:

RF123


----------



## kanachoe (Apr 20, 2007)

another thing i just tried to download Microsoft Security Essentials antivirus and its saying it can not as my operating system isnt supported by this program as its got to be xp services pack 2 or higher and mynes 3 and i dont have xp.


myne is xp professional 2002 services pack 3


----------



## rainforest123 (Dec 29, 2004)

See #37.

It is common for infected computers to not function properly.



> xp professional 2002 services pack 3


 is Windows XP Professional Service Pack 3.

You do, indeed, have XP.



> as its got to be xp services pack 2 or higher and mynes 3 and i dont have xp.


RF123


----------



## kanachoe (Apr 20, 2007)

its so frustrating getting them messages and i cant install anything because of it


----------



## rainforest123 (Dec 29, 2004)

YUP!

See #37. The sooner you do so, the sooner your issue will enter the que.

Be certain to read http://forums.techguy.org/malware-removal-hijackthis-logs/622404-please-read-here-first-before.html



> Now, when a user starts a new thread in the Malware Removal & HijackThis forum, the thread is automatically tagged "New" which appears to the left of the thread title. The tag "New" remains there even if the thread starter replies back to their own thread to add additional information. This also means that the thread starter can now post a reply to "bump" their thread back up to the top as is done in other forums. However, we do ask that posters be patient and wait at least 24 hours before doing so.


Thus, you might want to click "report", then ask the moderator if she / he suggests moving your thread or have you start a new thread & reference this thread.

I am not qualified by TGF to help with malware removal, so I have not been involved in such decisions.

Those at TGF who are designated as being qualified to assist with malware removal are intelligent, skilled and heavily burdened by the demands for their services.

and 
http://forums.techguy.org/malware-r...-important-security-forum-changes-effect.html

My advice. Get into the queue NOW. Be patient. Find your XP installation CD. 
All mentioned as advice and NOT as criticism.

RF123


----------



## kanachoe (Apr 20, 2007)

Phantom010 said:


> Your computer is infected. I would click on the *Report* button and kindly ask to be moved to the *Malware Removal & HijackThis Logs* forum. From there, be patient. You should get an answer within the next 48 hours. These guys are really busy!​


i done this but havent had a response or the thread moved


----------



## Phantom010 (Mar 9, 2009)

I don't know why. You could ask again in case they haven't noticed you. I did see a Moderator looking at your thread this morning but I don't know why it hasn't been moved yet.


----------



## kanachoe (Apr 20, 2007)

I just done it again


----------



## rainforest123 (Dec 29, 2004)

OK
:up:


----------



## Cookiegal (Aug 27, 2003)

Please download Malwarebytes' Anti-Malware from *Here*.

Double Click *mbam-setup.exe* to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish, so please be patient.
When the scan is complete, click *OK*, then *Show Results* to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to restart. (See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy and paste the entire report in your next reply.
Extra Note:

*If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts, click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.*


----------



## kanachoe (Apr 20, 2007)

thankyou cookiegal

Malwarebytes' Anti-Malware 1.44
Database version: 3662
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

30/01/2010 4:50:19 AM
mbam-log-2010-01-30 (04-50-19).txt

Scan type: Quick Scan
Objects scanned: 107875
Time elapsed: 5 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 20
Registry Values Infected: 2
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf1-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{00a6faf6-072e-44cf-8957-5838f569a31d} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07b18ea9-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1e0de227-5ce4-4ea3-ab0c-8b03e1aa76bc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{bb05bd70-4605-4829-93fc-ad80d8cc5b66} (Rogue.PerformanceCenter) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{497dddb6-6eee-4561-9621-b77dc82c1f84} (Rogue.Ascentive) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{31f3cf6e-a71a-4daa-852b-39ac230940b4} (Rogue.Ascentive) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINDOWS\system32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\adware_promfct (Rogue.AdwarePro) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Administrator\Application Data\FunWebProducts (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\SysRestore.dll (Rogue.Ascentive) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\avatar.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\outfit.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\register.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\zbucks.dat (Adware.MyWebSearch) -> Quarantined and deleted successfully.
C:\RECYCLER\ADAPT_Installer.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\MSVolume.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.


----------



## Cookiegal (Aug 27, 2003)

Download GMER from: http://gmer.net/index.php

Click on the Download exe button and save it on your desktop. It will create a oddly named exe file on your desktop. Double click that file to run it and select the rootkit tab and then press scan. When the scan is done, click *Copy*. This will copy the report to the clipboard. Paste it into Notepad and save it and also paste the log report back here please.


----------



## kanachoe (Apr 20, 2007)

cookiegal i done everything you said and when i went to save it and paste it on here it froze.so im doing it again hopefully this time it works.


----------



## kanachoe (Apr 20, 2007)

I just tried again and it wouldnt let me paste to notepad and then froze the whole computer again. and i had trouble getting everything to unfreeze i had to press windows task manager so many times before i got rid of everything then i couldnt restart the computer normally.


----------



## Cookiegal (Aug 27, 2003)

Let's try this one instead:


Download RootRepeal from the following location and save it to your desktop.
*Zip Mirrors*
Primary Mirror
Secondary Mirror
Secondary Mirror


Extract RootRepeal.exe from the archive.
Open RootRepeal on your desktop.

Be sure to close all other browser windows and let the scan run without interference.


----------



## kanachoe (Apr 20, 2007)

it went to scan but a error come up and wouldnt let it scan 


deviceI0 CONTROL ERROR!
ERROR CODE:0X0


----------



## Cookiegal (Aug 27, 2003)

Please go to *Start *- *Run *- type in *eventvwr.msc* to open the event viewer. Look under both "Application" and "System" for recent (the last 48 hours or so) errors (shown in red) and if found, do this for each one.

Double-click the error to open it up and then click on the icon that looks like two pieces of paper. This will copy the full error. Then "paste" the error into Notepad. Do this for each one until you have them all listed in Notepad and then copy and paste the list in a reply here please.


----------



## kanachoe (Apr 20, 2007)

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 1/02/2010
Time: 10:31:36 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:48 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 1/02/2010
Time: 10:17:46 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 30/01/2010
Time: 8:26:30 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:39 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## kanachoe (Apr 20, 2007)

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 8:20:37 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 30/01/2010
Time: 3:14:42 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 30/01/2010
Time: 2:21:36 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 30/01/2010
Time: 8:36:50 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 30/01/2010
Time: 5:18:29 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 29/01/2010
Time: 8:20:11 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 29/01/2010
Time: 7:59:04 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 29/01/2010
Time: 7:55:00 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3008
Date: 29/01/2010
Time: 7:54:02 PM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\NTUSER.INI> cannot be inserted into the history.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 29/01/2010
Time: 6:25:39 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 29/01/2010
Time: 3:34:58 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3024
Date: 29/01/2010
Time: 3:26:11 AM
User: N/A
Computer:	TRACY-PC
Description:
The update cannot be started because the content sources cannot be accessed. Fix the errors and try the update again.

Context: Windows Application, SystemIndex Catalog

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 29/01/2010
Time: 2:55:28 AM
User: N/A
Computer:	TRACY-PC
Description:
Hanging application iexplore.exe, version 8.0.6001.18702, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 69 65 78 70 6c 6f iexplo
0018: 72 65 2e 65 78 65 20 38 re.exe 8
0020: 2e 30 2e 36 30 30 31 2e .0.6001.
0028: 31 38 37 30 32 20 69 6e 18702 in
0030: 20 68 75 6e 67 61 70 70 hungapp
0038: 20 30 2e 30 2e 30 2e 30 0.0.0.0
0040: 20 61 74 20 6f 66 66 73 at offs
0048: 65 74 20 30 30 30 30 30 et 00000
0050: 30 30 30 000

Event Type:	Error
Event Source:	Microsoft Office 11
Event Category:	None
Event ID:	1000
Date: 29/01/2010
Time: 2:37:24 AM
User: N/A
Computer:	TRACY-PC
Description:
Faulting application winword.exe, version 11.0.8313.0, stamp 4a793d83, faulting module mso.dll, version 11.0.8221.0, stamp 483c699a, debug? 0, fault address 0x001c45f0.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 00 70 00 70 00 6c 00 A.p.p.l.
0008: 69 00 63 00 61 00 74 00 i.c.a.t.
0010: 69 00 6f 00 6e 00 20 00 i.o.n. .
0018: 46 00 61 00 69 00 6c 00 F.a.i.l.
0020: 75 00 72 00 65 00 20 00 u.r.e. .
0028: 20 00 77 00 69 00 6e 00 .w.i.n.
0030: 77 00 6f 00 72 00 64 00 w.o.r.d.
0038: 2e 00 65 00 78 00 65 00 ..e.x.e.
0040: 20 00 31 00 31 00 2e 00 .1.1...
0048: 30 00 2e 00 38 00 33 00 0...8.3.
0050: 31 00 33 00 2e 00 30 00 1.3...0.
0058: 20 00 34 00 61 00 37 00 .4.a.7.
0060: 39 00 33 00 64 00 38 00 9.3.d.8.
0068: 33 00 20 00 69 00 6e 00 3. .i.n.
0070: 20 00 6d 00 73 00 6f 00 .m.s.o.
0078: 2e 00 64 00 6c 00 6c 00 ..d.l.l.
0080: 20 00 31 00 31 00 2e 00 .1.1...
0088: 30 00 2e 00 38 00 32 00 0...8.2.
0090: 32 00 31 00 2e 00 30 00 2.1...0.
0098: 20 00 34 00 38 00 33 00 .4.8.3.
00a0: 63 00 36 00 39 00 39 00 c.6.9.9.
00a8: 61 00 20 00 66 00 44 00 a. .f.D.
00b0: 65 00 62 00 75 00 67 00 e.b.u.g.
00b8: 20 00 30 00 20 00 61 00 .0. .a.
00c0: 74 00 20 00 6f 00 66 00 t. .o.f.
00c8: 66 00 73 00 65 00 74 00 f.s.e.t.
00d0: 20 00 30 00 30 00 31 00 .0.0.1.
00d8: 63 00 34 00 35 00 66 00 c.4.5.f.
00e0: 30 00 0d 00 0a 00 0.....

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 23/01/2010
Time: 5:48:25 AM
User: N/A
Computer:	TRACY-PC
Description:
Hanging application firefox.exe, version 1.9.1.3642, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 66 69 72 65 66 6f firefo
0018: 78 2e 65 78 65 20 31 2e x.exe 1.
0020: 39 2e 31 2e 33 36 34 32 9.1.3642
0028: 20 69 6e 20 68 75 6e 67 in hung
0030: 61 70 70 20 30 2e 30 2e app 0.0.
0038: 30 2e 30 20 61 74 20 6f 0.0 at o
0040: 66 66 73 65 74 20 30 30 ffset 00
0048: 30 30 30 30 30 30 000000

Event Type:	Error
Event Source:	Application Error
Event Category:	None
Event ID:	1000
Date: 21/01/2010
Time: 8:25:36 AM
User: N/A
Computer:	TRACY-PC
Description:
Faulting application housecall.bin, version 1.3.0.1034, faulting module tscdll32.dll, version 6.1.0.3017, fault address 0x00050b20.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 46 61 69 6c ion Fail
0010: 75 72 65 20 20 68 6f 75 ure hou
0018: 73 65 63 61 6c 6c 2e 62 secall.b
0020: 69 6e 20 31 2e 33 2e 30 in 1.3.0
0028: 2e 31 30 33 34 20 69 6e .1034 in
0030: 20 74 73 63 64 6c 6c 33 tscdll3
0038: 32 2e 64 6c 6c 20 36 2e 2.dll 6.
0040: 31 2e 30 2e 33 30 31 37 1.0.3017
0048: 20 61 74 20 6f 66 66 73 at offs
0050: 65 74 20 30 30 30 35 30 et 00050
0058: 62 32 30 0d 0a b20..

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 1/02/2010
Time: 10:15:24 AM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 1/02/2010
Time: 10:15:24 AM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 1/02/2010
Time: 10:15:24 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## kanachoe (Apr 20, 2007)

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 1/02/2010
Time: 10:15:24 AM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 1/02/2010
Time: 10:15:24 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	W32Time
Event Category:	None
Event ID:	34
Date: 30/01/2010
Time: 8:19:28 PM
User: N/A
Computer:	TRACY-PC
Description:
The time service has detected that the system time needs to be changed by +86374 seconds. The time service will not change the system time by more than +54000 seconds. Verify that your time and time zone are correct, and that the time source time.windows.com (ntp.m|0x1|10.0.0.1:123->207.46.197.32:123) is working properly.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 30/01/2010
Time: 8:19:10 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 8:19:10 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 8:19:10 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 8:19:10 PM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 8:19:10 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 30/01/2010
Time: 2:19:29 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 2:19:29 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 2:19:29 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 2:19:29 PM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 2:19:29 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 30/01/2010
Time: 8:32:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 8:32:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 8:32:29 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 8:32:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 8:32:29 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 30/01/2010
Time: 4:54:15 AM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 4:54:15 AM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 4:54:15 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 30/01/2010
Time: 4:54:15 AM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 30/01/2010
Time: 4:54:15 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 29/01/2010
Time: 8:09:51 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 8:09:51 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 8:09:51 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 8:09:51 PM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 8:09:51 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 29/01/2010
Time: 7:53:50 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 7:53:50 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 7:53:50 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 7:53:50 PM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 7:53:50 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 29/01/2010
Time: 7:49:43 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 7:49:43 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 7:49:43 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 7:49:43 PM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 7:49:43 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 29/01/2010
Time: 5:57:26 AM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 5:57:26 AM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 5:57:26 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 29/01/2010
Time: 5:57:26 AM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 29/01/2010
Time: 5:57:26 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 28/01/2010
Time: 7:23:47 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 28/01/2010
Time: 7:23:47 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 28/01/2010
Time: 7:23:47 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 28/01/2010
Time: 7:23:47 PM
User: N/A
Computer:	TRACY-PC
Description:
The avast! Antivirus service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 28/01/2010
Time: 7:23:47 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the avast! Antivirus service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Let's run chkdsk.

Click Start and My Computer. Right-click the hard drive you want to check, and click Properties. Select the Tools tab and click Check Now. Check both boxes. Click Start. You'll get a message that the computer must be rebooted to run a complete check. Click Yes and reboot. Chkdsk will take awhile, so run it when you don't need to use the computer for something else.

To view results log:

Go to *Start *- *Run *and type in *eventvwr.msc*, and hit enter.
When Event Viewer opens, click on "Application", then scroll
down to "Winlogon" and double-click on it to open it up. This is the log
created after running chkdsk. Click on the icon that looks like two pieces of paper to copy it and then paste it here please.


----------



## kanachoe (Apr 20, 2007)

hi here is the log

Event Type:	Information
Event Source:	Winlogon
Event Category:	None
Event ID:	1001
Date: 2/02/2010
Time: 9:44:13 AM
User: N/A
Computer:	TRACY-PC
Description:
Checking file system on C:
The type of the file system is NTFS.
Volume label is System.

A disk check has been scheduled.
Windows will now check the disk. 
Cleaning up minor inconsistencies on the drive.
Cleaning up 114 unused index entries from index $SII of file 0x9.
Cleaning up 114 unused index entries from index $SDH of file 0x9.
Cleaning up 114 unused security descriptors.
CHKDSK is verifying Usn Journal...
Usn Journal verification completed.
CHKDSK is verifying file data (stage 4 of 5)...
File data verification completed.
CHKDSK is verifying free space (stage 5 of 5)...
Free space verification is complete.
CHKDSK discovered free space marked as allocated in the
master file table (MFT) bitmap.
Windows has made corrections to the file system.

78148160 KB total disk space.
32215884 KB in 125855 files.
75896 KB in 11094 indexes.
0 KB in bad sectors.
333736 KB in use by the system.
65536 KB occupied by the log file.
45522644 KB available on disk.

4096 bytes in each allocation unit.
19537040 total allocation units on disk.
11380661 allocation units available on disk.

Internal Info:
d0 db 02 00 00 17 02 00 ec 12 03 00 00 00 00 00 ................
1d b5 00 00 02 00 00 00 84 07 00 00 00 00 00 00 ................
04 30 9c 0c 00 00 00 00 78 b9 b2 6b 00 00 00 00 .0......x..k....
b4 be 8c 28 00 00 00 00 a0 e4 dc b3 03 00 00 00 ...(............
26 10 f3 24 02 00 00 00 7e 1d cc 82 06 00 00 00 &..$....~.......
40 30 36 77 00 00 00 00 50 3f 07 00 9f eb 01 00 @06w....P?......
00 00 00 00 00 30 4d ae 07 00 00 00 56 2b 00 00 .....0M.....V+..

Windows has finished checking your disk.
Please wait while your computer restarts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

Download *OTS.exe * to your Desktop and double-click on it to extract the files. It will create a folder named *OTS* on your desktop.

Close any open browsers.
If your Real protection or Antivirus interferes with OTS, allow it to run.
Open the *OTS* folder and double-click on *OTS.exe* to start the program.
In *Additional Scans *section put a check in Disabled MS Config Items and EventViewer logs
Now click the *Run Scan *button on the toolbar.
Let it run unhindered until it finishes.
When the scan is complete Notepad will open with the report file loaded in it.
Save that notepad file.
Use the *Reply* button, scroll down to the attachments section and attach the notepad file here.


----------



## kanachoe (Apr 20, 2007)

here it is


----------



## Cookiegal (Aug 27, 2003)

Start *OTS*. Copy/Paste the information in the code box below into the pane where it says *"Paste fix here"* and then click the "Run Fix" button.

The fix should only take a very short time. When the fix is completed a message box will popup telling you that it is finished. Click the OK button and Notepad will open with a log of actions taken during the fix. Post that information back here along with a new HijackThis log please.


```
[Kill All Processes]
[Unregister Dlls]
[Registry - Safe List]
< BHO's [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
YN -> {038cb5c7-48ea-4af9-94e0-a1646542e62b} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> {201f27d4-3704-41d6-89c1-aa35e39143ed} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
YN -> {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Internet Explorer ToolBars [HKEY_LOCAL_MACHINE] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar
YN -> "Locked" [HKLM] -> Reg Error: Key error. [Reg Error: Key error.]
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\
YN -> {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} [HKLM] -> Reg Error: Value error. [Reg Error: Key error.]
YN -> {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [HKLM] -> Reg Error: Value error. [Reg Error: Key error.]
YN -> {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [HKLM] -> Reg Error: Value error. [Reg Error: Key error.]
YN -> {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} [HKLM] -> Reg Error: Value error. [Reg Error: Key error.]
[Files/Folders - Created Within 30 Days]
NY ->  7 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp
NY ->  1 C:\windows\*.tmp files -> C:\windows\*.tmp
[Files/Folders - Modified Within 30 Days]
NY ->  7 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp
NY ->  31 C:\Documents and Settings\Administrator\Local Settings\temp\*.tmp files -> C:\Documents and Settings\Administrator\Local Settings\temp\*.tmp
NY ->  1 C:\windows\*.tmp files -> C:\windows\*.tmp
NY ->  1 C:\Documents and Settings\Administrator\Local Settings\temp\HouseCall\*.tmp files -> C:\Documents and Settings\Administrator\Local Settings\temp\HouseCall\*.tmp
NY ->  1 C:\Documents and Settings\Administrator\Local Settings\temp\HouseCall\*.tmp files -> C:\Documents and Settings\Administrator\Local Settings\temp\HouseCall\*.tmp
NY ->  1 C:\Documents and Settings\Administrator\Local Settings\temp\HCBackup\*.tmp files -> C:\Documents and Settings\Administrator\Local Settings\temp\HCBackup\*.tmp
[Alternate Data Streams]
NY -> @Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:723E56EC
NY -> @Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:0E5A8986
NY -> @Alternate Data Stream - 131 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2
NY -> @Alternate Data Stream - 135 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:814B9485
[Empty Temp Folders]
[Start Explorer]
[Reboot]
```
There also seems to be a problem with Avast. I recommend uninstalling and reinstalling it.


----------



## kanachoe (Apr 20, 2007)

hi here is the log thankyou

All Processes Killed
[Registry - Safe List]
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ToolBar\\Locked deleted successfully.
Starting removal of ActiveX control {30528230-99f7-4bb4-88d8-fa1d4f56a2ab}
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30528230-99f7-4bb4-88d8-fa1d4f56a2ab}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\Contains\Files\ not found.
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\ deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\Contains\Files\ not found.
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}\ deleted successfully.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\Contains\Files\ not found.
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\ deleted successfully.
[Files/Folders - Created Within 30 Days]
C:\windows\System32\SET102F.tmp deleted successfully.
C:\windows\System32\SET1034.tmp deleted successfully.
C:\windows\System32\SET103B.tmp deleted successfully.
C:\windows\System32\SET1044.tmp deleted successfully.
C:\windows\System32\SET1046.tmp deleted successfully.
C:\windows\System32\SET1048.tmp deleted successfully.
C:\windows\System32\SET1049.tmp deleted successfully.
C:\windows\003468_.tmp deleted successfully.
[Files/Folders - Modified Within 30 Days]
C:\Documents and Settings\Administrator\Local Settings\temp\byeFA8.tmp\Disk1 folder deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\byeFA8.tmp folder deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\IM_3DA.tmp folder deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache1548566835621547790.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache1692278932410804111.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache2051443306969068623.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache3135617406684775277.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache3629237604588853270.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache3816754354785531196.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache4124191873758540301.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache4260392303007788282.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache4747702107962579147.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache5264798001541398284.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache5352824456909778824.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache6223785330500734105.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache7331826217750725864.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache7491422493434106370.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache8486724769589942462.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\jar_cache954013444714621730.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\MPC291.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\MPC51.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\MPC708.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\MPCDB.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\nsz103.tmp folder deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DF2289.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DF3ECD.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DF5B6D.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DF76AC.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DF774.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DF920B.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DFB9B8.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~DFEBC.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\~nsu.tmp folder deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\HouseCall\iCRCReserve.tmp deleted successfully.
C:\Documents and Settings\Administrator\Local Settings\temp\HCBackup\iCRCReserve.tmp deleted successfully.
[Alternate Data Streams]
ADS C:\Documents and Settings\All Users\Application Data\TEMP:723E56EC deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:0E5A8986 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:4D066AD2 deleted successfully.
ADS C:\Documents and Settings\All Users\Application Data\TEMP:814B9485 deleted successfully.
[Empty Temp Folders]

User: Administrator
->Temp folder emptied: 133082760 bytes
->Temporary Internet Files folder emptied: 33379941 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 77417229 bytes
->Opera cache emptied: 91975376 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Opera cache emptied: 1723771 bytes

User: NetworkService
->Temp folder emptied: 820444 bytes
->Temporary Internet Files folder emptied: 45693673 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 712763 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 502020 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 6805922 bytes

Total Files Cleaned = 374.00 mb

< End of fix log >
OTS by OldTimer - Version 3.1.20.1 fix logfile created on 02032010_130059

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...


----------



## kanachoe (Apr 20, 2007)

hi here is the hijack log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:11:57 PM, on 3/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\windows\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\windows\RTHDCPL.EXE
C:\Program Files\Dodo Speed Accelerator\slipcore.exe
C:\Program Files\Dell AIO Printer 948\dldfmon.exe
C:\Program Files\Dell AIO Printer 948\memcard.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashWebSv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Dodo Speed Accelerator\slipgui.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2008 Deluxe\Planner\PLNRnote.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\windows\system32\dldfcoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\windows\system32\svchost.exe
C:\windows\system32\SearchIndexer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\VIDEOD~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Dodo Speed Accelerator\PBHelper.dll
O2 - BHO: ToolbarBHO Class - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Dodo Speed Accelerator\components\NOWImaging.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTSING~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: RAW Thumbnail Viewer - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O3 - Toolbar: Yahoo!7 Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Dodo Speed Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [dldfmon.exe] "C:\Program Files\Dell AIO Printer 948\dldfmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell AIO Printer 948\memcard.exe"
O4 - HKLM\..\Run: [Dell AIO Printer 948 Fax Server] "C:\Program Files\Dell AIO Printer 948\fm3032.exe" /s
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\Avast4\ashWebSv.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dodo Speed Accelerator.lnk = C:\Program Files\Dodo Speed Accelerator\slipgui.exe
O4 - Global Startup: Event Planner Reminder 2008.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1225368199591
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240125841343
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B7EBAEF-6B19-4424-805B-46FC78632DAF}: Domain = nsw.bigpond.net.au
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: dldfCATSCustConnectService - Unknown owner - C:\windows\System32\spool\DRIVERS\W32X86\3\\dldfserv.exe
O23 - Service: dldf_device - - C:\windows\system32\dldfcoms.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\windows\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 10962 bytes


----------



## kanachoe (Apr 20, 2007)

i cant get the folder for avast as i went to do a search for it but my search button on the start wont come up.


----------



## Cookiegal (Aug 27, 2003)

Open HijackThis and click on the *Open Misc Tools section* button. Click on the *Open Uninstall Manager* button. Click the *Save List* button. Save the list then copy and paste it here.


----------



## kanachoe (Apr 20, 2007)

2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
3D Landscape for Everyone
ABBYY FineReader 6.0 Sprint
Acrobat.com
Acronis*Disk Director Suite
Adobe AIR
Adobe AIR
Adobe Download Manager 2.2 (Remove Only)
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.3
Adobe Shockwave Player 11.5
Agere Systems PCI-SV92PP Soft Modem
aiofw
aioprnt
aioscnnr
ArcSoft MediaImpression 2
ArcSoft Panorama Maker 4
ArcSoft Photo Book Screen Saver
ArcSoft PhotoStudio 6
ArcSoft PhotoStudio Darkroom 2
ArcSoft Print Creations
ArcSoft Print Creations - Album Page
ArcSoft Print Creations - Funhouse
ArcSoft Print Creations - Greeting Card
ArcSoft Print Creations - Photo Book
ArcSoft Print Creations - Photo Calendar
ArcSoft Print Creations - Scrapbook
ArcSoft Print Creations - Slimline Card
ArcSoft RAW Thumbnail Viewer
ArcSoft Scan-n-Stitch Deluxe
ArcSoft Video Downloader
ArcSoft Video Downloader
ASUSUpdate
CCleaner
CCScore
center
Copernic Agent Basic
Corel Snapfire Plus
Critical Update for Windows Media Player 11 (KB959772)
Dell AIO Printer 948
Dodo Speed Accelerator
Driver Detective
DVD Suite
EmoDio
EmoDio
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESSini
ESSPCD
ESSPDock
ESSTOOLS
essvatgt
Hallmark Card Studio 2008 Deluxe
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB932716-v2)
Hotfix for Windows XP (KB945060-v3)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
IncrediMail
IncrediMail 2.0
Intel(R) Graphics Media Accelerator Driver
Invitation Express - Wedding Stationery Creation
Java(TM) 6 Update 18
Java(TM) 6 Update 7
KODAK AiO Home Center
Kodak EasyShare software
ksDIP
Lame ACM MP3 Codec
LoadIt
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional 2007
Microsoft Office Professional 2007 Trial
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Mozilla Firefox (3.6)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser (KB925673)
Nero 7 Essentials
netbrdg
OfotoXMI
OGA Notifier 2.0.0048.0
OpenOffice.org 3.0
Opera
Opera 10.10
PC Wizard 2008.1.85.2
PhotoImpression
Plan3D
Plan3D
PowerDVD
PowerProducer
PreReq
Racing Reels 4.05
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
Recuva
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB960003)
Security Update for Microsoft Office Excel 2007 (KB959997)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB950114)
Security Update for Microsoft Office system 2007 (KB954326)
Security Update for Microsoft Office system 2007 (KB956828)
Security Update for Microsoft Office Word 2007 (KB956358)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Serif PagePlus SE 1.0
SFR
SHASTA
skin0001
SKINXSDK
Slot_Parthenon 7.0
Slot_Scary 4.0
Slots_Cleo 3.0
staticcr
STK018_V2.01
Ulead Photo Express 4.0 SE
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office Outlook 2007 (KB952142)
Update for Microsoft Windows (KB971513)
Update for Outlook 2007 Junk Email Filter (kb968503)
Update for Windows Internet Explorer 8 (KB968220)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB978506)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VPRINTOL
Windows Defender
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows PowerShell(TM) 1.0
Windows Presentation Foundation
Windows Search 4.0
Windows XP Service Pack 3
WinRAR archiver
WIRELESS
XviD MPEG-4 Video Codec
Yahoo!7 Toolbar


----------



## kanachoe (Apr 20, 2007)

i finally got rid of advast


----------



## Cookiegal (Aug 27, 2003)

Please uninstall this older version of Java via the Control Panel - Add or Remove programs.

*Java(TM) 6 Update 7*

Now reinstall Avast or whatever anti-virus program you wish and post a new HijackThis log please.


----------



## kanachoe (Apr 20, 2007)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:35:12 PM, on 3/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\windows\system32\dldfcoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\windows\system32\svchost.exe
C:\windows\system32\SearchIndexer.exe
C:\windows\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\windows\RTHDCPL.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Dodo Speed Accelerator\slipcore.exe
C:\Program Files\Dell AIO Printer 948\dldfmon.exe
C:\Program Files\Dell AIO Printer 948\memcard.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\windows\system32\ctfmon.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2008 Deluxe\Planner\PLNRnote.exe
C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
C:\Program Files\Opera\opera.exe
C:\windows\system32\notepad.exe
C:\windows\system32\wuauclt.exe
C:\windows\system32\msiexec.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\VIDEOD~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Dodo Speed Accelerator\PBHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: ToolbarBHO Class - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Dodo Speed Accelerator\components\NOWImaging.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTSING~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: RAW Thumbnail Viewer - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O3 - Toolbar: Yahoo!7 Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Dodo Speed Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [dldfmon.exe] "C:\Program Files\Dell AIO Printer 948\dldfmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell AIO Printer 948\memcard.exe"
O4 - HKLM\..\Run: [Dell AIO Printer 948 Fax Server] "C:\Program Files\Dell AIO Printer 948\fm3032.exe" /s
O4 - HKLM\..\Run: [avast! Web Scanner] C:\PROGRA~1\ALWILS~1\Avast4\ashWebSv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\RunServices: [avast!] C:\Program Files\Alwil Software\Avast4\ashServ.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dodo Speed Accelerator.lnk = C:\Program Files\Dodo Speed Accelerator\slipgui.exe
O4 - Global Startup: Event Planner Reminder 2008.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Ulead Photo Express 4.0 SE Calendar Checker .lnk = C:\Program Files\Ulead Systems\Ulead Photo Express 4.0 SE\CalCheck.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1225368199591
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240125841343
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B7EBAEF-6B19-4424-805B-46FC78632DAF}: Domain = nsw.bigpond.net.au
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: dldfCATSCustConnectService - Unknown owner - C:\windows\System32\spool\DRIVERS\W32X86\3\\dldfserv.exe
O23 - Service: dldf_device - - C:\windows\system32\dldfcoms.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\windows\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 10783 bytes


----------



## Cookiegal (Aug 27, 2003)

Did you reinstall Avast? Because I only see one entry and it's not in the running processes.


----------



## kanachoe (Apr 20, 2007)

no i havent is it best to reinstall it now or not.


----------



## Cookiegal (Aug 27, 2003)

Yes, please do so and then post a new HijackThis log and let me know how things are.


----------



## kanachoe (Apr 20, 2007)

ok thanks


----------



## kanachoe (Apr 20, 2007)

i just downloaded it and reinstalled it now it doesnt work at all 


its saying unsecured 
your system is not protected please use the fix now button to start protecting your system


when i press this button it wont work


then there is another message saying the avast antivirus program has ben stopped to resume click start program and that doesnt work


----------



## Cookiegal (Aug 27, 2003)

Please remove ComboFix if you still have it by dragging it to the recycle bin. Then grab the latest version and run a new scan.

Please visit *Combofix Guide & Instructions * for instructions for downloading and running ComboFix.

The only thing different from the instructions there is that when downloading and saving the ComboFix.exe I would like you to rename it to puppy.exe please.


----------



## kanachoe (Apr 20, 2007)

hi here it is

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1015.487 [GMT 11:00]
Running from: c:\documents and settings\Administrator\Desktop\puppy.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Start Menu\Programs\Startup\Ulead Photo Express 4.0 SE Calendar Checker .lnk
C:\setup.exe
c:\windows\system32\EV02
c:\windows\system32\muzapp.exe

.
((((((((((((((((((((((((( Files Created from 2010-01-04 to 2010-02-04 )))))))))))))))))))))))))))))))
.

2010-02-04 00:09 . 2010-01-28 21:57	163280	----a-w-	c:\windows\system32\drivers\aswSP.sys
2010-02-04 00:09 . 2010-01-28 21:54	19024	----a-w-	c:\windows\system32\drivers\aswFsBlk.sys
2010-02-04 00:09 . 2010-01-28 21:54	23376	----a-w-	c:\windows\system32\drivers\aswRdr.sys
2010-02-04 00:09 . 2010-01-28 21:57	46672	----a-w-	c:\windows\system32\drivers\aswTdi.sys
2010-02-04 00:09 . 2010-01-28 21:54	100432	----a-w-	c:\windows\system32\drivers\aswmon2.sys
2010-02-04 00:09 . 2010-01-28 21:54	94800	----a-w-	c:\windows\system32\drivers\aswmon.sys
2010-02-04 00:09 . 2010-01-28 21:53	28240	----a-w-	c:\windows\system32\drivers\aavmker4.sys
2010-02-04 00:09 . 2010-01-28 22:09	38848	----a-w-	c:\windows\system32\avastSS.scr
2010-02-04 00:09 . 2010-01-28 22:09	152672	----a-w-	c:\windows\system32\aswBoot.exe
2010-02-04 00:09 . 2010-02-04 00:09	--------	d-----w-	c:\documents and settings\All Users\Application Data\Alwil Software
2010-02-03 02:00 . 2010-02-03 02:00	--------	d-----w-	C:\_OTS
2010-01-29 18:05 . 2010-01-21 06:10	52224	----a-w-	c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\FFExternalAlert.dll
2010-01-29 18:05 . 2010-01-21 06:10	101376	----a-w-	c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\RadioWMPCore.dll
2010-01-29 18:05 . 2010-01-25 06:25	65536	----a-w-	c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\extensions\{bc1162e8-b2dc-4e91-80e7-74a6b86ec21a}\components\Engine.dll
2010-01-29 17:39 . 2010-01-07 05:07	38224	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-29 17:39 . 2010-01-29 17:39	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2010-01-29 17:39 . 2010-01-07 05:07	18520	----a-w-	c:\windows\system32\drivers\mbam.sys
2010-01-29 09:59 . 2010-01-29 09:59	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Windows Search
2010-01-28 23:13 . 2010-01-28 23:13	--------	d-----w-	C:\72534f13bf7e92205e6e52
2010-01-28 16:27 . 2010-01-28 16:29	--------	d-----w-	c:\documents and settings\LocalService\Local Settings\Application Data\Adobe
2010-01-28 16:26 . 2010-01-28 16:26	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Windows Desktop Search
2010-01-28 16:25 . 2010-01-29 09:01	--------	d-----w-	c:\program files\Windows Desktop Search
2010-01-28 16:25 . 2010-01-28 16:25	--------	d-----w-	c:\windows\system32\GroupPolicy
2010-01-28 16:23 . 2008-03-07 17:02	98304	-c----w-	c:\windows\system32\dllcache\nlhtml.dll
2010-01-28 16:23 . 2008-03-07 17:02	29696	-c----w-	c:\windows\system32\dllcache\mimefilt.dll
2010-01-28 16:23 . 2008-03-07 17:02	192000	-c----w-	c:\windows\system32\dllcache\offfilt.dll
2010-01-15 04:29 . 2010-01-15 05:35	38784	----a-w-	c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-14 22:31 . 2010-01-14 22:31	315392	----a-w-	c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-20c4acd8-n\jogl.dll
2010-01-14 22:31 . 2010-01-14 22:31	20480	----a-w-	c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-20c4acd8-n\jogl_awt.dll
2010-01-14 22:31 . 2010-01-14 22:31	114688	----a-w-	c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\62\6baea4fe-20c4acd8-n\jogl_cg.dll
2010-01-14 22:31 . 2010-01-14 22:31	20480	----a-w-	c:\documents and settings\Administrator\Application Data\Sun\Java\Deployment\SystemCache\6.0\45\4f710eed-6958a037-n\gluegen-rt.dll
2010-01-13 00:16 . 2010-02-04 00:09	--------	d-----w-	c:\program files\Alwil Software
2010-01-12 13:55 . 2010-01-12 13:55	--------	d-----w-	c:\program files\CCleaner
2010-01-12 13:45 . 2010-01-12 13:45	--------	d-sh--w-	c:\documents and settings\Administrator\IECompatCache
2010-01-10 14:21 . 2010-01-10 14:21	--------	d-----w-	c:\program files\Recuva
2010-01-10 14:21 . 2010-01-10 14:21	--------	d-----w-	c:\program files\Phoenix Technologies
2010-01-10 14:21 . 2010-01-10 14:21	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Yahoo!
2010-01-09 15:24 . 2010-01-10 14:19	--------	d-----w-	c:\documents and settings\All Users\Application Data\Yahoo! Companion
2010-01-08 05:04 . 2009-11-21 15:51	471552	-c----w-	c:\windows\system32\dllcache\aclayers.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-03 04:15 . 2009-10-25 05:19	3140	--sha-w-	c:\windows\system32\KGyGaAvL.sys
2010-02-03 04:15 . 2009-10-25 05:19	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Corel
2010-02-03 04:15 . 2009-10-25 05:19	88	--sh--r-	c:\windows\system32\DBC8522492.sys
2010-02-03 03:31 . 2008-08-28 12:41	--------	d-----w-	c:\program files\Java
2010-02-03 02:24 . 2009-08-28 16:35	602	----a-w-	c:\documents and settings\All Users\Application Data\ArcSoft\kodak-printcreations-22-080812-oem\acforall.dll
2010-01-31 21:19 . 2009-03-27 11:48	1	----a-w-	c:\documents and settings\Administrator\Application Data\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-01-28 15:33 . 2009-03-19 23:30	--------	d-----w-	c:\documents and settings\Administrator\Application Data\Serif
2010-01-27 11:14 . 2008-08-01 07:53	--------	d-----w-	c:\program files\Opera
2010-01-20 16:01 . 2009-08-05 06:59	--------	d-----w-	c:\program files\Microsoft Silverlight
2010-01-15 05:36 . 2009-06-07 10:24	--------	d-----w-	c:\program files\Common Files\Adobe AIR
2010-01-15 05:35 . 2009-04-22 10:27	38784	----a-w-	c:\documents and settings\Administrator\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-01-15 04:27 . 2007-11-21 23:44	--------	d-----w-	c:\program files\Common Files\Adobe
2010-01-14 22:31 . 2008-12-12 09:30	411368	----a-w-	c:\windows\system32\deploytk.dll
2010-01-14 00:12 . 2009-10-03 03:17	181120	------w-	c:\windows\system32\MpSigStub.exe
2010-01-12 13:29 . 2009-06-21 12:20	--------	d-----w-	c:\program files\PopCap Games
2010-01-09 15:24 . 2008-09-17 23:54	--------	d-----w-	c:\program files\Yahoo!
2010-01-07 09:00 . 2009-04-27 13:44	960584	----a-w-	c:\documents and settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
2010-01-03 14:34 . 2008-08-02 23:40	--------	d-----w-	c:\program files\IncrediMail
2010-01-02 22:59 . 2009-08-28 09:00	--------	d-----w-	c:\documents and settings\All Users\Application Data\Kodak
2009-12-21 19:14 . 2004-08-04 12:00	916480	----a-w-	c:\windows\system32\wininet.dll
2009-12-19 00:14 . 2009-10-27 08:58	--------	d-----w-	c:\documents and settings\Administrator\Application Data\948 Series
2009-12-19 00:13 . 2009-10-25 04:48	--------	d-----w-	c:\program files\Dell AIO Printer 948
2009-12-10 16:58 . 2008-12-18 05:21	--------	d-----w-	c:\documents and settings\Administrator\Application Data\SlipStream
2009-11-21 15:51 . 2004-08-04 12:00	471552	----a-w-	c:\windows\AppPatch\aclayers.dll
2009-11-14 14:58 . 2009-11-14 14:58	0	----a-w-	c:\windows\popcreg.dat
2009-11-13 20:26 . 2009-11-13 20:26	152576	----a-w-	c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-11-13 20:25 . 2009-11-13 20:25	79488	----a-w-	c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2008-08-21 15:39 . 2008-08-21 15:39	0	----a-w-	c:\program files\temp01
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2010-02-02 349640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2006-11-23 56928]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2006-12-05 54832]
"SkyTel"="SkyTel.EXE" [2007-04-04 1822720]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-10-05 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-10-05 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-10-05 94208]
"RTHDCPL"="RTHDCPL.EXE" [2007-04-10 16126464]
"ArcSoft Connection Service"="c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe" [2009-10-10 203264]
"OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2006-04-12 1261475]
"Conime"="c:\windows\system32\conime.exe" [2008-04-14 27648]
"EKIJ5000StatusMonitor"="c:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe" [2009-08-02 1626112]
"SlipStream"="c:\program files\Dodo Speed Accelerator\slipcore.exe" [2006-06-08 253952]
"dldfmon.exe"="c:\program files\Dell AIO Printer 948\dldfmon.exe" [2007-09-18 455336]
"MemoryCardManager"="c:\program files\Dell AIO Printer 948\memcard.exe" [2007-09-18 410280]
"Dell AIO Printer 948 Fax Server"="c:\program files\Dell AIO Printer 948\fm3032.exe" [2007-09-20 312560]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-12-21 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-12-11 948672]
"Corel Photo Downloader"="c:\program files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe" [2007-03-20 478800]
"avast5"="c:\progra~1\ALWILS~1\Avast5\avastUI.exe" [2010-01-28 2757512]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Dodo Speed Accelerator.lnk - c:\program files\Dodo Speed Accelerator\slipgui.exe [2009-10-19 167936]
Event Planner Reminder 2008.lnk - c:\windows\Installer\{747A6A10-DA58-48C2-A1F0-C15514419C8A}\Shortcut_EventPlan_5D0DF1BBD82E4FB2B98E4FDE42EF7EBB.exe [2008-10-30 1718]
Kodak EasyShare software.lnk - c:\program files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2009-7-10 323584]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-24 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
"Performance Center"=c:\program files\Ascentive\Performance Center\ApcMain.exe -m

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
"NeroFilterCheck"=c:\program files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"d:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\AiOHomeCenter.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\Kodak.Statistics.exe"=
"c:\\Program Files\\Kodak\\AiO\\Center\\NetworkPrinterDiscovery.exe"=
"c:\\Program Files\\Kodak\\AiO\\Firmware\\KodakAiOUpdater.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\Kodak\\Installer\\Setup.exe"=
"c:\\WINDOWS\\system32\\dldfcoms.exe"=
"c:\\Program Files\\Dell AIO Printer 948\\dldfmon.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldfpswx.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldftime.exe"=
"c:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\dldfjswx.exe"=
"c:\\Program Files\\Dell AIO Printer 948\\dldfaiox.exe"=
"c:\\Program Files\\Opera\\opera.exe"=
"c:\\Program Files\\Dell AIO Printer 948\\DLDFFax.exe"=
"c:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Opera\\Opera\\temporary_downloads\\IncMail.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCPxpsp2res.dll,-22009
"9322:TCP"= 9322:TCP:EKDiscovery

R1 aswSP;aswSP;c:\windows\system32\drivers\aswSP.sys [4/02/2010 11:09 AM 163280]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [4/02/2010 11:09 AM 19024]
R2 dldf_device;dldf_device;c:\windows\system32\dldfcoms.exe -service --> c:\windows\system32\dldfcoms.exe -service [?]
R2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [3/11/2006 7:19 PM 13592]
S2 aswMon;aswMon;c:\windows\system32\drivers\aswmon.sys [4/02/2010 11:09 AM 94800]
S2 dldfCATSCustConnectService;dldfCATSCustConnectService;c:\windows\system32\spool\drivers\w32x86\3\dldfserv.exe [25/10/2009 3:59 PM 98952]
S2 Kodak AiO Network Discovery Service;Kodak AiO Network Discovery Service;c:\program files\Kodak\AiO\Center\ekdiscovery.exe [5/08/2009 12:49 PM 284016]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - ASWTDI
*NewlyCreated* - AVAST!_ANTIVIRUS
.
Contents of the 'Scheduled Tasks' folder

2010-02-03 c:\windows\Tasks\Kodak AiO Scheduled Maintenance.job
- c:\program files\Kodak\AiO\Center\Kodak.Statistics.exe [2009-08-05 01:49]

2010-02-03 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 08:20]

2010-02-03 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 05:07]

2010-02-03 c:\windows\Tasks\User_Feed_Synchronization-{AF64C872-9B75-4986-9A88-15E1A842B5B8}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 17:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://mystart.incredimail.com/
uInternet Settings,ProxyOverride = <local>
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
LSP: c:\progra~1\DODOSP~1\sliplsp.dll
Handler: copernicagent - {A979B6BD-E40B-4A07-ABDD-A62C64A4EBF6} - c:\progra~1\COPERN~1\COPERN~1.DLL
Handler: copernicagentcache - {AAC34CFD-274D-4A9D-B0DC-C74C05A67E1D} - c:\progra~1\COPERN~1\COPERN~1.DLL
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2077543&SearchSource=3&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://mystart.incredimail.com/
FF - prefs.js: keyword.URL - hxxp://search.freecause.com/search?fr=freecause&ourmark=3&type=58931&p=
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\FFExternalAlert.dll
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\extensions\{038cb5c7-48ea-4af9-94e0-a1646542e62b}\components\RadioWMPCore.dll
FF - component: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\l11ea3wu.default\extensions\{bc1162e8-b2dc-4e91-80e7-74a6b86ec21a}\components\Engine.dll
FF - component: c:\program files\ArcSoft\RAW Thumbnail Viewer\FireFox Extension\components\FirefoxMenu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-avast! Web Scanner - c:\progra~1\ALWILS~1\Avast4\ashWebSv.exe
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
AddRemove-InstallShield_{C20CE592-B0F8-4D20-BF31-0151CA6331A6} - c:\program files\InstallShield Installation Information\{C20CE592-B0F8-4D20-BF31-0151CA6331A6}\setup.exe

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-04 12:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-515967899-1580436667-839522115-500\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (Administrator)
"659BD8E725A05FDCC64118EA787EAA2B534A94FABE"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,f2,fa,87,40,a9,9b,42,88,f6,fa,\
"3A77B377802A4B6183DDE08FDE4AD9AF647A702826"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,7e,f2,fa,87,40,a9,9b,42,88,f6,fa,\
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a0,05,72,fe,d9,2a,8e,45,8b,8b,01,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a1,1d,01,ec,22,63,90,4f,a2,e8,d6,\
"6256FFB019F8FDFBD36745B06F4540E9AEAF222A25"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,a0,05,72,fe,d9,2a,8e,45,8b,8b,01,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(920)
c:\progra~1\DODOSP~1\sliplsp.dll
c:\windows\system32\sliprt.dll
.
Completion time: 2010-02-04 12:31:41
ComboFix-quarantined-files.txt 2010-02-04 01:31

Pre-Run: 46,808,297,472 bytes free
Post-Run: 46,766,063,616 bytes free

- - End Of File - - 3B4E8C79F5A79A168B5C574FADFF1F27


----------



## Cookiegal (Aug 27, 2003)

Are you still having problems with Avast? If so, please uninstall it again and then run this removal tool.

http://www.avast.com/uninstall-utility

Then reboot the computer and redownload Avast. When installing Avast, be sure all other windows are closed.

Let me know how that goes please.


----------



## kanachoe (Apr 20, 2007)

ok cause i noticed last night the computer kept going really slow and freezing and wouldnt let the mouse or keyboard work at all till i restarted it.


----------



## Cookiegal (Aug 27, 2003)

Are there other user accounts on this computer?


----------



## kanachoe (Apr 20, 2007)

no only this one i deleted it dont know if i done it right tho. ill reinstall avast now thanks


----------



## kanachoe (Apr 20, 2007)

i noticed i had a folder in there with windows nt


----------



## kanachoe (Apr 20, 2007)

hi i finally got it downloaded and working and it doesnt seem to be freezing now avast found 1 virus threat so i put in the chest,
here is the new log from hijack

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:10:40 AM, on 6/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\windows\system32\dldfcoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\windows\system32\svchost.exe
C:\windows\system32\SearchIndexer.exe
C:\windows\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\windows\RTHDCPL.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Dodo Speed Accelerator\slipcore.exe
C:\Program Files\Dell AIO Printer 948\dldfmon.exe
C:\Program Files\Dell AIO Printer 948\memcard.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2008 Deluxe\Planner\PLNRnote.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\Program Files\Alwil Software\Avast5\avastUI.exe
C:\Program Files\Opera\Opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\VIDEOD~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Dodo Speed Accelerator\PBHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: ToolbarBHO Class - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Dodo Speed Accelerator\components\NOWImaging.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTSING~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: RAW Thumbnail Viewer - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O3 - Toolbar: Yahoo!7 Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Dodo Speed Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [dldfmon.exe] "C:\Program Files\Dell AIO Printer 948\dldfmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell AIO Printer 948\memcard.exe"
O4 - HKLM\..\Run: [Dell AIO Printer 948 Fax Server] "C:\Program Files\Dell AIO Printer 948\fm3032.exe" /s
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dodo Speed Accelerator.lnk = C:\Program Files\Dodo Speed Accelerator\slipgui.exe
O4 - Global Startup: Event Planner Reminder 2008.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1225368199591
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240125841343
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B7EBAEF-6B19-4424-805B-46FC78632DAF}: Domain = nsw.bigpond.net.au
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: dldfCATSCustConnectService - Unknown owner - C:\windows\System32\spool\DRIVERS\W32X86\3\\dldfserv.exe
O23 - Service: dldf_device - - C:\windows\system32\dldfcoms.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\windows\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 10408 bytes


----------



## Cookiegal (Aug 27, 2003)

kanachoe said:


> i noticed i had a folder in there with windows nt


Can you explain what you mean by this? I'm not understanding.


----------



## Cookiegal (Aug 27, 2003)

kanachoe said:


> hi i finally got it downloaded and working and it doesnt seem to be freezing now avast found 1 virus threat so i put in the chest,


What virus did Avast fine and where was it located?


----------



## Cookiegal (Aug 27, 2003)

Also, please go back into the Event Viewer (as you did in post 61) and post all errors that have occurred only in the last two days please under both Application and System.


----------



## kanachoe (Apr 20, 2007)

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 7/02/2010
Time: 9:30:17 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3036
Date: 7/02/2010
Time: 3:36:08 AM
User: N/A
Computer:	TRACY-PC
Description:
The content source <outlookexpress://{s-1-5-21-515967899-1580436667-839522115-500}/{14ad1c2d-9eff-4e2f-9c62-d1406dcc4c8b}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
(0x81270005)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3036
Date: 6/02/2010
Time: 3:42:41 AM
User: N/A
Computer:	TRACY-PC
Description:
The content source <outlookexpress://{s-1-5-21-515967899-1580436667-839522115-500}/{14ad1c2d-9eff-4e2f-9c62-d1406dcc4c8b}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
(0x81270005)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 6/02/2010
Time: 2:19:30 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:30 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:30 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\UNINSTALL POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:30 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:30 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\READ ME.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:30 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:30 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\SYSTEM DIAGNOSIS.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\POWERDVD HELP FILE.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3013
Date: 6/02/2010
Time: 2:09:29 AM
User: N/A
Computer:	TRACY-PC
Description:
The entry <C:\DOCUMENTS AND SETTINGS\ADMINISTRATOR\START MENU\PROGRAMS\CYBERLINK DVD SUITE\POWERDVD\CYBERLINK POWERDVD.LNK> in the hash map cannot be updated.

Context: Application, SystemIndex Catalog

Details:
A device attached to the system is not functioning. (0x8007001f)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 5/02/2010
Time: 12:56:54 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 5/02/2010
Time: 12:23:20 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 4/02/2010
Time: 10:20:56 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 7/02/2010
Time: 9:04:57 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 7/02/2010
Time: 9:04:57 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 7/02/2010
Time: 9:04:57 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 7/02/2010
Time: 8:37:43 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 7/02/2010
Time: 8:37:43 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 7/02/2010
Time: 8:37:43 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	W32Time
Event Category:	None
Event ID:	36
Date: 6/02/2010
Time: 3:46:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 6/02/2010
Time: 2:07:12 AM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 6/02/2010
Time: 2:07:12 AM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 6/02/2010
Time: 2:07:12 AM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 5/02/2010
Time: 12:40:34 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 5/02/2010
Time: 12:40:34 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 5/02/2010
Time: 12:40:34 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:39:12 PM
User: NT AUTHORITY\SYSTEM
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:38:56 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:38:47 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:32:13 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service wuauserv with arguments "" in order to run the server:
{E60687F7-01A1-40AA-86AC-DB1CBF673334}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7026
Date: 5/02/2010
Time: 12:28:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The following boot-start or system-start driver(s) failed to load: 
AFD
Fips
intelppm
IPSec
MRxSmb
NetBIOS
NetBT
RasAcd
Rdbss
StarOpen
Tcpip
WS2IFSL

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7001
Date: 5/02/2010
Time: 12:28:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: 
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 5/02/2010
Time: 12:28:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7001
Date: 5/02/2010
Time: 12:28:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: 
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7001
Date: 5/02/2010
Time: 12:28:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: 
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7001
Date: 5/02/2010
Time: 12:28:20 PM
User: N/A
Computer:	TRACY-PC
Description:
The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: 
A device attached to the system is not functioning.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:28:02 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service StiSvc with arguments "" in order to run the server:
{A1F4E726-8CF1-11D1-BF92-0060081ED811}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:27:46 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service netman with arguments "" in order to run the server:
{BA126AE5-2166-11D1-B1D0-00805FC1270E}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10005
Date: 5/02/2010
Time: 12:27:43 PM
User: NT AUTHORITY\SYSTEM
Computer:	TRACY-PC
Description:
DCOM got error "This service cannot be started in Safe Mode " attempting to start the service EventSystem with arguments "" in order to run the server:
{1BE1F766-5536-11D1-B726-00C04FB926AF}

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 5/02/2010
Time: 12:17:09 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 5/02/2010
Time: 12:17:09 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 5/02/2010
Time: 12:17:09 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	W32Time
Event Category:	None
Event ID:	36
Date: 5/02/2010
Time: 11:20:53 AM
User: N/A
Computer:	TRACY-PC
Description:
The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	Tcpip
Event Category:	None
Event ID:	4226
Date: 4/02/2010
Time: 9:42:46 PM
User: N/A
Computer:	TRACY-PC
Description:
TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 00 00 00 00 01 00 54 00 ......T.
0008: 00 00 00 00 82 10 00 80 ....&#130;..&#128;
0010: 01 00 00 00 00 00 00 00 ........
0018: 00 00 00 00 00 00 00 00 ........
0020: 00 00 00 00 00 00 00 00 ........


----------



## kanachoe (Apr 20, 2007)

1 in my arcsoft win32 shutdowner trj

1 in my c/system volume informat i_restore{947a4e86-a777-4d2d-9a70-db2f9861571c}rp692\a0106194.exe


----------



## Cookiegal (Aug 27, 2003)

kanachoe said:


> 1 in my arcsoft win32 shutdowner trj


What the exact name of the file and the path please.


----------



## kanachoe (Apr 20, 2007)

c:\Documents and settings\All users\Desktop\Downloads\Installer_Arcsoft_PhotoImpression_6_5_Gold.exe


----------



## Cookiegal (Aug 27, 2003)

Is that a legitimate installer? I'm asking because I can't find anything on that file name.


----------



## kanachoe (Apr 20, 2007)

i did have photo impression on here ages ago


----------



## Cookiegal (Aug 27, 2003)

Well since it appears that was a crack for the program, it likely was infected.

Do you still have the Dell AIO Printer 948 printer and scanner?


----------



## kanachoe (Apr 20, 2007)

yeah thats my printer now that i have had for about 2 months


----------



## kanachoe (Apr 20, 2007)

Cookiegal said:


> Well since it appears that was a crack for the program, it likely was infected.
> 
> Do you still have the Dell AIO Printer 948 printer and scanner?


how do i get rid of that program?


----------



## Cookiegal (Aug 27, 2003)

Did you install the software for the printer?

There are errors that are related to the printer.

What program do you want to uninstall?


----------



## kanachoe (Apr 20, 2007)

yeah i installed the drivers and utilities into the computer from the cd

the photimpression program it doesnt work only the pictures are in that program


----------



## Cookiegal (Aug 27, 2003)

Is PhotoImpression listed in Add or Remove Programs in the Control Panel? If so, try uninstalling it from there.


----------



## Cookiegal (Aug 27, 2003)

I suggest uninstalling the printer/scanner software and reinstalling it as there are errors relating to it in the Event Viewer.


----------



## kanachoe (Apr 20, 2007)

hi i reinstalled the printer and i deleted the photimpression


----------



## Cookiegal (Aug 27, 2003)

Please go into the Event Viewer again and post any new errors under both Application and System that have occurred since you reinstalled the printer.


----------



## kanachoe (Apr 20, 2007)

hi here it is thanks

Event Type:	Warning
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3036
Date: 13/02/2010
Time: 2:09:32 AM
User: N/A
Computer:	TRACY-PC
Description:
The content source <outlookexpress://{s-1-5-21-515967899-1580436667-839522115-500}/{14ad1c2d-9eff-4e2f-9c62-d1406dcc4c8b}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
(0x81270005)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Application Hang
Event Category:	(101)
Event ID:	1002
Date: 13/02/2010
Time: 2:05:57 AM
User: N/A
Computer:	TRACY-PC
Description:
Hanging application msimn.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: 41 70 70 6c 69 63 61 74 Applicat
0008: 69 6f 6e 20 48 61 6e 67 ion Hang
0010: 20 20 6d 73 69 6d 6e 2e msimn.
0018: 65 78 65 20 36 2e 30 2e exe 6.0.
0020: 32 39 30 30 2e 35 35 31 2900.551
0028: 32 20 69 6e 20 68 75 6e 2 in hun
0030: 67 61 70 70 20 30 2e 30 gapp 0.0
0038: 2e 30 2e 30 20 61 74 20 .0.0 at 
0040: 6f 66 66 73 65 74 20 30 offset 0
0048: 30 30 30 30 30 30 30 0000000

Event Type:	Warning
Event Source:	MsiInstaller
Event Category:	None
Event ID:	1001
Date: 12/02/2010
Time: 8:10:45 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
Detection of product '{90110409-6000-11D3-8CFE-0150048383C9}', feature 'ProductNonBootFiles' failed during request for component '{22056900-C842-11D1-A0DD-00A0C9054277}'

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	MsiInstaller
Event Category:	None
Event ID:	1004
Date: 12/02/2010
Time: 8:10:45 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
Detection of product '{90110409-6000-11D3-8CFE-0150048383C9}', feature 'ProductNonBootFiles', component '{EE6C0B94-C3A4-11D3-91C4-00600893B51B}' failed. The resource 'C:\Program Files\Common Files\ODBC\Data Sources\' does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	MsiInstaller
Event Category:	None
Event ID:	1001
Date: 12/02/2010
Time: 8:10:38 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
Detection of product '{90110409-6000-11D3-8CFE-0150048383C9}', feature 'ProductNonBootFiles' failed during request for component '{22056900-C842-11D1-A0DD-00A0C9054277}'

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	MsiInstaller
Event Category:	None
Event ID:	1004
Date: 12/02/2010
Time: 8:10:38 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
Detection of product '{90110409-6000-11D3-8CFE-0150048383C9}', feature 'ProductNonBootFiles', component '{EE6C0B94-C3A4-11D3-91C4-00600893B51B}' failed. The resource 'C:\Program Files\Common Files\ODBC\Data Sources\' does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	MsiInstaller
Event Category:	None
Event ID:	1001
Date: 12/02/2010
Time: 8:09:35 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
Detection of product '{90110409-6000-11D3-8CFE-0150048383C9}', feature 'ProductNonBootFiles' failed during request for component '{22056900-C842-11D1-A0DD-00A0C9054277}'

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	MsiInstaller
Event Category:	None
Event ID:	1004
Date: 12/02/2010
Time: 8:09:35 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
Detection of product '{90110409-6000-11D3-8CFE-0150048383C9}', feature 'ProductNonBootFiles', component '{EE6C0B94-C3A4-11D3-91C4-00600893B51B}' failed. The resource 'C:\Program Files\Common Files\ODBC\Data Sources\' does not exist.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:	Warning
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3036
Date: 12/02/2010
Time: 3:21:40 PM
User: N/A
Computer:	TRACY-PC
Description:
The content source <outlookexpress://{s-1-5-21-515967899-1580436667-839522115-500}/{14ad1c2d-9eff-4e2f-9c62-d1406dcc4c8b}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
(0x81270005)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	Windows Search Service
Event Category:	Gatherer 
Event ID:	3036
Date: 12/02/2010
Time: 2:27:55 AM
User: N/A
Computer:	TRACY-PC
Description:
The content source <outlookexpress://{s-1-5-21-515967899-1580436667-839522115-500}/{14ad1c2d-9eff-4e2f-9c62-d1406dcc4c8b}/> cannot be accessed.

Context: Application, SystemIndex Catalog

Details:
(0x81270005)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 11/02/2010
Time: 1:17:04 PM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	.NET Runtime Optimization Service
Event Category:	None
Event ID:	1110
Date: 11/02/2010
Time: 6:15:21 AM
User: N/A
Computer:	TRACY-PC
Description:
.NET Runtime Optimization Service (clr_optimization_v2.0.50727_32) - Service Manager returned a fatal error (0x80004002). Will stop service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	W32Time
Event Category:	None
Event ID:	36
Date: 12/02/2010
Time: 2:22:01 AM
User: N/A
Computer:	TRACY-PC
Description:
The time service has not been able to synchronize the system time for 49152 seconds because none of the time providers has been able to provide a usable time stamp. The system clock is unsynchronized.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7000
Date: 11/02/2010
Time: 1:00:49 PM
User: N/A
Computer:	TRACY-PC
Description:
The dldfCATSCustConnectService service failed to start due to the following error: 
The service did not respond to the start or control request in a timely fashion.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7009
Date: 11/02/2010
Time: 1:00:49 PM
User: N/A
Computer:	TRACY-PC
Description:
Timeout (30000 milliseconds) waiting for the dldfCATSCustConnectService service to connect.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	Print
Event Category:	None
Event ID:	20
Date: 11/02/2010
Time: 1:00:25 PM
User: NT AUTHORITY\SYSTEM
Computer:	TRACY-PC
Description:
Printer Driver Dell AIO Printer 948 for Windows NT x86 Version-3 was added or updated. Files:- dldfdr.dll, dldfptpc.dll, dldfptpc.dll, dldfhelp.chm, dldfasnc.dll, dldfcats.dll, dldfceip.chm, dldfcfg.dll, dldfcfg.xml, dldfcfgx.exe, dldfclr1.lut, dldfclr2.lut, dldfclr3.lut, dldfclr4.lut, dldfcoco.lut, dldfcomx.dll, dldfcu.dll, dldfcub.dll, dldfcur.dll, dldfdatr.dll, dldfdrui.dll, dldfdtel.ini, dldfdtst.bmp, dldfdtst.jpg, dldfedf.dll, dldfeula.txt, dldfgf.dll, dldfhcp.dll, dldfhpec.dll, dldfins.dll, dldfinsb.dll, dldfinsr.dll, dldfjsw.dll, dldfjswb.dll, dldfjswr.dll, dldfjswx.exe, dldflpa.dll, dldflpab.dll, dldflpar.dll, dldfppx.dll, dldfprod.ver, dldfprp.dll, dldfprpb.dll, dldfprpr.dll, dldfpsw.dll, dldfpswb.dll, dldfpswr.dll, dldfpswx.exe, dldfretv.dll, dldfserv.exe, dldfsk0.dll, dldftime.dll, dldftime.exe, dldfuldr.dll, dldfupd.dll, dldfupdb.dll, dldfupdr.dll, dldfupld.exe, dldfuplr.dll, dldfutil.dll, dldfview.exe, dldfwbgc.dll, dldfwbgw.exe, dldfxmlu.dll.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Warning
Event Source:	Print
Event Category:	None
Event ID:	20
Date: 11/02/2010
Time: 12:59:17 PM
User: NT AUTHORITY\SYSTEM
Computer:	TRACY-PC
Description:
Printer Driver Fax Dell AIO Printer 948 for Windows NT x86 Version-3 was added or updated. Files:- UNIDRV.DLL, UNIDRVUI.DLL, DLDFP2FX.GPD, UNIDRV.HLP, STDNAMES.GPD, UNIRES.DLL.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Event Type:	Error
Event Source:	DCOM
Event Category:	None
Event ID:	10010
Date: 11/02/2010
Time: 12:47:42 PM
User: TRACY-PC\Administrator
Computer:	TRACY-PC
Description:
The server {84F66100-FF7C-4FB4-B0C0-02CD7FB668FE} did not register with DCOM within the required timeout.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Event Type:	Error
Event Source:	Service Control Manager
Event Category:	None
Event ID:	7003
Date: 11/02/2010
Time: 12:42:55 PM
User: N/A
Computer:	TRACY-PC
Description:
The Kodak AiO Network Discovery Service service depends on the following nonexistent service: Bonjour Service

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.


----------



## Cookiegal (Aug 27, 2003)

What version of Office did you have before installing 2007?


----------



## kanachoe (Apr 20, 2007)

2003


----------



## Cookiegal (Aug 27, 2003)

Do you still have 2003 installed as well?


----------



## kanachoe (Apr 20, 2007)

yeah the 2003 was a full version the 2007 was a trial version


----------



## Cookiegal (Aug 27, 2003)

Did you purchase the 2007 version then and did you uninstall the 2003 version?


----------



## kanachoe (Apr 20, 2007)

no i purchased the 2003 but i dont have the cd anymore as i lost it and the 2007 version is only a trial.


----------



## Cookiegal (Aug 27, 2003)

Then you should uninstall Office 2007 if it's only a trial unless the trial period has not yet expired. There is an error in your event viewer related to Office but I can't tell for sure which version is causing the error.

Please post a new HijackThis log and let me know if any problems remain.


----------



## kanachoe (Apr 20, 2007)

hi sorry i havent replied 
opera is playing it goes so slow and i really think all this problem has started since i updated it and i cant delete office as my search on the start menu wont come up.

here is the log thankyou

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:59:52 PM, on 22/02/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\windows\System32\svchost.exe
C:\windows\system32\svchost.exe
C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
C:\windows\System32\spool\DRIVERS\W32X86\3\dldfserv.exe
C:\windows\system32\dldfcoms.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\windows\system32\PSIService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\windows\system32\svchost.exe
C:\windows\system32\SearchIndexer.exe
C:\windows\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\windows\RTHDCPL.EXE
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
C:\Program Files\Dodo Speed Accelerator\slipcore.exe
C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe
C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac
C:\Program Files\Dell AIO Printer 948\dldfmon.exe
C:\Program Files\Dell AIO Printer 948\memcard.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Creative Home\Hallmark Card Studio 2008 Deluxe\Planner\PLNRnote.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O2 - BHO: IEPlugin Class - {11222041-111B-46E3-BD29-EFB2449479B1} - C:\PROGRA~1\ArcSoft\VIDEOD~1\ARCURL~1.DLL
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Dodo Speed Accelerator\PBHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: ToolbarBHO Class - {9519AF7E-638D-4933-BAD6-D33D23C79FE5} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O2 - BHO: NOW!Imaging - {9AA2F14F-E956-44B8-8694-A5B615CDF341} - C:\Program Files\Dodo Speed Accelerator\components\NOWImaging.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\YTSING~1.DLL
O3 - Toolbar: Copernic Agent - {F2E259E8-0FC8-438C-A6E0-342DD80FA53E} - C:\Program Files\Copernic Agent\CopernicAgentExt.dll
O3 - Toolbar: RAW Thumbnail Viewer - {F301665A-12F8-4331-804A-5BCBD379668C} - C:\PROGRA~1\ArcSoft\RAWTHU~1\EXIFToolBar.dll
O3 - Toolbar: Yahoo!7 Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
O4 - HKLM\..\Run: [OSSelectorReinstall] C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKLM\..\Run: [EKIJ5000StatusMonitor] C:\windows\System32\spool\DRIVERS\W32X86\3\EKIJ5000MUI.exe
O4 - HKLM\..\Run: [SlipStream] "C:\Program Files\Dodo Speed Accelerator\slipcore.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [avast5] C:\PROGRA~1\ALWILS~1\Avast5\avastUI.exe /nogui
O4 - HKLM\..\Run: [dldfmon.exe] "C:\Program Files\Dell AIO Printer 948\dldfmon.exe"
O4 - HKLM\..\Run: [MemoryCardManager] "C:\Program Files\Dell AIO Printer 948\memcard.exe"
O4 - HKLM\..\Run: [Dell AIO Printer 948 Fax Server] "C:\Program Files\Dell AIO Printer 948\fm3032.exe" /s
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [ctfmon.exe] C:\windows\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Dodo Speed Accelerator.lnk = C:\Program Files\Dodo Speed Accelerator\slipgui.exe
O4 - Global Startup: Event Planner Reminder 2008.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: (no name) - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra 'Tools' menuitem: Launch Copernic Agent - {193B17B0-7C9F-4D5B-AEAB-8D3605EFC084} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Copernic Agent - {688DC797-DC11-46A7-9F1B-445F4F58CE6E} - C:\PROGRA~1\COPERN~1\COPERN~1.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} (get_atlcom Class) - http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/win...ls/en/x86/client/wuweb_site.cab?1225368199591
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1240125841343
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{3B7EBAEF-6B19-4424-805B-46FC78632DAF}: Domain = nsw.bigpond.net.au
O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe
O23 - Service: dldfCATSCustConnectService - Unknown owner - C:\windows\System32\spool\DRIVERS\W32X86\3\\dldfserv.exe
O23 - Service: dldf_device - - C:\windows\system32\dldfcoms.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak AiO Network Discovery Service - Eastman Kodak Company - C:\Program Files\Kodak\AiO\Center\ekdiscovery.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\windows\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\windows\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe

--
End of file - 10533 bytes


----------



## Cookiegal (Aug 27, 2003)

Go to the following link:

http://www.kellys-korner-xp.com/xp_tweaks.htm

Scroll down to no. 70 and right-click on the left portion of it (the part that says Search is Missing from the Start Menu) and click Save As and save it to your desktop. This is a .reg file so once you have it on your desktop, double-click on it and allow it to merge into the registry. When that is complete, let me know if you see the Search in the Start Menu now.


----------



## kanachoe (Apr 20, 2007)

the search button is there but when i click on it nothing pops up.


----------



## Cookiegal (Aug 27, 2003)

I suggest you start a new thread about those errors and the search problem.

Here are some final instructions for you.

*Follow these steps to uninstall Combofix and all of its files and components.*

 Click *START* then *RUN*
 Now type *ComboFix /uninstall* in the runbox and click *OK*. Note the *space* between the *X* and the *U*, it needs to be there.









Now you should turn system restore off to flush out all previous system restore points, then turn it back on and create a new restore point:

To turn off system restore, on the Desktop, right click on *My Computer* and click on *Properties.*
Click the *System Restore* tab.
Check *Turn off System Restore.*
Click Apply and then click OK.

Restart your computer, turn System Restore back on and create a restore point.

To create a new restore point, click on *Start*  *All Programs*  *Accessories*  *System Tools* and then select *System Restore*.

In the System Restore wizard, select *Create a restore point* and click the Next button.

Type a name for your new restore point then click on Create.

I also recommend downloading  *SPYWAREBLASTER* for added protection.

*Read here* for info on how to tighten your security.


----------



## kanachoe (Apr 20, 2007)

hi i have done that now what section do you think i should start the thread in and thankyou for the help.


----------



## Cookiegal (Aug 27, 2003)

I would put it in the XP forum.


----------



## kanachoe (Apr 20, 2007)

ok thankyou


----------



## Cookiegal (Aug 27, 2003)

You're welcome.


----------

