Homer16 Posted July 8, 2010 ID:281108 Share Posted July 8, 2010 Hi,I hope someone can help me with this.I have encountered the missing themed32.dll error message. I am running a Dell Dimension 5150 desktop with windows XP, pre-installed and AVG 9.0 free.When the desktop boots up, the error message appears and doesn't displey the desktop. I have tried to run explorer from task manager but it doesn't allow me to do so.I have read some other posts on here and followed one as far as it went. I suggested running ERUNT which I have done, I then downloaded and ran OTL by OldTimer and securitycheck by screen317. The log files for the results are posted below.However, the original poster never got back to you and I am unsure of where to go now.p.s. I am having to use the wife's laptop asI am unable to access internet from desktop.OTL.txtOTL logfile created on: 08/07/2010 11:50:13 - Run 2OTL by OldTimer - Version 3.2.7.1 Folder = E:\Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 89.00% Memory free4.00 Gb Paging File | 4.00 Gb Available in Paging File | 99.00% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 228.14 Gb Total Space | 36.99 Gb Free Space | 16.21% Space Free | Partition Type: NTFSD: Drive not present or media not loadedDrive E: | 1.86 Gb Total Space | 1.82 Gb Free Space | 97.97% Space Free | Partition Type: FATF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: D2TTCG2JCurrent User Name: AdministratorLogged in as Administrator.Current Boot Mode: SafeModeScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Standard========== Processes (SafeList) ==========PRC - [2010/07/06 14:20:46 | 000,574,976 | ---- | M] (OldTimer Tools) -- E:\OTL.comPRC - [2010/06/03 20:13:32 | 001,101,152 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe========== Modules (SafeList) ==========MOD - [2010/07/06 14:20:46 | 000,574,976 | ---- | M] (OldTimer Tools) -- E:\OTL.comMOD - [2008/04/14 01:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx========== Win32 Services (SafeList) ==========SRV - [2010/07/06 15:08:54 | 006,384,592 | ---- | M] (Prevx) [Auto | Stopped] -- C:\Program Files\Prevx\prevx.exe -- (CSIScanner)SRV - [2010/04/16 08:33:40 | 000,144,672 | ---- | M] (Apple Inc.) [Auto | Stopped] -- C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe -- (Apple Mobile Device)SRV - [2010/03/17 16:12:18 | 000,308,064 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd)SRV - [2010/03/17 16:11:17 | 000,916,760 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Stopped] -- C:\Program Files\AVG\AVG9\avgemc.exe -- (avg9emc)SRV - [2008/04/07 10:17:30 | 000,430,592 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)SRV - [2006/12/11 12:12:06 | 000,537,520 | ---- | M] ( ) [Auto | Stopped] -- C:\WINDOWS\System32\lxcrcoms.exe -- (lxcr_device)========== Driver Services (SafeList) ==========DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW)DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Dell Support\GTAction\triggers\DSproct.sys -- (DSproct)DRV - [2010/07/06 15:08:56 | 000,061,752 | ---- | M] (Prevx) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\pxrts.sys -- (pxrts)DRV - [2010/07/06 15:08:56 | 000,030,320 | ---- | M] (Prevx) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\pxscan.sys -- (pxscan)DRV - [2010/07/06 15:08:54 | 000,024,400 | ---- | M] (Prevx) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\pxkbf.sys -- (pxkbf)DRV - [2010/06/03 20:13:37 | 000,242,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)DRV - [2010/06/03 20:13:35 | 000,029,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Stopped] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)DRV - [2010/03/17 16:11:16 | 000,216,200 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Stopped] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)DRV - [2008/04/13 19:36:39 | 000,043,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\amdagp.sys -- (amdagp)DRV - [2008/04/13 19:36:39 | 000,040,960 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sisagp.sys -- (sisagp)DRV - [2008/04/13 17:36:05 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)DRV - [2007/09/17 16:53:26 | 000,021,632 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd)DRV - [2006/02/10 18:19:12 | 001,107,224 | ---- | M] (SigmaTel, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)DRV - [2005/09/22 18:19:54 | 000,148,608 | ---- | M] (Hauppauge Computer Works, Inc.) [23|25|26]xxx) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hcwPP2.sys -- (hcwPP2)DRV - [2004/08/03 22:29:56 | 001,897,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)DRV - [2001/08/17 14:07:44 | 000,019,072 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sparrow.sys -- (Sparrow)DRV - [2001/08/17 14:07:42 | 000,030,688 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_u3.sys -- (sym_u3)DRV - [2001/08/17 14:07:40 | 000,028,384 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\sym_hi.sys -- (sym_hi)DRV - [2001/08/17 14:07:36 | 000,032,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc8xx.sys -- (symc8xx)DRV - [2001/08/17 14:07:34 | 000,016,256 | ---- | M] (Symbios Logic Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\symc810.sys -- (symc810)DRV - [2001/08/17 13:52:22 | 000,036,736 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ultra.sys -- (ultra)DRV - [2001/08/17 13:52:20 | 000,045,312 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql12160.sys -- (ql12160)DRV - [2001/08/17 13:52:20 | 000,040,320 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1080.sys -- (ql1080)DRV - [2001/08/17 13:52:18 | 000,049,024 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\ql1280.sys -- (ql1280)DRV - [2001/08/17 13:52:16 | 000,179,584 | ---- | M] (Mylex Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\dac2w2k.sys -- (dac2w2k)DRV - [2001/08/17 13:52:12 | 000,017,280 | ---- | M] (American Megatrends Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\mraid35x.sys -- (mraid35x)DRV - [2001/08/17 13:52:00 | 000,026,496 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc.sys -- (asc)DRV - [2001/08/17 13:51:58 | 000,014,848 | ---- | M] (Advanced System Products, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\asc3550.sys -- (asc3550)DRV - [2001/08/17 13:51:56 | 000,005,248 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\aliide.sys -- (AliIde)DRV - [2001/08/17 13:51:54 | 000,006,656 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\DRIVERS\cmdide.sys -- (CmdIde)========== Standard Registry (SafeList) ==================== Internet Explorer ==========IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=1060908IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=1060908IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=1060908IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk/hws/sb/dell-usuk/e...html?channel=ukIE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = www.google.co.uk/ig/dell?hl=en&client=dell-usuk&channel=uk&ibd=1060908IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2010/02/23 10:56:26 | 000,000,000 | ---D | M][2010/07/01 18:04:42 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions[2010/07/06 14:43:35 | 000,000,000 | ---D | M] (Internal security) -- C:\Program Files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}O1 HOSTS File: ([2004/08/10 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)O2 - BHO: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer)O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.O2 - BHO: (SafeOnline BHO) - {69D72956-317C-44bd-B369-8E44D4EF9801} - C:\WINDOWS\system32\PxSecure.dll (Prevx)O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()O2 - BHO: (MSN Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)O2 - BHO: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD0.dll (Conduit Ltd.)O3 - HKLM\..\Toolbar: (Lexmark Toolbar) - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll ()O3 - HKLM\..\Toolbar: (MSN Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll (Microsoft Corp.)O3 - HKLM\..\Toolbar: (Zynga Toolbar) - {7b13ec3e-999a-4b70-b9cb-2617b8323822} - C:\Program Files\Zynga\tbZyng.dll (Conduit Ltd.)O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {e9911ec6-1bcc-40b0-9993-e0eea7f6953f} - C:\Program Files\DVDVideoSoft\tbDVD0.dll (Conduit Ltd.)O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()O4 - HKLM..\Run: [EzPrint] C:\Program Files\Lexmark 2400 Series\ezprint.exe (Lexmark International Inc.)O4 - HKLM..\Run: [iSUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (InstallShield Software Corporation)O4 - HKLM..\Run: [iSUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)O4 - HKLM..\Run: [LXCRCATS] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCRtime.DLL (Lexmark International Inc.)O4 - HKLM..\Run: [lxcrmon.exe] C:\Program Files\Lexmark 2400 Series\lxcrmon.exe ()O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)O4 - HKLM..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe (McAfee, Inc.)O4 - HKLM..\Run: [sigmatelSysTrayApp] C:\WINDOWS\stsystra.exe (SigmaTel, Inc.)O4 - HKLM..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe (Sun Microsystems, Inc.)O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)O4 - HKLM..\Run: [WireLessKeyboard] C:\Program Files\DS-3200 Wireless Optical Slimline Deskset\PS2USBKbdDrv.exe ()O4 - HKLM..\Run: [WireLessMouse] C:\Program Files\Multimedia Mouse Driver\StartAutorun.exe MouseDrv.exe File not foundO4 - Startup: C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: rthdbpl = C:\Documents and Settings\Stuart Simpson\Application Data\SystemProc\lsass.exe File not foundO6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O8 - Extra context menu item: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)O8 - Extra context menu item: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)O8 - Extra context menu item: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)O8 - Extra context menu item: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)O8 - Extra context menu item: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)O8 - Extra context menu item: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll (Google Inc.)O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\NPJPI150_06.dll (Sun Microsystems, Inc.)O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.0...oUploader55.cab (Facebook Photo Uploader 5 Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06)O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-...indows-i586.cab (Java Plug-in 1.5.0_06)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)O18 - Protocol\Filter\application/x-internet-signup {A173B69A-1F9B-4823-9FDA-412F641E65D6} - C:\Program Files\Tiscali\Tiscali Internet\dlls\tiscalifilter.dll ()O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)O21 - SSODL: CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\System32\ripetandar.dll File not foundO21 - SSODL: SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\DOCUME~1\STUART~1\LOCALS~1\Temp\8507642547.dll File not foundO24 - Desktop WallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Wallpaper1.bmpO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2005/08/16 04:43:04 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRunO33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&PlayO33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe -- File not foundO34 - HKLM BootExecute: (autocheck autochk *) - File not foundO35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*========== Files/Folders - Created Within 30 Days ==========[2010/07/06 15:08:57 | 000,068,120 | ---- | C] (Prevx) -- C:\WINDOWS\System32\PxSecure.dll[2010/07/06 15:08:56 | 000,061,752 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys[2010/07/06 15:08:56 | 000,030,320 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys[2010/07/06 15:08:54 | 000,024,400 | ---- | C] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys[2010/07/06 15:08:52 | 000,000,000 | ---D | C] -- C:\Program Files\Prevx[2010/07/06 15:08:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PrevxCSI[2010/07/06 14:46:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\LastGood.Tmp[2010/07/06 14:16:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT[2010/07/06 14:15:56 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT[2010/07/06 14:10:26 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IECompatCache[2010/07/06 14:00:48 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\PrivacIE[2010/07/02 08:51:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Apple Computer[2010/07/02 08:50:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Local Settings\Application Data\Apple Computer[2010/07/01 14:33:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Application Data\Malwarebytes[2010/07/01 14:29:06 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Administrator\IETldCache[2010/02/27 18:58:33 | 001,224,704 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrserv.dll[2010/02/27 18:58:33 | 000,991,232 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrusb1.dll[2010/02/27 18:58:33 | 000,413,696 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrinpa.dll[2010/02/27 18:58:33 | 000,397,312 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcriesc.dll[2010/02/27 18:58:33 | 000,323,584 | ---- | C] ( ) -- C:\WINDOWS\System32\LXCRhcp.dll[2010/02/27 18:58:33 | 000,163,840 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrprox.dll[2010/02/27 18:58:32 | 000,684,032 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomc.dll[2010/02/27 18:58:32 | 000,643,072 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpmui.dll[2010/02/27 18:58:32 | 000,585,728 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrlmpm.dll[2010/02/27 18:58:32 | 000,421,888 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrcomm.dll[2010/02/27 18:58:32 | 000,094,208 | ---- | C] ( ) -- C:\WINDOWS\System32\lxcrpplc.dll[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]========== Files - Modified Within 30 Days ==========[2010/07/08 11:26:54 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2010/07/08 11:25:54 | 000,786,432 | ---- | M] () -- C:\Documents and Settings\Administrator\NTUSER.DAT[2010/07/08 11:25:54 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\Administrator\ntuser.ini[2010/07/08 11:19:25 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2010/07/06 15:08:57 | 000,068,120 | ---- | M] (Prevx) -- C:\WINDOWS\System32\PxSecure.dll[2010/07/06 15:08:56 | 000,061,752 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxrts.sys[2010/07/06 15:08:56 | 000,030,320 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxscan.sys[2010/07/06 15:08:54 | 000,024,400 | ---- | M] (Prevx) -- C:\WINDOWS\System32\drivers\pxkbf.sys[2010/07/06 15:08:37 | 000,000,161 | ---- | M] () -- C:\WINDOWS\wininit.ini[2010/07/06 15:05:42 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT[2010/07/06 14:43:35 | 000,000,009 | ---- | M] () -- C:\confin.sys[2010/07/06 14:16:11 | 000,000,767 | ---- | M] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk[2010/07/06 14:15:57 | 000,000,611 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk[2010/07/06 14:15:57 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk[2010/07/02 13:55:12 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat[2010/07/02 08:52:28 | 000,048,816 | ---- | M] () -- C:\Documents and Settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT[2010/06/22 15:35:33 | 000,503,304 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI[2010/06/22 15:35:33 | 000,442,466 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2010/06/22 15:35:33 | 000,071,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[2010/06/22 15:32:52 | 061,301,072 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm[2010/06/13 16:12:03 | 000,002,137 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\iTunes.lnk[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]========== Files Created - No Company Name ==========[2010/07/06 14:43:35 | 000,000,009 | ---- | C] () -- C:\confin.sys[2010/07/06 14:16:11 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk[2010/07/06 14:15:57 | 000,000,611 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\NTREGOPT.lnk[2010/07/06 14:15:57 | 000,000,592 | ---- | C] () -- C:\Documents and Settings\Administrator\Desktop\ERUNT.lnk[2010/07/02 08:52:37 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat[2010/03/25 13:34:09 | 000,404,480 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll[2010/03/25 13:34:09 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\TomsMoComp_ff.dll[2010/03/25 13:34:09 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\libmpeg2_ff.dll[2010/03/25 13:34:08 | 003,049,984 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll[2010/03/18 08:09:50 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI[2010/02/27 18:59:19 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxcrvs.dll[2010/02/27 18:59:16 | 000,344,064 | ---- | C] () -- C:\WINDOWS\System32\lxcrcoin.dll[2010/02/27 18:58:56 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxcrdrs.dll[2010/02/27 18:58:56 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxcrcaps.dll[2010/02/27 18:58:55 | 000,061,440 | ---- | C] () -- C:\WINDOWS\System32\lxcrcnv4.dll[2010/02/27 18:58:33 | 000,274,432 | ---- | C] () -- C:\WINDOWS\System32\LXCRinst.dll[2010/02/23 10:59:47 | 000,000,025 | ---- | C] () -- C:\WINDOWS\cdplayer.ini[2010/02/11 12:20:12 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini[2009/11/04 17:58:41 | 000,217,088 | ---- | C] () -- C:\WINDOWS\System32\avformat-50.dll[2009/11/04 17:58:41 | 000,018,432 | ---- | C] () -- C:\WINDOWS\System32\avutil-49.dll[2009/11/04 17:58:40 | 001,984,512 | ---- | C] () -- C:\WINDOWS\System32\avcodec-51.dll[2006/09/08 12:04:29 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini[2006/09/08 11:58:15 | 000,000,161 | ---- | C] () -- C:\WINDOWS\wininit.ini[2006/09/08 11:53:44 | 000,712,704 | ---- | C] () -- C:\WINDOWS\System32\DellSystemRestore.dll[2006/09/08 11:28:38 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\hcwXDS.dll[2006/09/08 11:28:16 | 000,000,475 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI[2005/08/16 04:37:24 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini[2005/08/05 14:01:54 | 000,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll========== LOP Check ==========[2010/04/01 15:03:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar[2010/06/15 14:29:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9[2010/02/11 16:25:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations[2010/02/24 12:59:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite[2010/07/06 15:09:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PrevxCSI[2010/03/26 14:14:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP[2010/04/01 09:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}[2010/02/11 13:18:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}========== Purity Check ==================== Alternate Data Streams ==========@Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:3AEA6AF9< End of report >Extras.txtOTL Extras logfile created on: 06/07/2010 14:21:54 - Run 1OTL by OldTimer - Version 3.2.7.1 Folder = E:\Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 88.00% Memory free4.00 Gb Paging File | 4.00 Gb Available in Paging File | 98.00% Paging File freePaging file location(s): C:\pagefile.sys 2046 4092 [binary data]%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 228.14 Gb Total Space | 37.01 Gb Free Space | 16.22% Space Free | Partition Type: NTFSD: Drive not present or media not loadedDrive E: | 1.86 Gb Total Space | 1.86 Gb Free Space | 99.93% Space Free | Partition Type: FATF: Drive not present or media not loadedG: Drive not present or media not loadedH: Drive not present or media not loadedI: Drive not present or media not loadedComputer Name: D2TTCG2JCurrent User Name: AdministratorLogged in as Administrator.Current Boot Mode: SafeModeScan Mode: Current userCompany Name Whitelist: OffSkip Microsoft Files: OffFile Age = 30 DaysOutput = Standard========== Extra Registry (SafeList) ==================== File Associations ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]========== Shell Spawning ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*exefile [open] -- "%1" %*htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)scrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirstRunDisabled" = 1"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]"DisableMonitoring" = 1[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]"DisableMonitoring" = 1[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]"EnableFirewall" = 1[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007"135:TCP" = 135:TCP:*:Enabled:TCP Port 135"5000:TCP" = 5000:TCP:*:Enabled:TCP Port 5000"5001:TCP" = 5001:TCP:*:Enabled:TCP Port 5001"5002:TCP" = 5002:TCP:*:Enabled:TCP Port 5002"5003:TCP" = 5003:TCP:*:Enabled:TCP Port 5003"5004:TCP" = 5004:TCP:*:Enabled:TCP Port 5004"5005:TCP" = 5005:TCP:*:Enabled:TCP Port 5005"5006:TCP" = 5006:TCP:*:Enabled:TCP Port 5006"5007:TCP" = 5007:TCP:*:Enabled:TCP Port 5007"5008:TCP" = 5008:TCP:*:Enabled:TCP Port 5008"5009:TCP" = 5009:TCP:*:Enabled:TCP Port 5009"5010:TCP" = 5010:TCP:*:Enabled:TCP Port 5010"5011:TCP" = 5011:TCP:*:Enabled:TCP Port 5011"5012:TCP" = 5012:TCP:*:Enabled:TCP Port 5012"5013:TCP" = 5013:TCP:*:Enabled:TCP Port 5013"5014:TCP" = 5014:TCP:*:Enabled:TCP Port 5014"5015:TCP" = 5015:TCP:*:Enabled:TCP Port 5015"5016:TCP" = 5016:TCP:*:Enabled:TCP Port 5016"5017:TCP" = 5017:TCP:*:Enabled:TCP Port 5017"5018:TCP" = 5018:TCP:*:Enabled:TCP Port 5018"5019:TCP" = 5019:TCP:*:Enabled:TCP Port 5019"5020:TCP" = 5020:TCP:*:Enabled:TCP Port 5020"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002========== Authorized Applications List ==========[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL -- File not found"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL -- File not found"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL -- File not found"C:\Program Files\AOL 9.0\waol.exe" = C:\Program Files\AOL 9.0\waol.exe:*:Enabled:AOL -- File not found"C:\Program Files\AVG\AVG9\avgemc.exe" = C:\Program Files\AVG\AVG9\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)"C:\Program Files\AVG\AVG9\avgupd.exe" = C:\Program Files\AVG\AVG9\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)"C:\Program Files\AVG\AVG9\avgnsx.exe" = C:\Program Files\AVG\AVG9\avgnsx.exe:*:Enabled:avgnsx.exe -- (AVG Technologies CZ, s.r.o.)"C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.)"C:\WINDOWS\system32\lxcrcoms.exe" = C:\WINDOWS\system32\lxcrcoms.exe:*:Enabled:Lexmark Communications System -- ( )"C:\Program Files\Windows Live\Messenger\wlcsdk.exe" = C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call -- (Microsoft Corporation)"C:\Program Files\iTunes\iTunes.exe" = C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes -- (Apple Inc.)========== HKEY_LOCAL_MACHINE Uninstall List ==========[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{1017A80C-6F09-4548-A84D-EDD6AC9525F0}" = Lexmark Toolbar"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter"{146E206D-7D2C-493A-B431-1F1D16E822AF}" = MobileMe Control Panel"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support"{58B2B6D3-E5FF-4D16-87AC-52CC5717C7C6}" = Tiscali Internet"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool"{5B6BE547-21E2-49CA-B2E2-6A5F470593B1}" = Sonic Activation Module"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore"{761443B6-AB01-4052-8683-12F1C5A5A5E5}" = Trust DS-3200 Wireless Optical Slimline Deskset"{7B63B2922B174135AFC0E1377DD81EC2}" = "{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{83F793B5-8BBF-42FD-A8A6-868CB3E2AAEA}" = Intel® PROSet for Wired Connections"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8A253629-0511-4854-8B4E-46E57E66005C}" = Bonjour"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel® Graphics Media Accelerator Driver"{90280409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional with FrontPage"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting"{9941F0AA-B903-4AF4-A055-83A9815CC011}" = Sonic Encoders"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support"{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}" = Segoe UI"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A67BB21E-D419-45BB-AB86-7D87D14BBCE2}" = Safari"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution"{AC76BA86-7AD7-1033-7B44-A70800000002}" = Adobe Reader 7.0.8"{AE17CF38-C912-4EFE-9620-AFED5607F018}" = Multimedia Mouse Driver"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C994D98C-293D-4825-958E-EB684B4D413F}" = MSN Toolbar"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D2988E9B-C73F-422C-AD4B-A66EBE257120}" = MCU"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard"{F4F4F84E-804F-4E9A-84D7-C34283F0088F}" = RealUpgrade 1.0"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Windows Driver Package - Nokia pccsmcfd (10/12/2007 6.85.4.0)"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX"AVG9Uninstall" = AVG Free 9.0"BitTorrent" = BitTorrent"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters"DivX Setup.divx.com" = DivX Setup"DVDVideoSoft Toolbar" = DVDVideoSoft Toolbar"EmeraldQFE2" = Windows Media Player 10 Hotfix [see EmeraldQFE2 for more information]"ERUNT_is1" = ERUNT 1.1j"Free Video to iPhone Converter_is1" = Free Video to iPhone Converter version 2.2"ie8" = Windows Internet Explorer 8"InstallShield_{761443B6-AB01-4052-8683-12F1C5A5A5E5}" = Trust DS-3200 Wireless Optical Slimline Deskset"InstallShield_{AE17CF38-C912-4EFE-9620-AFED5607F018}" = Multimedia Mouse Driver"Lexmark 2400 Series" = Lexmark 2400 Series"m__kgoTyMJDM9u" = LoudMo Contextual Ad Assistant"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP"PROSet" = Intel® PRO Network Connections Drivers"RealPlayer 12.0" = RealPlayer"Uninstall_is1" = Uninstall 1.0.0.1"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows Media Player" = Windows Media Player 11"Windows XP Service Pack" = Windows XP Service Pack 3"WinLiveSuite_Wave3" = Windows Live Essentials"WinRAR archiver" = WinRAR archiver"WMFDist11" = Windows Media Format 11 runtime"wmp11" = Windows Media Player 11"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5"Zynga Toolbar" = Zynga Toolbar========== Last 10 Event Log Errors ==========[ Application Events ]Error - 05/06/2010 14:37:16 | Computer Name = D2TTCG2J | Source = Bonjour Service | ID = 100Description = 232: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)Error - 05/06/2010 14:37:16 | Computer Name = D2TTCG2J | Source = Bonjour Service | ID = 100Description = 396: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)Error - 05/06/2010 14:37:16 | Computer Name = D2TTCG2J | Source = Bonjour Service | ID = 100Description = 388: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)Error - 05/06/2010 14:37:16 | Computer Name = D2TTCG2J | Source = Bonjour Service | ID = 100Description = 408: ERROR: read_msg errno 10054 (An existing connection was forcibly closed by the remote host.)Error - 08/06/2010 08:08:23 | Computer Name = D2TTCG2J | Source = Application Error | ID = 1000Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting module xvid.ax, version 0.0.0.0, fault address 0x0003dd11.Error - 08/06/2010 08:08:28 | Computer Name = D2TTCG2J | Source = Application Error | ID = 1000Description = Faulting application drwtsn32.exe, version 5.1.2600.0, faulting module dbghelp.dll, version 5.1.2600.5512, fault address 0x0001295d.Error - 08/06/2010 08:09:05 | Computer Name = D2TTCG2J | Source = Application Hang | ID = 1002Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.Error - 08/06/2010 08:09:20 | Computer Name = D2TTCG2J | Source = Application Error | ID = 1000Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting module xvid.ax, version 0.0.0.0, fault address 0x0003dd11.Error - 08/06/2010 08:11:45 | Computer Name = D2TTCG2J | Source = Application Error | ID = 1000Description = Faulting application explorer.exe, version 6.0.2900.5512, faulting module xvid.ax, version 0.0.0.0, fault address 0x0003dd11.Error - 08/06/2010 08:12:04 | Computer Name = D2TTCG2J | Source = Application Hang | ID = 1002Description = Hanging application explorer.exe, version 6.0.2900.5512, hang module hungapp, version 0.0.0.0, hang address 0x00000000.[ System Events ]Error - 19/03/2010 07:48:57 | Computer Name = D2TTCG2J | Source = Disk | ID = 262155Description = The driver detected a controller error on .Error - 19/03/2010 07:48:57 | Computer Name = D2TTCG2J | Source = Disk | ID = 262155Description = The driver detected a controller error on .Error - 26/03/2010 09:27:51 | Computer Name = D2TTCG2J | Source = BROWSER | ID = 8032Description = The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{67E58D39-2A62-403C-B5A2-6846A4CEEF9F}. The backup browser is stopping.Error - 31/03/2010 07:37:25 | Computer Name = D2TTCG2J | Source = BROWSER | ID = 8032Description = The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{67E58D39-2A62-403C-B5A2-6846A4CEEF9F}. The backup browser is stopping.Error - 06/04/2010 05:29:52 | Computer Name = D2TTCG2J | Source = Windows Update Agent | ID = 20Description = Installation Failure: Windows failed to install the following update with error 0x8024002d: Office XP Service Pack 3.Error - 07/04/2010 09:14:01 | Computer Name = D2TTCG2J | Source = BROWSER | ID = 8032Description = The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{67E58D39-2A62-403C-B5A2-6846A4CEEF9F}. The backup browser is stopping.Error - 17/04/2010 05:33:24 | Computer Name = D2TTCG2J | Source = W32Time | ID = 39452689Description = Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)Error - 17/04/2010 05:33:24 | Computer Name = D2TTCG2J | Source = W32Time | ID = 39452701Description = The time provider NtpClient is configured to acquire time from one or more time sources, however none of the sources are currently accessible. No attempt to contact a source will be made for 14 minutes. NtpClient has no source of accurate time. Error - 24/04/2010 09:30:19 | Computer Name = D2TTCG2J | Source = MRxSmb | ID = 8003Description = The master browser has received a server announcement from the computer MICHELLE-PC that believes that it is the master browser for the domain on transport NetBT_Tcpip_{67E58D39-2A62-40. The master browser is stopping or an election is being forced.Error - 24/04/2010 09:48:44 | Computer Name = D2TTCG2J | Source = BROWSER | ID = 8032Description = The browser service has failed to retrieve the backup list too many times on transport \Device\NetBT_Tcpip_{67E58D39-2A62-403C-B5A2-6846A4CEEF9F}. The backup browser is stopping.< End of report >checkup.txt Results of screen317's Security Check version 0.99.4 Windows XP Service Pack 3 Internet Explorer 8 `````````````````````````````` Antivirus/Firewall Check: Windows Security Center service is not running! This report may not be accurate! AVG Free 9.0 Prevx Antivirus out of date! (On Access scanning disabled!) ``````````````````````````````` Anti-malware/Other Utilities Check: Malwarebytes' Anti-Malware Adobe Flash Player Adobe Reader 7.0.8 Out of date Adobe Reader installed! ```````````````````````````````` Process Check: objlist.exe by Laurent AVG avgemc.exe ````````````````````````````````DNS Vulnerability Check: Unknown. This method cannot test your vulnerability to DNS cache poisoning. ``````````End of Log```````````` Link to post Share on other sites More sharing options...
Staff miekiemoes Posted July 9, 2010 Staff ID:281517 Share Posted July 9, 2010 Hi,If you get the message themed32.dll is missing then it's because your uxtheme.dll got replaced here with a malicious copy.To solve this easily, open taskmanager (CTRL-ALT-DEL), click the error messages away.Then go to File in the menu > new task > browse button.When the browse window opens (explorer), select "All files" for Files of type:Then, browse to your C:\windows\system32 folder and find uxtheme.dll in there. Rename that file to uxtheme.badNormally, Windows should already restore it with a new clean uxtheme.dll (from dllcache) automatically there. You can verify this if you rightclick inside the system32 folder and select refresh. A new uxtheme.dll should be created there.If not, navigate to your C:\windows\system32\dllcache folder and COPY the one from there back to your system32 folder.Or, another option is, this infection, before it has replaced the uxtheme.dll with a malicious version, it has first renamed the legitimate uxtheme.dll to uxtheme.dll~RF1ede9.TMP (last part may be random)So the uxtheme.dll~RF1ede9.TMP (last part may be random) is also still present in the system32 folder. That's the good uxtheme.dll as well. So you can also rename that one back to uxtheme.dll.Anyway, your choice which one to use to restore Let me know if that solved it. Link to post Share on other sites More sharing options...
Staff screen317 Posted July 24, 2010 Staff ID:289742 Share Posted July 24, 2010 Due to the lack of feedback this topic is closed to prevent others from posting here. If you need this topic reopened, please send a Private Message to any one of the moderating team members. Please include a link to this thread with your request. This applies only to the originator of this thread.Other members who need assistance please start your own topic in a new thread. Thanks! Link to post Share on other sites More sharing options...
Recommended Posts