Virus MBAM won't open or delete & IE won't open

gothicpanda · November 18, 2010

I am having a problem with my computer. IE will not open or let me connect to the internet. I can recieve emails and get updates from programs like adobe flash. I tried to install Malwarebytes, but I recieve a CreateFile Error Code 80. I tried to delete the previous version but the file folders were still left. I can not delete those and I think that is what is causing the error. I am pretty sure I have a virus that is not allowing this. I have Microsoft Security Essentials Running and the scan picked up nothing. I used HijackThis to form a log, attached bellow. Then I found another post listing the procedure which i started. Once I got to the part of running GMER Rootkit Scanner it scanned and half way through and my computer restarted and so I was not able to continue. I attached all the logs I was able to get.

attach.zip

Elise · November 18, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the Quick Scan button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please Download Rootkit Unhooker Save it to your desktop.

extract RKUnhooker to your desktop
- Note** it is zipped up in a .rar file - If you do not have a program to unzip this type of file -
  you can get a free one from here -
http://www.7-zip.org/

Now double-click on RKUnhookerLE.exe to run it.
Click the Report tab, then click Scan.
Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
Wait till the scanner has finished and then click File, Save Report.
Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!

It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
RKU log

Thanks and again sorry for the delay.

gothicpanda · November 19, 2010

Thank you for taking the time to help me! I really appreciate it. I am pretty sure that there is a virus on the computer. Malwarebytes refused to open and I realized that its files were missing. I tried reinstalling it and I could not. mbamext.dll is blocking full deletion and I also have two Malwarebytes folders in my Program FIles folder. The other one when I try to open says Access Denied. Durring reinstallation I get an ErrorCode 80 message. Internet Explorer also refuses to start up but the internet works. Firefox does connect to the internet which I am currently using.

OTL logfile created on: 11/18/2010 5:51:40 PM - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\jennifer.scheu\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 71.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 69.77 Gb Total Space | 53.28 Gb Free Space | 76.36% Space Free | Partition Type: NTFS

Computer Name: JENNIFERPC | User Name: Jennifer.Scheu | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2010/11/18 17:50:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jennifer.scheu\Desktop\OTL.exe

PRC - [2010/10/27 00:10:00 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Documents and Settings\jennifer.scheu\Local Settings\Application Data\Mozilla Firefox\firefox.exe

PRC - [2010/09/15 03:34:02 | 001,094,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe

PRC - [2010/03/25 20:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe

PRC - [2008/04/14 04:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006/09/14 13:06:48 | 000,028,672 | ---- | M] (Acer Inc.) -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe

PRC - [2006/09/12 19:38:32 | 000,339,968 | ---- | M] ( ) -- C:\Acer\Empowering Technology\eLock\Monitor\LockMon.exe

PRC - [2006/06/28 18:01:32 | 000,520,192 | ---- | M] () -- C:\Acer\Empowering Technology\eLock\LockServ.exe

PRC - [2006/04/18 20:54:50 | 000,049,152 | ---- | M] ( ) -- C:\WINDOWS\system32\SysMonitor.exe

PRC - [2004/08/11 01:22:40 | 000,757,760 | ---- | M] (Eastman Kodak Company) -- C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe

========== Modules (SafeList) ==========

MOD - [2010/11/18 17:50:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jennifer.scheu\Desktop\OTL.exe

MOD - [2010/08/23 10:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- c:\KGCServ\remotecontrol\winvnc.exe -- (winvnc)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Kyocera\FileUtility\SFUSVC.exe -- (SFUSVC)

SRV - File not found [Auto | Stopped] -- c:\PROGRA~1\mcafee\SITEAD~1\mcsacore.exe -- (McAfee SiteAdvisor Service)

SRV - File not found [Auto | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate) Google Update Service (gupdate)

SRV - [2010/03/25 20:40:44 | 000,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)

SRV - [2010/03/18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state)

SRV - [2010/03/18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400)

SRV - [2010/03/18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2010/03/18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing)

SRV - [2006/11/03 18:19:58 | 000,013,592 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MsMpEng.exe -- (WinDefend)

SRV - [2006/10/18 19:05:24 | 000,913,408 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc)

SRV - [2006/09/14 13:06:48 | 000,028,672 | ---- | M] (Acer Inc.) [Auto | Running] -- C:\Acer\Empowering Technology\ePerformance\MemCheck.exe -- (AcerMemUsageCheckService)

SRV - [2006/06/28 18:01:32 | 000,520,192 | ---- | M] () [Auto | Running] -- C:\Acer\Empowering Technology\eLock\LockServ.exe -- (LockServ)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)

DRV - [2010/07/06 03:13:10 | 000,234,392 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2008/08/28 17:32:30 | 000,006,144 | ---- | M] (NewTech Infosystems, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NTIDrvr.sys -- (NTIDrvr)

DRV - [2008/04/13 21:06:06 | 000,144,384 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)

DRV - [2008/02/15 05:12:06 | 005,854,752 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\igxpmp32.sys -- (ialm)

DRV - [2007/12/10 16:59:36 | 000,014,544 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\TVicPort.sys -- (tvicport)

DRV - [2007/12/10 16:59:36 | 000,006,080 | ---- | M] (Zeal SoftStudio) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\zntport.sys -- (zntport)

DRV - [2007/12/10 16:59:34 | 000,014,120 | ---- | M] (Acer, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\int15.sys -- (int15)

DRV - [2006/11/07 03:35:00 | 000,047,488 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SCR3XX2K.sys -- (SCR3xx USB Smart Card Reader)

DRV - [2006/08/27 20:30:04 | 000,013,952 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\UBHelper.sys -- (UBHelper)

DRV - [2006/06/08 18:54:24 | 000,017,664 | ---- | M] (Windows ® 2000 DDK provider) [File_System | Auto | Running] -- C:\WINDOWS\system32\eLock2BurnerLockDriver.sys -- (eLock2BurnerLockDriver)

DRV - [2006/06/06 19:36:30 | 000,090,112 | ---- | M] (Windows ® 2000 DDK provider) [File_System | Auto | Running] -- C:\WINDOWS\system32\eLock2FSCTLDriver.sys -- (eLock2FSCTLDriver)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.coveny.com

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&a...;m=veriton_m460

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.coveny.com

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.bing.com/?pc=Z006&form=ZGAPHP

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://home.mywebsearch.com/index.jhtml?n=...MU28qOlq5uj_m5Q

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\..\URLSearchHook: {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\..\URLSearchHook: {D3D233D5-9F6D-436C-B6C7-E63F77503B30} - Reg Error: Key error. File not found

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Fast Browser Search"

FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=18&q="

FF - prefs.js..browser.search.order.1: "Fast Browser Search"

FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=18&tid={980235C4-5205-BE07-A40B-38E7E3912833}&q="

FF - prefs.js..network.proxy.no_proxies_on: "localhost,127.0.0.1"

FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Documents and Settings\jennifer.scheu\Local Settings\Application Data\Mozilla Firefox\components [2010/11/15 20:41:53 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Documents and Settings\jennifer.scheu\Local Settings\Application Data\Mozilla Firefox\plugins [2010/11/15 20:41:53 | 000,000,000 | ---D | M]

[2009/06/15 13:13:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Extensions

[2010/11/16 21:58:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Firefox\Profiles\vrpe5dip.default\extensions

[2010/11/16 21:58:11 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Firefox\Profiles\vrpe5dip.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2009/07/17 12:58:06 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Firefox\Profiles\vrpe5dip.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}

[2010/10/07 12:41:54 | 000,001,919 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Firefox\Profiles\vrpe5dip.default\searchplugins\bing-zugo.xml

[2010/08/17 12:52:31 | 000,002,292 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Firefox\Profiles\vrpe5dip.default\searchplugins\inbox-search.xml

[2010/06/17 11:35:38 | 000,010,025 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Application Data\Mozilla\Firefox\Profiles\vrpe5dip.default\searchplugins\mywebsearch.xml

O1 HOSTS File: ([2009/05/14 11:53:29 | 000,306,127 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 70.89.213.203 ocsinventory-ng

O1 - Hosts: 127.0.0.1 www.007guard.com

O1 - Hosts: 127.0.0.1 007guard.com

O1 - Hosts: 127.0.0.1 008i.com

O1 - Hosts: 127.0.0.1 www.008k.com

O1 - Hosts: 127.0.0.1 008k.com

O1 - Hosts: 127.0.0.1 www.00hq.com

O1 - Hosts: 127.0.0.1 00hq.com

O1 - Hosts: 127.0.0.1 010402.com

O1 - Hosts: 127.0.0.1 www.032439.com

O1 - Hosts: 127.0.0.1 032439.com

O1 - Hosts: 127.0.0.1 www.0scan.com

O1 - Hosts: 127.0.0.1 0scan.com

O1 - Hosts: 127.0.0.1 www.1000gratisproben.com

O1 - Hosts: 127.0.0.1 1000gratisproben.com

O1 - Hosts: 127.0.0.1 www.1001namen.com

O1 - Hosts: 127.0.0.1 1001namen.com

O1 - Hosts: 127.0.0.1 100888290cs.com

O1 - Hosts: 127.0.0.1 www.100888290cs.com

O1 - Hosts: 127.0.0.1 100sexlinks.com

O1 - Hosts: 127.0.0.1 www.100sexlinks.com

O1 - Hosts: 127.0.0.1 10sek.com

O1 - Hosts: 127.0.0.1 www.10sek.com

O1 - Hosts: 127.0.0.1 www.1-2005-search.com

O1 - Hosts: 10540 more lines...

O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.

O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - No CLSID value found.

O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.

O3 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\..\Toolbar\WebBrowser: (no name) - {4B3803EA-5230-4DC3-A7FC-33638F3D3542} - No CLSID value found.

O3 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\..\Toolbar\WebBrowser: (no name) - {98279C38-DE4B-4BCF-93C9-8EC26069D6F4} - No CLSID value found.

O3 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.

O3 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.

O4 - HKLM..\Run: [Acer Empowering Technology Monitor] C:\WINDOWS\system32\SysMonitor.exe ( )

O4 - HKLM..\Run: [eLockMonitor] C:\Acer\Empowering Technology\eLock\Monitor\LaunchMonitor.exe ( )

O4 - HKLM..\Run: [iMJPMIG8.1] C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [LaunchApp] C:\WINDOWS\Alaunch.exe (Acer Inc.)

O4 - HKLM..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe ()

O4 - HKLM..\Run: [MSSE] C:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)

O4 - HKLM..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE (Microsoft Corporation)

O4 - HKLM..\Run: [unlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe File not found

O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112..\Run: [iSUSPM] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (Macrovision Corporation)

O4 - HKLM..\RunOnceEx: [] File not found

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe (Research In Motion Limited)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe (Eastman Kodak Company)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe ()

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Scanner File Utility.lnk = File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSimpleStartMenu = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoUserNameInStartMenu = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTaskGrouping = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogOff = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisablePersonalDirChange = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableChangePassword = 1

O7 - HKU\S-1-5-21-6269425-2005813812-3536144309-1112\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SetVisualStyle = %windir%\Resources\Themes\Luna\luna.msstyles (Microsoft)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = PRESTIGE.COVENY.COM

O18 - Protocol\Handler\dssrequest {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found

O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - Reg Error: Key error. File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)

O24 - Desktop WallPaper: C:\WINDOWS\covenylogo.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\covenylogo.bmp

O28 - HKLM ShellExecuteHooks: {091EB208-39DD-417D-A5DD-7E2C2D8FB9CB} - C:\Program Files\Windows Defender\MpShHook.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2008/08/28 16:56:16 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/11/18 17:50:50 | 000,575,488 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\jennifer.scheu\Desktop\OTL.exe

[2010/11/16 22:34:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jennifer.scheu\Application Data\WinRAR

[2010/11/16 22:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2010/11/16 22:24:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump

[2010/11/16 21:56:56 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro

[2010/11/15 20:41:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jennifer.scheu\Local Settings\Application Data\Mozilla Firefox

[2010/11/15 19:55:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\jennifer.scheu\Application Data\Auslogics

[2010/11/15 19:51:16 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\jennifer.scheu\Recent

[2010/11/15 19:28:11 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker

[2010/11/15 19:21:23 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes

[2010/11/15 19:19:28 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics

[2010/11/15 19:18:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner

[2010/11/09 16:52:04 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET

[2010/11/09 16:50:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\winrm

[2010/11/09 16:50:45 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$968930Uinstall_KB968930$

[2009/05/12 14:26:30 | 000,049,152 | ---- | C] ( ) -- C:\WINDOWS\INTEROP.IWSHRUNTIMELIBRARY.DLL

[2006/05/25 19:18:48 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\Interop.Shell32.dll

[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/11/18 17:50:51 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\jennifer.scheu\Desktop\OTL.exe

[2010/11/18 17:49:39 | 000,020,480 | ---- | M] () -- C:\EasyShare.me

[2010/11/18 17:49:21 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/11/18 17:49:16 | 000,000,898 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job

[2010/11/18 17:46:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/11/16 22:35:19 | 000,011,966 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Desktop\attach.zip

[2010/11/16 22:34:37 | 001,438,216 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Desktop\wrar40b1.exe

[2010/11/16 22:18:25 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Desktop\s5tchcrv.exe

[2010/11/16 22:14:35 | 000,630,272 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Desktop\dds.scr

[2010/11/16 22:14:15 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\defogger_reenable

[2010/11/16 22:11:59 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Desktop\Defogger.exe

[2010/11/16 21:57:00 | 000,002,465 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Desktop\HiJackThis.lnk

[2010/11/15 20:43:00 | 000,000,902 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

[2010/11/15 20:41:55 | 000,002,184 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2010/11/15 20:41:55 | 000,002,166 | ---- | M] () -- C:\Documents and Settings\jennifer.scheu\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2010/11/11 03:01:13 | 000,522,282 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2010/11/11 03:01:13 | 000,096,694 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2010/11/10 13:28:06 | 000,002,499 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\ShowingDesk Web Edition.lnk

[5 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[2 C:\WINDOWS\System32\dllcache\*.tmp files -> C:\WINDOWS\System32\dllcache\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/11/16 22:35:19 | 000,011,966 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Desktop\attach.zip

[2010/11/16 22:34:37 | 001,438,216 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Desktop\wrar40b1.exe

[2010/11/16 22:18:25 | 000,296,448 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Desktop\s5tchcrv.exe

[2010/11/16 22:14:35 | 000,630,272 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Desktop\dds.scr

[2010/11/16 22:14:15 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\defogger_reenable

[2010/11/16 22:11:58 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Desktop\Defogger.exe

[2010/11/16 21:56:56 | 000,002,465 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Desktop\HiJackThis.lnk

[2010/11/15 20:41:55 | 000,002,184 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk

[2010/11/15 20:41:55 | 000,002,166 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

[2010/10/19 11:38:23 | 000,775,696 | ---- | C] () -- C:\Program Files\Uninstall Fun Web Products.dll

[2010/05/27 10:22:32 | 000,003,584 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini

[2010/01/11 10:15:56 | 000,038,480 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Application Data\Microsoft Excel.ADR

[2009/08/03 14:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll

[2009/08/03 13:53:03 | 000,000,353 | ---- | C] () -- C:\WINDOWS\CAPTURE1.INI

[2009/05/21 10:53:03 | 000,000,175 | ---- | C] () -- C:\WINDOWS\nscatch.ini

[2009/05/14 11:34:55 | 000,000,376 | ---- | C] () -- C:\WINDOWS\ODBC.INI

[2009/05/14 11:22:17 | 000,000,137 | ---- | C] () -- C:\Documents and Settings\jennifer.scheu\Local Settings\Application Data\fusioncache.dat

[2009/05/13 15:33:47 | 000,000,050 | ---- | C] () -- C:\WINDOWS\commercial.ini

[2009/05/12 15:51:00 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll

[2009/03/03 11:18:04 | 000,080,416 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll

[2008/08/28 17:57:10 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2008/08/28 17:33:10 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIBUN4.dll

[2008/08/28 17:32:34 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMPEG2.dll

[2008/08/28 17:32:34 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTIMP3.dll

[2008/08/28 17:32:34 | 000,001,024 | RH-- | C] () -- C:\WINDOWS\System32\NTICDMK7.dll

[2008/08/28 16:56:06 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2008/01/19 10:10:52 | 000,000,113 | ---- | C] () -- C:\WINDOWS\ALaunch.ini

[2007/03/30 15:44:18 | 000,008,704 | ---- | C] () -- C:\WINDOWS\System32\drivers\int15_64.sys

[2006/08/27 20:30:04 | 000,013,952 | ---- | C] () -- C:\WINDOWS\System32\drivers\UBHelper.sys

[2006/05/25 19:18:48 | 000,331,776 | ---- | C] () -- C:\WINDOWS\System32\ScrollBarLib.dll

[2005/10/25 09:25:28 | 000,006,782 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI

[2004/08/03 23:00:00 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini

[2002/02/27 09:41:28 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\nsldappr32v50.dll

[2002/02/27 09:41:26 | 000,139,264 | ---- | C] () -- C:\WINDOWS\System32\nsldap32v50.dll

[2002/02/27 09:41:26 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\nsldapssl32v50.dll

[2001/12/26 16:12:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\multiplex_vcd.dll

[2001/09/03 23:46:38 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\Hmpg12.dll

[2001/07/30 16:33:56 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC.dll

[2001/07/23 22:04:36 | 000,118,784 | ---- | C] () -- C:\WINDOWS\System32\HMPV2_ENC_MMX.dll

[2000/09/08 16:53:50 | 000,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll

[1998/12/08 18:09:44 | 000,338,944 | ---- | C] () -- C:\WINDOWS\System32\lffpx7.dll

[1998/12/08 18:09:44 | 000,122,880 | ---- | C] () -- C:\WINDOWS\System32\LFKODAK.DLL

[1998/12/08 18:09:44 | 000,088,576 | ---- | C] () -- C:\WINDOWS\System32\lffpx90n.dll

[1996/04/01 11:00:00 | 000,000,200 | ---- | C] () -- C:\WINDOWS\System32\CAPTURE2.INI

========== LOP Check ==========

[2009/05/14 11:17:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AgentOffice

[2009/05/13 15:33:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\eSobi

[2009/06/11 10:59:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SentriLock

[2009/05/27 09:18:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Viewpoint

[2009/05/27 09:27:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\acccore

[2010/04/06 09:07:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Amazon

[2010/11/15 19:55:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Auslogics

[2010/01/11 10:11:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Blackberry Desktop

[2009/07/14 14:03:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Research In Motion

[2009/06/11 11:22:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\SentriLock

[2009/08/13 09:40:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\TeamViewer

[2009/05/21 11:05:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\jennifer.scheu\Application Data\Windows Search

[2009/11/04 08:22:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\TeamViewer

========== Purity Check ==========

< End of report >

OTL Extras logfile created on: 11/18/2010 5:51:40 PM - Run 1

OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\jennifer.scheu\Desktop

Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 7.0.5730.13)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 71.00% Memory free

4.00 Gb Paging File | 3.00 Gb Available in Paging File | 87.00% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 69.77 Gb Total Space | 53.28 Gb Free Space | 76.36% Space Free | Partition Type: NTFS

Computer Name: JENNIFERPC | User Name: Jennifer.Scheu | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 1

"FirewallOverride" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]

"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- File not found

"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe" = C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD -- File not found

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0008546E-DF6E-4CC1-AFD0-2CB8E16C95A2}" = Notifier

"{03792636-ED5B-4CD3-A93B-19BC2C18F8F8}" = Sentrilock Card Utility

"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended

"{10E98E14-832C-4AF7-A4D1-6A9EF83B282E}" = VCAMCEN

"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management

"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD

"{154508C0-07C5-4659-A7A0-E49968750D21}" = HLPPDOCK

"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker

"{1F2C8256-2773-46C7-9ABA-3E39C24ABB51}" = Acer eSettings Management

"{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java 6 Update 20

"{2BDAE5C3-4CC3-4281-8129-7549B1D1CCA3}" = ShowingDesk Web Edition

"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{38441BE7-79B0-42B8-8297-833704F949FE}" = HLPIndex

"{38C65D12-79E3-49C0-B211-DE3BE0A7AB39}" = commercial

"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile

"{3CA39B0C-BA85-4D42-AC0F-1FF5F60C3353}" = OTtBPSDK

"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth

"{432C3720-37BF-4BD7-8E49-F38E090246D0}" = CR2

"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis

"{469730CC-78DF-4CD3-B286-562D459EA619}" = ESSCAM

"{48C82F7A-F100-4DAB-A310-8E18BF2159E1}" = ESSvpot

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{4F677FC7-7AA8-412B-A957-F13CBE1C7331}" = ESSSONIC

"{54C8FE84-89C4-40E8-976C-439EB0729BD6}" = CardRd81

"{61C79AE1-5403-4687-AC68-28BFA5EF3895}" = Kyocera Scanner File Utility

"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr

"{69BD6399-3D8F-45B7-81D9-819361F5101D}" = PCDLNCH

"{7057702F-6D71-4F30-8000-9E72BC771887}" = Acer ePerformance Management

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{87843A41-7808-4F2E-B13F-25C1E67CF2FD}" = ESShelp

"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight

"{8BB4B58A-A402-4DE8-8FCD-287E60B88DD8}" = ESSCT

"{8D8DE8D1-95CF-4C63-84B0-3EE3A7FA7C20}" = TrueForms 4.5 for FNF

"{8DD94CA3-BCD2-49C0-B537-F3B5D95FF0C8}" = HLPSFO

"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini

"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system

"{91110409-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional

"{91190409-6000-11D3-8CFE-0050048383C9}" = Microsoft Publisher 2002

"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui

"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting

"{956A6D4F-B297-4E08-A39E-C00FFDB7826F}" = Intellisync for FNF

"{96009644-514C-47DD-BE49-6D93C7FCFFA3}" = BlackBerry Desktop Software 4.1.1

"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL

"{9D1CF8B6-17B3-4832-B062-2C2DD0B57B04}" = CCHelp

"{9D8FEE90-0377-49A9-AEFB-525BDE549BA4}" = ESScore

"{A06275F4-324B-4E85-95E6-87B2CD729401}" = Windows Defender

"{A0AF08BA-3630-4505-BFB2-A41F3837B0D0}" = SFR2

"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR

"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2

"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable

"{A5B3EB8A-4071-42F0-8E8E-7A8342AA8E69}" = ESSvpaht

"{A6F18A67-B771-4191-8A33-36D2E742D6D9}" = ESSANUP

"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper

"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology

"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.0

"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9

"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK

"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI

"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0

"{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore

"{B62B8B9A-6CB7-47D1-9A29-395EC0BFA60C}" = AgentOffice

"{B997C2A0-4383-41BF-B76E-9B8B7ECFB267}" = KSU

"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2

"{C354C9B6-A4E0-4BB0-A368-6DC6BCA0E314}" = SFR

"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries

"{C9BB218C-2D4B-4FF4-97E2-2C7E3D1B2679}" = Acer eProtection

"{CA60320D-6A16-49C8-A34F-84EEF4799567}" = ESSTUTOR

"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1

"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1

"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1

"{D15E9DB5-6BEB-4534-901E-80C0A29BAB97}" = ESSAdpt

"{DF6A13C0-77DF-41FE-BD05-6D5201EB0CE7}_is1" = Auslogics Disk Defrag

"{E62A1F01-07B7-4541-A835-EE5B0BF064C2}" = Microsoft Antimalware

"{EF98A02A-1748-4762-9B7D-5ED1600520D5}" = Microsoft Security Essentials

"{F2D0C1B1-80FF-46F9-BA61-33B01A07FAFC}" = HLPCCTR

"{F71760CD-0F8B-4DCC-B7B7-6B223CC3843C}" = OTtBP

"{F8131A35-47FD-27AD-116D-0E79AF5DE5EE}" = Acrobat.com

"{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock

"{FEDE2483-87B7-44C1-A5BB-D75AEB8B6340}" = ESSEMAIL

"Adobe AIR" = Adobe AIR

"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin

"Adobe Shockwave Player" = Adobe Shockwave Player 11

"BlackBerry_{96009644-514C-47DD-BE49-6D93C7FCFFA3}" = BlackBerry Desktop Software 4.1.1

"C4B4D7F5499921DF57A4F6B55E59E0F50C2FE298" = Windows Driver Package - SCM Microsystems Inc. (SCR3xx USB Smart Card Reader) SmartCardReader (11/07/2006 4.35.00.01)

"CCleaner" = CCleaner

"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com

"HDMI" = Intel® Graphics Media Accelerator Driver

"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs

"ie7" = Windows Internet Explorer 7

"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker

"InstallShield_{B62B8B9A-6CB7-47D1-9A29-395EC0BFA60C}" = AgentOffice 10.0

"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1

"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1

"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile

"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended

"Microsoft Security Essentials" = Microsoft Security Essentials

"Mozilla Firefox (3.6.12)" = Mozilla Firefox (3.6.12)

"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP

"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs

"OcaHistoryUpd" = OCA Client history tool install

"Windows Media Format Runtime" = Windows Media Format 11 runtime

"Windows Media Player" = Windows Media Player 11

"Windows XP Service Pack" = Windows XP Service Pack 3

"WinRAR archiver" = WinRAR 4.00 beta 1 (32-bit)

"WMFDist11" = Windows Media Format 11 runtime

"wmp11" = Windows Media Player 11

"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== Last 10 Event Log Errors ==========

[ Application Events ]

Error - 11/17/2010 9:04:08 PM | Computer Name = JENNIFERPC | Source = Userenv | ID = 1500

Description = Windows cannot log you on because your profile cannot be loaded. Check

that you are connected to the network, or that your network is functioning correctly.