Computer freezes randomly

[Bobh]

Hi -
I am running Vista Home Basic  32 bit.  My computer runs slower than it used to.  Recently it has began to freeze randomly.  I can not detect any pattern to what might be causing the problem.  However I don't know much about computers.  When I turn the computer on the background picture comes up and I ask for Internet Explorer.  At that time the three bars at the top come up but the rest of the page stays blank.  Sometimes if I leave it alone for 15 minutes or more and come back the page has filled out and I can go on to other things.  After I have gone to other things (checking the e-mail, etc. ) it works OK for a while and then it might freeze for a few minutes.  The problem seems to be getting more often.  I ran avast Antivirus, Malwarebytes, and Superspyware.  All three found 0 defects.  Sometimes I get a message "Internet Explorer cannot display the webpage"  Once in order to get on the computer I taped on F8 and used "Last best configuration" and that worked but did not solve the problem.                                                       
Broni suggested I run HiJackThis. i ran it the best I could.  Sometimes the answers I got I could not match with your instructions.  However I got logs which I will put at the end of this.  I hope it is enough.  Thanks for your time.
PS  I have the 3 logs on my desktop.  I can't copy and paste them.  What am I doing wrong?    Bob

[Bobh]

Hi -
Here are the logs for my previous message:
I should have read farther.
Thank you   Bob


[recovering disk space - old attachment deleted by admin]

[SuperDave]

Hello and welcome to Computer Hope Forum. My name is Dave. I will be helping you out with your particular problem on your computer. I am working under the guidance of one of the specialist of this forum so it may take a bit longer to process your logs.

1. I will be working on your Malware issues. This may or may not solve other issues you have with your machine.
2. The fixes are specific to your problem and should only be used for this issue on this machine.
3. If you don't know or understand something, please don't hesitate to ask.
4. Please DO NOT run any other tools or scans while I am helping you.
5. It is important that you reply to this thread. Do not start a new topic.
6. Your security programs may give warnings for some of the tools I will ask you to use. Be assured, any links I give are safe.
7. Absence of symptoms does not mean that everything is clear.

Sorry for being so late in getting to your post. I've never seen the forums so busy. Is it just your internet that is slow or is it slow when not on the net? How much RAM do you have?

I can't copy and paste them.  What am I doing wrong?

When open each file, place your cursor in the document, CTRL+ A, CTRL+ C and then paste it in your reply.

Download OTL to your desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* When the window appears, underneath Output at the top change it to Minimal Output.
* Check the boxes beside LOP Check and Purity Check.
* Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan won't take long.

When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.

Please copy and pate the contents of these files, one at a time, into your next reply.

Note: You may need two or more posts to fit them all in.

[Bobh]

SuperDave -
Thanks for your reply.  Being late is not a problem.  I am slow because I don't know what I am doing but I am learning.  I hope I can continue but sometimes the computer will not let me on.  I will give you a better report later.   I will work on your instructions this afternoon.    Thanks    Bob

[Bobh]

SuperDave -
I have 1.5 GB of RAM.  I have been told that this is enough for what I use the computer for, which is to check e-mail, check bank account, work jig saws, read news, check weather, etc.
The major problem I have is getting on.  When I turn the power on my background comes up and I click on Internet Explorer.  A page comes up with the top 3 lines full but the rest of the page is blank.  This is where my home page is supposed to be.  Nothing I do can get the home page to come up.  What I have done is to turn on the power and hit F8, which gives me "advance boot options".  I then use "Last known good configuration", "safe mode", or "start windows normally".  Sometimes one works or sometimes another will get me to my home page.  Once I get to my home page I am alright for the rest of the day but I have to start over the next day.

Here are my logs:
     SuperDave -
I have 1.5 GB of RAM.  I have been told that this is enough for what I use the computer for, which is to check e-mail, check bank account, work jig saws, read news, check weather, etc.
The major problem I have is getting on.  When I turn the power on my background comes up and I click on Internet Explorer.  A page comes up with the top 3 lines full but the rest of the page is blank.  This is where my home page is supposed to be.  Nothing I do can get the home page to come up.  What I have done is to turn on the power and hit F8, which gives me "advance boot options".  I then use "Last known good configuration", "safe mode", or "start windows normally".  Sometimes one works or sometimes another will get me to my home page.  Once I get to my home page I am alright for the rest of the day but I have to start over the next day.

Here are my logs:
     SuperDave -
I have 1.5 GB of RAM.  I have been told that this is enough for what I use the computer for, which is to check e-mail, check bank account, work jig saws, read news, check weather, etc.
The major problem I have is getting on.  When I turn the power on my background comes up and I click on Internet Explorer.  A page comes up with the top 3 lines full but the rest of the page is blank.  This is where my home page is supposed to be.  Nothing I do can get the home page to come up.  What I have done is to turn on the power and hit F8, which gives me "advance boot options".  I then use "Last known good configuration", "safe mode", or "start windows normally".  Sometimes one works or sometimes another will get me to my home page.  Once I get to my home page I am alright for the rest of the day but I have to start over the next day.

Here are my logs:
SuperDave -
I have 1.5 GB of RAM.  I have been told that this is enough for what I use the computer for, which is to check e-mail, check bank account, work jig saws, read news, check weather, etc.
The major problem I have is getting on.  When I turn the power on my background comes up and I click on Internet Explorer.  A page comes up with the top 3 lines full but the rest of the page is blank.  This is where my home page is supposed to be.  Nothing I do can get the home page to come up.  What I have done is to turn on the power and hit F8, which gives me "advance boot options".  I then use "Last known good configuration", "safe mode", or "start windows normally".  Sometimes one works or sometimes another will get me to my home page.  Once I get to my home page I am alright for the rest of the day but I have to start over the next day.

Here are my logs:
     SuperDave -
I have 1.5 GB of RAM.  I have been told that this is enough for what I use the computer for, which is to check e-mail, check bank account, work jig saws, read news, check weather, etc.
The major problem I have is getting on.  When I turn the power on my background comes up and I click on Internet Explorer.  A page comes up with the top 3 lines full but the rest of the page is blank.  This is where my home page is supposed to be.  Nothing I do can get the home page to come up.  What I have done is to turn on the power and hit F8, which gives me "advance boot options".  I then use "Last known good configuration", "safe mode", or "start windows normally".  Sometimes one works or sometimes another will get me to my home page.  Once I get to my home page I am alright for the rest of the day but I have to start over the next day.


I have the 2 files but I can't copy them to this reply.  I read what you said but I am doing something wrong.  Help!!  Thanks    Bob

[Bobh]

SuperDave -
Here are the logs:cccACOTL logfile created on: 9/6/2010 10:09:09 AM - Run 1
OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\Bob\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 57.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 103.42 Gb Total Space | 66.09 Gb Free Space | 63.90% Space Free | Partition Type: NTFS
Drive D: | 8.37 Gb Total Space | 1.75 Gb Free Space | 20.94% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: BOB-PC
Current User Name: Bob
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Bob\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Internet Explorer\ieuser.exe (Microsoft Corporation)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\System32\audiodg.exe (Microsoft Corporation)
 
 
========== Modules (SafeList) ==========
 
MOD - C:\Users\Bob\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18005_none_5cb72f96088b0de0\comctl32.dll (Microsoft Corporation)
MOD - C:\WINDOWS\System32\msscript.ocx (Microsoft Corporation)
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (avast! Web Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Mail Scanner) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (avast! Antivirus) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe (AVAST Software)
SRV - (WPFFontCache_v0400) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (FontCache) -- C:\WINDOWS\System32\FntCache.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (SABProcEnum) -- C:\Program Files\Internet Explorer\SABProcEnum.sys File not found
DRV - (NwlnkFwd) -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys File not found
DRV - (NwlnkFlt) -- C:\Windows\System32\DRIVERS\nwlnkflt.sys File not found
DRV - (MRESP50a64) -- C:\PROGRA~1\COMMON~1\Motive\MRESP50a64.SYS File not found
DRV - (MRESP50) -- C:\PROGRA~1\COMMON~1\Motive\MRESP50.SYS File not found
DRV - (MRENDIS5) -- C:\PROGRA~1\COMMON~1\Motive\MRENDIS5.SYS File not found
DRV - (MREMPR5) -- C:\PROGRA~1\COMMON~1\Motive\MREMPR5.SYS File not found
DRV - (MREMP50a64) -- C:\PROGRA~1\COMMON~1\Motive\MREMP50a64.SYS File not found
DRV - (MREMP50) -- C:\PROGRA~1\COMMON~1\Motive\MREMP50.SYS File not found
DRV - (IpInIp) -- C:\Windows\System32\DRIVERS\ipinip.sys File not found
DRV - (catchme) -- C:\Users\Bob\AppData\Local\Temp\catchme.sys File not found
DRV - (blbdrive) -- C:\Windows\System32\drivers\blbdrive.sys File not found
DRV - (aswTdi) -- C:\Windows\System32\drivers\aswTdi.sys (ALWIL Software)
DRV - (aswSP) -- C:\Windows\System32\drivers\aswSP.sys (ALWIL Software)
DRV - (aswRdr) -- C:\Windows\System32\drivers\aswRdr.sys (ALWIL Software)
DRV - (aswMonFlt) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys (ALWIL Software)
DRV - (aswFsBlk) -- C:\Windows\System32\drivers\aswFsBlk.sys (ALWIL Software)
DRV - (SASENUM) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (igfx) -- C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (ialm) -- C:\WINDOWS\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (XAudio) -- C:\WINDOWS\System32\drivers\XAudio.sys (Conexant Systems, Inc.)
DRV - (HSF_DPV) -- C:\WINDOWS\System32\drivers\HSX_DPV.sys (Conexant Systems, Inc.)
DRV - (HSXHWBS2) -- C:\WINDOWS\System32\drivers\HSXHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\System32\drivers\HSX_CNXT.sys (Conexant Systems, Inc.)
DRV - (STHDA) -- C:\WINDOWS\System32\drivers\stwrt.sys (SigmaTel, Inc.)
DRV - (ql2300) -- C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (adp94xx) -- C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (elxstor) -- C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adpahci) -- C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (uliahci) -- C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (iaStorV) -- C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (adpu320) -- C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (ulsata2) -- C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (vsmraid) -- C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (ql40xx) -- C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) -- C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (adpu160m) -- C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (nvraid) -- C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nfrd960) -- C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) -- C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (SiSRaid4) -- C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (nvstor) -- C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (aic78xx) -- C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (arcsas) -- C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (LSI_SCSI) -- C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (SiSRaid2) -- C:\Windows\system32\drivers\sisraid2.sys (Silicon Integrated Systems Corp.)
DRV - (HpCISSs) -- C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (arc) -- C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iteraid) -- C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) -- C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (LSI_SAS) -- C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (Symc8xx) -- C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (LSI_FC) -- C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (Sym_u3) -- C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) -- C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) -- C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (megasas) -- C:\Windows\system32\drivers\megasas.sys (LSI Logic Corporation)
DRV - (viaide) -- C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) -- C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) -- C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) -- C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) -- C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) -- C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) -- C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) -- C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) -- C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) -- C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (NETw2v32) Intel(R) -- C:\WINDOWS\System32\drivers\NETw2v32.sys (Intel® Corporation)
DRV - (yukonwlh) -- C:\WINDOWS\System32\drivers\yk60x86.sys (Marvell)
DRV - (E1G60) Intel(R) -- C:\WINDOWS\System32\drivers\E1G60I32.sys (Intel Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=W3609
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://verizon.my.yahoo.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
O1 HOSTS File: ([2009/06/14 20:34:17 | 000,000,027 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\google\bae.dll (Gateway Inc.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D7E97865-918F-41E4-9CD0-25AB1C574CE8} - No CLSID value found.
O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software)
O4 - HKCU..\Run: [DriverScanner] C:\Program Files\Uniblue\DriverScanner\launcher.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: EnableShellExecuteHooks = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Desert Landscape.jpg
O28 - HKLM ShellExecuteHooks: {4F07DA45-8170-4859-9B5F-037EF2970034} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 16:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2010/09/06 10:06:53 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe
[2010/09/03 08:41:50 | 000,000,000 | ---D | C] -- C:\Users\Bob\AppData\Roaming\CyberLink
[2010/09/03 08:41:35 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2010/09/03 07:21:06 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010/09/03 07:21:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010/09/03 07:21:06 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010/09/03 07:20:45 | 000,000,000 | ---D | C] -- C:\Program Files\Java
[2010/09/02 16:37:03 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2010/08/30 19:48:39 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2010/08/30 19:48:38 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2010/08/29 13:54:15 | 000,000,000 | ---D | C] -- C:\Windows\Sun
[2010/08/22 08:33:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Uniblue
[2010/08/22 08:33:18 | 000,000,000 | ---D | C] -- C:\Program Files\Uniblue
[2010/08/21 17:09:30 | 000,081,920 | ---- | C] (Radius Inc.) -- C:\Windows\System32\iccvid.dll
[2010/08/21 17:09:20 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2010/08/21 17:09:20 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2010/08/21 17:09:19 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2010/08/21 17:09:01 | 002,037,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2010/08/21 17:08:59 | 000,036,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rtutils.dll
[2010/08/21 17:07:20 | 003,600,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntkrnlpa.exe
[2010/08/21 17:07:19 | 003,548,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ntoskrnl.exe
 
========== Files - Modified Within 30 Days ==========
 
[2010/09/06 10:09:14 | 001,572,864 | -HS- | M] () -- C:\Users\Bob\ntuser.dat
[2010/09/06 10:06:53 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\Bob\Desktop\OTL.exe
[2010/09/06 09:53:36 | 000,004,672 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/09/06 09:53:36 | 000,004,672 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/09/06 09:49:30 | 000,703,388 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/09/06 09:49:30 | 000,604,264 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/09/06 09:49:30 | 000,103,964 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/09/06 09:44:52 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/09/06 09:44:39 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/09/06 08:18:33 | 000,524,288 | -HS- | M] () -- C:\Users\Bob\ntuser.dat{b47b01f6-73f2-11df-8fc1-0019d1498f68}.TMContainer00000000000000000001.regtrans-ms
[2010/09/06 08:18:33 | 000,065,536 | -HS- | M] () -- C:\Users\Bob\ntuser.dat{b47b01f6-73f2-11df-8fc1-0019d1498f68}.TM.blf
[2010/09/06 08:18:30 | 000,922,721 | -H-- | M] () -- C:\Users\Bob\AppData\Local\IconCache.db
[2010/09/03 08:37:24 | 000,001,881 | ---- | M] () -- C:\Users\Bob\Desktop\BobHJT.lnk
[2010/09/03 07:20:49 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\deployJava1.dll
[2010/09/03 07:20:49 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe
[2010/09/03 07:20:49 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe
[2010/09/03 07:20:49 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe
[2010/09/02 18:31:57 | 000,001,807 | ---- | M] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/08/30 18:34:37 | 000,001,609 | ---- | M] () -- C:\Users\Bob\Documents\Fix.bat
[2010/08/30 06:22:41 | 000,002,577 | ---- | M] () -- C:\Windows\System32\config.nt
[2010/08/22 08:01:22 | 000,294,288 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
 
========== Files Created - No Company Name ==========
 
[2010/09/03 08:37:24 | 000,001,881 | ---- | C] () -- C:\Users\Bob\Desktop\BobHJT.lnk
[2010/09/02 18:31:57 | 000,001,807 | ---- | C] () -- C:\Users\Public\Desktop\SUPERAntiSpyware Free Edition.lnk
[2010/08/30 18:33:25 | 000,001,609 | ---- | C] () -- C:\Users\Bob\Documents\Fix.bat
[2009/11/30 17:46:14 | 000,000,680 | ---- | C] () -- C:\Users\Bob\AppData\Local\d3d9caps.dat
[2009/08/13 16:03:19 | 000,024,206 | ---- | C] () -- C:\Users\Bob\AppData\Roaming\UserTile.png
[2009/06/22 15:50:24 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009/06/10 14:58:53 | 000,005,843 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2009/06/10 10:38:02 | 000,006,656 | ---- | C] () -- C:\Users\Bob\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2008/10/10 10:24:40 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1147.dll
[2008/01/02 16:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
 
========== LOP Check ==========
 
[2009/11/15 11:06:09 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\DriverCure
[2009/06/28 14:04:05 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\licenses
[2009/06/28 14:05:14 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\PCMM2009
[2009/08/13 16:03:19 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\PeerNetworking
[2009/06/10 10:21:26 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\SampleView
[2010/05/17 16:41:26 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Softland
[2009/08/22 13:11:18 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Tibo Software
[2010/08/22 08:33:25 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\Uniblue
[2009/06/10 16:19:42 | 000,000,000 | ---D | M] -- C:\Users\Bob\AppData\Roaming\WildTangent
[2010/01/10 16:55:17 | 000,000,348 | ---- | M] () -- C:\WINDOWS\Tasks\File Helper.job
[2010/09/06 08:18:38 | 000,032,526 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
< End of report >

[Bobh]

SuperDave -
After messing around I finally figured out how to do the logs.  I have sent the first one , now here is the secOTL Extras logfile created on: 9/6/2010 10:09:09 AM - Run 1
OTL by OldTimer - Version 3.2.11.0     Folder = C:\Users\Bob\Desktop
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy
 
1.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 57.00% Memory free
3.00 Gb Paging File | 3.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 103.42 Gb Total Space | 66.09 Gb Free Space | 63.90% Space Free | Partition Type: NTFS
Drive D: | 8.37 Gb Total Space | 1.75 Gb Free Space | 20.94% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
 
Computer Name: BOB-PC
Current User Name: Bob
Logged in as Administrator.
 
Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3206373129-98774604-3863853047-1000]
"EnableNotificationsRef" = 2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-3206373129-98774604-3863853047-500]
"EnableNotificationsRef" = 2
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0A8AC2AC-CE73-491C-8024-413BF0EC69FA}" = lport=445 | protocol=6 | dir=in | app=system |
"{33A8799D-49B8-41E7-A0AD-519650DDCD57}" = lport=139 | protocol=6 | dir=in | app=system |
"{3F633BA9-BA7C-4460-81B5-9A4E3AAB4E5F}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | [email protected],-28539 |
"{53DE8F74-C57A-44CF-98FD-449863CB1C75}" = rport=139 | protocol=6 | dir=out | app=system |
"{60CE652A-69ED-44EB-92E3-292E6C710A8B}" = lport=137 | protocol=17 | dir=in | app=system |
"{8C6CFD8D-E6AC-4902-830E-0AEAC5A3F442}" = rport=138 | protocol=17 | dir=out | app=system |
"{A319AB1E-2D78-488E-BEAD-6679C9185A90}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{B20BDADA-4AA7-42AF-A595-CE7D1B6EF09B}" = rport=445 | protocol=6 | dir=out | app=system |
"{F90E66B5-B10D-42D3-A765-E31D3C749CE0}" = rport=137 | protocol=17 | dir=out | app=system |
"{FDD3AB4B-2628-4B65-AA0B-A692572749D6}" = lport=138 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{4C83F9A5-9DE1-4E91-B757-62EB827293E2}" = protocol=1 | dir=in | [email protected],-28543 |
"{5FF1F788-263F-4AB2-8321-0C9B8D53AA52}" = protocol=58 | dir=out | [email protected],-28546 |
"{8F7C6F7D-F74E-4B9E-AE17-3438E8B07D2E}" = protocol=1 | dir=out | [email protected],-28544 |
"{D6CE64AA-1540-4549-816F-908A7C456EF6}" = protocol=58 | dir=in | [email protected],-28545 |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216021FF}" = Java(TM) 6 Update 21
"{36FDBE6E-6684-462B-AE98-9A39A1B200CC}" = HP Product Assistant
"{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}" = Copy
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go 5.0
"{44C05309-60F4-410B-BC32-31733CFF1A41}" = Microsoft Digital Image Starter Edition 2006 Editor
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4FE542EB-FF0B-4739-94DD-25C8AE0AB251}" = Microsoft Digital Image Starter Edition 2006 Library
"{5E6D6161-5509-4f55-9372-1E01792F843A}" = F300_Help
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6D8D64BE-F500-55B6-705D-DFD08AFE0624}" = Acrobat.com
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{787D1A33-A97B-4245-87C0-7174609A540C}" = HP Update
"{7F3BCF8A-8E02-4659-AF25-F9AB66BD6718}" = eMachines Recovery Center Installer
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9F7FC79B-3059-4264-9450-39EB368E3225}" = Microsoft Digital Image Library 9 - Blocker
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}" = SigmaTel Audio
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A92000000001}" = Adobe Reader 9.2
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F1568757-E564-4cb5-8980-9333119A4384}" = F300
"{F6AC5364-2FB7-437a-811A-D645F22AA6AC}" = F300Trb
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"avast5" = avast! Free Antivirus
"CNXT_MODEM_PCI_HSF" = Soft Data Fax Modem with SmartCP
"eMachines Game Console" = eMachines Game Console
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"HijackThis" = HijackThis 2.0.2
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"PictureItSuiteTrial_v12" = Microsoft Digital Image Starter Edition 2006
"PROSet" = Intel(R) PRO Network Connections Drivers
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
[ Antivirus Events ]
Error - 1/16/2010 3:50:45 PM | Computer Name = Bob-PC | Source = avast! | ID = 33554522
Description =
 
[ Application Events ]
Error - 2/8/2010 9:48:06 AM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 9:49:47 AM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 9:51:32 AM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 10:38:25 AM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 10:41:40 AM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 12:33:21 PM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 12:34:42 PM | Computer Name = Bob-PC | Source = RasClient | ID = 20227
Description =
 
Error - 2/8/2010 12:47:11 PM | Computer Name = Bob-PC | Source = Application Error | ID = 1000
Description = Faulting application HPWUCli.exe, version 5.0.9.0, time stamp 0x4acfa581,
 faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code
 0xc0000005, fault offset 0x01674a20,  process id 0xe10, application start time 0x01caa8de12e9b14f.
 
Error - 2/9/2010 12:26:49 PM | Computer Name = Bob-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6002.18005, time stamp
 0x49e01e78, faulting module Multimedia.api, version 9.2.0.124, time stamp 0x4ac71df2,
 exception code 0xc0000005, fault offset 0x00042f8b,  process id 0xaf0, application
 start time 0x01caa9a39f2b761d.
 
Error - 2/9/2010 12:26:56 PM | Computer Name = Bob-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6002.18005, time stamp
 0x49e01e78, faulting module Multimedia.api, version 9.2.0.124, time stamp 0x4ac71df2,
 exception code 0xc0000005, fault offset 0x00030b34,  process id 0xaf0, application
 start time 0x01caa9a39f2b761d.
 
[ System Events ]
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7026
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:47:10 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 9/6/2010 7:53:23 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7022
Description =
 
Error - 9/6/2010 10:46:35 AM | Computer Name = Bob-PC | Source = Service Control Manager | ID = 7022
Description =
 
 
< End of report >
ond:

[SuperDave]

Download ComboFix by sUBs from one of the below links.  Be sure to save it to the Desktop.

link # 1
Link # 2

Close any open web browsers (Firefox, Internet Explorer, etc) before starting ComboFix.

Temporarily disable your anti-virus, and any anti-spyware real-time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.

Right-click combofix.exe and select Run as Administrator and follow the prompts.
When finished, ComboFix will produce a log for you.
Post the ComboFix log and a new HijackThis log in your next reply.

NOTE: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

Remember to re-enable your anti-virus and anti-spyware protection when ComboFix is complete.

[Bobh]

SuperDave -
Here is the log ComboFix.  I will get the other as soon as I can.   Bob
ComboFix 10-09-06.04 - Bob 09/07/2010  10:52:31.5.1 - x86
Microsoft® Windows Vista™ Home Basic   6.0.6002.2.1252.1.1033.18.1525.880 [GMT -5:00]
Running from: c:\users\Bob\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
AC
(((((((((((((((((((((((((   Files Created from 2010-08-07 to 2010-09-07  )))))))))))))))))))))))))))))))
.

2010-09-07 AC15:59 . 2010-09-07 16:00   --------   d-----w-   c:\users\Bob\AppData\Local\temp
2010-09-07 15:59 . 2010-09-07 15:59   --------   d-----w-   c:\users\Public\AppData\Local\temp
2010-09-07 15:59 . 2010-09-07 15:59   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-09-03 13:41 . 2010-09-03 13:41   --------   d-----w-   c:\users\Public\CyberLink
2010-09-03 13:41 . 2010-09-03 13:41   --------   d-----w-   c:\users\Bob\AppData\Roaming\CyberLink
2010-09-03 13:41 . 2010-09-03 13:41   --------   d-----w-   c:\programdata\CyberLink
2010-09-03 12:20 . 2010-09-03 12:20   --------   d-----w-   c:\program files\Java
2010-08-31 00:48 . 2010-04-29 20:39   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-31 00:48 . 2010-04-29 20:39   20952   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-08-29 18:54 . 2010-08-29 18:54   --------   d-----w-   c:\windows\Sun
2010-08-23 10:21 . 2010-08-23 10:21   388096   ----a-r-   c:\users\Bob\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-08-22 13:33 . 2010-08-22 13:33   --------   d-----w-   c:\programdata\Uniblue
2010-08-22 13:33 . 2010-08-30 11:14   --------   d-----w-   c:\program files\Uniblue
2010-08-21 22:09 . 2010-05-27 20:08   81920   ----a-w-   c:\windows\system32\iccvid.dll
2010-08-21 22:09 . 2010-06-29 15:47   834048   ----a-w-   c:\windows\system32\wininet.dll
2010-08-21 22:09 . 2010-06-28 16:13   78336   ----a-w-   c:\windows\system32\ieencode.dll
2010-08-21 22:09 . 2010-06-11 16:16   274944   ----a-w-   c:\windows\system32\schannel.dll
2010-08-21 22:09 . 2010-06-21 13:37   2037760   ----a-w-   c:\windows\system32\win32k.sys
2010-08-21 22:08 . 2010-06-18 17:31   36864   ----a-w-   c:\windows\system32\rtutils.dll
2010-08-21 22:07 . 2010-06-08 17:35   3600768   ----a-w-   c:\windows\system32\ntkrnlpa.exe
2010-08-21 22:07 . 2010-06-08 17:35   3548040   ----a-w-   c:\windows\system32\ntoskrnl.exe
2010-08-21 22:07 . 2010-06-11 16:15   1248768   ----a-w-   c:\windows\system32\msxml3.dll
2010-08-21 22:07 . 2010-06-18 15:04   302080   ----a-w-   c:\windows\system32\drivers\srv.sys
2010-08-21 22:07 . 2010-06-18 15:04   144896   ----a-w-   c:\windows\system32\drivers\srv2.sys
2010-08-21 22:05 . 2010-06-16 16:04   905088   ----a-w-   c:\windows\system32\drivers\tcpip.sys

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-07 15:37 . 2009-06-13 15:23   --------   d-----w-   c:\program files\SUPERAntiSpyware
2010-09-03 12:21 . 2009-06-10 17:03   --------   d-----w-   c:\program files\Common Files\Java
2010-09-03 12:20 . 2010-05-21 11:06   423656   ----a-w-   c:\windows\system32\deployJava1.dll
2010-08-31 00:48 . 2009-06-13 16:17   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-08-22 13:33 . 2010-05-27 01:11   --------   d-----w-   c:\users\Bob\AppData\Roaming\Uniblue
2010-08-22 12:53 . 2006-11-02 11:18   --------   d-----w-   c:\program files\Windows Mail
2010-08-03 12:23 . 2009-06-10 17:02   --------   d-----w-   c:\program files\Google
2010-07-17 10:55 . 2009-06-10 15:22   69840   ----a-w-   c:\users\Bob\AppData\Local\GDIPFONTCACHEV1.DAT
.

(((((((((((((((((((((((((((((   SnapShot_2010-09-07_14.27.15   )))))))))))))))))))))))))))))))))))))))))
.
- 2006-11-02 13:02 . 2010-09-07 14:12   72820              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:02 . 2010-09-07 15:50   72820              c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2009-06-10 15:23 . 2010-09-07 14:12   13576              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3206373129-98774604-3863853047-1000_UserData.bin
+ 2009-06-10 15:23 . 2010-09-07 15:50   13576              c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3206373129-98774604-3863853047-1000_UserData.bin
- 2009-06-10 16:55 . 2010-09-07 14:15   32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-06-10 16:55 . 2010-09-07 15:35   32768              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-09-07 15:27 . 2010-09-07 15:35   32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-09-02 18:00 . 2010-09-07 14:15   32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2009-06-10 16:55 . 2010-09-07 15:35   16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2009-06-10 16:55 . 2010-09-07 14:15   16384              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-06-15 00:34 . 2010-09-07 15:49   16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2009-06-15 00:34 . 2010-09-07 14:10   16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2009-06-15 00:34 . 2010-09-07 15:49   32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-06-15 00:34 . 2010-09-07 14:10   32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2009-06-15 00:34 . 2010-09-07 14:10   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-06-15 00:34 . 2010-09-07 15:49   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-09-07 14:10 . 2010-09-07 14:10   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-09-07 15:48 . 2010-09-07 15:48   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-09-07 14:10 . 2010-09-07 14:10   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2010-09-07 15:48 . 2010-09-07 15:48   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2006-11-17 06:33 . 2010-09-07 15:50   112624              c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 10:33 . 2010-09-07 15:56   604264              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-09-07 14:15   604264              c:\windows\System32\perfh009.dat
- 2006-11-02 10:33 . 2010-09-07 14:15   103964              c:\windows\System32\perfc009.dat
+ 2006-11-02 10:33 . 2010-09-07 15:56   103964              c:\windows\System32\perfc009.dat
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"EnableShellExecuteHooks"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=c:\windows\pss\HP Digital Imaging Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2009-09-04 18:08   935288   ----a-r-   c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2009-10-03 10:08   35696   ----a-w-   c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2008-01-02 22:06   166424   ----a-w-   c:\windows\System32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2006-12-11 02:52   49152   ----a-w-   c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2008-01-02 22:07   141848   ----a-w-   c:\windows\System32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 20:39   1090952   ----a-w-   c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
2008-01-02 22:07   133656   ----a-w-   c:\windows\System32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
2006-11-02 10:38   303104   ----a-w-   c:\windows\sttray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 16:44   248552   ----a-w-   c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):0a,77,2f,c9,7f,f3,c9,01

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3206373129-98774604-3863853047-1000]
"EnableNotificationsRef"=dword:00000002

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-3206373129-98774604-3863853047-500]
"EnableNotificationsRef"=dword:00000002

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\DRIVERS\NETw2v32.sys [2006-11-02 2589184]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceNoNetwork   REG_MULTI_SZ      PLA DPS BFE mpssvc
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation   REG_MULTI_SZ      FontCache
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://verizon.my.yahoo.com/
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=W3609
uInternet Settings,ProxyOverride = <local>
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-07 11:00
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2010-09-07  11:03:38
ComboFix-quarantined-files.txt  2010-09-07 16:03
ComboFix2.txt  2010-09-07 14:31
ComboFix3.txt  2009-06-15 01:37
ComboFix4.txt  2009-06-14 20:22

Pre-Run: 70,758,563,840 bytes free
Post-Run: 70,512,422,912 bytes free

- - End Of File - - 70F47BD3CCB879D922CC5B7CD4D8FCBA

[SuperDave]

Download Security Check by screen317 from one of the following links and save it to your desktop.

Link 1
Link 2

* Unzip SecurityCheck.zip and a folder named Security Check should appear.
* Open the Security Check folder and double-click Security Check.bat
* Follow the on-screen instructions inside of the black box.
* A Notepad document should open automatically called checkup.txt
* Post the contents of that document in your next reply.

Note: If a security program requests permission from dig.exe to access the Internet, allow it to do so.
***************************************

* Download the following tool: RootRepeal - Rootkit Detector
* Direct download link is here: RootRepeal.zip

* Close all programs and temporarily disable your anti-virus, Firewall and any anti-malware real-time protection before performing a scan.
* Click this link to see a list of such programs and how to disable them.

* Extract the program file to a new folder such as C:\RootRepeal
* Run the program RootRepeal.exe and go to the REPORT tab and click on the Scan button.
* Select ALL of the checkboxes and then click OK and it will start scanning your system.
* If you have multiple drives you only need to check the C: drive or the one Windows is installed on.
* When done, click on Save Report
* Save it to the same location where you ran it from, such as C:RootRepeal
* Save it as rootrepeal.txt
* Then open that log and select all and copy/paste it back on your next reply please.
* Close RootRepeal.

[Bobh]

SuperDave -
Here is the log of Security Check:
 Results of screen317's Security Check version 0.99.5 
 Windows Vista Service Pack 2 (UAC is enabled)
 Internet Explorer 7 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
 Windows Firewall Enabled! 
 WMI entry may not exist for antivirus; attempting automatic update.
```````````````````````````````
Anti-malware/Other Utilities Check:
 Malwarebytes' Anti-Malware   
 HijackThis 2.0.2   
 Java(TM) 6 Update 21 
 Adobe Flash Player   
Adobe Reader 9.2
Out of date Adobe Reader installed!
````````````````````````````````
Process Check: 
objlist.exe by Laurent
````````````````````````````````
DNS Vulnerability Check:
 GREAT! (Not vulnerable to DNS cache poisoning)

``````````End of Log````````````

[Bobh]

SuperDave -
I am having trouble with your last instructions.  I will work on that tomarrow.  Bob

[Bobh]

SuperDave -
This morning I could not get on the internet.  After waiting a long time my home page would come up but I could not get on the internet to do anything like connect to Computer Hope.  I had to tap on F8 and use "Last known good configuration" and I could work.
I notice that my Internet Explorer 7  is out of date.  I remember you said not to change anything until you are done but if I got Internet Explorer 8 would it help and could we finish working on the problem I have?  If this is OK how do I get Internet 8?
I will continue to follow your instructions where I left off last night as the computer will allow me to work.    Thanks    Bob

[Bobh]

SuperDave -
I got RootRepeal on my desk top.  I removed all of my security but I can not figure how to get any farther.  Can you give me more detailed instructions?   How do I get it to C:/RootRepeal and how do I get to it when it gets there?  Sorry to be so dumb.    Bob

[SuperDave]

Go ahead and upgrade to IE 8. To run RootRepeal you must first download the zip file to computer. Next you must create a folder on your C drive called RootRepeal. (Click on the C drive so that it is highlighted then click on file at the top and select New and Folder.)  The go to the zip file and unzip it to that folder you just created on your C drive. Now double-click on the folder to see all the files that were extracted and click on the rootrepeal.exe to run the program. After the scan, save the report/log in the same folder and copy and paste it in your next reply.