Computer starts up fine, when i get into windows all i can see is my background, i can ctrl+alt+delete and use task manager, and use some things like notepad, firefox, and regedit. System restore does not work in safe mode, or normal windows. I cannot browse files on my computer only through notepad so this has been a little tough. iexplorer.exe does not work, most antivirus programs do not work like malware anti-bytes.
Here is what i tried so far.
1. ctrl+alt+del, new task, explorer.exe tried many times with no luck
1) RESTORE A MISSING "USERINIT" REGISTRY VALUE
1. Copy below and paste into Notepad:
----------copy inside only----------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Userinit"="C:\\WINDOWS\\SYSTEM32\\userinit.ex e,"
----------copy inside only----------
2. If your Windows is not on drive C: replace C: with your
Windows drive letter and Save-As Userinit.reg
(or any name + .reg).
3. Double-click or right-click and merge into the registry.
4. Restart.
(2) DELETE AN INCORRECT "EXPLORER.EXE" ENTRY IN THE REGISTRY
1. Open the Run box and enter: regedit
2. Go to this key:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options]
3. If you see "explorer.exe" as a subkey below, delete it.
4. Restart.
(3) RESTORE A MISSING "EXPLORER.EXE" ENTRY IN THE REGISTRY
1. Copy below and paste into Notepad:
----------copy inside only----------
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"Shell"="explorer.exe"
----------copy inside only----------
2. Save-As WinLogon.reg (or any name + .reg).
3. Double-click or right-click and merge into the registry.
4. Restart.
(4) EXLORER.EXE IS MISSING
If explorer.exe is not in C:\WINDOWS\ then insert
your Windows CD and, using the 'Task Manager', run
the 'System File Checker' utility with this command:
sfc /scannow
If the 'System File Checker' didn't replace it, boot
to the Recovery Console with the Windows CD and copy
explorer.exe manually:
1. Insert the Windows CD and restart.
2. When setup begins, choose the "Repair or Recover"
option by pressing "R".
3. Once at the command prompt, enter:
copy D:\I386\EXPLORER.EX_ C:\WINDOWS\
(Change drive letters accordingly)
4. The file, "EXPLORER.EX_" is compressed and should be
automatically expanded on copy. If it doesn't just enter
this command:
expand C:\WINDOWS\EXPLORER.EX_ C:\WINDOWS\explorer.exe
5. To exit the Recovery Console, type: exit.
If the desktop still does not load then, from within the
Task Manager, run a new task to open the Registry Editor:
regedit.exe
and check the registry data from above, adding as neccessary,
if it is missing or incorrect.
That didnt work, and ive tried a few other things. Here is my hijack this file and combofix file
ComboFix 10-08-31.01 - Riley 08/31/2010 19:59:29.1.2 - x86
Running from: c:\documents and settings\Riley\My Documents\Downloads\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\Rileybro.exe
.
((((((((((((((((((((((((( Files Created from 2010-08-01 to 2010-09-01 )))))))))))))))))))))))))))))))
.
2010-08-31 23:56 . 2010-08-31 23:56 -------- d-----w- c:\program files\Trend Micro
2010-08-31 23:37 . 2010-08-31 23:37 -------- d-----w- c:\program files\Panda Security
2010-08-31 23:24 . 2010-08-31 23:24 -------- d-----w- c:\program files\zabkat
2010-08-31 23:04 . 2010-08-31 23:11 -------- d-----w- c:\documents and settings\Riley\Application Data\QuickScan
2010-08-31 23:04 . 2010-07-27 02:30 705208 ----a-w- c:\documents and settings\Riley\Application Data\Mozilla\Firefox\Profiles\xlzf5tge.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-08-31 23:04 . 2010-07-27 02:30 978664 ----a-w- c:\documents and settings\Riley\Application Data\Mozilla\Firefox\Profiles\xlzf5tge.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-08-31 22:45 . 2010-08-31 23:32 -------- d-----w- c:\program files\mbamm
2010-08-31 22:35 . 2010-08-31 23:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2010-08-31 22:35 . 2010-08-31 22:36 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-08-31 22:21 . 2010-08-31 22:21 218 ----a-w- C:\WallPaperViews.VBS
2010-08-31 21:20 . 2010-08-31 21:41 138 ----a-w- C:\winexp.reg
2010-08-31 20:34 . 2001-08-17 17:28 701386 -c--a-w- c:\windows\system32\dllcache\wdhaalba.sys
2010-08-31 20:33 . 2001-08-18 02:36 26624 -c--a-w- c:\windows\system32\dllcache\umaxu22.dll
2010-08-31 20:32 . 2001-08-17 16:13 17129 -c--a-w- c:\windows\system32\dllcache\tdkcd31.sys
2010-08-31 20:31 . 2001-08-17 17:56 7552 -c--a-w- c:\windows\system32\dllcache\sonypvu1.sys
2010-08-31 20:30 . 2004-08-04 04:56 3901 -c--a-w- c:\windows\system32\dllcache\siint5.dll
2010-08-31 20:29 . 2001-08-18 02:36 79872 -c--a-w- c:\windows\system32\dllcache\rwia430.dll
2010-08-31 20:28 . 2004-08-04 03:00 17664 -c--a-w- c:\windows\system32\dllcache\ppa3.sys
2010-08-31 20:27 . 2001-08-17 18:05 25088 -c--a-w- c:\windows\system32\dllcache\ovca.sys
2010-08-31 20:26 . 2001-08-18 02:36 19968 -c--a-w- c:\windows\system32\dllcache\mxicfg.dll
2010-08-31 20:25 . 2004-08-04 03:00 7040 -c--a-w- c:\windows\system32\dllcache\ltotape.sys
2010-08-31 20:24 . 2001-08-18 02:36 372824 -c--a-w- c:\windows\system32\dllcache\iconf32.dll
2010-08-31 20:23 . 2001-08-17 17:28 199711 -c--a-w- c:\windows\system32\dllcache\hsf_faxx.sys
2010-08-31 20:22 . 2001-08-18 02:36 71680 -c--a-w- c:\windows\system32\dllcache\fnfilter.dll
2010-08-31 20:21 . 2001-08-17 16:12 28062 -c--a-w- c:\windows\system32\dllcache\dp83820.sys
2010-08-31 20:20 . 2004-08-04 03:00 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys
2010-08-31 20:19 . 2004-08-04 03:07 42752 -c--a-w- c:\windows\system32\dllcache\alim1541.sys
2010-08-31 20:13 . 2010-08-31 21:42 164 ----a-w- C:\Winlogon.reg
2010-08-31 20:12 . 2010-08-31 20:12 136 ----a-w- c:\windows\system32\Winlogon.reg
2010-08-31 18:02 . 2010-08-31 18:02 -------- d-----w- c:\documents and settings\LocalService\Application Data\WTablet
2010-08-31 17:01 . 2010-08-31 17:01 -------- d-----w- c:\documents and settings\Riley\Application Data\WTablet
2010-08-31 17:01 . 2010-08-31 17:01 -------- d-----w- c:\program files\TabletPlugins
2010-08-31 17:01 . 2010-05-19 18:52 16240 ----a-w- c:\windows\system32\drivers\wacmoumonitor.sys
2010-08-31 17:01 . 2009-09-21 20:29 14120 ----a-w- c:\windows\system32\drivers\wacomvhid.sys
2010-08-31 17:01 . 2010-07-13 18:26 656240 ----a-w- c:\windows\system32\Pen_Tablet.dll
2010-08-31 17:01 . 2010-07-13 18:24 495616 ----a-w- c:\windows\system32\Wintab32.dll
2010-08-30 19:34 . 2010-08-31 17:01 -------- d-----w- c:\program files\Tablet
2010-08-30 18:55 . 2010-08-30 18:55 -------- d-----w- C:\Users
2010-08-30 18:55 . 2010-08-30 18:55 -------- d-----w- c:\program files\Pixologic
2010-08-30 18:54 . 2010-08-30 18:54 -------- d-----w- c:\documents and settings\Riley\Local Settings\Application Data\Downloaded Installations
2010-08-30 00:09 . 2010-08-30 00:09 -------- d-----w- c:\documents and settings\Riley\Application Data\Publish Providers
2010-08-30 00:03 . 2010-08-30 00:09 -------- d-----w- c:\documents and settings\Riley\Application Data\Sony
2010-08-30 00:03 . 2010-08-30 00:03 -------- d-----w- c:\documents and settings\Riley\Local Settings\Application Data\Sony
2010-08-29 23:57 . 2010-08-29 23:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Sony
2010-08-29 23:57 . 2010-08-29 23:57 -------- d-----w- c:\program files\Sony
2010-08-29 23:43 . 2010-08-29 23:43 -------- d-----w- c:\program files\Flip Video
2010-08-29 23:43 . 2010-08-29 23:43 -------- d-----w- c:\documents and settings\All Users\Application Data\Flip Video
2010-08-29 17:51 . 2010-08-29 17:51 -------- d-----w- c:\documents and settings\Riley\Application Data\Malwarebytes
2010-08-29 17:50 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-08-29 17:50 . 2010-08-29 17:51 -------- d-----w- c:\program files\mapp
2010-08-29 17:50 . 2010-08-29 17:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2010-08-29 17:50 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-08-29 13:49 . 2010-08-29 17:46 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-08-28 17:36 . 2010-08-29 05:06 -------- d-----w- c:\program files\World of Warcraft
2010-08-28 17:33 . 2010-08-28 17:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard
2010-08-27 00:17 . 2010-08-27 00:17 47364 ----a-w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment\Battle.net\Cache\Download\Scan.dll
2010-08-26 00:07 . 2010-08-28 15:32 -------- d-----w- C:\gPotato.com
2010-08-25 23:27 . 2010-08-27 23:25 -------- d-----w- c:\documents and settings\Riley\Local Settings\Application Data\PMB Files
2010-08-25 23:27 . 2010-08-25 23:40 -------- d-----w- c:\documents and settings\All Users\Application Data\PMB Files
2010-08-25 23:27 . 2010-08-25 23:27 -------- d-----w- c:\program files\Pando Networks
2010-08-25 23:18 . 2010-08-25 23:24 -------- d-----w- c:\documents and settings\Riley\Application Data\FOG Downloader
2010-08-25 20:27 . 2010-08-25 20:27 -------- d-----w- C:\$AVG
2010-08-25 03:29 . 2008-03-21 17:57 14640 ------w- c:\windows\system32\spmsgXP_2k3.dll
2010-08-25 03:23 . 2010-08-25 03:23 -------- d-----w- c:\windows\Sun
2010-08-25 03:21 . 2010-08-25 03:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Codemasters
2010-08-25 03:18 . 2010-08-25 03:18 444952 ----a-w- c:\windows\system32\wrap_oal.dll
2010-08-25 03:18 . 2010-08-25 03:18 109080 ----a-w- c:\windows\system32\OpenAL32.dll
2010-08-25 03:18 . 2010-08-25 03:18 -------- d-----w- c:\program files\OpenAL
2010-08-25 03:07 . 2010-08-25 03:07 -------- d-----w- c:\program files\Codemasters
2010-08-25 03:01 . 2010-08-25 03:03 -------- d-----w- c:\program files\DAEMON Tools Lite
2010-08-25 03:00 . 2010-08-25 03:06 -------- d-----w- c:\documents and settings\Riley\Application Data\DAEMON Tools Lite
2010-08-25 03:00 . 2010-08-25 03:01 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2010-08-25 02:56 . 2010-08-25 02:57 -------- d-----w- c:\program files\MagicISO
2010-08-24 21:47 . 2010-08-25 19:29 -------- d-----w- c:\program files\JDownloader
2010-08-24 21:47 . 2010-08-24 21:47 411368 ----a-w- c:\windows\system32\deploytk.dll
2010-08-24 21:47 . 2010-08-24 21:47 -------- d-----w- c:\program files\Java
2010-08-24 21:47 . 2010-08-24 21:47 152576 ----a-w- c:\documents and settings\Riley\Application Data\Sun\Java\jre1.6.0_15\lzma.dll
2010-08-21 15:34 . 2010-08-21 15:34 -------- d-----w- c:\documents and settings\Riley\Application Data\NVIDIA
2010-08-21 15:34 . 2010-08-21 15:34 -------- d-----w- c:\documents and settings\Riley\Local Settings\Application Data\2K Games
2010-08-21 15:34 . 2010-06-02 08:55 74072 ----a-w- c:\windows\system32\XAPOFX1_5.dll
2010-08-21 15:34 . 2010-06-02 08:55 527192 ----a-w- c:\windows\system32\XAudio2_7.dll
2010-08-21 15:34 . 2010-06-02 08:55 239960 ----a-w- c:\windows\system32\xactengine3_7.dll
2010-08-21 15:34 . 2010-05-26 15:41 470880 ----a-w- c:\windows\system32\d3dx10_43.dll
2010-08-21 15:34 . 2010-05-26 15:41 248672 ----a-w- c:\windows\system32\d3dx11_43.dll
2010-08-21 15:34 . 2010-05-26 15:41 2106216 ----a-w- c:\windows\system32\D3DCompiler_43.dll
2010-08-21 15:34 . 2010-05-26 15:41 1868128 ----a-w- c:\windows\system32\d3dcsx_43.dll
2010-08-21 15:34 . 2010-05-26 15:41 1998168 ----a-w- c:\windows\system32\D3DX9_43.dll
2010-08-21 15:34 . 2010-02-04 14:01 74072 ----a-w- c:\windows\system32\XAPOFX1_4.dll
2010-08-21 15:34 . 2010-02-04 14:01 528216 ----a-w- c:\windows\system32\XAudio2_6.dll
2010-08-21 15:06 . 2010-08-31 16:42 -------- d-----w- c:\program files\Steam
2010-08-19 17:02 . 2010-08-19 17:02 -------- d-----w- c:\program files\7-Zip
2010-08-17 01:54 . 2001-08-18 02:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
2010-08-17 01:54 . 2004-08-04 04:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
2010-08-17 01:54 . 2004-08-04 02:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
2010-08-17 01:54 . 2004-08-04 02:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2010-08-13 17:17 . 2010-08-13 17:22 -------- d-----w- C:\My Recordings
2010-08-13 17:16 . 2010-08-13 17:16 -------- d-----w- c:\program files\FREE Hi-Q Recorder
2010-08-13 17:16 . 2002-01-05 13:37 344064 ----a-w- c:\windows\system32\msvcr70.dll
2010-08-10 12:12 . 2010-08-10 12:12 -------- d-----w- c:\windows\system32\XPSViewer
2010-08-10 12:12 . 2010-08-10 12:12 -------- d-----w- c:\program files\MSBuild
2010-08-10 12:12 . 2010-08-10 12:12 -------- d-----w- c:\program files\Reference Assemblies
2010-08-10 12:12 . 2008-07-06 12:06 89088 ----a-w- c:\windows\system32\Spool\prtprocs\w32x86\filterpipelineprintproc.dll
2010-08-10 12:11 . 2010-08-10 12:12 -------- d-----w- C:\2df0caef6cf86ef4a8adbe6084d5
2010-08-10 12:11 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2010-08-10 12:11 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2010-08-10 12:11 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2010-08-10 12:11 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2010-08-10 12:11 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2010-08-10 12:11 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2010-08-10 12:11 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2010-08-10 12:11 . 2008-07-06 10:50 597504 ------w- c:\windows\system32\Spool\prtprocs\w32x86\printfilterpipelinesvc.exe
2010-08-09 16:54 . 2010-08-09 16:54 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2010-08-09 16:52 . 2010-08-09 16:54 -------- d-----w- c:\documents and settings\Riley\Application Data\Temp
2010-08-09 16:43 . 2010-08-09 16:43 -------- d-----w- c:\program files\Common Files\Adobe
2010-08-09 16:42 . 2010-08-09 16:43 -------- d-----w- c:\documents and settings\Riley\Local Settings\Application Data\Adobe
2010-08-08 15:15 . 2010-08-08 15:15 -------- d-----w- c:\documents and settings\Riley\Local Settings\Application Data\Identities
2010-08-08 14:59 . 2010-08-31 23:25 -------- d-----w- c:\documents and settings\Riley\Application Data\Bc
2010-08-07 15:48 . 2010-08-07 15:48 -------- d-----w- c:\program files\Windows Media Connect 2
2010-08-07 15:47 . 2010-08-07 15:48 -------- d-----w- C:\f37c2195970f90f9f1cc0ece
2010-08-07 15:47 . 2010-08-10 14:02 -------- d-----w- c:\windows\system32\LogFiles
2010-08-07 15:47 . 2010-08-07 15:48 -------- d-----w- c:\windows\system32\drivers\UMDF
2010-08-07 15:47 . 2010-08-07 15:47 -------- d-----w- C:\7dcba15be8241d949075bf5c108d
2010-08-07 15:44 . 2010-08-07 15:44 354744 ----a-w- c:\documents and settings\Riley\Application Data\SanDisk\Sansa Updater\SansaUpdaterInstall.exe
2010-08-07 15:44 . 2010-08-07 15:44 -------- d-----w- c:\documents and settings\Riley\Application Data\SanDisk
2010-08-07 14:38 . 2010-08-07 15:04 0 --sh--r- C:\logwmemory.bin
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-31 17:59 . 2010-07-29 03:35 -------- d-----w- c:\documents and settings\Riley\Application Data\Skype
2010-08-31 16:43 . 2010-08-01 03:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-08-31 16:37 . 2010-08-01 18:55 0 ----a-w- c:\documents and settings\Riley\Local Settings\Application Data\prvlcl.dat
2010-08-31 03:12 . 2010-07-29 03:35 -------- d-----w- c:\documents and settings\Riley\Application Data\skypePM
2010-08-30 19:35 . 2010-07-28 21:58 12328 ----a-w- c:\documents and settings\Riley\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-08-30 18:55 . 2010-07-28 21:50 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-08-29 17:53 . 2006-02-28 12:00 8832 ----a-w- c:\windows\system32\drivers\rasacd.sys
2010-08-28 22:42 . 2010-07-29 01:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Blizzard Entertainment
2010-08-28 18:49 . 2010-07-29 01:13 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment
2010-08-25 03:29 . 2010-08-25 03:29 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_xusb21_01007.Wdf
2010-08-25 03:29 . 2010-08-25 03:29 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
2010-08-17 22:19 . 2010-07-29 01:13 -------- d-----w- c:\program files\StarCraft II
2010-08-16 19:13 . 2010-07-30 19:46 -------- d-----w- c:\documents and settings\Riley\Application Data\vlc
2010-08-09 16:54 . 2010-07-28 22:55 -------- d-----w- c:\program files\Bonjour
2010-08-09 16:54 . 2010-07-28 22:55 -------- d-----w- c:\documents and settings\All Users\Application Data\Kodak
2010-08-01 03:11 . 2010-08-01 03:11 -------- d-----w- c:\program files\Skype Recorder
2010-08-01 03:05 . 2010-08-01 03:05 -------- d-----w- c:\documents and settings\All Users\Application Data\MXSkypeRecorder
2010-07-30 19:45 . 2010-07-30 19:45 -------- d-----w- c:\program files\VideoLAN
2010-07-30 19:37 . 2010-07-30 19:37 12536 ----a-w- c:\windows\system32\avgrsstx.dll
2010-07-30 19:37 . 2010-07-30 19:37 243024 ----a-w- c:\windows\system32\drivers\avgtdix.sys
2010-07-30 19:37 . 2010-07-30 19:37 216400 ----a-w- c:\windows\system32\drivers\avgldx86.sys
2010-07-30 19:37 . 2010-07-30 19:37 29584 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
2010-07-30 19:35 . 2010-07-30 19:35 -------- d-----w- c:\program files\AVG
2010-07-30 19:35 . 2010-07-30 19:35 -------- d-----w- c:\documents and settings\All Users\Application Data\avg9
2010-07-30 07:00 . 2010-07-30 07:00 0 ---ha-w- c:\windows\system32\drivers\Msft_Kernel_NuidFltr_01005.Wdf
2010-07-30 07:00 . 2010-07-30 07:00 0 ---ha-w- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2010-07-29 21:48 . 2010-07-28 21:41 76487 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-07-29 03:35 . 2010-07-29 03:35 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2010-07-29 03:35 . 2010-07-29 03:34 -------- d-----r- c:\program files\Skype
2010-07-29 03:34 . 2010-07-29 03:34 -------- d-----w- c:\program files\Common Files\Skype
2010-07-29 03:34 . 2010-07-29 03:34 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2010-07-29 03:28 . 2010-07-28 21:50 -------- d-----w- c:\program files\NVIDIA Corporation
2010-07-29 03:27 . 2010-07-29 03:27 2605008 ----a-w- c:\documents and settings\Riley\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2010-07-29 03:27 . 2010-07-29 03:27 -------- d-----w- c:\documents and settings\All Users\Application Data\NVIDIA Corporation
2010-07-29 03:27 . 2010-07-29 03:27 232968 ----a-w- c:\windows\system32\nvdrsdb0.bin
2010-07-29 03:27 . 2010-07-29 03:27 1 ----a-w- c:\windows\system32\nvdrssel.bin
2010-07-29 03:27 . 2010-07-29 03:27 232968 ----a-w- c:\windows\system32\nvdrsdb1.bin
2010-07-29 03:21 . 2010-07-28 22:08 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-07-29 01:07 . 2010-07-28 21:53 -------- d-----w- c:\program files\ASUS
2010-07-29 01:07 . 2010-07-29 01:01 -------- d-----w- c:\program files\Common Files\InstallShield
2010-07-29 01:01 . 2010-07-29 01:01 -------- d-----w- c:\program files\Realtek
2010-07-29 01:01 . 2010-07-29 01:01 315392 ----a-w- c:\windows\HideWin.exe
2010-07-29 00:55 . 2010-07-29 00:55 -------- d-----w- c:\documents and settings\Riley\Application Data\InstallShield
2010-07-29 00:52 . 2010-07-29 00:52 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-07-29 00:52 . 2010-07-28 22:15 -------- d-----w- c:\documents and settings\Riley\Application Data\DisplayTune
2010-07-29 00:52 . 2010-07-28 22:18 -------- d-----w- c:\program files\StarCraft II.temp
2010-07-29 00:52 . 2010-07-28 22:18 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment.temp
2010-07-28 22:55 . 2010-07-28 22:55 -------- d-----w- c:\program files\MSXML 6.0
2010-07-28 22:24 . 2010-07-28 22:24 -------- d-----w- c:\documents and settings\All Users\Application Data\McAfee
2010-07-28 22:23 . 2010-07-28 22:23 0 ----a-w- c:\windows\nsreg.dat
2010-07-28 22:08 . 2010-07-28 22:08 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-07-28 22:06 . 2010-07-28 22:06 -------- d-----w- c:\program files\Portrait Displays
2010-07-28 22:06 . 2010-07-28 22:06 -------- d-----w- c:\program files\Acer Display
2010-07-28 21:41 . 2010-07-28 21:41 -------- d-----w- c:\program files\microsoft frontpage
2010-07-28 21:39 . 2010-07-28 21:39 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2010-07-09 22:38 . 2010-07-28 22:10 61440 ----a-w- c:\windows\system32\OpenCL.dll
2010-07-09 22:38 . 2010-07-28 22:10 13549568 ----a-w- c:\windows\system32\nvoglnt.dll
2010-07-09 22:38 . 2010-07-28 22:10 10604128 ----a-w- c:\windows\system32\drivers\nv4_mini.sys
2010-07-09 22:38 . 2010-07-28 22:10 4595712 ----a-w- c:\windows\system32\nvcuda.dll
2010-07-09 22:38 . 2010-07-28 22:10 2914408 ----a-w- c:\windows\system32\nvcuvid.dll
2010-07-09 22:38 . 2010-07-28 22:10 2506344 ----a-w- c:\windows\system32\nvcuvenc.dll
2010-07-09 22:38 . 2010-07-28 22:10 236136 ----a-w- c:\windows\system32\nvcodins.dll
2010-07-09 22:38 . 2010-07-28 22:10 236136 ----a-w- c:\windows\system32\nvcod.dll
2010-07-09 22:38 . 2010-07-28 22:10 1388544 ----a-w- c:\windows\system32\nvapi.dll
2010-07-09 22:38 . 2010-07-28 22:10 10260480 ----a-w- c:\windows\system32\nvcompiler.dll
2010-07-09 22:38 . 2010-07-28 22:10 6343040 ----a-w- c:\windows\system32\nv4_disp.dll
2010-07-09 22:38 . 2010-07-28 22:10 2195030 ----a-w- c:\windows\system32\nvdata.bin
2010-07-09 20:24 . 2010-07-09 20:24 81920 ----a-w- c:\windows\system32\nvwddi.dll
2010-07-09 20:24 . 2010-07-09 20:24 277608 ----a-w- c:\windows\system32\nvmccs.dll
2010-07-09 20:24 . 2010-07-09 20:24 110696 ----a-w- c:\windows\system32\nvmctray.dll
2010-07-09 20:24 . 2010-07-09 20:24 155752 ----a-w- c:\windows\system32\nvsvc32.exe
2010-07-09 20:24 . 2010-07-09 20:24 145000 ----a-w- c:\windows\system32\nvcolor.exe
2010-07-09 20:24 . 2010-07-09 20:24 13923432 ----a-w- c:\windows\system32\nvcpl.dll
2010-07-07 17:46 . 2010-07-29 00:55 604776 ----a-w- c:\windows\system32\NVUNINST.EXE
2010-06-14 14:30 . 2010-07-28 21:39 743936 ----a-w- c:\windows\pchealth\helpctr\binaries\helpsvc.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-05-13 26192168]
"MX Skype Recorder"="c:\documents and settings\All Users\Application Data\MXSkypeRecorder\MXSkypeRecorder.exe" [2010-01-30 581272]
"Steam"="c:\program files\Steam\Steam.exe" [2010-08-25 1242448]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2010-04-01 357696]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDCPL"="RTHDCPL.EXE" [2007-10-25 16855552]
"Ai Nap"="c:\program files\ASUS\Ai Suite\AiNap\AiNap.exe" [2007-09-06 1426432]
"CPU Power Monitor"="c:\program files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe" [2007-10-16 626176]
"Cpu Level Up help"="c:\program files\ASUS\Ai Suite\CpuLevelUpHelp.exe" [2007-09-11 880640]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]
"AVG9_TRAY"="c:\progra~1\AVG\AVG9\avgtray.exe" [2010-07-30 2065760]
"Skype Recorder"="c:\program files\Skype Recorder\Skype Recorder.exe" [2010-06-10 917504]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"Conime"="c:\windows\system32\conime.exe" [2006-02-28 27648]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2010-07-30 19:37 12536 ----a-w- c:\windows\system32\avgrsstx.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\StarCraft II\\StarCraft II.exe"=
"c:\\Program Files\\StarCraft II\\Versions\\Base15405\\SC2.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG9\\avgnsx.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Steam\\Steam.exe"=
"c:\\Program Files\\Steam\\steamapps\\common\\mafia ii - public demo\\launcher.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Codemasters\\GRID\\GRID.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0-enUS-downloader.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58134:TCP"= 58134:TCP:Pando Media Booster
"58134:UDP"= 58134:UDP:Pando Media Booster
R2 avg9emc;AVG Free E-mail Scanner;c:\program files\AVG\AVG9\avgemc.exe [2010-07-31 921952]
R3 wacmoumonitor;Wacom Mode Helper;c:\windows\system32\DRIVERS\wacmoumonitor.sys [2010-05-19 16240]
S1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2010-07-30 216400]
S1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2010-07-30 243024]
S2 avg9wd;AVG Free WatchDog;c:\program files\AVG\AVG9\avgwdsvc.exe [2010-07-30 308136]
S2 TabletServicePen;TabletServicePen;c:\program files\Tablet\Pen\Pen_Tablet.exe [2010-07-13 6076272]
S2 TouchServicePen;Wacom Consumer Touch Service;c:\program files\Tablet\Pen\Pen_TouchService.exe [2010-07-13 616816]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
LSP: %SYSTEMROOT%\system32\nvappfilter.dll
FF - ProfilePath - c:\documents and settings\Riley\Application Data\Mozilla\Firefox\Profiles\xlzf5tge.default\
FF - prefs.js: network.proxy.type - 0
FF - component: c:\documents and settings\Riley\Application Data\Mozilla\Firefox\Profiles\xlzf5tge.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - component: c:\program files\AVG\AVG9\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\Riley\Application Data\Mozilla\Firefox\Profiles\xlzf5tge.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\TabletPlugins\npwacom.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-klmdb.sys
SafeBoot-Wdf01000.sys
AddRemove-Pen Tablet Driver - c:\program files\Tablet\Pen\Remove.exe
**************************************************************************
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe,-101"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10h_ActiveX.exe"
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'lsass.exe'(756)
c:\windows\system32\nvappfilter.dll
.
Completion time: 2010-08-31 20:02:04
ComboFix-quarantined-files.txt 2010-09-01 00:02
Pre-Run: 522,086,023,168 bytes free
Post-Run: 522,499,489,792 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
- - End Of File - - 47578C42B33CB9052B2A1254B5726FAE
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:56:29 PM, on 8/31/2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Tablet\Pen\Pen_TouchService.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Program Files\Tablet\Pen\Pen_TouchUser.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
C:\Program Files\Tablet\Pen\Pen_TabletUser.exe
C:\Program Files\Tablet\Pen\Pen_Tablet.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\ComboFix\CF15411.cfxxe
C:\WINDOWS\PEV.exe
C:\ComboFix\PEV.cfxxe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: Shell=Rileybro.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\SYSTEM32\userinit.exe
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - (no file)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - (no file)
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - (no file)
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Ai Nap] "C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe"
O4 - HKLM\..\Run: [CPU Power Monitor] "C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe"
O4 - HKLM\..\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AVG9_TRAY] C:\PROGRA~1\AVG\AVG9\avgtray.exe
O4 - HKLM\..\Run: [Skype Recorder] "C:\Program Files\Skype Recorder\Skype Recorder.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [Conime] %windir%\system32\conime.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MX Skype Recorder] "C:\Documents and Settings\All Users\Application Data\MXSkypeRecorder\MXSkypeRecorder.exe" /autorun
O4 - HKCU\..\Run: [Swhst] C:\Documents and Settings\Riley\Application Data\Bc\swhst.exe
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-21-1390067357-1637723038-839522115-1004\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (User '?')
O4 - HKUS\S-1-5-21-1390067357-1637723038-839522115-1004\..\Run: [MX Skype Recorder] "C:\Documents and Settings\All Users\Application Data\MXSkypeRecorder\MXSkypeRecorder.exe" /autorun (User '?')
O4 - HKUS\S-1-5-21-1390067357-1637723038-839522115-1004\..\Run: [Swhst] C:\Documents and Settings\Riley\Application Data\Bc\swhst.exe (User '?')
O4 - HKUS\S-1-5-21-1390067357-1637723038-839522115-1004\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent (User '?')
O4 - HKUS\S-1-5-21-1390067357-1637723038-839522115-1004\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun (User '?')
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - (no file)
O9 - Extra button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - (no file)
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - (no file)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: ForceWare IP service (nSvcIp) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\Program Files\Tablet\Pen\Pen_Tablet.exe
O23 - Service: Wacom Consumer Touch Service (TouchServicePen) - Wacom Technology, Corp. - C:\Program Files\Tablet\Pen\Pen_TouchService.exe
--
End of file - 6511 bytes
Thanks for the help
Edited by Pandy, 01 September 2010 - 12:29 PM.
Moved from XP forum to Malware Removal Logs ~ Hamluis.