[alastair70]

Hi guys, I could use some help please. My system is a fresh install of XP pro SP3 today. Whenever I start windows update svchost.exe goes up to and then stays at 99% cpu usage. After reading and reading I have tried a few things, the 1st was from here and downloaded & try "fix_svchost.bat" along with "windowsupdateagent30-x86" & then "WindowsXP-KB927891-v3-x86-ENU". the .bat ran ok but the other two said they couldn't run as I had a later system.

So back to some more reading, after reading on a microsoft forum it suggested turning off windows update, which did stop svchost.exe going nuts until i tried running "WindowsXP-KB905474-ENU-x86" and once again it went to svchost went to 99%. The geniune advantage tool ran up to 70-80% then just hung.

Further reading suggested that I might have a malware problem so ran Malwarebytes anti malware's quick scan which said I had no problems.

I have another problem with my laptop but I will start another thread, the disk with Win XP Pro SP3 I have used has always worked perfectly before and I have never had this problem before. I would be very grateful for any help you could give me.


OTL LogFile

OTL logfile created on: 11/10/2013 01:04:55 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Alastair\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

1.44 Gb Total Physical Memory | 0.96 Gb Available Physical Memory | 67.09% Memory free
3.44 Gb Paging File | 3.07 Gb Available in Paging File | 89.09% Paging File free
Paging file location(s): C:\pagefile.sys 2205 3880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 73.33 Gb Total Space | 66.84 Gb Free Space | 91.15% Space Free | Partition Type: NTFS
Drive F: | 41.17 Gb Total Space | 29.43 Gb Free Space | 71.48% Space Free | Partition Type: NTFS
Drive H: | 7.45 Gb Total Space | 5.58 Gb Free Space | 74.88% Space Free | Partition Type: FAT32

Computer Name: ALASTAIR-DESKTO | User Name: Alastair | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013/10/11 01:03:29 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Alastair\My Documents\Downloads\OTL.exe
PRC - [2013/10/08 09:26:43 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2013/05/28 11:42:24 | 000,037,344 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe
PRC - [2013/05/28 11:42:23 | 000,032,736 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe
PRC - [2013/05/28 11:20:15 | 000,140,768 | ---- | M] (Panda Security, S.L.) -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe
PRC - [2008/04/14 05:42:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2013/10/10 23:48:16 | 016,233,864 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll
MOD - [2013/10/08 09:26:59 | 003,364,464 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2013/04/12 19:23:30 | 000,612,664 | ---- | M] () -- C:\Program Files\Panda Security\Panda Cloud Antivirus\sqlite3.dll


========== Services (SafeList) ==========

SRV - [2013/10/10 23:48:17 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013/10/08 09:26:52 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013/05/28 11:42:24 | 000,037,344 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAService.exe -- (PSUAService)
SRV - [2013/05/28 11:20:15 | 000,140,768 | ---- | M] (Panda Security, S.L.) [Auto | Running] -- C:\Program Files\Panda Security\Panda Cloud Antivirus\PSANHost.exe -- (NanoServiceMain)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - [2013/05/29 17:16:40 | 000,128,104 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINProt.sys -- (PSINProt)
DRV - [2013/05/29 05:55:11 | 000,230,376 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSStrm.sys -- (NNSSTRM)
DRV - [2013/05/29 05:55:11 | 000,108,904 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSSmtp.sys -- (NNSSMTP)
DRV - [2013/05/29 05:55:11 | 000,093,928 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNStlsc.sys -- (NNSTLSC)
DRV - [2013/05/29 05:55:10 | 000,287,336 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSProt.sys -- (NNSPROT)
DRV - [2013/05/29 05:55:10 | 000,161,384 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSPrv.sys -- (NNSPRV)
DRV - [2013/05/29 05:55:10 | 000,106,344 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSPop3.sys -- (NNSPOP3)
DRV - [2013/05/29 05:55:09 | 000,124,648 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSIds.sys -- (NNSIDS)
DRV - [2013/05/29 05:55:09 | 000,095,464 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSpicc.sys -- (NNSPICC)
DRV - [2013/05/29 05:55:09 | 000,052,328 | ---- | M] (Panda Security, S.L.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\NNSpihs.sys -- (NNSPIHS)
DRV - [2013/05/29 05:55:08 | 000,126,184 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSHttp.sys -- (NNSHTTP)
DRV - [2013/05/29 05:55:08 | 000,107,752 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSHttps.sys -- (NNSHTTPS)
DRV - [2013/05/29 05:55:08 | 000,084,200 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\NNSAlpc.sys -- (NNSALPC)
DRV - [2013/05/28 11:26:08 | 000,097,768 | ---- | M] (Panda Security, S.L.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PSINReg.sys -- (PSINReg)
DRV - [2013/05/28 11:26:07 | 000,179,688 | ---- | M] (Panda Security, S.L.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\PSINKNC.sys -- (PSINKNC)
DRV - [2013/05/28 11:26:07 | 000,114,920 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINProc.sys -- (PSINProc)
DRV - [2013/05/28 11:26:06 | 000,145,128 | ---- | M] (Panda Security, S.L.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINAflt.sys -- (PSINAflt)
DRV - [2013/05/28 11:26:06 | 000,103,400 | ---- | M] (Panda Security, S.L.) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\PSINFile.sys -- (PSINFile)
DRV - [2013/04/29 09:17:34 | 000,047,632 | ---- | M] (Panda Security, S.L.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\PSKMAD.sys -- (PSKMAD)
DRV - [2013/03/07 09:49:20 | 000,013,896 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\epmntdrv.sys -- (epmntdrv)
DRV - [2013/03/07 09:49:20 | 000,009,160 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2010/10/26 12:12:36 | 000,019,200 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)
DRV - [2010/10/26 11:39:24 | 000,325,120 | ---- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)
DRV - [2008/09/24 10:40:22 | 004,122,368 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcxwdm.sys -- (ALCXWDM)
DRV - [2008/04/13 23:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:25.0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_9_900_117.dll ()
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 25.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2013/10/10 15:55:24 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Alastair\Application Data\Mozilla\Extensions
[2013/10/10 15:55:04 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\browser\extensions
[2013/10/10 15:55:04 | 000,000,000 | ---D | M] (Default) -- C:\Program Files\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

========== Chrome ==========

CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&q={searchTerms}&{google:cursorPosition}{google:zeroPrefixUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter},
CHR - homepage: http://www.google.com
CHR - Extension: Google Docs = C:\Documents and Settings\Alastair\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\
CHR - Extension: Google Drive = C:\Documents and Settings\Alastair\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\
CHR - Extension: YouTube = C:\Documents and Settings\Alastair\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\
CHR - Extension: Google Search = C:\Documents and Settings\Alastair\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\
CHR - Extension: Chrome In-App Payments service = C:\Documents and Settings\Alastair\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
CHR - Extension: Gmail = C:\Documents and Settings\Alastair\Local Settings\Application Data\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\

O1 HOSTS File: ([2001/08/23 13:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [PSUAMain] C:\Program Files\Panda Security\Panda Cloud Antivirus\PSUAMain.exe (Panda Security, S.L.)
O4 - HKLM..\RunOnce: [Malwarebytes Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O16 - DPF: {5AE58FCF-6F6A-49B2-B064-02492C66E3F4} http://catalog.updat...b?1381441665984 (MUCatalogWebControl Class)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{850EE5D3-7FD2-48B6-AF45-300A5EB801A9}: DhcpNameServer = 192.168.1.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013/10/10 21:49:47 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013/10/11 00:52:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Application Data\Malwarebytes
[2013/10/11 00:51:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013/10/11 00:51:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2013/10/11 00:51:01 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2013/10/11 00:51:00 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013/10/11 00:36:16 | 000,047,632 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\PSKMAD.sys
[2013/10/11 00:03:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Application Data\Macromedia
[2013/10/11 00:03:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Application Data\Adobe
[2013/10/10 23:52:58 | 000,000,000 | ---D | C] -- C:\def704331ca29f26562df8c738e50d
[2013/10/10 23:42:13 | 000,000,000 | ---D | C] -- C:\105f0243fba884439f
[2013/10/10 23:26:04 | 000,000,000 | ---D | C] -- C:\644a2f4233a9e9ff294efce6f2
[2013/10/10 23:15:42 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\windowspowershell
[2013/10/10 21:54:07 | 000,000,000 | ---D | C] -- C:\WINDOWS\SoftwareDistribution
[2013/10/10 21:54:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch
[2013/10/10 21:54:04 | 000,000,000 | --SD | C] -- C:\WINDOWS\System32\Microsoft
[2013/10/10 21:54:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
[2013/10/10 21:54:03 | 000,000,000 | --SD | C] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
[2013/10/10 21:53:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
[2013/10/10 21:53:34 | 000,000,000 | --SD | C] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
[2013/10/10 21:52:09 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia330.dll
[2013/10/10 21:52:09 | 000,079,872 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rwia001.dll
[2013/10/10 21:52:09 | 000,029,184 | ---- | C] (Ricoh Co., Ltd.) -- C:\WINDOWS\System32\dllcache\rw330ext.dll
[2013/10/10 21:50:53 | 000,054,528 | ---- | C] (Philips Semiconductors GmbH) -- C:\WINDOWS\System32\dllcache\cap7146.sys
[2013/10/10 21:50:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom
[2013/10/10 21:50:16 | 000,000,000 | ---D | C] -- C:\Program Files\xerox
[2013/10/10 21:50:16 | 000,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage
[2013/10/10 21:48:39 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\DRM
[2013/10/10 21:48:26 | 000,000,000 | --SD | C] -- C:\WINDOWS\Downloaded Program Files
[2013/10/10 21:48:26 | 000,000,000 | R--D | C] -- C:\WINDOWS\Offline Web Pages
[2013/10/10 21:48:14 | 000,000,000 | -H-D | C] -- C:\Program Files\WindowsUpdate
[2013/10/10 21:47:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\DirectX
[2013/10/10 21:47:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Services
[2013/10/10 21:47:34 | 000,000,000 | --SD | C] -- C:\WINDOWS\Tasks
[2013/10/10 21:47:33 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MSSoap
[2013/10/10 21:47:30 | 000,000,000 | ---D | C] -- C:\WINDOWS\srchasst
[2013/10/10 21:47:29 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Macromed
[2013/10/10 21:47:21 | 000,000,000 | ---D | C] -- C:\Program Files\Movie Maker
[2013/10/10 21:46:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Restore
[2013/10/10 21:46:40 | 000,000,000 | ---D | C] -- C:\Program Files\NetMeeting
[2013/10/10 21:46:34 | 000,000,000 | ---D | C] -- C:\Program Files\Outlook Express
[2013/10/10 21:46:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\System
[2013/10/10 21:46:20 | 000,000,000 | ---D | C] -- C:\Program Files\Internet Explorer
[2013/10/10 21:46:19 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Pictures
[2013/10/10 21:45:48 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Games
[2013/10/10 21:45:35 | 000,000,000 | ---D | C] -- C:\Program Files\ComPlus Applications
[2013/10/10 21:45:27 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Administrative Tools
[2013/10/10 21:45:27 | 000,000,000 | ---D | C] -- C:\WINDOWS\Registration
[2013/10/10 21:45:19 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Music
[2013/10/10 21:45:19 | 000,000,000 | ---D | C] -- C:\Program Files\Windows Media Player
[2013/10/10 21:45:19 | 000,000,000 | ---D | C] -- C:\Program Files\Online Services
[2013/10/10 21:45:09 | 000,000,000 | ---D | C] -- C:\Program Files\Messenger
[2013/10/10 21:45:06 | 000,000,000 | ---D | C] -- C:\Program Files\MSN Gaming Zone
[2013/10/10 21:44:28 | 000,000,000 | ---D | C] -- C:\Program Files\MSN
[2013/10/10 21:44:26 | 000,281,088 | ---- | C] (Cinematronics) -- C:\WINDOWS\System32\dllcache\pinball.exe
[2013/10/10 21:44:23 | 000,000,000 | ---D | C] -- C:\Program Files\Windows NT
[2013/10/10 21:44:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en-US
[2013/10/10 21:44:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\MsDtc
[2013/10/10 21:44:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\CSC
[2013/10/10 21:44:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Com
[2013/10/10 21:43:51 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents\My Videos
[2013/10/10 21:42:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Accessories
[2013/10/10 21:37:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\EaseUS Partition Master 9.2.2
[2013/10/10 21:37:08 | 000,000,000 | ---D | C] -- C:\Program Files\EaseUS
[2013/10/10 18:27:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Alastair\Recent
[2013/10/10 18:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\My Documents\Reg Backup
[2013/10/10 18:25:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2013/10/10 18:24:58 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2013/10/10 18:08:17 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Alastair\UserData
[2013/10/10 18:07:40 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013/10/10 18:07:40 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe
[2013/10/10 18:07:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Adobe
[2013/10/10 18:06:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Defraggler
[2013/10/10 18:06:44 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2013/10/10 18:06:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Identities
[2013/10/10 18:05:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Application Data\Panda Security
[2013/10/10 18:04:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Panda Cloud Antivirus
[2013/10/10 18:03:47 | 000,000,000 | ---D | C] -- C:\Program Files\Panda Security
[2013/10/10 18:03:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Panda Security
[2013/10/10 17:55:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Local Settings\Application Data\Adobe
[2013/10/10 17:49:21 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek AC97
[2013/10/10 17:45:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SiS VGA Utilities
[2013/10/10 17:45:44 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2013/10/10 17:44:47 | 000,000,000 | ---D | C] -- C:\Program Files\sisagp
[2013/10/10 17:44:43 | 000,000,000 | ---D | C] -- C:\Program Files\SiSUnin
[2013/10/10 17:44:43 | 000,000,000 | ---D | C] -- C:\WINDOWS\SIS
[2013/10/10 17:44:40 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information
[2013/10/10 17:44:18 | 000,000,000 | ---D | C] -- C:\Program Files\SiS VGA Utilities V3.93
[2013/10/10 17:43:53 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\InstallShield
[2013/10/10 16:59:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Desktop\setup
[2013/10/10 16:19:36 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss
[2013/10/10 15:55:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Local Settings\Application Data\Mozilla
[2013/10/10 15:55:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Application Data\Mozilla
[2013/10/10 15:55:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Mozilla
[2013/10/10 15:55:05 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service
[2013/10/10 15:54:59 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2013/10/10 14:54:32 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\UAB
[2013/10/10 14:54:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Local Settings\Application Data\PC_Drivers_Headquarters
[2013/10/10 14:50:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Driver Tool
[2013/10/10 14:50:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Driver Tool
[2013/10/10 14:49:54 | 000,000,000 | ---D | C] -- C:\Program Files\Driver Tool
[2013/10/10 14:36:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2013/10/10 14:34:04 | 000,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2013/10/10 14:32:34 | 000,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2013/10/10 14:31:35 | 000,000,000 | -HSD | C] -- C:\WINDOWS\Installer
[2013/10/10 14:31:34 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC
[2013/10/10 14:31:29 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\SpeechEngines
[2013/10/10 14:31:28 | 000,000,000 | R--D | C] -- C:\Program Files
[2013/10/10 14:31:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Microsoft Shared
[2013/10/10 14:31:28 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files
[2013/10/10 14:30:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup
[2013/10/10 14:30:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Start Menu
[2013/10/10 14:30:45 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Documents
[2013/10/10 14:30:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Templates
[2013/10/10 14:30:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Favorites
[2013/10/10 14:30:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Desktop
[2013/10/10 14:30:25 | 000,000,000 | ---D | C] -- C:\7aa11b5706e47925f8d192
[2013/10/10 14:28:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot2
[2013/10/10 14:28:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\CatRoot
[2013/10/10 14:28:47 | 000,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Application Data\Microsoft
[2013/10/10 14:28:47 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\All Users\Application Data
[2013/10/10 14:28:26 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2013/10/10 14:28:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings
[2013/10/10 14:27:53 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2013/10/10 14:23:08 | 000,000,000 | R-SD | C] -- C:\WINDOWS\Fonts
[2013/10/10 14:23:08 | 000,000,000 | RHSD | C] -- C:\WINDOWS\System32\dllcache
[2013/10/10 14:23:08 | 000,000,000 | R--D | C] -- C:\WINDOWS\Web
[2013/10/10 14:23:08 | 000,000,000 | -H-D | C] -- C:\WINDOWS\inf
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\WinSxS
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wins
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\wbem
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\usmt
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\twain_32
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Temp
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\system32
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\system
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\spool
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ShellExt
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Setup
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\security
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\scripting
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Resources
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\repair
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ras
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Provisioning
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\PeerNet
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\pchealth
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\npp
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Network Diagnostic
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\mui
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\mui
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\msapps
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\msagent
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Media
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\L2Schemas
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\java
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\inetsrv
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\IME
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ime
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\icsxml
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ias
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Help
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\export
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\etc
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\en
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\ehome
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Driver Cache
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\disdn
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\dhcp
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Debug
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Cursors
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Connection Wizard
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\config
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Config
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\AppPatch
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\addins
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3com_dmi
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\3076
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\2052
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1054
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1042
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1041
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1037
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1033
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1031
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1028
[2013/10/10 14:23:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\1025
[2013/10/10 14:15:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Google Chrome
[2013/10/10 14:13:24 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2013/10/10 14:13:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Local Settings\Application Data\Google
[2013/10/10 14:13:12 | 000,229,648 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2013/10/10 14:11:33 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2013/10/10 14:10:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/10/10 14:04:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Speccy
[2013/10/10 14:04:44 | 000,000,000 | ---D | C] -- C:\Program Files\Speccy
[2013/10/10 14:00:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\My Documents\Downloads
[2013/10/10 13:56:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Application Data\Identities
[2013/10/10 13:56:17 | 000,000,000 | -H-D | C] -- C:\Program Files\Uninstall Information
[2013/10/10 13:56:15 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\My Documents\My Pictures
[2013/10/10 13:56:15 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\My Documents\My Music
[2013/10/10 13:55:59 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Alastair\Application Data\Microsoft
[2013/10/10 13:55:59 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Alastair\Cookies
[2013/10/10 13:55:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Alastair\SendTo
[2013/10/10 13:55:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Alastair\Application Data
[2013/10/10 13:55:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\Start Menu\Programs\Startup
[2013/10/10 13:55:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\Start Menu
[2013/10/10 13:55:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\My Documents
[2013/10/10 13:55:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\Favorites
[2013/10/10 13:55:59 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Alastair\Start Menu\Programs\Accessories
[2013/10/10 13:55:59 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Alastair\Templates
[2013/10/10 13:55:59 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Alastair\PrintHood
[2013/10/10 13:55:59 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Alastair\NetHood
[2013/10/10 13:55:59 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Alastair\Local Settings
[2013/10/10 13:55:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Local Settings\Application Data\Microsoft
[2013/10/10 13:55:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Alastair\Desktop
[2013/10/10 13:55:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013/10/11 00:51:06 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/10/11 00:37:38 | 000,000,886 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/10/11 00:35:49 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013/10/11 00:26:57 | 000,000,210 | -HS- | M] () -- C:\boot.ini
[2013/10/11 00:18:01 | 000,145,796 | ---- | M] () -- C:\Documents and Settings\Alastair\Desktop\971058.htm
[2013/10/10 23:48:18 | 000,000,830 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/10/10 22:53:41 | 000,000,890 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/10/10 21:53:38 | 000,008,192 | ---- | M] () -- C:\WINDOWS\REGLOCS.OLD
[2013/10/10 21:52:52 | 000,000,261 | ---- | M] () -- C:\WINDOWS\System32\$winnt$.inf
[2013/10/10 21:52:12 | 000,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2013/10/10 21:52:12 | 000,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2013/10/10 21:50:36 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/10/10 21:49:47 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2013/10/10 21:49:47 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2013/10/10 21:49:47 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2013/10/10 21:49:47 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2013/10/10 21:49:38 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2013/10/10 21:49:26 | 000,004,161 | ---- | M] () -- C:\WINDOWS\ODBCINST.INI
[2013/10/10 21:45:46 | 000,021,640 | ---- | M] () -- C:\WINDOWS\System32\emptyregdb.dat
[2013/10/10 21:42:08 | 000,098,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/10/10 21:40:40 | 000,000,889 | -H-- | M] () -- C:\WINDOWS\EPMBatch.ept
[2013/10/10 18:25:03 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/10/10 18:08:32 | 000,001,734 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/10/10 18:06:48 | 000,001,580 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2013/10/10 17:46:02 | 000,080,949 | ---- | M] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2013/10/10 15:55:08 | 000,000,742 | ---- | M] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/10/10 15:55:08 | 000,000,724 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/10/10 14:54:32 | 000,000,460 | ---- | M] () -- C:\WINDOWS\tasks\Driver Tool-RTMUpdater.job
[2013/10/10 14:54:32 | 000,000,450 | ---- | M] () -- C:\WINDOWS\tasks\Driver Tool-RTMRules.job
[2013/10/10 14:54:31 | 000,000,462 | ---- | M] () -- C:\WINDOWS\tasks\Driver Tool-RTMScan.job
[2013/10/10 14:54:30 | 000,000,462 | ---- | M] () -- C:\WINDOWS\tasks\Driver Tool-RTMScanRunOnce.job
[2013/10/10 14:50:04 | 000,001,969 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Driver Tool.lnk
[2013/10/10 14:43:04 | 000,433,534 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013/10/10 14:43:04 | 000,067,374 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013/10/10 14:41:02 | 000,004,444 | ---- | M] () -- C:\WINDOWS\System32\pid.PNF
[2013/10/10 14:36:27 | 000,001,831 | ---- | M] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/10/10 14:15:56 | 000,001,813 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/10/10 14:13:12 | 000,002,577 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2013/10/10 13:56:28 | 000,000,779 | ---- | M] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/10/10 13:56:27 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2013/10/10 13:55:57 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013/10/11 00:51:06 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2013/10/11 00:18:06 | 000,145,796 | ---- | C] () -- C:\Documents and Settings\Alastair\Desktop\971058.htm
[2013/10/10 21:53:38 | 000,008,192 | ---- | C] () -- C:\WINDOWS\REGLOCS.OLD
[2013/10/10 21:52:52 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2013/10/10 21:52:02 | 000,175,104 | ---- | C] () -- C:\WINDOWS\System32\dllcache\pintlcsa.dll
[2013/10/10 21:51:42 | 001,158,818 | ---- | C] () -- C:\WINDOWS\System32\dllcache\korwbrkr.lex
[2013/10/10 21:51:34 | 000,059,392 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imscinst.exe
[2013/10/10 21:51:33 | 000,196,665 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imjpinst.exe
[2013/10/10 21:51:30 | 000,134,339 | ---- | C] () -- C:\WINDOWS\System32\dllcache\imekr.lex
[2013/10/10 21:51:20 | 013,463,552 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hwxjpn.dll
[2013/10/10 21:51:14 | 000,108,827 | ---- | C] () -- C:\WINDOWS\System32\dllcache\hanja.lex
[2013/10/10 21:51:10 | 000,094,208 | ---- | C] () -- C:\WINDOWS\System32\dllcache\fpencode.dll
[2013/10/10 21:50:56 | 000,173,568 | ---- | C] () -- C:\WINDOWS\System32\dllcache\chtskf.dll
[2013/10/10 21:49:47 | 000,002,577 | ---- | C] () -- C:\WINDOWS\System32\CONFIG.NT
[2013/10/10 21:49:47 | 000,000,000 | RHS- | C] () -- C:\MSDOS.SYS
[2013/10/10 21:49:47 | 000,000,000 | RHS- | C] () -- C:\IO.SYS
[2013/10/10 21:49:47 | 000,000,000 | ---- | C] () -- C:\CONFIG.SYS
[2013/10/10 21:49:47 | 000,000,000 | ---- | C] () -- C:\AUTOEXEC.BAT
[2013/10/10 21:49:37 | 000,023,392 | ---- | C] () -- C:\WINDOWS\System32\nscompat.tlb
[2013/10/10 21:49:37 | 000,016,832 | ---- | C] () -- C:\WINDOWS\System32\amcompat.tlb
[2013/10/10 21:49:35 | 000,316,640 | ---- | C] () -- C:\WINDOWS\WMSysPr9.prx
[2013/10/10 21:48:13 | 000,000,786 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Movie Maker.lnk
[2013/10/10 21:48:00 | 004,399,505 | ---- | C] () -- C:\WINDOWS\System32\dllcache\nls302en.lex
[2013/10/10 21:47:45 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt256.bmp
[2013/10/10 21:47:45 | 000,048,680 | -HS- | C] () -- C:\WINDOWS\winnt.bmp
[2013/10/10 21:47:39 | 000,000,984 | ---- | C] () -- C:\WINDOWS\System32\dllcache\srframe.mmf
[2013/10/10 21:46:53 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msinfo.dll
[2013/10/10 21:45:48 | 000,000,609 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Windows Messenger.lnk
[2013/10/10 21:45:46 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2013/10/10 21:45:19 | 000,001,986 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\MSN.lnk
[2013/10/10 21:44:52 | 000,065,954 | ---- | C] () -- C:\WINDOWS\Prairie Wind.bmp
[2013/10/10 21:44:52 | 000,065,832 | ---- | C] () -- C:\WINDOWS\Santa Fe Stucco.bmp
[2013/10/10 21:44:52 | 000,026,680 | ---- | C] () -- C:\WINDOWS\River Sumida.bmp
[2013/10/10 21:44:52 | 000,017,362 | ---- | C] () -- C:\WINDOWS\Rhododendron.bmp
[2013/10/10 21:44:52 | 000,009,522 | ---- | C] () -- C:\WINDOWS\Zapotec.bmp
[2013/10/10 21:44:51 | 000,065,978 | ---- | C] () -- C:\WINDOWS\Soap Bubbles.bmp
[2013/10/10 21:44:51 | 000,026,582 | ---- | C] () -- C:\WINDOWS\Greenstone.bmp
[2013/10/10 21:44:51 | 000,017,336 | ---- | C] () -- C:\WINDOWS\Gone Fishing.bmp
[2013/10/10 21:44:51 | 000,017,062 | ---- | C] () -- C:\WINDOWS\Coffee Bean.bmp
[2013/10/10 21:44:51 | 000,016,730 | ---- | C] () -- C:\WINDOWS\FeatherTexture.bmp
[2013/10/10 21:44:51 | 000,001,272 | ---- | C] () -- C:\WINDOWS\Blue Lace 16.bmp
[2013/10/10 21:44:49 | 000,001,161 | ---- | C] () -- C:\WINDOWS\System32\usrlogon.cmd
[2013/10/10 21:44:48 | 000,003,286 | ---- | C] () -- C:\WINDOWS\System32\tslabels.h
[2013/10/10 21:44:47 | 000,000,768 | ---- | C] () -- C:\WINDOWS\System32\msdtcprf.h
[2013/10/10 21:44:42 | 000,063,488 | ---- | C] () -- C:\WINDOWS\System32\wmimgmt.msc
[2013/10/10 21:42:08 | 000,098,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013/10/10 21:39:32 | 000,000,889 | -H-- | C] () -- C:\WINDOWS\EPMBatch.ept
[2013/10/10 21:37:28 | 002,498,216 | ---- | C] () -- C:\WINDOWS\System32\BootMan.exe
[2013/10/10 21:37:28 | 000,087,112 | ---- | C] () -- C:\WINDOWS\System32\setupempdrv03.exe
[2013/10/10 21:37:28 | 000,019,840 | ---- | C] () -- C:\WINDOWS\System32\EuEpmGdi.dll
[2013/10/10 21:37:28 | 000,013,896 | ---- | C] () -- C:\WINDOWS\System32\epmntdrv.sys
[2013/10/10 21:37:28 | 000,009,160 | ---- | C] () -- C:\WINDOWS\System32\EuGdiDrv.sys
[2013/10/10 18:25:03 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2013/10/10 18:11:22 | 000,000,830 | ---- | C] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013/10/10 18:08:32 | 000,001,804 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Adobe Reader XI.lnk
[2013/10/10 18:08:32 | 000,001,734 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Adobe Reader XI.lnk
[2013/10/10 18:06:48 | 000,001,580 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2013/10/10 17:50:15 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe
[2013/10/10 17:49:19 | 000,141,016 | ---- | C] () -- C:\WINDOWS\System32\alsndmgr.wav
[2013/10/10 17:49:16 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\RtlCPAPI.dll
[2013/10/10 17:45:54 | 000,093,813 | ---- | C] () -- C:\WINDOWS\VGAsetup.ini
[2013/10/10 17:44:43 | 000,163,923 | ---- | C] () -- C:\WINDOWS\System32\SiSUninstall.exe
[2013/10/10 17:44:35 | 000,208,896 | ---- | C] () -- C:\WINDOWS\Progress.exe
[2013/10/10 17:44:35 | 000,049,152 | ---- | C] () -- C:\WINDOWS\InstFunc.exe
[2013/10/10 17:43:56 | 000,080,949 | ---- | C] () -- C:\WINDOWS\System32\VGAunistlog.ini
[2013/10/10 15:55:08 | 000,000,742 | ---- | C] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2013/10/10 15:55:08 | 000,000,724 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Mozilla Firefox.lnk
[2013/10/10 15:55:07 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Mozilla Firefox.lnk
[2013/10/10 14:54:32 | 000,000,450 | ---- | C] () -- C:\WINDOWS\tasks\Driver Tool-RTMRules.job
[2013/10/10 14:54:31 | 000,000,462 | ---- | C] () -- C:\WINDOWS\tasks\Driver Tool-RTMScan.job
[2013/10/10 14:54:31 | 000,000,460 | ---- | C] () -- C:\WINDOWS\tasks\Driver Tool-RTMUpdater.job
[2013/10/10 14:54:30 | 000,000,462 | ---- | C] () -- C:\WINDOWS\tasks\Driver Tool-RTMScanRunOnce.job
[2013/10/10 14:50:04 | 000,001,969 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Driver Tool.lnk
[2013/10/10 14:41:02 | 000,004,444 | ---- | C] () -- C:\WINDOWS\System32\pid.PNF
[2013/10/10 14:31:34 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2013/10/10 14:31:31 | 001,685,606 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.spd
[2013/10/10 14:31:31 | 000,000,888 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sam.sdf
[2013/10/10 14:31:30 | 000,643,717 | ---- | C] () -- C:\WINDOWS\System32\dllcache\ltts1033.lxa
[2013/10/10 14:31:30 | 000,605,050 | ---- | C] () -- C:\WINDOWS\System32\dllcache\r1033tts.lxa
[2013/10/10 14:30:58 | 000,001,688 | ---- | C] () -- C:\WINDOWS\System32\AUTOEXEC.NT
[2013/10/10 14:29:05 | 000,797,189 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5IIS.CAT
[2013/10/10 14:29:05 | 000,399,645 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MAPIMIG.CAT
[2013/10/10 14:29:05 | 000,144,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\netfx.cat
[2013/10/10 14:29:05 | 000,112,918 | ---- | C] () -- C:\WINDOWS\System32\dllcache\tabletpc.cat
[2013/10/10 14:29:05 | 000,037,484 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MW770.CAT
[2013/10/10 14:29:05 | 000,034,747 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mediactr.cat
[2013/10/10 14:29:05 | 000,034,063 | ---- | C] () -- C:\WINDOWS\System32\dllcache\FP4.CAT
[2013/10/10 14:29:05 | 000,026,991 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn7.cat
[2013/10/10 14:29:05 | 000,016,535 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IMS.CAT
[2013/10/10 14:29:05 | 000,014,433 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msn9.cat
[2013/10/10 14:29:05 | 000,013,472 | ---- | C] () -- C:\WINDOWS\System32\dllcache\HPCRDP.CAT
[2013/10/10 14:29:05 | 000,012,363 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSMSGS.CAT
[2013/10/10 14:29:05 | 000,010,027 | ---- | C] () -- C:\WINDOWS\System32\dllcache\MSTSWEB.CAT
[2013/10/10 14:29:05 | 000,008,574 | ---- | C] () -- C:\WINDOWS\System32\dllcache\IASNT4.CAT
[2013/10/10 14:29:05 | 000,007,382 | ---- | C] () -- C:\WINDOWS\System32\dllcache\OEMBIOS.CAT
[2013/10/10 14:29:05 | 000,007,334 | ---- | C] () -- C:\WINDOWS\System32\dllcache\wmerrenu.cat
[2013/10/10 14:29:04 | 002,144,487 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5.CAT
[2013/10/10 14:29:04 | 001,296,669 | ---- | C] () -- C:\WINDOWS\System32\dllcache\SP3.CAT
[2013/10/10 14:29:04 | 000,522,220 | ---- | C] () -- C:\WINDOWS\System32\dllcache\NT5INF.CAT
[2013/10/10 14:27:42 | 000,000,210 | -HS- | C] () -- C:\boot.ini
[2013/10/10 14:27:38 | 000,000,261 | ---- | C] () -- C:\WINDOWS\System32\$winnt$.inf
[2013/10/10 14:26:28 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2013/10/10 14:15:56 | 000,001,831 | ---- | C] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
[2013/10/10 14:15:56 | 000,001,813 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Google Chrome.lnk
[2013/10/10 14:13:29 | 000,000,890 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013/10/10 14:13:28 | 000,000,886 | ---- | C] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013/10/10 13:56:27 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2013/10/10 13:56:19 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\Alastair\Start Menu\Programs\Outlook Express.lnk
[2013/10/10 13:56:17 | 000,000,779 | ---- | C] () -- C:\Documents and Settings\Alastair\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2013/10/10 13:56:17 | 000,000,767 | ---- | C] () -- C:\Documents and Settings\Alastair\Start Menu\Programs\Internet Explorer.lnk
[2013/10/10 13:56:00 | 000,001,599 | ---- | C] () -- C:\Documents and Settings\Alastair\Start Menu\Programs\Remote Assistance.lnk
[2013/10/10 13:56:00 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Alastair\Start Menu\Programs\Windows Media Player.lnk

========== ZeroAccess Check ==========

[2013/10/10 14:42:15 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008/04/14 05:42:06 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2008/04/14 05:41:54 | 000,472,064 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008/04/14 05:42:10 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013/10/10 18:05:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Alastair\Application Data\Panda Security
[2013/10/10 17:43:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2013/10/10 14:50:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Driver Tool
[2013/10/10 18:03:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Panda Security
[2013/10/10 14:55:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\UAB

========== Purity Check ==========



< End of report >

[Advertisements]

Problem seems to be solved. After further reading I downloaded Internet Explorer 8 from file hippo (when I tried from Microsoft the download kept failing) it has installed, I rebooted and it has let me access Windows update. It is currently downloading 127 updates. So all seems to be going okay.

Spoke too soon, it is happily install all updates except KB905474 the windows advantage tool. When it trys this it just hangs at about 70-80% and the svchost.exe goes upto and stays at 99%. I know my copy of windows is legit as it has previous never had a problem so I have unchecked it and hidden the update. Hopefully this will work.

If anyone has any ideas why this keeps happening i would be very grateful

Edited by alastair70, 11 October 2013 - 07:18 AM.

[alastair70]

Problem seems to be solved. After further reading I downloaded Internet Explorer 8 from file hippo (when I tried from Microsoft the download kept failing) it has installed, I rebooted and it has let me access Windows update. It is currently downloading 127 updates. So all seems to be going okay.

Spoke too soon, it is happily install all updates except KB905474 the windows advantage tool. When it trys this it just hangs at about 70-80% and the svchost.exe goes upto and stays at 99%. I know my copy of windows is legit as it has previous never had a problem so I have unchecked it and hidden the update. Hopefully this will work.

If anyone has any ideas why this keeps happening i would be very grateful

Edited by alastair70, 11 October 2013 - 07:18 AM.