PLEASE ADVISE: what can we safely remove from c drive

ddoris

Please read posts #3, 5, 6, 13, 26, 33 and 37 -find out what is filling up your h/d - I'd use windirstat, just hold cursor over each section and it names the file in it's taskbar.
Have you only got a 20GB h/d ???? - it's full !!
Those logs will not tell anyone what is really filling up your h/d. They are taking a very long time because it's standing room only in your old pc.
http://uk.webuy.com/product.php?mode=buy&catid=888
30GB h/d - £5 del. +12mth warranty -you could get larger but on your past use a 20-80GB one should last a bit.

aliEnRIK

TICK and FIX these in hijack ~
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://www.searchforge.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,CustomizeSearch = http://www.searchforge.com/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.searchforge.com/search.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O2 - BHO: (no name) - {008DB894-99ED-445D-8547-0E7C9808898D} - (no file)
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: (no name) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SO5 Integrator Pass Two] C:\WINDOWS\SOINTGR.EXE
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [IconixOEAddOn] "C:\Program Files\Iconix\OEAddOn\OEdmn_6.exe"
O4 - HKCU\..\Run: [RegistryMechanic] C:\Program Files\Registry Mechanic\RegMech.exe /H
O4 - HKUS\S-1-5-21-1582333133-3307144382-660890162-1005\..\Run: [BLMessagingIntegration] C:\Program Files\Common Files\PSD Tools\blengine.exe (User 'fil')
O4 - HKUS\S-1-5-21-1582333133-3307144382-660890162-1005\..\Run: [Surs] C:\Documents and Settings\fil\Application Data\awab.exe (User 'fil')
O4 - HKUS\S-1-5-21-1582333133-3307144382-660890162-1005\..\Run: [MyWebSearch Email Plugin] C:\PROGRA~1\MYWEBS~1\bar\1.bin\mwsoemon.exe (User 'fil')
O4 - HKUS\S-1-5-21-1582333133-3307144382-660890162-1005\..\Run: [Helpex32] c:\windows\system32\helpex32.exe (User 'fil')
O4 - HKUS\S-1-5-21-1582333133-3307144382-660890162-1005\..\Run: [Netdll32] c:\windows\system32\netdll32.exe (User 'fil')
O4 - HKUS\S-1-5-21-1582333133-3307144382-660890162-1005\..\Run: [Cbtdhlg] C:\WINDOWS\System32\rdcdfi.exe (User 'fil')
O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZNxdm22735
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O16 - DPF: v3cab - http://searchmiracle.com/cab/v3cab.cab
O16 - DPF: {02C20140-76F8-4763-83D5-B660107B7A90} - http://63.219.181.7/cax_gb.cab
O16 - DPF: {03C543A1-C090-418F-A1D0-FB96380D601D} - http://216.82.66.200/build/preload.cab
O16 - DPF: {0594AF7E-573B-40DF-8165-E47AB2EAEFE8} - http://akamai.downloadv3.com/binarie...1028_EN_XP.cab
O16 - DPF: {0878B424-1F95-4E26-B5AB-F0D349D89650} - ftp://download2.us4.outblaze.com/dow...il_mcea115.cab
O16 - DPF: {093F9CF8-0DE1-491C-95D5-5EC257BD4CA3} - http://akamai.downloadv3.com/binarie...tc32_EN_XP.cab
O16 - DPF: {0BE0E0B4-3E03-4EB6-99B2-00948505A067} (Media Client ActiveX Installer) - http://www.downloadcoach.com/MCInstaller.cab
O16 - DPF: {15AD4789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://public.windupdates.com/get_fi...791f5533d91105
O16 - DPF: {1E89F686-B78D-4C85-9EFC-3474516E3FE2} - http://directplugin.com/plugin/109486.exe
O16 - DPF: {1EB17D1C-141D-4D9D-91CB-24D99215851D} - http://akamai.downloadv3.com/binarie...ia32_EN_XP.cab
O16 - DPF: {2ABE804B-4D3A-41BF-A172-304627874B45} - http://akamai.downloadv3.com/binarie...EGDHTML_XP.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yaho...st20040510.cab
O16 - DPF: {30CE93AE-4987-483C-9ABE-F2BD5301AB70} - http://64.156.31.79/100039/uk/ringtone/ringtone.exe
O16 - DPF: {469C7080-8EC8-43A6-AD97-45848113743C} - http://akamai.downloadv3.com/binarie...hv32_EN_XP.cab
O16 - DPF: {486E48B5-ABF2-42BB-A327-2679DF3FB822} - http://akamai.downloadv3.com/binaries/IA/ia_XP.cab
O16 - DPF: {551A94FA-1F29-4CEB-4086-4A6F727A758B} - http://63.219.178.91/1/rdgGB990.exe
O16 - DPF: {5EE8C907-D4BD-5F94-E377-6D3F2C26724A} - http://63.219.176.203/1/gdnGB485.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/S.../bin/cabsa.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/Driver...aSmartScan.cab
O16 - DPF: {765E6B09-6832-4738-BDBE-25F226BA2AB0} - http://www.mainentrypoint.com/linkzz/QcBar.cab
O16 - DPF: {79849612-A98F-45B8-95E9-4D13C7B6B35C} - http://static.topconverting.com/activex/loader2.ocx
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {8EF27A70-DD04-11D6-B7F6-00A0C9CD5F8A} - http://www.quikshield.com/qshsetup.exe
O16 - DPF: {91433D86-9F27-402C-B5E3-DEBDD122C339} - http://www.netvenda.com/sites/gamc7-gb/gbc7/games4.cab
O16 - DPF: {94742E3F-D9A1-4780-9A87-2FFA43655DA2} - http://fr4-scripts.downloadv3.com/bi...DHTML_pack.cab
O16 - DPF: {9DBAFCCF-592F-FFFF-FFFF-00608CEC297B} - http://www.exactsearchbar.com/mailco...exactSetup.exe
O16 - DPF: {A0F0D762-D1DE-43AF-B70E-D87864743EB3} - http://217.145.76.16/nslite/nslite.cab
O16 - DPF: {A1DC3241-B122-195F-B21A-000000000000} - http://pluginaccess.com/Browser_Plugin.cab
O16 - DPF: {AD7FAFB0-16D6-40C3-AF27-585D6E6453FE} - http://217.73.66.1/minidialler/mddl/...05320_HCGA.exe
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yaho...tocomplete.cab
O16 - DPF: {C1C2AC28-5E4B-4228-B7A0-05E986FFCE14} - http://www.movie-browser.com/tl4000.dll
O16 - DPF: {CEFB7B49-9652-464F-8AFD-A577C0500F39} - http://akamai.downloadv3.com/binarie...4a_pack_XP.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/ge...sh/swflash.cab
O16 - DPF: {DA9A0B1E-9B7B-11D3-B8A4-00C04F79641C} - http://204.177.92.201/quickdl/proclaim/NSupd9x.cab
O16 - DPF: {E3F7205F-2AE0-4BF0-816B-2D24A5F20EC7} - http://usa-download.strip-player.com...up_minsize.cab
O16 - DPF: {E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} - http://xbs.mtreexxx.nl/mt/dialers/fc/UniDist.CAB
O16 - DPF: {F0AA2376-F073-4E57-86E8-0238F99087C7} - http://216.129.173.30/xxxnaughty/activeinstaller.dll
O16 - DPF: {FC87A650-207D-4392-A6A1-82ADBC56FA64} - http://xbs.mtree.com/mt/dialers/fc/MultiDistFC.CAB
O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://66.117.37.13/gba1862.exe
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B23E0CC} - http://direct.data-line.us/gba1096.exe
O16 - DPF: {FFFF0003-0001-101A-A3C9-08002B2F49FB} - http://www.dikai.com/em-meuk.exe
***NOTE - ive left out INCREDIMAIL as it can be a nightmare to get right***

Uninstall AVAST
Uninstall REGISTRY MECHANIC
Uninstall INCREDIMAIL (If possible)

run combofix

nottseagull

Thanks. I believe I did uninstall Incredimail many months ago; at least, it isn't showing in the list of programmes.
I am unable to uninstall Registry Mechanic because I can't stop it running. I have unchecked and saved the "Enable Registry Monitor" box, which causes the box in the tray to change to "Monitoring OFF", but it doesn't seem to stop it from running. Should I just go ahead and run Combofix anyway?

dogmaryxx

Stop the Registry Mechanic process in Task Manager then uninstall.

aliEnRIK

Run combofix anyways

nottseagull

dogmaryxx wrote: »

Stop the Registry Mechanic process in Task Manager then uninstall.

Thanks for introducing me to Task manager; I've never felt the urge to right-click on a blank piece of the taskbar before, so didn't know about it! (it doesn't appear in the navigational paths for Control Panel, My Computer or even All Programmes on XP. Maybe they should have called it Most Programmes )
Actually Reg Mech wasn't showing as running, and I was able to uninstall it without that error.

aliEnRIK wrote: »

Run combofix anyways

Just about to disconnect from the 'net, uninstall Avast 4.8 and run Combo.
Is it OK to install 5.0 (already downloaded to a CD) before I return to post the log?

aliEnRIK

Well it should be, but I find it kind of pointless risking it

id run combofix THEN install Avast

nottseagull

Sorry, I think you must have misread my post. Obviously I would install 5.0 after running Combo; I was just unsure as to whether the next stage would also need AV protection turned off. I could save the log on my phone if need be, and post it from there via its browser.

aliEnRIK

combofix requires av programs to be off

Either way, just run it and see if it works or not

hogshead

fiddiwebb wrote: »

Is confused, whats happened to the original op hogshead ?

Really are out of our depth here. Tried to download malaware, request to save etc but a prompt flashes then nothing?

I googled buying a restore disc in the hope that it will sort out the problem. Cost is £32 which is easily what a PC repair dept would want so may resort to this option. Can I assume all windows etc will be on that disc?

C drive if full no space left at all so perhaps why we can't run defrag, malaware etc.