TechSpot

I have the trojan horse Hider.OOW

By bykerboy68
Dec 31, 2011
  1. I have the trojan horse hider, I can't run windows firewall at all,can change any of my network settings,i.e. media sharing,discovery. Here are the logs you requested.

    Malwarebytes Anti-Malware (Trial) 1.60.0.1800
    www.malwarebytes.org

    Database version: v2011.12.29.04

    Windows Vista Service Pack 2 x86 NTFS
    Internet Explorer 9.0.8112.16421
    MIKE AND STEF :: STEFANIE [administrator]

    Protection: Enabled

    12/29/2011 7:06:56 PM
    mbam-log-2011-12-29 (19-06-56).txt

    Scan type: Quick scan
    Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
    Scan options disabled: P2P
    Objects scanned: 191535
    Time elapsed: 5 minute(s), 16 second(s)

    Memory Processes Detected: 0
    (No malicious items detected)

    Memory Modules Detected: 0
    (No malicious items detected)

    Registry Keys Detected: 27
    HKCR\CLSID\{96AFBE69-C3B0-4b00-8578-D933D2896EE2} (TrojanProxy.Agent) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EA1-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EAB-A523-4961-B6BB-170DE4475CCA} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1D4DB7D2-6EC9-47A3-BD87-1E41684E07BB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{258C9770-1713-4021-8D7E-1F184A2BD754} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{BDEA95CF-F0E6-41E0-BD3D-B00F39A4E939} (Adware.ShoppingReport2) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF6-072E-44CF-8957-5838F569A31D} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1602F07D-8BF3-4C08-BDD6-DDDB1C48AEDC} (Adware.ClickPotato) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{25560540-9571-4D7B-9389-0F166788785A} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{3DC201FB-E9C9-499C-A11F-23C360D7C3F8} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{9FF05104-B030-46FC-94B8-81276E4E27DF} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A078F691-9C07-4AF2-BF43-35E79EECF8B7} (Adware.Softomate) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4D1EC4CA-4B92-4324-B8F8-C9A6ED06A8AE} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{4E674574-3F0B-491d-8AE3-F90B43A34FD6} (Adware.Hotbar) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{98D9753D-D73B-42D5-8C85-4469CDA897AB} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKCR\sp (TrojanProxy.Agent) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\sp (TrojanProxy.Agent) -> Quarantined and deleted successfully.
    HKLM\System\CurrentControlSet\Services\SPService (TrojanProxy.Agent) -> Quarantined and deleted successfully.

    Registry Values Detected: 1
    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost|netsvc (TrojanProxy.Agent) -> Data: SPService^^ -> Quarantined and deleted successfully.

    Registry Data Items Detected: 0
    (No malicious items detected)

    Folders Detected: 1
    C:\Users\MIKE AND STEF\AppData\Roaming\HBLite (Adware.Hotbar) -> Quarantined and deleted successfully.

    Files Detected: 3
    C:\Users\MIKE AND STEF\Local Settings\Application Data\048102515610049.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
    C:\Users\MIKE AND STEF\Local Settings\Application Data\0535049569854.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.
    C:\Users\MIKE AND STEF\Local Settings\Application Data\05557102489799.xxe (Worm.KoobFace) -> Quarantined and deleted successfully.

    (end)
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft® Windows Vista™ Home Basic
    Boot Device: \Device\HarddiskVolume1
    Install Date: 5/19/2008 4:23:11 PM
    System Uptime: 12/31/2011 7:39:05 PM (1 hours ago)
    .
    Motherboard: OEM_MB | | IVY8
    Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 4200+ | Socket AM2 | 2200/200mhz
    .
    ==== Disk Partitions =========================
    .
    C: is FIXED (NTFS) - 139 GiB total, 34.822 GiB free.
    D: is FIXED (NTFS) - 10 GiB total, 1.291 GiB free.
    E: is CDROM ()
    .
    ==== Disabled Device Manager Items =============
    .
    Class GUID: {6bdd1fc6-810f-11d0-bec7-08002be2092f}
    Description: Photosmart C6300 series
    Device ID: ROOT\IMAGE\0000
    Manufacturer: HP
    Name: Photosmart C6300 series
    PNP Device ID: ROOT\IMAGE\0000
    Service: StillCam
    .
    Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
    Description: Photosmart C6300 series
    Device ID: ROOT\MULTIFUNCTION\0000
    Manufacturer: HP
    Name: Photosmart C6300 series
    PNP Device ID: ROOT\MULTIFUNCTION\0000
    Service:
    .
    ==== System Restore Points ===================
    .
    .
    ==== Installed Programs ======================
    .
    Update for Microsoft Office 2007 (KB2508958)
    32 Bit HP CIO Components Installer
    Activation Assistant for the 2007 Microsoft Office suites
    Adobe Flash Player 11 ActiveX
    Adobe Reader 8.3.1
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AVG 2012
    AVG PC Tuneup 2011
    Bonjour
    BufferChm
    Cards_Calendar_OrderGift_DoMorePlugout
    CCleaner
    Compatibility Pack for the 2007 Office system
    CustomerResearchQFolder
    CyberLink DVD Suite Deluxe
    CyberLink PowerDirector
    Destination Component
    DeviceDiscovery
    DeviceManagementQFolder
    DocProc
    DocProcQFolder
    DVD Play
    DVDFab 8.1.1.2 (08/08/2011) Qt
    EssentialFax
    eSupportQFolder
    F4100_doccd
    FrostWire 4.21.8
    GPBaseService
    Hewlett-Packard Active Check for Health Check
    Hewlett-Packard Asset Agent for Health Check
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    HP Active Support Library
    HP Customer Experience Enhancements
    HP Customer Feedback
    HP Customer Participation Program 11.0
    HP Demo
    HP Imaging Device Functions 11.0
    HP Photosmart C6300 All-In-One Driver Software 11.0 Rel .4
    HP Photosmart Essential 2.5
    HP Photosmart Essential 3.0
    HP Smart Web Printing 4.60
    HP Solution Center 11.0
    HP Update
    HPPhotoSmartPhotobookWebPack1
    HPProductAssistant
    HPSSupply
    HPTCSSetup
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 16
    Java(TM) 6 Update 22
    Java(TM) 6 Update 26
    LabelPrint
    LightScribe System Software
    LightScribeTemplateLabeler
    Linksys Wireless Manager
    Logitech Desktop Messenger
    Logitech Legacy USB Camera Driver Package
    Logitech Webcam Software
    Logitech Webcam Software Driver Package
    Malwarebytes Anti-Malware version 1.60.0.1800
    MarketResearch
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Office 2007 Service Pack 2 (SP2)
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office File Validation Add-In
    Microsoft Office Home and Student 2007
    Microsoft Office OneNote MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office PowerPoint Viewer 2007 (English)
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2005 Redistributable - KB2467175
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works
    Move Networks Media Player for Internet Explorer
    MSVCSetup
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB941833)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    muvee autoProducer 6.1
    My HP Games
    Netflix Movie Viewer
    Network
    NVIDIA Drivers
    OCR Software by I.R.I.S. 11.0
    OGA Notifier 2.0.0048.0
    OpenOffice.org 3.3
    PanoStandAlone
    Plants vs Zombies - Game of The Year
    Power2Go
    Princess Isabella A Witch’s Curse
    PS_AIO_04_C6300_ProductContext
    PS_AIO_04_C6300_Software
    PS_AIO_04_C6300_Software_Min
    PSSWCORE
    Pure Networks Platform
    Python 2.5
    QuickTime
    RealArcade
    Realtek High Definition Audio Driver
    RTC Client API v1.2
    SAMSUNG USB Driver for Mobile Phones V5.2.0.0
    SamsungSimpleDL
    Scan
    Security Update for 2007 Microsoft Office System (KB2553089)
    Security Update for 2007 Microsoft Office System (KB2553090)
    Security Update for 2007 Microsoft Office System (KB2584063)
    Security Update for 2007 Microsoft Office System (KB969559)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
    Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
    Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
    Security Update for Microsoft Office system 2007 (972581)
    Security Update for Microsoft Office system 2007 (KB969613)
    Security Update for Microsoft Office system 2007 (KB974234)
    Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
    Shop for HP Supplies
    SmartWebPrinting
    Soft Data Fax Modem with SmartCP
    SolutionCenter
    Status
    Toolbox
    TrayApp
    TSP_CODEC
    UnloadSupport
    Update for 2007 Microsoft Office System (KB967642)
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Microsoft Office 2007 Help for Common Features (KB963673)
    Update for Microsoft Office 2007 suites (KB2596651) 32-Bit Edition
    Update for Microsoft Office 2007 suites (KB2596789) 32-Bit Edition
    Update for Microsoft Office 2007 System (KB2539530)
    Update for Microsoft Office Excel 2007 (KB2596596) 32-Bit Edition
    Update for Microsoft Office Excel 2007 Help (KB963678)
    Update for Microsoft Office InfoPath 2007 (KB976416)
    Update for Microsoft Office OneNote 2007 (KB980729)
    Update for Microsoft Office OneNote 2007 Help (KB963670)
    Update for Microsoft Office Powerpoint 2007 Help (KB963669)
    Update for Microsoft Office Script Editor Help (KB963671)
    Update for Microsoft Office Word 2007 (KB974561)
    Update for Microsoft Office Word 2007 Help (KB963665)
    VideoToolkit01
    Viewpoint Media Player
    WebReg
    Windows Live ID Sign-in Assistant
    Yahoo! BrowserPlus 2.9.8
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12/31/2011 8:08:35 PM, Error: Microsoft-Windows-Dhcp-Client [1002] - The IP address lease 10.0.0.12 for the Network Card with network address 00259CB37302 has been denied by the DHCP server 10.0.0.1 (The DHCP Server sent a DHCPNACK message).
    12/31/2011 8:02:11 PM, Error: nvstor32 [5] - A parity error was detected on \Device\RaidPort0.
    12/31/2011 7:43:29 PM, Error: Microsoft-Windows-WMPNSS-Service [14325] - Service 'WMPNetworkSvc' did not start correctly because QueryService encountered error '0x80070424'. In Windows Media Player, turn off media sharing, and then turn it back on.
    12/31/2011 7:41:26 PM, Error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
    12/31/2011 7:41:05 PM, Error: Service Control Manager [7023] - The Computer Browser service terminated with the following error: The specified service does not exist as an installed service.
    12/31/2011 7:41:05 PM, Error: Service Control Manager [7003] - The IPsec Policy Agent service depends the following service: BFE. This service might not be installed.
    12/31/2011 7:41:05 PM, Error: Service Control Manager [7003] - The Internet Connection Sharing (ICS) service depends the following service: BFE. This service might not be installed.
    12/31/2011 7:41:05 PM, Error: Service Control Manager [7003] - The IKE and AuthIP IPsec Keying Modules service depends the following service: BFE. This service might not be installed.
    12/31/2011 7:41:05 PM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
    12/31/2011 7:39:35 PM, Error: EventLog [6008] - The previous system shutdown at 7:36:48 PM on 12/31/2011 was unexpected.
    12/30/2011 9:58:58 PM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user STEFANIE\MIKE AND STEF SID (S-1-5-21-2450527456-1965013573-2852655101-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
    12/29/2011 12:56:49 PM, Error: Service Control Manager [7023] - The SPService service terminated with the following error: The specified module could not be found.
    12/29/2011 12:51:22 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    12/29/2011 12:48:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service wcncsvc with arguments "" in order to run the server: {375FF000-DD27-11D9-8F9C-0002B3988E81}
    12/29/2011 12:48:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {D3DCB472-7261-43CE-924B-0704BD730D5F}
    12/29/2011 12:48:03 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments "" in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
    12/29/2011 12:13:32 PM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: Avgldx86 Avgmfx86 spldr Wanarpv6
    12/29/2011 12:13:32 PM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 12:12:50 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
    12/29/2011 12:12:49 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments "" in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
    12/29/2011 12:12:43 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/29/2011 12:12:32 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments "" in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
    12/29/2011 12:12:06 PM, Error: EventLog [6008] - The previous system shutdown at 12:10:15 PM on 12/29/2011 was unexpected.
    12/29/2011 11:25:47 AM, Error: EventLog [6008] - The previous system shutdown at 11:13:22 AM on 12/29/2011 was unexpected.
    12/29/2011 11:14:46 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the avgwd service.
    12/29/2011 11:14:16 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AVGIDSAgent service.
    12/29/2011 11:13:46 AM, Error: Service Control Manager [7043] - The Group Policy Client service did not shut down properly after receiving a preshutdown control.
    12/29/2011 11:11:58 AM, Error: Service Control Manager [7003] - The Spybot-S&D 2 Security Center Service service depends the following service: wscsvc. This service might not be installed.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD Avgldx86 Avgmfx86 Avgtdix DfsC NetBIOS netbt nsiproxy PSched RasAcd rdbss SDHookDriver Smb spldr Tcpip tdx Wanarpv6
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:57:45 AM, Error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/29/2011 10:56:58 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments "" in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
    12/29/2011 10:56:58 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments "" in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
    12/29/2011 10:56:18 AM, Error: EventLog [6008] - The previous system shutdown at 10:52:13 AM on 12/29/2011 was unexpected.
    12/29/2011 10:37:29 AM, Error: EventLog [6008] - The previous system shutdown at 10:31:58 AM on 12/29/2011 was unexpected.
    12/29/2011 10:11:51 AM, Error: EventLog [6008] - The previous system shutdown at 10:05:05 AM on 12/29/2011 was unexpected.
    12/29/2011 10:03:16 AM, Error: EventLog [6008] - The previous system shutdown at 9:50:15 AM on 12/29/2011 was unexpected.
    .
    ==== End Of File ===========================
    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 9.0.8112.16421
    Run by MIKE AND STEF at 20:11:04 on 2011-12-31
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.3454.1962 [GMT -5:00]
    .
    AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    ============== Running Processes ===============
    .
    C:\Windows\system32\wininit.exe
    C:\Windows\system32\lsm.exe
    C:\Windows\system32\svchost.exe -k DcomLaunch
    C:\Windows\system32\nvvsvc.exe
    C:\Windows\system32\svchost.exe -k rpcss
    C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
    C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
    C:\Windows\system32\svchost.exe -k netsvcs
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    C:\Windows\system32\SLsvc.exe
    C:\Windows\system32\svchost.exe -k LocalService
    C:\Windows\system32\rundll32.exe
    C:\Windows\system32\svchost.exe -k NetworkService
    C:\Windows\System32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\AVG\AVG2012\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Windows\System32\svchost.exe -k LocalServiceNoNetwork
    C:\Windows\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\Program Files\Common Files\Motive\McciCMService.exe
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\System32\svchost.exe -k HPZ12
    C:\Windows\system32\svchost.exe -k imgsvc
    C:\Windows\System32\svchost.exe -k WerSvcGroup
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Windows\system32\SearchIndexer.exe
    C:\Windows\system32\DRIVERS\xaudio.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Windows\system32\Dwm.exe
    C:\Windows\Explorer.EXE
    C:\Windows\system32\taskeng.exe
    C:\Windows\RtHDVCpl.exe
    C:\hp\support\hpsysdrv.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\EssentialFax\essfaxcontrol.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
    C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe
    C:\Program Files\AVG\AVG2012\avgtray.exe
    C:\Program Files\Windows Media Player\wmpnscfg.exe
    C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe
    C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
    C:\Program Files\OpenOffice.org 3\program\soffice.exe
    C:\Program Files\OpenOffice.org 3\program\soffice.bin
    C:\Windows\system32\taskeng.exe
    C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
    C:\Windows\system32\svchost.exe -k HPService
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
    c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
    C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Windows\system32\Macromed\Flash\FlashUtil11e_ActiveX.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Yahoo!\Companion\Installs\cpn0\ytbb.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\SearchProtocolHost.exe
    C:\Windows\system32\SearchFilterHost.exe
    C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page = hxxp://www.my.yahoo.com/
    uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cndt
    uSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
    uSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    mStart Page = hxxp://www.comcast.net/
    mDefault_Page_URL = hxxp://www.yahoo.com/
    mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr9/*http://www.yahoo.com
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    mWindow Title = Windows Internet Explorer provided by Comcast
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    mSearchAssistant = hxxp://my.netzero.net/s/search?r=minisearch
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    uURLSearchHooks: YTNavAssist.YTNavAssistPlugin Class: {81017ea9-9aa8-4a6a-9734-7af40e7d593f} - c:\program files\yahoo!\companion\installs\cpn0\YTNavAssist.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg2012\avgssie.dll
    BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
    uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden
    mRun: [RtHDVCpl] RtHDVCpl.exe
    mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    mRun: [DPService] "c:\program files\hp\dvdplay\DPService.exe"
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
    mRun: [Essential Fax Print Controller] "c:\program files\essentialfax\essfaxcontrol.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [nmctxth] "c:\program files\common files\pure networks shared\platform\nmctxth.exe"
    mRun: [Linksys Wireless Manager] "c:\program files\linksys\linksys wireless manager\LinksysWirelessManager.exe" /cm /min /lcid 1033
    mRun: [LogitechQuickCamRibbon] "c:\program files\logitech\logitech webcam software\LWS.exe" /hide
    mRun: [AVG_TRAY] "c:\program files\avg\avg2012\avgtray.exe"
    mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
    mRun: [Spybot-S&D Cleaning] "c:\program files\spybot - search & destroy 2\SDCleaner.exe" /autoclean
    mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
    dRun: [DelayShred] c:\progra~1\mcafee\mshr\shrcl.exe /p7 /q c:\users\mikean~1\appdata\local\temp\low\tempor~1\content.ie5\dik4wt33.sh! c:\users\mikean~1\appdata\local\temp\low\tempor~1\content.ie5\akrjxl80.sh! c:\users\mikean~1\appdata\local\temp\low\tempor~1\content.ie5\5ze1pa41.sh! c:\users\mikean~1\appdata\local\temp\low\tempor~1\content.ie5\0s8pakzs.sh! c:\users\mikean~1\appdata\local\temp\low\tempor~1\content.sh! c:\users\mikean~1\appdata\local\temp\low\TEMPOR~1.SH!
    StartupFolder: c:\users\mikean~1\appdata\roaming\micros~1\windows\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
    mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
    mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
    IE: &Search - ?p=ZJxdm172YYUS
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
    IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    LSP: mswsock.dll
    Trusted Zone: juno.com
    Trusted Zone: netzero.com
    Trusted Zone: netzero.net
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    TCP: DhcpNameServer = 10.0.0.1
    TCP: Interfaces\{D838551E-0487-4A69-9584-E6338E562725} : DhcpNameServer = 10.0.0.1
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\logitech\desktop messenger\8876480\program\GAPlugProtocol-8876480.dll
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg2012\avgpp.dll
    Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp4.dll
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2011-7-11 23120]
    R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2011-9-13 32592]
    R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2011-10-7 230608]
    R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2011-8-8 40016]
    R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2011-7-11 295248]
    R2 avgwd;AVG WatchDog;c:\program files\avg\avg2012\avgwdsvc.exe [2011-8-2 192776]
    R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
    R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2011-12-29 652872]
    R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2011-7-11 134736]
    R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2011-7-11 24272]
    R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2011-10-4 16720]
    R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-29 20464]
    R3 netr28;Linksys WPC600N/WMP600N Wireless-N Card Driver for Vista;c:\windows\system32\drivers\netr28.sys [2010-1-22 440832]
    S2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg2012\AVGIDSAgent.exe [2011-10-12 4433248]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2012-01-01 00:38:40 66560 ----a-w- c:\windows\system32\drivers\smb.sys
    2011-12-30 00:25:34 -------- d-----w- c:\program files\CCleaner
    2011-12-30 00:05:19 -------- d-----w- c:\users\mike and stef\appdata\roaming\Malwarebytes
    2011-12-30 00:05:09 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-12-30 00:05:09 -------- d-----w- c:\programdata\Malwarebytes
    2011-12-30 00:05:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-12-29 18:12:22 -------- d-----w- C:\ee080bf5dced262ea3d85d1d85864b
    2011-12-29 14:09:48 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
    2011-12-15 21:03:45 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-12-15 21:03:45 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-12-15 21:03:44 429056 ----a-w- c:\windows\system32\EncDec.dll
    2011-12-15 21:03:43 2043904 ----a-w- c:\windows\system32\win32k.sys
    2011-12-15 21:03:42 2409784 ----a-w- c:\program files\windows mail\OESpamFilter.dat
    2011-12-15 21:03:40 49152 ----a-w- c:\windows\system32\csrsrv.dll
    2011-12-15 21:03:33 2048 ----a-w- c:\windows\system32\tzres.dll
    .
    ==================== Find3M ====================
    .
    2011-12-02 21:14:26 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-11-03 22:47:42 1798144 ----a-w- c:\windows\system32\jscript9.dll
    2011-11-03 22:40:21 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-11-03 22:39:47 1127424 ----a-w- c:\windows\system32\wininet.dll
    2011-11-03 22:31:57 2382848 ----a-w- c:\windows\system32\mshtml.tlb
    2011-10-07 10:23:48 230608 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2011-10-04 10:21:16 16720 ----a-w- c:\windows\system32\drivers\AVGIDSShim.sys
    2011-02-27 13:47:23 462 ----a-w- c:\program files\022720118472297.bat
    .
    ============= FINISH: 20:11:34.91 ===============
     
  2. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Welcome aboard [​IMG]

    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =============================================================

    I still need GMER log.
     
  3. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    I'm sorry thought I sent it.

    here it is

    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit quick scan 2011-12-31 20:07:50
    Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\0000005d Hitachi_ rev.P22O
    Running: 0vrl1ee3.exe; Driver: C:\Windows\TEMP\kglyypob.sys


    ---- Devices - GMER 1.0.15 ----

    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)

    AttachedDevice \Driver\tdx \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
    AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

    ---- EOF - GMER 1.0.15 ----
     
  4. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Download aswMBR to your desktop.
    Double click the aswMBR.exe to run it.
    If you see this question: Would you like to download latest Avast! virus definitions?" say "Yes".
    Click the "Scan" button to start scan.
    On completion of the scan click "Save log", save it to your desktop and post in your next reply.

    NOTE. aswMBR will create MBR.dat file on your desktop. This is a copy of your MBR. Do NOT delete it.

    ============================================================

    Please download ComboFix from Here or Here to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG and CA Internet Security users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.

    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
  5. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    Logs

    Here are the 2 logs you requested. And thanks Happy New Year.

    aswMBR version 0.9.9.1124 Copyright(c) 2011 AVAST Software
    Run date: 2012-01-01 11:59:24
    -----------------------------
    11:59:24.890 OS Version: Windows 6.0.6002 Service Pack 2
    11:59:24.890 Number of processors: 2 586 0x6B02
    11:59:24.890 ComputerName: STEFANIE UserName:
    11:59:26.372 Initialize success
    12:00:27.774 AVAST engine defs: 12010100
    12:00:37.166 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000005d
    12:00:37.166 Disk 0 Vendor: Hitachi_ P22O Size: 152627MB BusType: 6
    12:00:37.197 Disk 0 MBR read successfully
    12:00:37.212 Disk 0 MBR scan
    12:00:37.212 Disk 0 unknown MBR code
    12:00:37.228 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 142741 MB offset 63
    12:00:37.259 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 9883 MB offset 292334805
    12:00:37.275 Disk 0 scanning sectors +312576705
    12:00:37.368 Disk 0 scanning C:\Windows\system32\drivers
    12:00:49.788 Service scanning
    12:00:51.067 Modules scanning
    12:01:01.628 Disk 0 trace - called modules:
    12:01:01.660 ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll storport.sys nvstor32.sys
    12:01:02.174 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85f3f608]
    12:01:02.190 3 CLASSPNP.SYS[807398b3] -> nt!IofCallDriver -> [0x85e0a5f8]
    12:01:02.190 5 acpi.sys[806166bc] -> nt!IofCallDriver -> \Device\0000005d[0x859f6870]
    12:01:03.266 AVAST engine scan C:\Windows
    12:01:07.229 AVAST engine scan C:\Windows\system32
    12:03:27.017 AVAST engine scan C:\Windows\system32\drivers
    12:03:38.420 AVAST engine scan C:\Users\MIKE AND STEF
    12:11:39.985 AVAST engine scan C:\ProgramData
    12:17:04.052 Scan finished successfully
    12:19:30.581 Disk 0 MBR has been saved successfully to "C:\Users\MIKE AND STEF\Desktop\MBR.dat"
    12:19:30.581 The log file has been saved successfully to "C:\Users\MIKE AND STEF\Desktop\aswMBR.txt"


    ComboFix 12-01-01.01 - MIKE AND STEF 01/01/2012 12:55:02.1.2 - x86
    Microsoft® Windows Vista™ Home Basic 6.0.6002.2.1252.1.1033.18.3454.2775 [GMT -5:00]
    Running from: c:\users\MIKE AND STEF\Desktop\ComboFix.exe
    AV: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
    SP: AVG Anti-Virus Free Edition 2012 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
    SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\users\MIKE AND STEF\AppData\Roaming\inst.exe
    c:\windows\$NtUninstallKB32349$
    c:\windows\$NtUninstallKB32349$\1563632494\@
    c:\windows\$NtUninstallKB32349$\1563632494\bckfg.tmp
    c:\windows\$NtUninstallKB32349$\1563632494\cfg.ini
    c:\windows\$NtUninstallKB32349$\1563632494\Desktop.ini
    c:\windows\$NtUninstallKB32349$\1563632494\keywords
    c:\windows\$NtUninstallKB32349$\1563632494\kwrd.dll
    c:\windows\$NtUninstallKB32349$\1563632494\L\ogejidap
    c:\windows\$NtUninstallKB32349$\1563632494\lsflt7.ver
    c:\windows\$NtUninstallKB32349$\1563632494\U\00000001.@
    c:\windows\$NtUninstallKB32349$\1563632494\U\00000002.@
    c:\windows\$NtUninstallKB32349$\1563632494\U\00000004.@
    c:\windows\$NtUninstallKB32349$\1563632494\U\80000000.@
    c:\windows\$NtUninstallKB32349$\1563632494\U\80000004.@
    c:\windows\$NtUninstallKB32349$\1563632494\U\80000032.@
    c:\windows\$NtUninstallKB32349$\3090918601
    c:\windows\bwUnin-8.1.1.50-8876480SL.exe
    c:\windows\bwUnin-8.1.1.87-8876480SL.exe
    c:\windows\system32\AutoRun.inf
    c:\windows\system32\RENFBD8.tmp
    c:\windows\system32\system
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    -------\Service_wuauserv
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-12-01 to 2012-01-01 )))))))))))))))))))))))))))))))
    .
    .
    2012-01-01 18:05 . 2012-01-01 18:05 9310 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXTBOX.JS
    2012-01-01 18:05 . 2012-01-01 18:05 8646 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
    2012-01-01 18:05 . 2012-01-01 18:05 8613 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\SAVEDUSER.JS
    2012-01-01 18:05 . 2012-01-01 18:05 6429 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UICORE.JS
    2012-01-01 18:05 . 2012-01-01 18:05 63115 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\USERTILE.JS
    2012-01-01 18:05 . 2012-01-01 18:05 5927 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TEXT.JS
    2012-01-01 18:05 . 2012-01-01 18:05 4599 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\UIRESOURCE.JS
    2012-01-01 18:05 . 2012-01-01 18:05 1651 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\QUERYSTRING.JS
    2012-01-01 18:04 . 2012-01-01 18:04 8288 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\IMAGE.JS
    2012-01-01 18:04 . 2012-01-01 18:04 6910 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\NEWUSERCOMM.JS
    2012-01-01 18:04 . 2012-01-01 18:04 6208 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LINK.JS
    2012-01-01 18:04 . 2012-01-01 18:04 18541 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\LOCALIZATION.JS
    2012-01-01 18:04 . 2012-01-01 18:04 8782 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\BUTTON.JS
    2012-01-01 18:04 . 2012-01-01 18:04 7271 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\CHECKBOX.JS
    2012-01-01 18:04 . 2012-01-01 18:04 51852 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\EXTERNALWRAPPER.JS
    2012-01-01 18:04 . 2012-01-01 18:04 23327 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\COMBOBOX.JS
    2012-01-01 18:04 . 2012-01-01 18:04 20719 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\DIVWRAPPER.JS
    2012-01-01 00:38 . 2011-12-31 23:19 66560 ----a-w- c:\windows\system32\drivers\smb.sys
    2011-12-30 00:25 . 2011-12-30 00:25 -------- d-----w- c:\program files\CCleaner
    2011-12-30 00:05 . 2011-12-30 00:05 -------- d-----w- c:\users\MIKE AND STEF\AppData\Roaming\Malwarebytes
    2011-12-30 00:05 . 2011-12-30 00:18 -------- d-----w- c:\programdata\Malwarebytes
    2011-12-30 00:05 . 2011-12-10 20:24 20464 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-12-30 00:05 . 2011-12-30 00:05 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-12-29 18:12 . 2011-12-29 18:12 -------- d-----w- C:\ee080bf5dced262ea3d85d1d85864b
    2011-12-29 14:09 . 2011-12-29 17:55 -------- d-----w- c:\program files\Spybot - Search & Destroy 2
    2011-12-19 16:26 . 2011-12-29 17:45 -------- d-----w- c:\users\fix
    2011-12-15 21:03 . 2011-10-27 08:01 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-12-15 21:03 . 2011-10-27 08:01 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-12-15 21:03 . 2011-10-14 16:02 429056 ----a-w- c:\windows\system32\EncDec.dll
    2011-12-15 21:03 . 2011-11-23 13:37 2043904 ----a-w- c:\windows\system32\win32k.sys
    2011-12-15 21:03 . 2011-11-08 12:10 2409784 ----a-w- c:\program files\Windows Mail\OESpamFilter.dat
    2011-12-15 21:03 . 2011-10-25 15:56 49152 ----a-w- c:\windows\system32\csrsrv.dll
    2011-12-15 21:03 . 2011-11-08 14:42 2048 ----a-w- c:\windows\system32\tzres.dll
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-12-02 21:14 . 2011-09-13 00:12 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-02-27 13:47 . 2011-02-27 13:47 462 ----a-w- c:\program files\022720118472297.bat
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{81017EA9-9AA8-4A6A-9734-7AF40E7D593F}"= "c:\program files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll" [2011-09-08 202040]
    .
    [HKEY_CLASSES_ROOT\clsid\{81017ea9-9aa8-4a6a-9734-7af40e7d593f}]
    [HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin.1]
    [HKEY_CLASSES_ROOT\TypeLib\{A31F34A1-EBD2-45A2-BF6D-231C1B987CC8}]
    [HKEY_CLASSES_ROOT\YTNavAssist.YTNavAssistPlugin]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-03-17 2387968]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "RtHDVCpl"="RtHDVCpl.exe" [2008-07-03 6266880]
    "hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
    "DPService"="c:\program files\HP\DVDPlay\DPService.exe" [2008-03-11 90112]
    "HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2008-03-26 49152]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704]
    "Essential Fax Print Controller"="c:\program files\EssentialFax\essfaxcontrol.exe" [2009-01-12 94208]
    "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]
    "nmctxth"="c:\program files\Common Files\Pure Networks Shared\Platform\nmctxth.exe" [2008-12-12 642856]
    "Linksys Wireless Manager"="c:\program files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe" [2009-02-16 1358384]
    "LogitechQuickCamRibbon"="c:\program files\Logitech\Logitech WebCam Software\LWS.exe" [2009-10-14 2793304]
    "hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-03-13 81920]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2011-08-31 40368]
    "Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]
    "Malwarebytes' Anti-Malware"="c:\program files\Malwarebytes' Anti-Malware\mbamgui.exe" [2011-12-24 460872]
    .
    c:\users\MIKE AND STEF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
    OpenOffice.org 3.3.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2010-12-13 1198592]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "EnableUIADesktopToggle"= 0 (0x0)
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001
    .
    R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
    R3 PCD5SRVC{BD6912E3-AC9D80E8-05040000};PCD5SRVC{BD6912E3-AC9D80E8-05040000} - PCDR Kernel Mode Service Helper Driver;c:\progra~1\PC-DOC~1\PCD5SRVC.pkms [x]
    R3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys [2008-12-15 47360]
    R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
    S2 MBAMService;MBAMService;c:\program files\Malwarebytes' Anti-Malware\mbamservice.exe [2011-12-24 652872]
    S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2011-12-10 20464]
    S3 netr28;Linksys WPC600N/WMP600N Wireless-N Card Driver for Vista;c:\windows\system32\DRIVERS\netr28.sys [2009-01-13 440832]
    .
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
    HPService REG_MULTI_SZ HPSLPSVC
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.my.yahoo.com/
    mStart Page = hxxp://www.comcast.net/
    mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    mWindow Title = Windows Internet Explorer provided by Comcast
    uInternet Settings,ProxyOverride = *.local
    uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    Trusted Zone: juno.com
    Trusted Zone: netzero.com
    Trusted Zone: netzero.net
    TCP: DhcpNameServer = 10.0.0.1
    Handler: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - c:\program files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    .
    - - - - ORPHANS REMOVED - - - -
    .
    HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
    HKLM-Run-Spybot-S&D Cleaning - c:\program files\Spybot - Search & Destroy 2\SDCleaner.exe
    HKU-Default-Run-DelayShred - c:\progra~1\mcafee\mshr\ShrCL.EXE
    SafeBoot-klmdb.sys
    SafeBoot-mcmscsvc
    SafeBoot-MCODS
    .
    .
    .
    **************************************************************************
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files:
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet003\Services\PCD5SRVC{BD6912E3-AC9D80E8-05040000}]
    "ImagePath"="\??\c:\progra~1\PC-DOC~1\PCD5SRVC.pkms"
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    [HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
    @Denied: (A) (Users)
    @Denied: (A) (Everyone)
    @Allowed: (B 1 2 3 4 5) (S-1-5-20)
    "BlindDial"=dword:00000000
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\nvvsvc.exe
    c:\windows\system32\rundll32.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    c:\program files\Common Files\Motive\McciCMService.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    c:\windows\system32\DRIVERS\xaudio.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\program files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    c:\program files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    c:\windows\RtHDVCpl.exe
    c:\windows\System32\rundll32.exe
    c:\program files\Windows Media Player\wmpnscfg.exe
    c:\program files\OpenOffice.org 3\program\soffice.exe
    c:\program files\OpenOffice.org 3\program\soffice.bin
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
    .
    **************************************************************************
    .
    Completion time: 2012-01-01 13:13:21 - machine was rebooted
    ComboFix-quarantined-files.txt 2012-01-01 18:13
    .
    Pre-Run: 36,286,820,352 bytes free
    Post-Run: 35,963,531,264 bytes free
    .
    - - End Of File - - ED45D85E41D7EABACDCC7939221ABDCC
     
  6. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    [​IMG]

    All looks good.

    Any current issues?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
  7. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    otl logs 1 of 2

    It seem to be running fine,still says firewall can't open to change settings. Haven't checked to see if I can set upi mt network sharing yet.

    OTL logfile created on: 1/1/2012 2:36:13 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\MIKE AND STEF\Desktop
    Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.37 Gb Total Physical Memory | 2.35 Gb Available Physical Memory | 69.69% Memory free
    6.96 Gb Paging File | 6.05 Gb Available in Paging File | 86.86% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 139.40 Gb Total Space | 33.56 Gb Free Space | 24.08% Space Free | Partition Type: NTFS
    Drive D: | 9.65 Gb Total Space | 1.29 Gb Free Space | 13.38% Space Free | Partition Type: NTFS

    Computer Name: STEFANIE | User Name: MIKE AND STEF | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Processes (SafeList) ==========

    PRC - [2012/01/01 14:33:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\MIKE AND STEF\Desktop\OTL.exe
    PRC - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
    PRC - [2011/12/02 16:14:26 | 000,247,968 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\System32\Macromed\Flash\FlashUtil11e_ActiveX.exe
    PRC - [2011/01/17 17:37:40 | 011,322,880 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe
    PRC - [2011/01/17 17:37:40 | 011,314,688 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin
    PRC - [2009/10/07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
    PRC - [2009/02/16 04:35:38 | 001,358,384 | R--- | M] (Linksys, LLC) -- C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe
    PRC - [2009/01/12 08:09:06 | 000,094,208 | ---- | M] () -- C:\Program Files\EssentialFax\essfaxcontrol.exe
    PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    PRC - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe
    PRC - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    PRC - [2008/07/03 10:27:12 | 006,266,880 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe
    PRC - [2007/04/18 10:01:34 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe


    ========== Modules (No Company Name) ==========

    MOD - [2011/08/30 11:51:24 | 000,985,088 | ---- | M] () -- C:\Program Files\OpenOffice.org 3\program\libxml2.dll
    MOD - [2009/09/05 00:54:38 | 000,180,224 | ---- | M] () -- C:\Program Files\QuickTime\QTSystem\QTCF.dll
    MOD - [2009/09/04 22:15:06 | 000,067,872 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
    MOD - [2009/09/04 22:14:56 | 000,120,096 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\objc.dll
    MOD - [2009/09/04 22:14:44 | 000,039,712 | ---- | M] () -- C:\Program Files\Common Files\Apple\Apple Application Support\ASL.dll
    MOD - [2009/03/17 10:09:56 | 007,331,840 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtGui4.dll
    MOD - [2009/03/17 10:09:56 | 002,023,424 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\QtCore4.dll
    MOD - [2009/03/17 10:09:42 | 000,135,168 | ---- | M] () -- C:\Program Files\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
    MOD - [2009/01/12 08:09:06 | 000,094,208 | ---- | M] () -- C:\Program Files\EssentialFax\essfaxcontrol.exe
    MOD - [2008/12/12 18:11:26 | 000,148,480 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CAntiVirusCOM.dll
    MOD - [2008/12/12 18:11:26 | 000,097,280 | ---- | M] () -- C:\Program Files\Common Files\Pure Networks Shared\Platform\CFirewallCOM.dll


    ========== Win32 Services (SafeList) ==========

    SRV - [2011/12/24 17:50:18 | 000,652,872 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
    SRV - [2009/10/07 00:47:34 | 000,154,136 | ---- | M] (Logitech Inc.) [Auto | Running] -- C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe -- (LVPrcSrv)
    SRV - [2008/12/12 18:06:40 | 000,642,856 | ---- | M] (Cisco Systems, Inc.) [Auto | Running] -- C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe -- (nmservice)
    SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Auto | Running] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)


    ========== Driver Services (SafeList) ==========

    DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
    DRV - [2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
    DRV - [2010/01/28 16:46:44 | 000,021,248 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MREMP50.sys -- (MREMP50)
    DRV - [2010/01/28 16:46:42 | 000,020,096 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Program Files\Common Files\Motive\MRESP50.sys -- (MRESP50)
    DRV - [2010/01/14 02:02:54 | 000,014,848 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)
    DRV - [2010/01/14 02:02:52 | 000,123,648 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)
    DRV - [2010/01/14 02:02:52 | 000,098,560 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)
    DRV - [2009/10/07 00:46:36 | 000,025,752 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVPr2Mon.sys -- (LVPr2Mon)
    DRV - [2009/04/30 18:01:34 | 000,265,496 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lvrs.sys -- (LVRS)
    DRV - [2009/04/30 17:55:56 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI)
    DRV - [2009/04/30 17:55:32 | 000,013,976 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\lv302af.sys -- (pepifilter)
    DRV - [2008/12/17 01:01:20 | 000,041,752 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LVUSBSta.sys -- (LVUSBSta)
    DRV - [2008/12/12 18:05:18 | 000,026,416 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\purendis.sys -- (purendis)
    DRV - [2008/12/12 18:05:18 | 000,024,880 | ---- | M] (Cisco Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pnarp.sys -- (pnarp)
    DRV - [2008/05/22 20:49:00 | 007,465,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
    DRV - [2008/05/08 12:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)
    DRV - [2008/05/08 12:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)
    DRV - [2008/01/29 07:55:00 | 001,042,464 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)
    DRV - [2008/01/25 14:02:04 | 000,132,128 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvrd32.sys -- (nvrd32)
    DRV - [2008/01/25 14:02:02 | 000,140,832 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\nvstor32.sys -- (nvstor32)
    DRV - [2007/10/18 10:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)
    DRV - [2007/10/12 10:53:10 | 000,013,312 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvsmu.sys -- (nvsmu)


    ========== Standard Registry (SafeList) ==========


    ========== Internet Explorer ==========

    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr9/*http://www.yahoo.com/ext/search/search.html
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/
    IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://us.rd.yahoo.com/customize/ie/defaults/cs/msgr9/*http://www.yahoo.com/ext/search/search.html


    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0



    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.my.yahoo.com/
    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..\URLSearchHook: {81017EA9-9AA8-4A6A-9734-7AF40E7D593F} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTNavAssist.dll (Yahoo! Inc.)
    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
    IE - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = :0

    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found
    FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
    FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
    FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
    FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
    FF - HKLM\Software\MozillaPlugins\@oberon-media.com/ONCAdapter: C:\Program Files\Common Files\Oberon Media\NCAdapter\1.0.0.7\npapicomadapter.dll (Oberon-Media )
    FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()
    FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.9.8: C:\Users\MIKE AND STEF\AppData\Local\Yahoo!\BrowserPlus\2.9.8\Plugins\npybrowserplus_2.9.8.dll (Yahoo! Inc.)

    FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/19 12:30:11 | 000,000,000 | ---D | M]
    FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3 [2010/03/19 12:30:11 | 000,000,000 | ---D | M]


    O1 HOSTS File: ([2012/01/01 13:06:44 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
    O1 - Hosts: 127.0.0.1 localhost
    O2 - BHO: (&Yahoo! Toolbar Helper) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
    O2 - BHO: (SingleInstance Class) - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll (Yahoo! Inc)
    O3 - HKLM\..\Toolbar: (Yahoo! Toolbar) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll (Yahoo! Inc.)
    O4 - HKLM..\Run: [DPService] C:\Program Files\HP\DVDPlay\DPService.exe (CyberLink Corp.)
    O4 - HKLM..\Run: [Essential Fax Print Controller] C:\Program Files\EssentialFax\essfaxcontrol.exe ()
    O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)
    O4 - HKLM..\Run: [Linksys Wireless Manager] C:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe (Linksys, LLC)
    O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\Logitech WebCam Software\LWS.exe ()
    O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
    O4 - HKLM..\Run: [nmctxth] C:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe (Cisco Systems, Inc.)
    O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)
    O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
    O4 - Startup: C:\Users\MIKE AND STEF\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.3.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
    O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O7 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
    O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
    O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
    O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: juno.com ([]* in Trusted sites)
    O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: netzero.com ([]* in Trusted sites)
    O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: netzero.net ([]* in Trusted sites)
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.1
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D838551E-0487-4A69-9584-E6338E562725}: DhcpNameServer = 10.0.0.1
    O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
    O18 - Protocol\Handler\pure-go {4746C79A-2042-4332-8650-48966E44ABA8} - C:\Program Files\Common Files\Pure Networks Shared\Platform\puresp4.dll (Cisco Systems, Inc.)
    O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
    O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
    O24 - Desktop WallPaper: C:\Users\MIKE AND STEF\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O24 - Desktop BackupWallPaper: C:\Users\MIKE AND STEF\AppData\Roaming\Microsoft\Windows Photo Gallery\Windows Photo Gallery Wallpaper.jpg
    O32 - HKLM CDRom: AutoRun - 1
    O32 - AutoRun File - [2008/05/09 23:40:56 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
    O34 - HKLM BootExecute: (autocheck autochk *)
    O35 - HKLM\..comfile [open] -- "%1" %*
    O35 - HKLM\..exefile [open] -- "%1" %*
    O37 - HKLM\...com [@ = ComFile] -- "%1" %*
    O37 - HKLM\...exe [@ = exefile] -- "%1" %*

    NetSvcs: FastUserSwitchingCompatibility - File not found
    NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
    NetSvcs: Nla - File not found
    NetSvcs: Ntmssvc - File not found
    NetSvcs: NWCWorkstation - File not found
    NetSvcs: Nwsapagent - File not found
    NetSvcs: SRService - File not found
    NetSvcs: WmdmPmSp - File not found
    NetSvcs: wuauserv - File not found
    NetSvcs: LogonHours - File not found
    NetSvcs: PCAudit - File not found
    NetSvcs: helpsvc - File not found
    NetSvcs: uploadmgr - File not found

    Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.l3codecp - C:\Windows\System32\l3codecp.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
    Drivers32: msacm.trspch - C:\Windows\System32\tssoft32.acm (DSP GROUP, INC.)
    Drivers32: MSVideo - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: MSVideo8 - C:\Windows\System32\vfwwdm32.dll (Microsoft Corporation)
    Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
    Drivers32: VIDC.I420 - C:\Windows\System32\LVCodec2.dll (Logitech Inc.)

    CREATERESTOREPOINT
    Restore point Set: OTL Restore Point

    ========== Files/Folders - Created Within 30 Days ==========

    [2012/01/01 14:33:28 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\MIKE AND STEF\Desktop\OTL.exe
    [2012/01/01 13:13:24 | 000,000,000 | ---D | C] -- C:\Users\MIKE AND STEF\AppData\Local\temp
    [2012/01/01 13:06:55 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
    [2012/01/01 12:40:45 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
    [2012/01/01 12:40:45 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
    [2012/01/01 12:40:45 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
    [2012/01/01 12:39:24 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
    [2012/01/01 12:35:10 | 000,000,000 | ---D | C] -- C:\Qoobox
    [2012/01/01 12:22:47 | 000,000,000 | ---D | C] -- C:\Config.Msi
    [2012/01/01 12:20:05 | 004,359,888 | R--- | C] (Swearware) -- C:\Users\MIKE AND STEF\Desktop\ComboFix.exe
    [2012/01/01 11:57:40 | 004,702,720 | ---- | C] (AVAST Software) -- C:\Users\MIKE AND STEF\Desktop\aswMBR.exe
    [2011/12/31 20:09:11 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\MIKE AND STEF\Desktop\dds.scr
    [2011/12/29 19:25:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CCleaner
    [2011/12/29 19:25:34 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
    [2011/12/29 19:05:19 | 000,000,000 | ---D | C] -- C:\Users\MIKE AND STEF\AppData\Roaming\Malwarebytes
    [2011/12/29 19:05:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
    [2011/12/29 19:05:09 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2011/12/29 19:05:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
    [2011/12/29 19:05:08 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
    [2011/12/29 13:12:22 | 000,000,000 | ---D | C] -- C:\ee080bf5dced262ea3d85d1d85864b
    [2011/12/29 09:09:48 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy 2
    [2008/12/14 21:24:36 | 000,047,360 | ---- | C] (VSO Software) -- C:\Users\MIKE AND STEF\AppData\Roaming\pcouffin.sys
    [3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

    ========== Files - Modified Within 30 Days ==========

    [2012/01/01 14:33:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\MIKE AND STEF\Desktop\OTL.exe
    [2012/01/01 13:12:15 | 000,617,226 | ---- | M] () -- C:\Windows\System32\perfh009.dat
    [2012/01/01 13:12:15 | 000,108,360 | ---- | M] () -- C:\Windows\System32\perfc009.dat
    [2012/01/01 13:06:44 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
    [2012/01/01 13:04:56 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
    [2012/01/01 13:04:56 | 000,003,744 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
    [2012/01/01 13:04:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
    [2012/01/01 12:39:40 | 004,359,888 | R--- | M] (Swearware) -- C:\Users\MIKE AND STEF\Desktop\ComboFix.exe
    [2012/01/01 12:19:30 | 000,000,512 | ---- | M] () -- C:\Users\MIKE AND STEF\Desktop\MBR.dat
    [2012/01/01 11:57:41 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Users\MIKE AND STEF\Desktop\aswMBR.exe
    [2011/12/31 20:09:11 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\MIKE AND STEF\Desktop\dds.scr
    [2011/12/31 20:00:53 | 000,302,592 | ---- | M] () -- C:\Users\MIKE AND STEF\Desktop\0vrl1ee3.exe
    [2011/12/31 19:38:36 | 319,369,138 | ---- | M] () -- C:\Windows\MEMORY.DMP
    [2011/12/29 19:25:35 | 000,000,810 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
    [2011/12/29 19:05:11 | 000,000,912 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2011/12/29 12:48:00 | 000,001,356 | ---- | M] () -- C:\Users\MIKE AND STEF\AppData\Local\d3d9caps.dat
    [2011/12/29 09:37:22 | 000,004,979 | ---- | M] () -- C:\Windows\wininit.ini
    [2011/12/28 21:49:28 | 000,000,944 | ---- | M] () -- C:\Users\MIKE AND STEF\Application Data\Microsoft\Internet Explorer\Quick Launch\Windows Media Player.lnk
    [2011/12/16 03:25:57 | 000,354,128 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
    [2011/12/10 15:24:06 | 000,020,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
    [2011/12/08 20:01:03 | 000,018,618 | ---- | M] () -- C:\Users\MIKE AND STEF\Desktop\388998_305459449473515_100000283879147_1191554_368724373_n.jpg
    [2011/12/04 12:22:57 | 000,075,687 | ---- | M] () -- C:\Users\MIKE AND STEF\Desktop\380435_2270786768639_1217712501_31919267_994100138_n.jpg
    [3 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]

    ========== Files Created - No Company Name ==========

    [2012/01/01 12:40:45 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
    [2012/01/01 12:40:45 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
    [2012/01/01 12:40:45 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
    [2012/01/01 12:40:45 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
    [2012/01/01 12:40:45 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
    [2012/01/01 12:19:30 | 000,000,512 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\MBR.dat
    [2011/12/31 20:00:53 | 000,302,592 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\0vrl1ee3.exe
    [2011/12/31 19:38:36 | 319,369,138 | ---- | C] () -- C:\Windows\MEMORY.DMP
    [2011/12/29 19:25:35 | 000,000,810 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
    [2011/12/29 19:05:11 | 000,000,912 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
    [2011/12/14 15:33:27 | 000,987,168 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2020.JPG
    [2011/12/08 20:06:46 | 000,018,618 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\388998_305459449473515_100000283879147_1191554_368724373_n.jpg
    [2011/12/05 16:33:43 | 000,708,414 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2016.JPG
    [2011/12/05 16:33:43 | 000,667,100 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2013.JPG
    [2011/12/05 16:33:43 | 000,661,949 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2017.JPG
    [2011/12/05 16:33:43 | 000,647,516 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2015.JPG
    [2011/12/05 16:33:43 | 000,643,023 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2014.JPG
    [2011/12/05 16:33:43 | 000,577,184 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2018.JPG
    [2011/12/05 16:33:43 | 000,519,982 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\100_2019.JPG
    [2011/12/04 12:23:17 | 000,075,687 | ---- | C] () -- C:\Users\MIKE AND STEF\Desktop\380435_2270786768639_1217712501_31919267_994100138_n.jpg
    [2011/02/27 08:47:23 | 000,000,462 | ---- | C] () -- C:\Program Files\022720118472297.bat
    [2011/01/25 17:00:17 | 000,165,842 | ---- | C] () -- C:\Windows\hpoins31.dat.temp
    [2011/01/25 17:00:17 | 000,001,691 | ---- | C] () -- C:\Windows\hpomdl31.dat.temp
    [2011/01/25 16:17:13 | 000,166,315 | ---- | C] () -- C:\Windows\hpoins31.dat
    [2010/11/06 09:40:10 | 000,082,289 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
    [2010/06/10 10:56:09 | 000,004,979 | ---- | C] () -- C:\Windows\wininit.ini
    [2010/03/19 12:26:37 | 000,023,115 | ---- | C] () -- C:\Windows\hpqins15.dat
    [2010/01/22 14:09:19 | 000,015,312 | ---- | C] () -- C:\Windows\System32\RaCoInst.dat
    [2009/12/10 10:27:33 | 000,077,379 | ---- | C] () -- C:\Windows\hpqins05.dat
    [2009/10/07 00:46:36 | 000,025,752 | ---- | C] () -- C:\Windows\System32\drivers\LVPr2Mon.sys
    [2009/10/07 00:23:08 | 000,013,584 | ---- | C] () -- C:\Windows\System32\drivers\iKeyLFT2.dll
    [2009/09/23 17:52:10 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
    [2009/09/23 17:52:09 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
    [2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\Windows\System32\OGACheckControl.dll
    [2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\Windows\System32\OGAEXEC.exe
    [2009/02/03 17:07:03 | 000,027,648 | ---- | C] () -- C:\Windows\System32\essfaxpm.dll
    [2009/02/03 16:18:47 | 000,004,900 | ---- | C] () -- C:\ProgramData\tuhpttzl.his
    [2009/01/12 12:20:14 | 000,031,007 | ---- | C] () -- C:\Users\MIKE AND STEF\AppData\Roaming\UserTile.png
    [2008/12/14 21:24:36 | 000,007,887 | ---- | C] () -- C:\Users\MIKE AND STEF\AppData\Roaming\pcouffin.cat
    [2008/12/14 21:24:36 | 000,001,144 | ---- | C] () -- C:\Users\MIKE AND STEF\AppData\Roaming\pcouffin.inf
    [2008/10/09 19:55:29 | 000,000,002 | ---- | C] () -- C:\Windows\msoffice.ini
    [2008/10/07 13:02:13 | 000,000,488 | ---- | C] () -- C:\Users\MIKE AND STEF\AppData\Roaming\wklnhst.dat
    [2008/08/02 11:18:46 | 000,013,824 | ---- | C] () -- C:\Users\MIKE AND STEF\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
    [2008/07/28 22:15:00 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
    [2008/07/22 16:40:33 | 000,000,861 | ---- | C] () -- C:\Windows\aolback.exe.lnk
    [2008/07/22 11:57:32 | 000,001,356 | ---- | C] () -- C:\Users\MIKE AND STEF\AppData\Local\d3d9caps.dat
    [2008/07/21 22:17:32 | 000,000,335 | ---- | C] () -- C:\Windows\nsreg.dat
    [2008/06/17 04:23:21 | 000,001,691 | ---- | C] () -- C:\Windows\hpomdl31.dat
    [2008/05/09 23:41:09 | 000,691,481 | ---- | C] () -- C:\Windows\unins000.exe
    [2008/05/09 23:41:09 | 000,001,446 | ---- | C] () -- C:\Windows\unins000.dat
    [2008/05/09 23:17:56 | 000,327,680 | ---- | C] () -- C:\Windows\System32\pythoncom25.dll
    [2008/05/09 23:17:56 | 000,102,400 | ---- | C] () -- C:\Windows\System32\pywintypes25.dll
    [2006/11/02 07:53:49 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
    [2006/11/02 07:44:53 | 000,354,128 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
    [2006/11/02 05:33:01 | 000,617,226 | ---- | C] () -- C:\Windows\System32\perfh009.dat
    [2006/11/02 05:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
    [2006/11/02 05:33:01 | 000,108,360 | ---- | C] () -- C:\Windows\System32\perfc009.dat
    [2006/11/02 05:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
    [2006/11/02 05:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
    [2006/11/02 03:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
    [2006/11/02 03:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
    [2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
    [2006/11/02 02:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat

    ========== LOP Check ==========

    [2008/11/26 08:02:24 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\Pogo Games
    [2008/11/24 13:29:08 | 000,000,000 | ---D | M] -- C:\Users\Guest\AppData\Roaming\Snapfish
    [2010/08/18 16:05:52 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\AVG9
    [2011/12/29 19:36:14 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\FrostWire
    [2008/07/22 14:50:05 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\iWin
    [2010/11/06 09:46:44 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Leadertech
    [2008/12/31 23:19:04 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\LimeWire
    [2010/03/13 18:51:15 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Merscom
    [2008/07/22 17:13:05 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\MSNInstaller
    [2011/02/27 08:45:37 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Oberon Media
    [2011/07/22 11:16:19 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\OpenOffice.org
    [2009/02/04 18:42:45 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Pogo Games
    [2009/10/06 14:27:50 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Princess Isabella
    [2011/03/06 16:22:54 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Snapfish
    [2008/10/07 13:02:17 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Template
    [2010/06/08 19:45:22 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Uniblue
    [2011/03/24 18:52:16 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Vso
    [2008/07/22 14:49:23 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\WildTangent
    [2008/07/22 22:09:15 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\WinBatch
    [2012/01/01 13:03:47 | 000,032,644 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

    ========== Purity Check ==========



    ========== Custom Scans ==========


    < %SYSTEMDRIVE%\*.* >
    [2008/05/09 23:40:56 | 000,000,074 | ---- | M] () -- C:\autoexec.bat
    [2009/04/11 01:36:36 | 000,333,257 | RHS- | M] () -- C:\bootmgr
    [2008/05/10 00:08:37 | 000,008,192 | R-S- | M] () -- C:\BOOTSECT.BAK
    [2012/01/01 13:13:22 | 000,013,419 | ---- | M] () -- C:\ComboFix.txt
    [2006/09/18 16:43:37 | 000,000,010 | ---- | M] () -- C:\config.sys
    [2009/11/18 14:50:45 | 000,000,250 | ---- | M] () -- C:\FINIS_IT.TXT
    [2008/10/31 09:13:21 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
    [2008/07/28 20:56:50 | 000,000,646 | -H-- | M] () -- C:\IPH.PH
    [2008/10/31 09:13:21 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
    [2009/04/03 09:18:23 | 000,000,895 | ---- | M] () -- C:\net_save.dna
    [2012/01/01 13:04:45 | 3935,903,744 | -HS- | M] () -- C:\pagefile.sys
    [2010/06/11 21:55:38 | 000,060,312 | ---- | M] () -- C:\report.txt
    [2008/10/27 11:16:21 | 000,000,574 | ---- | M] () -- C:\RHDSetup.log

    < %systemroot%\Fonts\*.com >
    [2006/11/02 07:35:34 | 000,026,040 | ---- | M] () -- C:\Windows\Fonts\GlobalMonospace.CompositeFont
    [2006/11/02 07:35:34 | 000,026,489 | ---- | M] () -- C:\Windows\Fonts\GlobalSansSerif.CompositeFont
    [2006/11/02 07:35:34 | 000,029,779 | ---- | M] () -- C:\Windows\Fonts\GlobalSerif.CompositeFont
    [2009/09/25 09:48:32 | 000,037,665 | ---- | M] () -- C:\Windows\Fonts\GlobalUserInterface.CompositeFont

    < %systemroot%\Fonts\*.dll >

    < %systemroot%\Fonts\*.ini >
    [2006/09/18 16:37:34 | 000,000,065 | ---- | M] () -- C:\Windows\Fonts\desktop.ini

    < %systemroot%\Fonts\*.ini2 >

    < %systemroot%\Fonts\*.exe >

    < %systemroot%\system32\spool\prtprocs\w32x86\*.* >
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\10_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\11_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\1_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\2_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\3_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\4_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\5_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\6_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\7_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\8_hpzpp692.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\9_hpzpp692.dll
    [2007/03/28 12:57:34 | 000,274,944 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\hpzpp5ha.dll
    [2008/06/06 20:49:18 | 000,302,592 | ---- | M] (Hewlett-Packard Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\hpzpp692.dll
    [2006/10/26 18:56:12 | 000,033,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\spool\prtprocs\w32x86\msonpppr.dll

    < %systemroot%\REPAIR\*.bak1 >

    < %systemroot%\REPAIR\*.ini >

    < %systemroot%\system32\*.jpg >

    < %systemroot%\*.jpg >

    < %systemroot%\*.png >

    < %systemroot%\*.scr >

    < %systemroot%\*._sy >

    < %APPDATA%\Adobe\Update\*.* >

    < %ALLUSERSPROFILE%\Favorites\*.* >

    < %APPDATA%\Microsoft\*.* >

    < %PROGRAMFILES%\*.* >
    [2011/02/27 08:47:23 | 000,000,462 | ---- | M] () -- C:\Program Files\022720118472297.bat
    [2008/01/20 21:57:01 | 000,000,174 | -HS- | M] () -- C:\Program Files\desktop.ini

    < %APPDATA%\Update\*.* >

    < %systemroot%\*. /mp /s >

    < %systemroot%\System32\config\*.sav >
    [2008/01/20 22:31:11 | 015,716,352 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
    [2008/01/20 22:31:01 | 000,102,400 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
    [2008/01/20 22:31:12 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
    [2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
    [2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV

    < %PROGRAMFILES%\bak. /s >

    < %systemroot%\system32\bak. /s >

    < %ALLUSERSPROFILE%\Start Menu\*.lnk /x >

    < %systemroot%\system32\config\systemprofile\*.dat /x >

    < %systemroot%\*.config >

    < %systemroot%\system32\*.db >

    < %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
    [2011/12/28 21:49:28 | 000,000,350 | -HS- | M] () -- C:\Users\MIKE AND STEF\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini

    < %USERPROFILE%\Desktop\*.exe >
    [2011/12/31 20:00:53 | 000,302,592 | ---- | M] () -- C:\Users\MIKE AND STEF\Desktop\0vrl1ee3.exe
    [2012/01/01 11:57:41 | 004,702,720 | ---- | M] (AVAST Software) -- C:\Users\MIKE AND STEF\Desktop\aswMBR.exe
    [2012/01/01 12:39:40 | 004,359,888 | R--- | M] (Swearware) -- C:\Users\MIKE AND STEF\Desktop\ComboFix.exe
    [2012/01/01 14:33:28 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\MIKE AND STEF\Desktop\OTL.exe

    < %PROGRAMFILES%\Common Files\*.* >

    < %systemroot%\*.src >

    < %systemroot%\install\*.* >

    < %systemroot%\system32\DLL\*.* >

    < %systemroot%\system32\HelpFiles\*.* >

    < %systemroot%\system32\rundll\*.* >

    < %systemroot%\winn32\*.* >

    < %systemroot%\Java\*.* >

    < %systemroot%\system32\test\*.* >

    < %systemroot%\system32\Rundll32\*.* >

    < %systemroot%\AppPatch\Custom\*.* >

    < %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

    < %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

    < %PROGRAMFILES%\Internet Explorer\*.tmp >

    < %PROGRAMFILES%\Internet Explorer\*.dat >

    < %USERPROFILE%\My Documents\*.exe >

    < %USERPROFILE%\*.exe >

    < %systemroot%\ADDINS\*.* >

    < %systemroot%\assembly\*.bak2 >

    < %systemroot%\Config\*.* >

    < %systemroot%\REPAIR\*.bak2 >

    < %systemroot%\SECURITY\Database\*.sdb /x >

    < %systemroot%\SYSTEM\*.bak2 >

    < %systemroot%\Web\*.bak2 >

    < %systemroot%\Driver Cache\*.* >

    < %PROGRAMFILES%\Mozilla Firefox\0*.exe >

    < %ProgramFiles%\Microsoft Common\*.* >

    < %ProgramFiles%\TinyProxy. >

    < %USERPROFILE%\Favorites\*.url /x >
    [2008/07/21 21:09:08 | 000,000,402 | -HS- | M] () -- C:\Users\MIKE AND STEF\Favorites\desktop.ini

    < %systemroot%\system32\*.bk >

    < %systemroot%\*.te >

    < %systemroot%\system32\system32\*.* >

    < %ALLUSERSPROFILE%\*.dat /x >
    [2011/01/25 17:00:59 | 000,008,956 | ---- | M] () -- C:\ProgramData\hpzinstall.log
    [2009/02/03 16:18:47 | 000,004,900 | ---- | M] () -- C:\ProgramData\tuhpttzl.his

    < %systemroot%\system32\drivers\*.rmv >

    < dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

    < dir /b "%systemroot%\*.exe" | find /i " " /c >

    < %PROGRAMFILES%\Microsoft\*.* >

    < %systemroot%\System32\Wbem\proquota.exe >

    < %PROGRAMFILES%\Mozilla Firefox\*.dat >

    < %USERPROFILE%\Cookies\*.txt /x >

    < %SystemRoot%\system32\fonts\*.* >

    < %systemroot%\system32\winlog\*.* >

    < %systemroot%\system32\Language\*.* >

    < %systemroot%\system32\Settings\*.* >

    < %systemroot%\system32\*.quo >

    < %SYSTEMROOT%\AppPatch\*.exe >

    < %SYSTEMROOT%\inf\*.exe >

    < %SYSTEMROOT%\Installer\*.exe >

    < %systemroot%\system32\config\*.bak2 >

    < %systemroot%\system32\Computers\*.* >

    < %SystemRoot%\system32\Sound\*.* >

    < %SystemRoot%\system32\SpecialImg\*.* >

    < %SystemRoot%\system32\code\*.* >

    < %SystemRoot%\system32\draft\*.* >

    < %SystemRoot%\system32\MSSSys\*.* >

    < %ProgramFiles%\Javascript\*.* >

    < %systemroot%\pchealth\helpctr\System\*.exe /s >

    < %systemroot%\Web\*.exe >

    < %systemroot%\system32\msn\*.* >

    < %systemroot%\system32\*.tro >

    < %AppData%\Microsoft\Installer\msupdates\*.* >

    < %ProgramFiles%\Messenger\*.* >

    < %systemroot%\system32\systhem32\*.* >

    < %systemroot%\system\*.exe >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

    < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


    < >

    ========== Alternate Data Streams ==========

    @Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:8DCF53BE
    @Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:5D9A374E
    @Alternate Data Stream - 187 bytes -> C:\ProgramData\TEMP:5E358F67
    @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:07348C09
    @Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:1E66EE85
    @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:8C885EDD
    @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:9B7E8561
    @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:91CF76E3
    @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0B4227B4

    < End of report >
     
  8. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    otl log 2 of 2

    OTL Extras logfile created on: 1/1/2012 2:36:13 PM - Run 1
    OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\MIKE AND STEF\Desktop
    Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
    Internet Explorer (Version = 9.0.8112.16421)
    Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

    3.37 Gb Total Physical Memory | 2.35 Gb Available Physical Memory | 69.69% Memory free
    6.96 Gb Paging File | 6.05 Gb Available in Paging File | 86.86% Paging File free
    Paging file location(s): ?:\pagefile.sys [binary data]

    %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
    Drive C: | 139.40 Gb Total Space | 33.56 Gb Free Space | 24.08% Space Free | Partition Type: NTFS
    Drive D: | 9.65 Gb Total Space | 1.29 Gb Free Space | 13.38% Space Free | Partition Type: NTFS

    Computer Name: STEFANIE | User Name: MIKE AND STEF | Logged in as Administrator.
    Boot Mode: Normal | Scan Mode: All users | Quick Scan
    Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

    ========== Extra Registry (SafeList) ==========


    ========== File Associations ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
    .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

    ========== Shell Spawning ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
    batfile [open] -- "%1" %*
    cmdfile [open] -- "%1" %*
    comfile [open] -- "%1" %*
    cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
    exefile [open] -- "%1" %*
    helpfile [open] -- Reg Error: Key error.
    hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
    piffile [open] -- "%1" %*
    regfile [merge] -- Reg Error: Key error.
    scrfile [config] -- "%1"
    scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
    scrfile [open] -- "%1" /S
    txtfile [edit] -- Reg Error: Key error.
    Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
    Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
    Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
    Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
    Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
    Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

    ========== Security Center Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
    "cval" = 1
    "FirewallDisableNotify" = 0
    "AntiVirusDisableNotify" = 0
    "UpdatesDisableNotify" = 0

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
    "DisableMonitoring" = 1

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
    "AntiVirusOverride" = 0
    "AntiSpywareOverride" = 0
    "FirewallOverride" = 0
    "VistaSp1" = Reg Error: Unknown registry data type -- File not found
    "VistaSp2" = Reg Error: Unknown registry data type -- File not found

    ========== System Restore Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
    "DisableSR" = 0

    ========== Firewall Settings ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
    "EnableFirewall" = 1
    "DisableNotifications" = 0

    ========== Authorized Applications List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


    ========== Vista Active Open Ports Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{10DDE8C8-F91B-446C-A6B4-EF5D865086DA}" = lport=138 | protocol=17 | dir=in | app=system |
    "{19A47E26-143F-4651-A21B-1FEB2CD9F468}" = lport=137 | protocol=17 | dir=in | app=system |
    "{3B4B6946-ABB2-4976-83DC-1B177DDBBEA7}" = lport=139 | protocol=6 | dir=in | app=system |
    "{3C1FBBBF-BE22-4428-B0C4-7687DD12F6BC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{3E26A63B-4192-456C-A2AC-B7C70D14D412}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
    "{4C73DD41-46DC-4F5F-AB97-E2ABE14F4931}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{50DC9AF5-EB94-4F77-9211-74F0493DEB94}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{57A08AE9-0553-4F22-8012-552A86168BCD}" = rport=137 | protocol=17 | dir=out | app=system |
    "{5B0952E9-ECF5-406F-A9DA-6BE1ACFA606A}" = rport=139 | protocol=6 | dir=out | app=system |
    "{61837ECC-1FD8-4B61-986E-8D424720BE26}" = rport=10243 | protocol=6 | dir=out | app=system |
    "{67536779-F77A-475F-A535-0483C1F2AF52}" = rport=427 | protocol=17 | dir=in | svc=hpslpsvc | app=c:\windows\system32\svchost.exe |
    "{6A7A09B8-A03D-4AC3-861D-D3E9160F3434}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
    "{6B81D448-3294-4C61-8380-227028F47B12}" = rport=138 | protocol=17 | dir=out | app=system |
    "{884ECB4C-5F09-42B8-BF48-AC7F425EF626}" = rport=445 | protocol=6 | dir=out | app=system |
    "{AD888854-359E-4C6F-9FBE-CB666C8D045F}" = lport=2869 | protocol=6 | dir=in | app=system |
    "{AF14FC1D-D8B6-4876-9090-54DFF88B767A}" = lport=10243 | protocol=6 | dir=in | app=system |
    "{CEB47B6B-29AE-4A50-B9B3-5EB7A241CAAA}" = lport=445 | protocol=6 | dir=in | app=system |
    "{CFD0A0C9-E0EF-4BD6-98F9-5F34D30A0DA7}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
    "{E5E6849B-00CF-4B8D-9A18-E124A8E356DB}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
    "{F73E07FE-A1A2-41B9-8065-20ECE570B19A}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |

    ========== Vista Active Application Exception List ==========

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
    "{080E8B6C-9556-47E8-BB1D-69B0FCB62231}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqsudi.exe |
    "{0C3AC3ED-A21B-4CE3-8A27-031E6883F270}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
    "{0E46423E-2583-4B28-8575-36507A21F07D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{104BF9A3-0985-4BF9-BBFD-B9D7A574B91B}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
    "{108CE07B-4E81-40B8-80C6-A1EEFF2DF117}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
    "{108E65CC-DA2D-4FB4-AF21-E13A8561B88D}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{10B18C4C-108C-4365-946D-85C3552C3BFC}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{14088D1F-30B7-4968-B4B6-985D47236C64}" = dir=in | app=c:\program files\hp\digital imaging\smart web printing\smartwebprintexe.exe |
    "{1ABBC609-AC0D-4912-B236-509336536EF7}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
    "{287D268D-1ACE-4421-900F-09462297F3E6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{28ADEDE1-A4D5-42D8-9B05-BF7C283C4059}" = protocol=6 | dir=in | app=c:\windows\system32\svchost.exe |
    "{28ADEDE1-A4D5-42D8-9B05-BF7C283C4060}" = protocol=6 | dir=out | app=c:\windows\system32\svchost.exe |
    "{29B576D8-F4C3-42EC-92AF-83C388050226}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
    "{2A53B24F-1903-4188-B2C7-1A05E2EEAAB0}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
    "{3800A602-03C6-4DFA-8329-462FB29E5C45}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{38465501-9112-44B8-8314-6451649A17E8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpsapp.exe |
    "{3A35C346-FD0B-4283-8369-03CF57C07CEC}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
    "{3B0194CD-E151-4084-B76B-1D9579E45DCA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{3BD4EACE-D721-439B-9994-87AFFE21AE6F}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe |
    "{41C13D98-56CE-4049-86EF-6D9553772DAB}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{42FAED9C-263B-4B4F-894A-A31582763E33}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
    "{48988340-1B98-4E0F-A856-77A0B0B22A8F}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
    "{4D935C4D-3B2E-456D-9324-017A8609B5D8}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
    "{4F062144-8B2A-4A2E-BCC4-CE769F5B1A34}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
    "{55CDAE81-726D-410F-AC79-1F15BE562D16}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "{592E6271-3855-4BAD-8AF1-E645C61BDE54}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
    "{5C74627E-B067-4531-9AA0-D9FCC57604D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{5CD58129-DF0F-4133-9A31-AE78FC05D6A0}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
    "{6A35EFC6-F74B-43B8-8393-5ABE981E12BB}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
    "{6BEC5917-F7AF-4E13-8387-4D12A1BE1D5A}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
    "{6D35CF0C-7C21-4DC2-AB84-9194336C0719}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
    "{713B16F5-A182-4D30-9B6E-C4317C253348}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgemcx.exe |
    "{7160BBFF-FEDF-41BB-8EAA-1B90CBC102B9}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
    "{7F718FA5-898F-42F6-8A5A-CDBC0720A547}" = dir=in | app=e:\setup\hpznui01.exe |
    "{8110B969-B9BC-4A09-89D6-74605CCA6233}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
    "{86A5A10A-30AD-4A80-B07F-98C4C954152A}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
    "{88CFCEBA-3A31-4AA8-A2E9-8CE0BB508D33}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
    "{88ED7E5B-174C-40C8-865D-A764F23EB99D}" = protocol=6 | dir=out | app=system |
    "{8A2276C7-8981-4318-B0B5-2E823BE11939}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
    "{8D6262AD-1B9D-41F9-8F46-CDFF311E6E7C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{8D694A1D-5C1C-45D7-9F9C-3E49FCF20725}" = dir=in | app=c:\program files\hp\dvdplay\dpservice.exe |
    "{90D336F3-2546-4B0A-AB27-D100724B72E9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{9292D46B-5279-42D8-9F7E-5945D0AA2F51}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
    "{93BBA1FB-4477-4FB5-8AF9-C06CEDBFF451}" = dir=in | app=c:\program files\common files\hp\digital imaging\bin\hpqphotocrm.exe |
    "{9AD932E3-21F7-40E1-80C4-74F3AA95E521}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
    "{A0F3010C-EDED-448F-BA34-A7C4F648124F}" = dir=in | app=c:\program files\hp\dvdplay\dvdplay.exe |
    "{A4E96005-55E0-4B33-B021-8D1D6D73A9C2}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
    "{AF32FC23-560F-4232-AFC3-DE8DA80563EA}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
    "{B1E6CBCD-782B-42A9-AE02-B9F72C68FAE3}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
    "{B2ACAD48-43C1-4FEE-97C1-44D7213AD682}" = dir=in | app=c:\program files\hp\hp software update\hpwucli.exe |
    "{B4C4B385-713A-40C0-82BD-7B0B557F4D83}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgnsx.exe |
    "{B600168D-2B0E-42A4-9055-7549003436FE}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
    "{B78AED0F-63FD-40A8-AF9A-9581015EEE6D}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{B7E9FF5F-F78A-49F4-812C-C957BF90C550}" = protocol=6 | dir=in | app=c:\program files\frostwire\frostwire.exe |
    "{BA0E4478-985A-4A5A-9AF2-8E8576BCC895}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
    "{BAFA928D-5525-47C5-9D1D-B0B4A373F5E9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
    "{BF40287B-0513-44E4-9B21-8A6E80F595F0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgh.exe |
    "{C0EC4E4E-D1E9-43F0-AF44-63652850BCB1}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
    "{C4FFC536-C130-4341-90BE-69C2591C7540}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
    "{C78CCB78-3C88-4AA4-A35E-FA847009A48C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqpse.exe |
    "{CA065EF2-5AA2-45B1-8ACB-C8605681BE9D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqusgm.exe |
    "{DB836D3A-8670-4479-86D8-4BB18D2B617F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
    "{DD3DA7E0-3FEE-47AA-94FA-D84DD1EC5DBC}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
    "{DE6DDE36-51B3-4F4F-8116-783CE87AF83C}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
    "{DFCA7FDD-F853-4BBD-BCB1-46B728EE6CC0}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
    "{E56F5355-41BD-4A9D-AF5F-D9CC29BC26D3}" = protocol=6 | dir=in | app=c:\program files\avg\avg10\avgdiagex.exe |
    "{EC79F3D8-50D5-4C4A-AB36-DFBF1229BD3D}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
    "{F680E8F2-05DD-4060-A255-772C9E983F47}" = protocol=17 | dir=in | app=c:\program files\avg\avg10\avgmfapx.exe |
    "{F8D198CC-9138-48E0-835A-F8CDE9F185CE}" = protocol=17 | dir=in | app=c:\program files\frostwire\frostwire.exe |
    "{F91CDE6A-7D19-4A9C-92E4-ECCAB5CA0F21}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
    "{FA7E2342-CDDF-4873-B8C8-055875F51318}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
    "{FE42A5B6-D72E-4F6C-BF10-5FF439D41A82}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
    "TCP Query User{16F313A4-9040-4DE3-AC4C-55493E8A3314}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
    "TCP Query User{C4B0A11A-6851-4853-93E6-285E28EBECD2}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "UDP Query User{2353F63F-FBF0-477B-A5B5-5E37C6B55138}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
    "UDP Query User{9A02037C-8BED-4EAB-B9C9-F54426EDCEB0}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |

    ========== HKEY_LOCAL_MACHINE Uninstall List ==========

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
    "{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
    "{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
    "{09633A5E-3089-41A8-9FF1-382171423C5D}" = PSSWCORE
    "{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
    "{0C34B801-6AEC-4667-B053-03A67E2D0415}" = Apple Application Support
    "{15B8AFD9-92E9-4E86-96D9-83FAC510B82E}" = HPPhotoSmartPhotobookWebPack1
    "{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
    "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
    "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite Deluxe
    "{22F761D1-8063-4170-ADF7-2D2F47834CA9}" = VideoToolkit01
    "{254C37AA-6B72-4300-84F6-98A82419187E}" = Hewlett-Packard Active Check for Health Check
    "{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
    "{26A24AE4-039D-4CA4-87B4-2F83216016F0}" = Java(TM) 6 Update 16
    "{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
    "{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 26
    "{27197499-7680-4208-8FD8-5439CDB0FDC1}" = HPProductAssistant
    "{2AFEAA03-2DFE-4519-A629-EDAB6541ABE9}" = HPSSupply
    "{305D4B08-5807-4475-B1C8-D54685534864}" = LightScribeTemplateLabeler
    "{32622F02-640A-4335-86FF-557325DC39D4}" = PS_AIO_04_C6300_Software_Min
    "{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
    "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
    "{3E171899-0175-47CC-84C4-562ACDD4C021}" = OpenOffice.org 3.3
    "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = Power2Go
    "{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
    "{44F3AD4C-D8A0-40DD-94A1-7443BE9953C7}_is1" = HP Demo
    "{45D707E9-F3C4-11D9-A373-0050BAE317E1}" = DVD Play
    "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
    "{4A3D0CF8-60FF-4CEF-91A4-A1F001424602}" = DocProc
    "{4E7C28C7-D5DA-4E9F-A1CA-60490B54AE35}" = UnloadSupport
    "{54F6C98F-94A0-421C-B90E-0B6A2A96A9CF}" = Pure Networks Platform
    "{593A6CAF-E114-4e31-884F-74FF349E8E36}" = SolutionCenter
    "{64C85B95-E971-4705-B3ED-D4A0153C0D5B}" = SAMSUNG USB Driver for Mobile Phones V5.2.0.0
    "{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
    "{669D4A35-146B-4314-89F1-1AC3D7B88367}" = Hewlett-Packard Asset Agent for Health Check
    "{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
    "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
    "{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
    "{7059BDA7-E1DB-442C-B7A1-6144596720A4}" = HP Update
    "{70E1E357-E57C-4284-B04E-58196DC27BC1}" = PanoStandAlone
    "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
    "{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    "{7BD42C12-74D1-4804-B24D-D21E25D4E3CF}" = PS_AIO_04_C6300_ProductContext
    "{7F10292C-A190-4176-A665-A1ED3478DF86}" = LightScribe System Software
    "{8111C33A-87E8-49CA-BB38-9E7FAA568D68}" = SamsungSimpleDL
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-117629560}" = Princess Isabella A Witch’s Curse
    "{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-119154157}" = Plants vs Zombies - Game of The Year
    "{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    "{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
    "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
    "{8FF6F5CA-4E30-4E3B-B951-204CAAA2716A}" = SmartWebPrinting
    "{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
    "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007
    "{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007
    "{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007
    "{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
    "{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
    "{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007
    "{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
    "{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
    "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007
    "{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007
    "{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007
    "{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
    "{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2)
    "{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581)
    "{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
    "{99832252-D489-4276-B961-6D505CF0AFAA}" = PS_AIO_04_C6300_Software
    "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    "{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
    "{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
    "{9F4EE72A-C5C9-42ad-ABEF-427690843577}" = MarketResearch
    "{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
    "{A3723EB8-255B-4A2D-9831-0752C0D06FF6}_is1" = EssentialFax
    "{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}" = QuickTime
    "{A90C03D6-08E1-4C59-B93B-6919A6C0AC19}" = TSP_CODEC
    "{AA2E8A46-B45E-4aea-8A23-88AB57D04523}" = WebReg
    "{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}" = Apple Mobile Device Support
    "{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
    "{AC76BA86-7AD7-1033-7B44-A83000000003}" = Adobe Reader 8.3.1
    "{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
    "{BCE72AED-3332-4863-9567-C5DCB9052CA2}" = Netflix Movie Viewer
    "{BF08AB1C-3357-4f20-A200-8EBB8EF27C59}" = BufferChm
    "{C27BC2A2-30DD-4014-B22E-63EB0DB572F9}" = Logitech Webcam Software
    "{C27C82E4-9C53-4D76-9ED3-A01A3D5EE679}" = HP Customer Experience Enhancements
    "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = LabelPrint
    "{C8732DC3-1736-44b2-B741-2D636DE58605}" = HP Photosmart C6300 All-In-One Driver Software 11.0 Rel .4
    "{C89B5E3A-690F-4CEE-909A-BF869E198B0A}" = Scan
    "{C9D88AF8-7B0A-4200-BFBC-7827A7535096}" = F4100_doccd
    "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
    "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
    "{D16B4BE6-8B10-422f-8034-96D1CA9483B5}" = GPBaseService
    "{D74CFE48-087F-46E1-80E6-E2950E1A8DCE}" = HP Photosmart Essential 2.5
    "{DA34FE93-5DC5-48E0-ACC8-A5389E05BB51}" = iTunes
    "{E0810CC2-4B5B-4439-B1D0-452306AF2D64}" = HP Active Support Library
    "{E535C94A-B87F-4182-BEA8-1E9322078D3E}" = Cards_Calendar_OrderGift_DoMorePlugout
    "{E96B0085-6659-486b-A221-5042A042728D}" = Toolbox
    "{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
    "{EF9E56EE-0243-4BAD-88F4-5E7508AA7D96}" = Destination Component
    "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
    "{F95F178B-56AD-4fab-87F8-FA81E66C7D68}" = Network
    "{FA3B34BE-4246-4062-90A3-34CBBEA12B72}" = HPTCSSetup
    "{FDDB69BB-2F9A-4830-A579-ABBB7C5AF9A8}" = muvee autoProducer 6.1
    "Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
    "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
    "CCleaner" = CCleaner
    "CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
    "DVDFab 8 Qt_is1" = DVDFab 8.1.1.2 (08/08/2011) Qt
    "FrostWire" = FrostWire 4.21.8
    "HOMESTUDENTR" = Microsoft Office Home and Student 2007
    "HP Imaging Device Functions" = HP Imaging Device Functions 11.0
    "HP Photosmart Essential" = HP Photosmart Essential 3.0
    "HP Smart Web Printing" = HP Smart Web Printing 4.60
    "HP Solution Center & Imaging Support Tools" = HP Solution Center 11.0
    "HPExtendedCapabilities" = HP Customer Participation Program 11.0
    "HPOCR" = OCR Software by I.R.I.S. 11.0
    "InstallShield_{8111C33A-87E8-49CA-BB38-9E7FAA568D68}" = SamsungSimpleDL
    "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector
    "legacyqcam_11.10" = Logitech Legacy USB Camera Driver Package
    "Linksys Wireless Manager" = Linksys Wireless Manager
    "lvdrivers_12.10" = Logitech Webcam Software Driver Package
    "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.60.0.1800
    "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
    "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
    "NVIDIA Drivers" = NVIDIA Drivers
    "RealArcade" = RealArcade
    "Shop for HP Supplies" = Shop for HP Supplies
    "ViewpointMediaPlayer" = Viewpoint Media Player
    "WildTangent hp Master Uninstall" = My HP Games
    "Yahoo! Companion" = Yahoo! Toolbar
    "Yahoo! Messenger" = Yahoo! Messenger
    "Yahoo! Software Update" = Yahoo! Software Update

    ========== HKEY_USERS Uninstall List ==========

    [HKEY_USERS\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
    "Move Networks Player - IE" = Move Networks Media Player for Internet Explorer
    "Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.8

    ========== Last 10 Event Log Errors ==========

    [ Application Events ]
    Error - 1/27/2011 4:49:08 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:49:08 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:49:39 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:49:39 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:50:09 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:50:09 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:50:37 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:50:37 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:52:08 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    Error - 1/27/2011 4:52:08 AM | Computer Name = stefanie | Source = MsiInstaller | ID = 11606
    Description =

    [ System Events ]
    Error - 1/1/2012 2:03:28 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/1/2012 2:03:36 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7030
    Description =

    Error - 1/1/2012 2:06:31 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7023
    Description =

    Error - 1/1/2012 2:06:31 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7000
    Description =

    Error - 1/1/2012 2:06:31 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7003
    Description =

    Error - 1/1/2012 2:06:31 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7003
    Description =

    Error - 1/1/2012 2:06:31 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7003
    Description =

    Error - 1/1/2012 2:06:31 PM | Computer Name = stefanie | Source = Service Control Manager | ID = 7022
    Description =

    Error - 1/1/2012 2:07:07 PM | Computer Name = stefanie | Source = WMPNetworkSvc | ID = 866293
    Description =

    Error - 1/1/2012 2:11:22 PM | Computer Name = stefanie | Source = WMPNetworkSvc | ID = 866293
    Description =


    < End of report >
     
  9. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Please download Farbar Service Scanner and run it on the computer with the issue.
    • Make sure the following options are checked:
      • Internet Services
      • Windows Firewall
      • System Restore
      • Security Center
      • Windows Update
    • Press "Scan".
    • It will create a log (FSS.txt) in the same directory the tool is run.
    • Please copy and paste the log to your reply.
     
  10. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    fss log

    Yes it won't let me open the windows firewall at all.

    Farbar Service Scanner
    Ran by MIKE AND STEF (administrator) on 01-01-2012 at 15:05:16
    Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============
    MpsSvc Service is not running. Checking service configuration:
    Checking Start type: Attention! Unable to retrieve start type of MpsSvc. The value does not exist.
    Checking ImagePath: Attention! Unable to retrieve ImagePath of MpsSvc. The value does not exist.
    The ServiceDll of MpsSvc service is OK.
    Checking LEGACY_MpsSvc: Attention! Unable to open LEGACY_MpsSvc\0000 registry key. The key does not exist.

    bfe Service is not running. Checking service configuration:
    Checking Start type: Attention! Unable to open bfe registry key. The service key does not exist.
    Checking ImagePath: Attention! Unable to open bfe registry key. The service key does not exist.
    Checking ServiceDll: Attention! Unable to open bfe registry key. The service key does not exist.
    Checking LEGACY_bfe: Attention! Unable to open LEGACY_bfe\0000 registry key. The key does not exist.

    mpsdrv Service is not running. Checking service configuration:
    The start type of mpsdrv service is OK.
    The ImagePath of mpsdrv service is OK.


    Firewall Disabled Policy:
    ==================


    System Restore:
    ============
    SDRSVC Service is not running. Checking service configuration:
    The start type of SDRSVC service is OK.
    The ImagePath of SDRSVC service is OK.
    The ServiceDll of SDRSVC service is OK.
    Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist.

    VSS Service is not running. Checking service configuration:
    The start type of VSS service is OK.
    The ImagePath of VSS service is OK.


    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    Windows Update:
    ===========
    wuauserv Service is not running. Checking service configuration:
    The start type of wuauserv service is OK.
    Checking ImagePath: Attention! Unable to retrieve ImagePath of wuauserv. The value does not exist.
    Checking ServiceDll: Attention! Unable to open wuauserv registry key. The service key does not exist.


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB

    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F

    C:\Windows\system32\es.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F

    C:\Windows\system32\cryptsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B

    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
     
  11. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    question

    Is it ok to download the antivirus yet? Think I'm going with Avast instead of avg.
     
  12. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    If you uninstalled AVG then yes.

    Now, you have number of registry keys missing/corrupted.

    Let's start with Windows firewall...

    WARNING!
    Using internet with no active firewall poses a serious threat to your computer security.
    If you're behind a router you're fine.
    If no router is involved limit your internet activity to bare minimum.

    Following steps involve registry editing. Please create new restore point before proceeding!!!
    How to:
    XP - http://support.microsoft.com/kb/948247
    Vista and Seven - http://www.howtogeek.com/howto/wind...tore-point-for-windows-vistas-system-restore/


    Download Vista.zip file from here: http://www.smartestcomputing.us.com/files/download/9-registry-network-keys/
    Unzip the file.
    You'll find several files inside.
    Right click on bfe.reg file, click "Merge".
    Allow registry merge.
    Right click on mpssvc.reg file, click "Merge".
    Allow registry merge.

    Restart computer.

    Click Start and in "Start search" type in:
    regedit
    Press Enter.

    Registry editor will open.
    Navigate to:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\BFE
    Right click on BFE key, click "Permissions"
    Click on Add button, type Everyone and click OK.
    Now click once on Everyone
    Below, in "Permissions" pane checkmark "Alow" in "Full control" row.
    Click OK.

    In a set of files you downloaded in previous step find start_services.bat.
    Right click on it, click "Run As Administrator" to run the fix.
    Command prompt black window will pop-up for a split second and it'll disappear. That's normal.

    Check on firewall issue and post new FSS log
     
  13. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    the new fss log

    After I restart I get an error that LWS.exe has stopped working.

    Farbar Service Scanner
    Ran by MIKE AND STEF (administrator) on 01-01-2012 at 15:40:21
    Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============
    SDRSVC Service is not running. Checking service configuration:
    The start type of SDRSVC service is OK.
    The ImagePath of SDRSVC service is OK.
    The ServiceDll of SDRSVC service is OK.
    Checking LEGACY_SDRSVC: Attention! Unable to open LEGACY_SDRSVC\0000 registry key. The key does not exist.

    VSS Service is not running. Checking service configuration:
    The start type of VSS service is OK.
    The ImagePath of VSS service is OK.


    System Restore Disabled Policy:
    ========================


    Security Center:
    ============

    Windows Update:
    ===========
    wuauserv Service is not running. Checking service configuration:
    The start type of wuauserv service is OK.
    Checking ImagePath: Attention! Unable to retrieve ImagePath of wuauserv. The value does not exist.
    Checking ServiceDll: Attention! Unable to open wuauserv registry key. The service key does not exist.


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB

    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F

    C:\Windows\system32\es.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F

    C:\Windows\system32\cryptsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B

    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
     
  14. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    It looks like Logitech Webcam.
    It may come back on next restart.

    Is Windows firewall working now?
     
  15. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    Yes :)

    the fire wall and media/file sharing are back working..Thanks awesome you rock and I will be making a donation on payday..:)
     
  16. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    I'm glad to hear good news but we're not done yet.
    I need to check your Combofix log and then you have some other registry keys missing.
    Hold on...
     
  17. Broni

    Broni Malware Annihilator Posts: 52,915   +344

  18. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    ok

    ok one merged but the other gives me and error that says...Can not import C:\Users\Mike and Stef\Desktop\legacy_sdrsvc.reg: Error accessing the registry
     
  19. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    Ooops...sorry about it.

    Please go to Start=>Run (alternatively use Windows key+R), type regedit and click OK.
    Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    Right-Click Root and select Permissions...
    Click Advanced.
    Under Owner tab select the entry starting with you user name, example: Farbar(Farbar-PC\Farbar)
    Put a check mark next to Replace owner on subcontainers and objects and click Apply and OK.
    Under Security type while Everyone is selected put a check mark in the box under Allow next to Full Control.
    Click Apply and OK.

    Run "Merge" now.

    Then...
    Please go back to the the Root key again while Everyone is selected remove check mark in the box under Allow next to Full Control and close the registry.

    Restart computer, post new FSS log.
     
  20. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    new fss log

    here's the new fss log.

    Farbar Service Scanner
    Ran by MIKE AND STEF (administrator) on 01-01-2012 at 16:55:36
    Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============
    SDRSVC Service is not running. Checking service configuration:
    The start type of SDRSVC service is OK.
    The ImagePath of SDRSVC service is OK.
    The ServiceDll of SDRSVC service is OK.

    VSS Service is not running. Checking service configuration:
    The start type of VSS service is OK.
    The ImagePath of VSS service is OK.


    System Restore Disabled Policy:
    ========================


    Security Center:
    ============
    wscsvc Service is not running. Checking service configuration:
    The start type of wscsvc service is OK.
    The ImagePath of wscsvc service is OK.
    The ServiceDll of wscsvc service is OK.
    Checking LEGACY_wscsvc: Attention! Unable to open LEGACY_wscsvc\0000 registry key. The key does not exist.


    Windows Update:
    ===========
    wuauserv Service is not running. Checking service configuration:
    The start type of wuauserv service is OK.
    The ImagePath of wuauserv service is OK.
    The ServiceDll of wuauserv: "C:\Windows\system32\wuaueng.dll".

    BITS Service is not running. Checking service configuration:
    The start type of BITS service is OK.
    The ImagePath of BITS service is OK.
    The ServiceDll of BITS service is OK.
    Checking LEGACY_BITS: Attention! Unable to open LEGACY_BITS\0000 registry key. The key does not exist.


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB

    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F

    C:\Windows\system32\es.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F

    C:\Windows\system32\cryptsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B

    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
     
  21. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    We still have couple more issues there.

    Please go to Start=>Run (alternatively use Windows key+R), type regedit and click OK.
    Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root
    Right-Click Root and select Permissions...
    Click Advanced.
    Under Owner tab select the entry starting with you user name, example: Farbar(Farbar-PC\Farbar)
    Put a check mark next to Replace owner on subcontainers and objects and click Apply and OK.
    Under Security type while Everyone is selected put a check mark in the box under Allow next to Full Control.
    Click Apply and OK.

    Download following file: http://www.filedropper.com/legacybits
    Right click on it, click "Merge".
    Allow registry merge.

    Download following file: http://www.filedropper.com/legacywscsvc
    Right click on it, click "Merge".
    Allow registry merge.

    Please go back to the the Root key again while Everyone is selected remove check mark in the box under Allow next to Full Control and close the registry.
    Restart computer, post new FSS log.
     
  22. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    fss log

    when I try and check the box next to to Replace owner on subcontainers and objects and hit apply( the owner is already as it should be or as you tell me to make it) it saye Registry Edtior could not set owner on the key currently selected or some of it's subkeys.

    Farbar Service Scanner
    Ran by MIKE AND STEF (administrator) on 01-01-2012 at 17:43:09
    Microsoft® Windows Vista™ Home Basic Service Pack 2 (X86)
    Boot Mode: Normal
    ****************************************************************

    Internet Services:
    ============

    Connection Status:
    ==============
    Localhost is accessible.
    LAN connected.
    Google IP is accessible.
    Yahoo IP is accessible.


    Windows Firewall:
    =============

    Firewall Disabled Policy:
    ==================


    System Restore:
    ============
    SDRSVC Service is not running. Checking service configuration:
    The start type of SDRSVC service is OK.
    The ImagePath of SDRSVC service is OK.
    The ServiceDll of SDRSVC service is OK.

    VSS Service is not running. Checking service configuration:
    The start type of VSS service is OK.
    The ImagePath of VSS service is OK.


    System Restore Disabled Policy:
    ========================


    Security Center:
    ============
    wscsvc Service is not running. Checking service configuration:
    The start type of wscsvc service is OK.
    The ImagePath of wscsvc service is OK.
    The ServiceDll of wscsvc service is OK.


    Windows Update:
    ===========
    wuauserv Service is not running. Checking service configuration:
    The start type of wuauserv service is OK.
    The ImagePath of wuauserv service is OK.
    The ServiceDll of wuauserv: "C:\Windows\system32\wuaueng.dll".

    BITS Service is not running. Checking service configuration:
    The start type of BITS service is OK.
    The ImagePath of BITS service is OK.
    The ServiceDll of BITS service is OK.


    File Check:
    ========
    C:\Windows\system32\nsisvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\nsiproxy.sys => MD5 is legit
    C:\Windows\system32\dhcpcsvc.dll => MD5 is legit
    C:\Windows\system32\Drivers\afd.sys => MD5 is legit
    C:\Windows\system32\Drivers\tdx.sys => MD5 is legit
    C:\Windows\system32\Drivers\tcpip.sys => MD5 is legit
    C:\Windows\system32\dnsrslvr.dll => MD5 is legit
    C:\Windows\system32\mpssvc.dll => MD5 is legit
    C:\Windows\system32\bfe.dll => MD5 is legit
    C:\Windows\system32\Drivers\mpsdrv.sys => MD5 is legit
    C:\Windows\system32\SDRSVC.dll => MD5 is legit
    C:\Windows\system32\vssvc.exe => MD5 is legit
    C:\Windows\system32\wscsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0061440 ____A (Microsoft Corporation) 1CA6C40261DDC0425987980D0CD2AAAB

    C:\Windows\system32\wbem\WMIsvc.dll => MD5 is legit
    C:\Windows\system32\wuaueng.dll => MD5 is legit
    C:\Windows\system32\qmgr.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0758784 ____A (Microsoft Corporation) 93952506C6D67330367F7E7934B6A02F

    C:\Windows\system32\es.dll
    [2009-09-23 17:52] - [2009-04-11 01:28] - 0268800 ____A (Microsoft Corporation) 67058C46504BC12D821F38CF99B7B28F

    C:\Windows\system32\cryptsvc.dll
    [2009-09-23 17:51] - [2009-04-11 01:28] - 0129024 ____A (Microsoft Corporation) FB27772BEAF8E1D28CCD825C09DA939B

    C:\Windows\system32\svchost.exe => MD5 is legit
    C:\Windows\system32\rpcss.dll => MD5 is legit


    **** End of log ****
     
  23. Broni

    Broni Malware Annihilator Posts: 52,915   +344

    That looks good.

    Any current issues?

    Run OTL
    • Under the Custom Scans/Fixes box at the bottom, paste in the following

      Code:
      :OTL
      O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: aol.com ([objects] * is out of zone range - 5)
      O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: juno.com ([]* in Trusted sites)
      O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: netzero.com ([]* in Trusted sites)
      O15 - HKU\S-1-5-21-2450527456-1965013573-2852655101-1000\..Trusted Domains: netzero.net ([]* in Trusted sites)
      [2010/08/18 16:05:52 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\AVG9
      [2010/06/08 19:45:22 | 000,000,000 | ---D | M] -- C:\Users\MIKE AND STEF\AppData\Roaming\Uniblue
      @Alternate Data Stream - 203 bytes -> C:\ProgramData\TEMP:8DCF53BE
      @Alternate Data Stream - 202 bytes -> C:\ProgramData\TEMP:5D9A374E
      @Alternate Data Stream - 187 bytes -> C:\ProgramData\TEMP:5E358F67
      @Alternate Data Stream - 151 bytes -> C:\ProgramData\TEMP:07348C09
      @Alternate Data Stream - 149 bytes -> C:\ProgramData\TEMP:1E66EE85
      @Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:8C885EDD
      @Alternate Data Stream - 135 bytes -> C:\ProgramData\TEMP:9B7E8561
      @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:91CF76E3
      @Alternate Data Stream - 124 bytes -> C:\ProgramData\TEMP:0B4227B4
      
      :Commands
      [purity]
      [emptytemp]
      [emptyflash]
      [Reboot]
      
    • Then click the Run Fix button at the top
    • Let the program run unhindered, reboot the PC when it is done
    • You will get a log that shows the results of the fix. Please post it.

    ==============================================================

    Last scans....

    1. Download Security Check from HERE, and save it to your Desktop.
    • Double-click SecurityCheck.exe
    • Follow the onscreen instructions inside of the black box.
    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.

      NOTE SecurityCheck may produce some false warning(s), so leave the results reading to me.


    2. Download Temp File Cleaner (TFC)
    • Double click on TFC.exe to run the program.
    • Click on Start button to begin cleaning process.
    • TFC will close all running programs, and it may ask you to restart computer.


    3. Please run a free online scan with the ESET Online Scanner

    • Disable your antivirus program
    • Tick the box next to YES, I accept the Terms of Use
    • Click Start
    • Accept any security warnings from your browser.
    • Check Scan archives
    • Click Start
    • ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
    • When the scan completes, click on List of found threats
    • Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
    • NOTE. If Eset won't find any threats, it won't produce any log.
     
  24. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    otl log

    no issues that I have seen so far so good, awesome

    All processes killed
    ========== OTL ==========
    Registry key HKEY_USERS\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\aol.com\objects\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\juno.com\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\netzero.com\ deleted successfully.
    Registry key HKEY_USERS\S-1-5-21-2450527456-1965013573-2852655101-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\netzero.net\ deleted successfully.
    C:\Users\MIKE AND STEF\AppData\Roaming\AVG9\cfgall folder moved successfully.
    C:\Users\MIKE AND STEF\AppData\Roaming\AVG9 folder moved successfully.
    C:\Users\MIKE AND STEF\AppData\Roaming\Uniblue\RegistryBooster\history folder moved successfully.
    C:\Users\MIKE AND STEF\AppData\Roaming\Uniblue\RegistryBooster folder moved successfully.
    C:\Users\MIKE AND STEF\AppData\Roaming\Uniblue\Registry Booster2 folder moved successfully.
    C:\Users\MIKE AND STEF\AppData\Roaming\Uniblue folder moved successfully.
    ADS C:\ProgramData\TEMP:8DCF53BE deleted successfully.
    ADS C:\ProgramData\TEMP:5D9A374E deleted successfully.
    ADS C:\ProgramData\TEMP:5E358F67 deleted successfully.
    ADS C:\ProgramData\TEMP:07348C09 deleted successfully.
    ADS C:\ProgramData\TEMP:1E66EE85 deleted successfully.
    ADS C:\ProgramData\TEMP:8C885EDD deleted successfully.
    ADS C:\ProgramData\TEMP:9B7E8561 deleted successfully.
    ADS C:\ProgramData\TEMP:91CF76E3 deleted successfully.
    ADS C:\ProgramData\TEMP:0B4227B4 deleted successfully.
    ========== COMMANDS ==========

    [EMPTYTEMP]

    User: All Users

    User: Default
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 67 bytes

    User: Default User
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 0 bytes

    User: fix
    ->Temp folder emptied: 0 bytes

    User: Guest
    ->Temp folder emptied: 0 bytes
    ->Temporary Internet Files folder emptied: 804 bytes
    ->Java cache emptied: 0 bytes
    ->Flash cache emptied: 3178 bytes

    User: MIKE AND STEF
    ->Temp folder emptied: 22324657 bytes
    ->Temporary Internet Files folder emptied: 221823564 bytes
    ->Java cache emptied: 49874752 bytes
    ->Flash cache emptied: 3112 bytes

    User: Public
    ->Temp folder emptied: 0 bytes

    %systemdrive% .tmp files removed: 0 bytes
    %systemroot% .tmp files removed: 0 bytes
    %systemroot%\System32 .tmp files removed: 0 bytes
    %systemroot%\System32\drivers .tmp files removed: 0 bytes
    Windows Temp folder emptied: 1140129 bytes
    RecycleBin emptied: 214665 bytes

    Total Files Cleaned = 282.00 mb


    [EMPTYFLASH]

    User: All Users

    User: Default

    User: Default User

    User: fix

    User: Guest
    ->Flash cache emptied: 0 bytes

    User: MIKE AND STEF
    ->Flash cache emptied: 0 bytes

    User: Public

    Total Flash Files Cleaned = 0.00 mb


    OTL by OldTimer - Version 3.2.31.0 log created on 01012012_184155

    Files\Folders moved on Reboot...
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZLQQT6L0\blank[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\ZLQQT6L0\ext-render-secure[3].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VN1VH6E7\compose[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VN1VH6E7\loader[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TAG4P7ZS\918[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TAG4P7ZS\fmr[2].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TAG4P7ZS\iframe3[5].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\TAG4P7ZS\trackCAU9NNFR.htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O482NKWF\controller[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O482NKWF\iframe3[5].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O482NKWF\iframe3[6].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O482NKWF\newmailcount[4] moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O482NKWF\serve[2].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O482NKWF\si[9].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MTQ3V2NV\adsCALFEJCW.htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MTQ3V2NV\iframe[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\MTQ3V2NV\st[3] moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CLVLQ8HP\partner[2].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BE9BPTP3\adsCA0272GB.htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BE9BPTP3\apiCAZFM4JZ.htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BE9BPTP3\fc[6].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BE9BPTP3\st[7] moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BE9BPTP3\st[8] moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BBCB8W05\tsd[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BBCB8W05\view[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\BBCB8W05\yimapp[1].htm moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\ED8654D5-B9F0-4DD9-B3E8-F8F560086FDF.dat moved successfully.
    C:\Users\MIKE AND STEF\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\MSIMGSIZ.DAT moved successfully.
    File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.
    C:\Windows\temp\Low\~DF513B.tmp moved successfully.
    C:\Windows\temp\Low\~DF9EBE.tmp moved successfully.
    File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

    Registry entries deleted on Reboot...
     
  25. bykerboy68

    bykerboy68 TS Rookie Topic Starter Posts: 16

    checkup log

    Results of screen317's Security Check version 0.99.24
    Windows Vista Service Pack 2 x86 (UAC is enabled)
    Internet Explorer 9
    ``````````````````````````````
    Antivirus/Firewall Check:

    Windows Firewall Enabled!
    avast! Internet Security
    WMI entry may not exist for antivirus; attempting automatic update.
    ```````````````````````````````
    Anti-malware/Other Utilities Check:

    CCleaner
    Java(TM) 6 Update 16
    Java(TM) 6 Update 22
    Java(TM) 6 Update 26
    Out of date Java installed!
    ````````````````````````````````
    Process Check:
    objlist.exe by Laurent

    Malwarebytes' Anti-Malware mbamservice.exe
    AVAST Software Avast AvastSvc.exe
    AVAST Software Avast AvastUI.exe
    ``````````End of Log````````````
     

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...