dakotawolf04

June 30, 2012

The message said "An unauthorized change was made to Windows. You must retype your Windows Vista product key to activate." When I input the product key it says it's invalid. The error code is 0xC004E003 which is "The software licensing service reported that license evaluation failed."

June 30, 2012

I really appreciate all of your help. One last question, do you have any advice on the Windows Vista product key validation error?

June 30, 2012

I ran JavaRe and removed the old versions. Then downloaded the latest version of Java. The validation issue is the only problem that i've noticed. Ran another scan with Malwarebytes and nothing detected. Seems to be looking good so far.

June 30, 2012

Here's the ESET log.

ESETSmartInstaller@High as CAB hook log:

OnlineScanner.ocx - registred OK

# version=7

# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)

# OnlineScanner.ocx=1.0.0.6583

# api_version=3.0.2

# EOSSerial=b116f3437150d648ac9aa80dcbfb0c42

# end=finished

# remove_checked=true

# archives_checked=false

# unwanted_checked=true

# unsafe_checked=false

# antistealth_checked=true

# utc_time=2012-06-30 02:39:44

# local_time=2012-06-29 09:39:44 (-0600, Central Daylight Time)

# country="United States"

# lang=1033

# osver=6.0.6002 NT Service Pack 2

# compatibility_mode=512 16777215 100 0 0 0 0 0

# compatibility_mode=1024 16777215 100 0 2190179 2190179 0 0

# compatibility_mode=5892 16776574 100 100 52644117 177624091 0 0

# compatibility_mode=8192 67108863 100 0 0 0 0 0

# scanned=241140

# found=17

# cleaned=17

# scan_time=7420

C:\Qoobox\Quarantine\C\Windows\System32\Services.exe.vir Win32/Sirefef.FB.Gen trojan (deleted - quarantined) 00000000000000000000000000000000 C

C:\TDSSKiller_Quarantine\27.06.2012_10.43.53\tdlfs0000\tsk0001.dta Win32/Olmarik.AYI trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\TDSSKiller_Quarantine\27.06.2012_10.43.53\tdlfs0000\tsk0002.dta Win64/Olmarik.AK trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\TDSSKiller_Quarantine\27.06.2012_10.43.53\tdlfs0000\tsk0003.dta Win32/Olmarik.AWO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\TDSSKiller_Quarantine\27.06.2012_10.43.53\tdlfs0000\tsk0004.dta Win64/Olmarik.AK trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\TDSSKiller_Quarantine\27.06.2012_10.43.53\tdlfs0000\tsk0008.dta Win32/Olmarik.AFK trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\TDSSKiller_Quarantine\27.06.2012_10.43.53\tdlfs0000\tsk0009.dta Win64/Olmarik.AK trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Michael&Mary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\43\58630b2b-348466c0 Java/TrojanDownloader.OpenStream.NCM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Michael&Mary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\2bc3143e-711b6879 a variant of Java/TrojanDownloader.OpenStream.NBM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Michael&Mary\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\62\2bc3143e-77d11ed3 a variant of Java/TrojanDownloader.OpenStream.NBM trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Michael&Mary\Desktop\Downloads\couponprinter.exe probably a variant of Win32/Adware.Softomate.AD application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Users\Michael&Mary\Documents\Program Files\couponprinter.exe probably a variant of Win32/Adware.Softomate.AD application (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\79WM0YSE\mx_nan_a[1].txt HTML/Iframe.B.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DRM6ORQE\mx_nan_a[1].txt HTML/Iframe.B.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\O9ALQRDM\firstload_com[1].txt HTML/ScrInject.B.Gen virus (deleted - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\06272012_104945\C_Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\80000000.@ a variant of Win32/Sirefef.FA trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

C:\_OTL\MovedFiles\06272012_104945\C_Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\800000cb.@ probably a variant of Win32/Agent.TEO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C

June 29, 2012

I believe those are from Power Tab editor. Here's the link https://www.virustotal.com/file/240d073240eff10bbeab58c8ef0652f5e2929ac54cd441d7d50eb93402a68f77/analysis/

I tried to validate my Windows Vista but, when i input the product from the sticker it keeps coming up with an error and cant validate it.

June 28, 2012

After I turned on and logged in to my computer today, the desktop background was black, normally have a picture set as the background, and after a bit a window popped up that said "An unauthorized change was made to Windows. You must retype your Windows Vista product key to activate." This is really odd. Would any of the tools I've run so far cause this to happen? I did not put the key in yet, i just hit cancel. I ran the Combofix program and here is the log.

ComboFix 12-06-28.01 - Michael&Mary 06/28/2012 10:48:24.1.2 - x86

Running from: c:\users\Michael&Mary\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\users\Michael&Mary\AppData\Roaming\Microsoft\Windows\Recent\scan0001.jpg

c:\users\Michael&Mary\AppData\Roaming\Microsoft\Windows\Recent\scan0002.jpg

c:\windows\Downloaded Program Files\popcaploader.dll

c:\windows\Downloaded Program Files\popcaploader.inf

c:\windows\system32\AutoRun.inf

c:\windows\system32\BSTIEPrintCtl1.dll

c:\windows\system32\drivers\etc\lmhosts

c:\windows\system32\spsys.log

.

Infected copy of c:\windows\system32\Services.exe was found and disinfected

Restored copy from - c:\windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.0.6002.18005_none_d14b3973ca6acc56\services.exe

.

((((((((((((((((((((((((( Files Created from 2012-05-28 to 2012-06-28 )))))))))))))))))))))))))))))))

.

2012-06-28 15:54 . 2012-06-28 15:54 -------- d-----w- c:\users\Default\AppData\Local\temp

2012-06-27 15:50 . 2012-06-27 15:50 -------- d-sh--w- c:\users\Michael&Mary\%APPDATA%

2012-06-27 15:49 . 2012-06-27 15:49 -------- d-----w- C:\_OTL

2012-06-27 15:47 . 2012-06-27 15:47 -------- d-----w- C:\TDSSKiller_Quarantine

2012-06-09 17:07 . 2012-06-09 17:07 -------- d-----w- c:\users\Michael&Mary\AppData\Roaming\Sibelius Software

2012-06-09 17:07 . 2012-06-09 17:07 -------- d-----w- c:\program files\Sibelius Software

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSTITL.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSTEXT.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSSTMP.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSSPEC.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSSCRP.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSREH_.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSMET_.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRSCHOR.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\RPRS____.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSTEXT.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSSE__.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSS___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSROMC.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSPC__.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSP___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSO___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSNN__.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSM___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSFS__.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSFBE_.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSFB__.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSCSC_.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSCS__.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUSC___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\OPUS____.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\INKPEN2_.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\INK2TEXT.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\INK2SPEC.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\INK2SCRI.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\INK2METR.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\INK2CHOR.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\HELST___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\HELSS___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\HELSM___.FOT

2012-06-09 17:07 . 2012-06-09 17:07 1409 ----a-w- c:\windows\Fonts\HELSINKI.FOT

2012-06-02 22:19 . 2012-06-22 12:32 53784 ----a-w- c:\windows\system32\wuauclt.exe

2012-06-02 22:19 . 2012-06-22 12:32 45080 ----a-w- c:\windows\system32\wups2.dll

2012-06-02 22:19 . 2012-06-22 12:32 35864 ----a-w- c:\windows\system32\wups.dll

2012-06-02 22:19 . 2012-06-22 12:32 577048 ----a-w- c:\windows\system32\wuapi.dll

2012-06-02 22:19 . 2012-06-22 12:32 1933848 ----a-w- c:\windows\system32\wuaueng.dll

2012-06-02 22:12 . 2012-06-22 12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll

2012-06-02 22:12 . 2012-06-22 12:32 88576 ----a-w- c:\windows\system32\wudriver.dll

2012-06-02 20:19 . 2012-06-22 12:32 171904 ----a-w- c:\windows\system32\wuwebv.dll

2012-06-02 20:12 . 2012-06-22 12:32 33792 ----a-w- c:\windows\system32\wuapp.exe

2012-05-15 19:51 . 2012-06-13 22:25 2045440 ----a-w- c:\windows\system32\win32k.sys

2012-05-15 06:37 . 2012-06-13 22:25 916992 ----a-w- c:\windows\system32\wininet.dll

2012-05-15 06:32 . 2012-06-13 22:25 43520 ----a-w- c:\windows\system32\licmgr10.dll

2012-05-15 06:32 . 2012-06-13 22:25 1469440 ----a-w- c:\windows\system32\inetcpl.cpl

2012-05-15 03:23 . 2012-06-13 22:25 1638912 ----a-w- c:\windows\system32\mshtml.tlb

2012-05-05 00:27 . 2012-04-02 16:11 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe

2012-05-05 00:27 . 2011-06-06 01:45 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2012-04-04 20:56 . 2012-05-25 03:29 22344 ----a-w- c:\windows\system32\drivers\mbam.sys

2012-04-03 08:16 . 2012-05-09 23:34 3602816 ----a-w- c:\windows\system32\ntkrnlpa.exe

2012-04-03 08:16 . 2012-05-09 23:34 3550080 ----a-w- c:\windows\system32\ntoskrnl.exe

2007-10-28 19:57 . 2007-10-28 19:57 774144 ----a-w- c:\program files\RngInterstitial.dll

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]

"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-06-21 3905408]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]

"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]

"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe" [2007-03-12 49152]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-23 13539872]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-23 92704]

"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]

"Microsoft Default Manager"="c:\program files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" [2010-05-10 439568]

"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]

.

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\

HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"EnableLUA"= 0 (0x0)

"EnableUIADesktopToggle"= 0 (0x0)

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-08-05 113024]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]

BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart

.

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]

@=""

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]

2011-09-27 12:22 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

2011-10-24 19:28 421888 ----a-w- c:\program files\QuickTime Alternative\QTTask.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Reader Library Launcher]

2010-07-13 07:34 906648 ----a-w- c:\program files\Sony\Reader\Data\bin\launcher\Reader Library Launcher.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]

2007-01-19 18:49 4670968 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusOverride"=dword:00000001

"FirewallOverride"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

.

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

.

R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [x]

S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [x]

S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]

HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12

hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc

LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

.

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{A509B1FF-37FF-4bFF-8CFF-4F3A747040FF}]

2009-03-08 11:32 128512 ----a-w- c:\windows\System32\advpack.dll

.

Contents of the 'Scheduled Tasks' folder

.

2012-06-28 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 00:27]

.

2012-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 21:47]

.

2012-06-28 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job

- c:\program files\Google\Update\GoogleUpdate.exe [2010-02-01 21:47]

.

2012-06-28 c:\windows\Tasks\User_Feed_Synchronization-{E5B68E09-26C2-423A-B845-02510555A17D}.job

- c:\windows\system32\msfeedssync.exe [2012-06-13 03:24]

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/?fr=fp-yie8

mStart Page = hxxp://www.yahoo.com

uInternet Settings,ProxyOverride = *.local

TCP: DhcpNameServer = 192.168.2.1

DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} - hxxp://www.psapoll.com/CopyGuardIE.cab

DPF: {A7846ED2-9DE6-4E8A-B116-A8ACEBFA7DB1} - hxxp://rms2.invokesolutions.com/events/bin/6.2.0.1452/MILive.cab

DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} - hxxp://games.bellsouth.net/Gh/DeliciousWeb/zylomplayer.cab

DPF: {D9944C1C-C6BB-4E90-8E37-55F9FFABC6B8} - hxxps://server.userzoom.com/uz/UserZoom.cab

DPF: {EEA3945F-2702-45A0-BBE1-BC88E252AED1} - hxxp://www.lifetimetv.com/games/dinerdash/DDPrilosec.1.0.0.30.cab

DPF: {F4EBFE42-D82A-48EB-B70E-7499FFEAFF3F} - hxxp://download.dinerdash.com/play/game/dressshophop/DressShopHopWeb.1.0.0.7.cab

.

- - - - ORPHANS REMOVED - - - -

.

Toolbar-Locked - (no file)

.

**************************************************************************

.

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2012-06-28 10:58

Windows 6.0.6002 Service Pack 2 NTFS

.

scanning hidden processes ...

.

scanning hidden autostart entries ...

.

scanning hidden files ...

.

scan completed successfully

hidden files: 0

.

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

------------------------ Other Running Processes ------------------------

.

c:\progra~1\AVG\AVG2012\avgrsx.exe

c:\program files\AVG\AVG2012\avgcsrvx.exe

c:\windows\system32\nvvsvc.exe

c:\windows\system32\rundll32.exe

c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe

c:\program files\AVG\AVG2012\avgwdsvc.exe

c:\program files\Bonjour\mDNSResponder.exe

c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE

c:\program files\Microsoft\BingBar\SeaPort.EXE

c:\program files\AVG\AVG2012\avgnsx.exe

c:\windows\system32\DRIVERS\xaudio.exe

c:\program files\AVG\AVG2012\AVGIDSAgent.exe

c:\windows\system32\WUDFHost.exe

c:\windows\RtHDVCpl.exe

c:\windows\System32\rundll32.exe

c:\windows\ehome\ehmsas.exe

c:\windows\system32\SLUI.exe

c:\windows\System32\SLLUA.exe

c:\windows\servicing\TrustedInstaller.exe

.

**************************************************************************

.

Completion time: 2012-06-28 11:07:26 - machine was rebooted

ComboFix-quarantined-files.txt 2012-06-28 16:07

.

Pre-Run: 153,004,351,488 bytes free

Post-Run: 152,863,887,360 bytes free

.

- - End Of File - - 69290FD9F9D6B54A7C30940F8F2BBDC5

June 28, 2012

This is what AVG found

"";"C:\Windows\System32\services.exe";"Trojan horse Patched_c.LYT";"Object is white-listed (critical/system file that should not be removed)"

June 27, 2012

I ran the programs as requested. One question though, I still have AVG running and when Malwarebytes runs AVG will pop up with a message about the trojans we're trying to get rid of. Is this ok? Should I turn off AVG when running Malwarebytes? Here are the logs.

All processes killed

========== OTL ==========

Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Run\\ElevatedDiagnostics deleted successfully.

Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Run\\ElevatedDiagnostics deleted successfully.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\800000cb.@ moved successfully.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\80000000.@ moved successfully.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\00000001.@ moved successfully.

File move failed. C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.

File move failed. C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\@ moved successfully.

C:\Users\Michael&Mary\AppData\Local\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\@ moved successfully.

C:\Users\Michael&Mary\AppData\Roaming\LimeWire\xml\data folder moved successfully.

C:\Users\Michael&Mary\AppData\Roaming\LimeWire\xml folder moved successfully.

C:\Users\Michael&Mary\AppData\Roaming\LimeWire\themes\windows_theme folder moved successfully.

C:\Users\Michael&Mary\AppData\Roaming\LimeWire\themes folder moved successfully.

C:\Users\Michael&Mary\AppData\Roaming\LimeWire\.AppSpecialShare folder moved successfully.

C:\Users\Michael&Mary\AppData\Roaming\LimeWire folder moved successfully.

========== FILES ==========

C:\Users\Michael&Mary\AppData\Local\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U folder moved successfully.

C:\Users\Michael&Mary\AppData\Local\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\L folder moved successfully.

C:\Users\Michael&Mary\AppData\Local\{7545cdec-4528-ad10-63ef-2b0029fa9fc4} folder moved successfully.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U folder moved successfully.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\L folder moved successfully.

Folder move failed. C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4} scheduled to be moved on reboot.

< ipconfig /flushdns /c >

Windows IP Configuration

Successfully flushed the DNS Resolver Cache.

C:\Users\Michael&Mary\Desktop\cmd.bat deleted successfully.

C:\Users\Michael&Mary\Desktop\cmd.txt deleted successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: Default

->Temporary Internet Files folder emptied: 33170 bytes

User: Michael&Mary

->Temporary Internet Files folder emptied: 294804 bytes

->Flash cache emptied: 60068 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 14508 bytes

RecycleBin emptied: 5184989 bytes

Total Files Cleaned = 5.00 mb

System Restore Service not available.

OTL by OldTimer - Version 3.2.53.0 log created on 06272012_104945

Files\Folders moved on Reboot...

File move failed. C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.

File move failed. C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 scheduled to be moved on reboot.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U folder moved successfully.

C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4} folder moved successfully.

PendingFileRenameOperations files...

[2012/06/27 10:55:24 | 000,003,696 | -H-- | M] () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 : Unable to obtain MD5

[2012/06/27 10:55:24 | 000,003,696 | -H-- | M] () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 : Unable to obtain MD5

File C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4} not found!

Registry entries deleted on Reboot...

Malwarebytes Anti-Malware 1.61.0.1400

www.malwarebytes.org

Database version: v2012.06.27.06

Windows Vista Service Pack 2 x86 NTFS

Internet Explorer 8.0.6001.19272

Michael&Mary :: MMSCOMP [administrator]

6/27/2012 11:14:20 AM

mbam-log-2012-06-27 (11-14-20).txt

Scan type: Quick scan

Scan options disabled: P2P

Objects scanned: 205192

Time elapsed: 1 minute(s), 40 second(s)

Memory Processes Detected: 0

(No malicious items detected)

Memory Modules Detected: 0

(No malicious items detected)

Registry Keys Detected: 0

(No malicious items detected)

Registry Values Detected: 0

(No malicious items detected)

Registry Data Items Detected: 0

(No malicious items detected)

Folders Detected: 0

(No malicious items detected)

Files Detected: 0

(No malicious items detected)

(end)

June 27, 2012

OTL logfile created on: 6/26/2012 1:21:28 PM - Run 1

OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Michael&Mary\Desktop

Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.19272)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.37 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 58.26% Memory free

6.10 Gb Paging File | 4.60 Gb Available in Paging File | 75.43% Paging File free

Paging file location(s): c:\pagefile.sys 2875 2875 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 291.83 Gb Total Space | 142.77 Gb Free Space | 48.92% Space Free | Partition Type: NTFS

Drive D: | 6.26 Gb Total Space | 0.90 Gb Free Space | 14.43% Space Free | Partition Type: NTFS

Computer Name: MMSCOMP | User Name: Michael&Mary | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users | Quick Scan

Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012/06/26 13:13:10 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Michael&Mary\Desktop\OTL.exe

PRC - [2012/06/21 00:18:22 | 003,905,408 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

PRC - [2012/01/24 17:24:26 | 002,416,480 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgtray.exe

PRC - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe

PRC - [2011/11/28 01:19:04 | 001,229,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgnsx.exe

PRC - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe

PRC - [2011/09/08 20:53:26 | 000,743,264 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgrsx.exe

PRC - [2011/08/17 20:10:55 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE

PRC - [2011/08/15 06:21:40 | 000,337,760 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgcsrvx.exe

PRC - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe

PRC - [2011/08/02 06:08:34 | 000,967,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG2012\avgscanx.exe

PRC - [2011/02/25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE

PRC - [2009/04/11 01:27:36 | 002,926,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2008/01/15 11:26:18 | 004,874,240 | ---- | M] (Realtek Semiconductor) -- C:\Windows\RtHDVCpl.exe

PRC - [2007/03/11 22:34:40 | 000,049,152 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe

PRC - [2007/03/11 22:32:42 | 000,151,552 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqste08.exe

PRC - [2007/03/11 22:26:24 | 000,210,520 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe

PRC - [2006/09/28 08:42:24 | 000,065,536 | ---- | M] (Hewlett-Packard Company) -- C:\hp\support\hpsysdrv.exe

========== Modules (No Company Name) ==========

MOD - [2012/06/26 10:58:11 | 000,065,024 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll

MOD - [2012/06/26 10:58:11 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll

MOD - [2011/08/05 08:20:54 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL

MOD - [2011/08/05 08:20:54 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll

MOD - [2010/01/27 07:18:57 | 000,163,728 | ---- | M] () -- C:\Program Files\Lavasoft\Ad-Aware\ShellExt.dll

MOD - [2005/10/07 15:05:32 | 000,125,440 | ---- | M] () -- C:\Program Files\WinRAR\RarExt.dll

========== Win32 Services (SafeList) ==========

SRV - [2012/05/04 19:27:17 | 000,257,696 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012/01/03 08:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)

SRV - [2011/10/12 06:25:22 | 004,433,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)

SRV - [2011/08/17 20:10:55 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)

SRV - [2011/08/02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG2012\avgwdsvc.exe -- (avgwd)

SRV - [2011/02/28 18:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [Disabled | Stopped] -- C:\Program Files\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)

SRV - [2011/02/25 10:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)

SRV - [2010/04/02 22:34:12 | 000,073,728 | ---- | M] (Sony Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe -- (Sony SCSI Helper Service)

SRV - [2009/03/30 18:31:36 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2009/03/23 20:21:51 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)

SRV - [2008/11/09 15:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007/06/04 23:14:50 | 000,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08)

SRV - [2007/06/04 23:14:50 | 000,131,072 | ---- | M] (Hewlett-Packard Co.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc)

========== Driver Services (SafeList) ==========

DRV - File not found [Adapter | On_Demand | Unknown] -- -- (Winsock - Google Desktop Search Backup Before Last Install)

DRV - File not found [Adapter | On_Demand | Unknown] -- -- (Winsock - Google Desktop Search Backup Before First Install)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\sxuptp.sys -- (sxuptp)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)

DRV - File not found [Kernel | On_Demand | Unknown] -- C:\Users\MICHAE~1\AppData\Local\Temp\mbr.sys -- (mbr)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ipinip.sys -- (IpInIp)

DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\blbdrive.sys -- (blbdrive)

DRV - [2012/06/26 11:53:59 | 000,054,016 | ---- | M] () [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\fnwg.sys -- (ryjqwor)

DRV - [2011/10/07 06:23:48 | 000,230,608 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgldx86.sys -- (Avgldx86)

DRV - [2011/10/04 06:21:16 | 000,016,720 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSShim.sys -- (AVGIDSShim)

DRV - [2011/09/13 06:30:10 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\System32\drivers\avgrkx86.sys -- (Avgrkx86)

DRV - [2011/08/08 06:08:58 | 000,040,016 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\Windows\System32\drivers\avgmfx86.sys -- (Avgmfx86)

DRV - [2011/08/05 08:17:19 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2011/08/05 08:17:19 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)

DRV - [2011/07/11 01:14:38 | 000,295,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\System32\drivers\avgtdix.sys -- (Avgtdix)

DRV - [2011/07/11 01:14:02 | 000,024,272 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)

DRV - [2011/07/11 01:14:00 | 000,023,120 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AVGIDSEH.sys -- (AVGIDSEH)

DRV - [2011/07/11 01:13:58 | 000,134,736 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)

DRV - [2008/08/01 20:51:14 | 001,052,704 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvmfdx32.sys -- (NVENETFD)

DRV - [2008/05/22 21:49:00 | 007,465,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2008/05/08 05:05:18 | 000,266,752 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSXHWBS2.sys -- (HSXHWBS2)

DRV - [2008/05/08 05:03:18 | 000,980,992 | ---- | M] (Conexant Systems, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HSX_DP.sys -- (HSF_DP)

DRV - [2007/10/26 18:51:24 | 000,110,624 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\nvstor32.sys -- (nvstor32)

DRV - [2007/10/18 07:36:54 | 000,008,704 | ---- | M] (Conexant Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\XAudio.sys -- (XAudio)

DRV - [2007/06/18 14:18:26 | 000,023,680 | ---- | M] (Motorola) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\motmodem.sys -- (motmodem)

DRV - [2005/12/12 11:27:00 | 000,019,072 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\PS2.sys -- (Ps2)

DRV - [2005/08/17 08:47:48 | 000,073,696 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdserd.sys -- (sscdserd) SAMSUNG CDMA Modem Diagnostic Serial Port (WDM)

DRV - [2005/08/17 08:46:26 | 000,093,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdm.sys -- (sscdmdm)

DRV - [2005/08/17 08:46:20 | 000,008,272 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdmdfl.sys -- (sscdmdfl)

DRV - [2005/08/17 08:45:00 | 000,058,352 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sscdbus.sys -- (sscdbus) SAMSUNG USB Composite Device driver (WDM)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com

IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 79 7E A2 01 C2 A9 C7 46 8A C5 85 75 8D EF 96 ED [binary data]

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 79 7E A2 01 C2 A9 C7 46 8A C5 85 75 8D EF 96 ED [binary data]

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 79 7E A2 01 C2 A9 C7 46 8A C5 85 75 8D EF 96 ED [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 79 7E A2 01 C2 A9 C7 46 8A C5 85 75 8D EF 96 ED [binary data]

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [binary data over 100 bytes]

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?fr=fp-yie8

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{080FBDF6-B230-4e4d-A4E7-7C7A56D7BABC}: "URL" = http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry={searchTerms}&type=Web&orig=IMC-IEDS

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{0B0219F8-2B01-4167-BD43-A36C53CD08E8}: "URL" = http://delicious.com/search?p={searchTerms}

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{5E21637A-9BD5-4ED5-9A15-F6C95F06AB2A}: "URL" = http://rover.ebay.com/rover/1/711-43047-14818-1/4?satitle={searchTerms}

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7ADFA_enUS365

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}: "URL" = http://isearch.avg.com/search?cid={7A7941BE-96CA-4810-8DF3-8C565390C872}&mid=4ca587aa215cf3075cd69d3275846ec1-2793da85c7042633c4b74aabcfbe61472fe2a859〈=en&ds=AVG&pr=fr&d=&v=&sap=dsp&q={searchTerms}

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{BFB66404-4CC9-4A7D-9BC7-8216115A8AB2}: "URL" = http://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=chr-yie8

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\..\SearchScopes\{CD34A348-F951-4788-AB5B-A54131B373F8}: "URL" = http://www.flickr.com/search/?q={searchTerms}

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.3: C:\Program Files\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@sony.com/eBookLibrary: C:\Program Files\Sony\Reader\Data\bin\npebldetectmoz.dll (Sony Corporation)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKLM\Software\MozillaPlugins\yaxmpb@yahoo.com/YahooActiveXPluginBridge;version=1.0.0.1: C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll File not found

FF - HKCU\Software\MozillaPlugins\@yahoo.com/BrowserPlus,version=2.8.1: C:\Users\Michael&Mary\AppData\Local\Yahoo!\BrowserPlus\2.8.1\Plugins\npybrowserplus_2.8.1.dll (Yahoo! Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/05/03 14:12:13 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{3252b9ae-c69a-4eaf-9502-dc9c1f6c009e}: C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DMExtension\ [2011/01/05 16:53:20 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG2012\Firefox4\ [2012/05/24 19:15:43 | 000,000,000 | ---D | M]

FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files\HP\Digital Imaging\Smart Web Printing\MozillaAddOn2 [2009/05/03 14:12:13 | 000,000,000 | ---D | M]

O1 HOSTS File: ([2006/09/18 16:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: ::1 localhost

O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - No CLSID value found.

O2 - BHO: (UserZoomBHO Class) - {246E2928-34B8-48D9-BE73-38BA37241E5B} - C:\Windows\Downloaded Program Files\UserZoom.dll ()

O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)

O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)

O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)

O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.

O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)

O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)

O4 - HKLM..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe (Hewlett-Packard Company)

O4 - HKLM..\Run: [KBD] C:\hp\KBD\KbdStub.exe ()

O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

O4 - HKU\S-1-5-19..\Run: [ElevatedDiagnostics] rundll32.exe "C:\Users\Michael&Mary\AppData\Local\Help\ElevatedDiagnostics\airlock32.dll",DllRegisterServer File not found

O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-20..\Run: [ElevatedDiagnostics] rundll32.exe "C:\Users\Michael&Mary\AppData\Local\Help\ElevatedDiagnostics\airlock32.dll",DllRegisterServer File not found

O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)

O4 - HKU\S-1-5-21-2334938911-1074720391-1350934541-1000..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

O13 - gopher Prefix: missing

O15 - HKU\.DEFAULT\..Trusted Ranges: Range1 ([http] in Local intranet)

O15 - HKU\S-1-5-18\..Trusted Ranges: Range1 ([http] in Local intranet)

O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} http://office.microsoft.com/sites/production/ieawsdc32.cab (Microsoft Office Template and Media Control)

O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} http://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab (Office Genuine Advantage Validation Tool)

O16 - DPF: {15B782AF-55D8-11D1-B477-006097098764} http://fpdownload.macromedia.com/get/shockwave/cabs/authorware/awswaxd.cab (Macromedia Authorware Web Player Control)

O16 - DPF: {1663ed61-23eb-11d2-b92f-008048fdd814} http://www.commissarycoupons.com/scriptx/smsx.cab (MeadCo ScriptX)

O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)

O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)

O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/icaweb-20070115.cab (Citrix ICA Client)

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Reg Error: Key error.)

O16 - DPF: {445F47D7-E043-4BD6-82EB-7A1BD0EBA773} http://www.psapoll.com/CopyGuardIE.cab (CopyGuardCtrl Class)

O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} http://lads.myspace.com/upload/MySpaceUploader1006.cab (MySpace Uploader Control)

O16 - DPF: {54B52E52-8000-4413-BD67-FC7FE24B59F2} http://simcity.ea.com/update/EARTPX.cab (EARTPatchX Class)

O16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} http://mediaplayer.walmart.com/installer/install.cab (Reg Error: Key error.)

O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_4.0.27.0.cab (Battlefield Heroes Updater)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)

O16 - DPF: {A7846ED2-9DE6-4E8A-B116-A8ACEBFA7DB1} http://rms2.invokesolutions.com/events/bin/6.2.0.1452/MILive.cab (Reg Error: Key error.)

O16 - DPF: {A7EA8AD2-287F-11D3-B120-006008C39542} http://offers.e-centives.com/cif/download/bin/actxcab.cab (CBSTIEPrint Class)

O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} http://www.sibelius.com/download/software/win/ActiveXPlugin.cab (ScorchPlugin Class)

O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} http://myspace.oberon-media.com/gameshell/games/channel--110343720/lc--en/room--acbd97ff-acec-41d1-b161-f8885a087681/online/Diner_Dash_3/en/ddfotg.1.0.0.37.cab (CPlayFirstddfotgControl Object)

O16 - DPF: {BE319D04-18BD-4B34-AECC-EE7CB610FCA9} http://download.games.yahoo.com/games/web_games/sony/bewitched/main.cab (BewitchedGameClass Control)

O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} http://games.bellsouth.net/Gh/DeliciousWeb/zylomplayer.cab (Zylom Games Player)

O16 - DPF: {C36661D7-3590-45B1-80B5-520839E94DAD} http://simcity.ea.com/update/MaxisSimCity4PatcherX.cab (MaxisSimCity4PatcherX Control)

O16 - DPF: {CAFECAFE-0013-0001-0017-ABCDEFABCDEF} Reg Error: Value error. (JInitiator 1.3.1.17)

O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)

O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)

O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02)

O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Java Plug-in 1.6.0_03)

O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05)

O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)

O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)

O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} http://games.myspace.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab (Shockwave Flash Object)

O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} http://games.bellsouth.net/Gh/FeedingFrenzy/SproutLauncher.cab (SproutLauncherCtrl Class)

O16 - DPF: {D8AA889B-2C65-47C3-8C16-3DCD4EF76A47} Reg Error: Key error. (Reg Error: Key error.)

O16 - DPF: {D9944C1C-C6BB-4E90-8E37-55F9FFABC6B8} https://server.userzoom.com/uz/UserZoom.cab (CUZControl Object)

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} http://l.yimg.com/jh/games/web_games/popcap/bejeweled2/popcaploader_v6.cab (PopCapLoader Object)

O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (Reg Error: Value error.)

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)

O16 - DPF: {EEA3945F-2702-45A0-BBE1-BC88E252AED1} http://www.lifetimetv.com/games/dinerdash/DDPrilosec.1.0.0.30.cab (CPlayFirstDDPrilosecControl Object)

O16 - DPF: {F4EBFE42-D82A-48EB-B70E-7499FFEAFF3F} http://download.dinerdash.com/play/game/dressshophop/DressShopHopWeb.1.0.0.7.cab (CPlayFirstDressShopHControl Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{C6F86646-8A1F-4FA3-B4AF-7531341EE00D}: DhcpNameServer = 192.168.2.1

O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)

O18 - Protocol\Filter\application/xhtml+xml {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)

O18 - Protocol\Filter\application/xhtml+xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)

O18 - Protocol\Filter\application/xhtml+xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)

O18 - Protocol\Filter\text/xml; charset=iso-8859-1 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)

O18 - Protocol\Filter\text/xml; charset=utf-8 {32F66A26-7614-11D4-BD11-00104BD3F987} - C:\Program Files\Design Science\MathPlayer\MathMLMimer.dll (Design Science, Inc.)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)

O24 - Desktop WallPaper: C:\Users\Public\Pictures\Sample Pictures\Garden.jpg

O24 - Desktop BackupWallPaper: C:\Users\Public\Pictures\Sample Pictures\Garden.jpg

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/12/26 04:21:35 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O33 - MountPoints2\{46b8b70f-dd03-11db-9ae5-806e6f6e6963}\Shell - "" = AutoRun

O33 - MountPoints2\{46b8b70f-dd03-11db-9ae5-806e6f6e6963}\Shell\AutoRun\command - "" = E:\RunGame.exe

O33 - MountPoints2\{f264cf93-bc99-11db-9e35-001a92100efa}\Shell\AutoRun\command - "" = K:\setupSNK.exe

O34 - HKLM BootExecute: (autocheck autochk *)

O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG2012\avgrsx.exe /sync /restart)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012/06/26 13:13:09 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Michael&Mary\Desktop\OTL.exe

[2012/06/26 13:11:12 | 002,128,984 | ---- | C] (Kaspersky Lab ZAO) -- C:\Users\Michael&Mary\Desktop\tdsskiller.exe

[2012/06/26 11:50:53 | 000,607,260 | R--- | C] (Swearware) -- C:\Users\Michael&Mary\Desktop\dds.scr

[2012/06/15 11:48:29 | 000,000,000 | ---D | C] -- C:\Users\Michael&Mary\Documents\Utility Receipts

[2012/06/09 12:07:58 | 000,000,000 | ---D | C] -- C:\Users\Michael&Mary\AppData\Roaming\Sibelius Software

[2012/06/09 12:07:06 | 000,000,000 | ---D | C] -- C:\Program Files\Sibelius Software

[2007/10/28 14:57:13 | 000,774,144 | ---- | C] (RealNetworks, Inc.) -- C:\Program Files\RngInterstitial.dll

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/06/26 13:27:06 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012/06/26 13:13:10 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Michael&Mary\Desktop\OTL.exe

[2012/06/26 13:11:19 | 002,128,984 | ---- | M] (Kaspersky Lab ZAO) -- C:\Users\Michael&Mary\Desktop\tdsskiller.exe

[2012/06/26 12:59:00 | 000,000,886 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012/06/26 12:56:29 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0

[2012/06/26 12:56:29 | 000,003,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0

[2012/06/26 11:53:59 | 000,054,016 | ---- | M] () -- C:\Windows\System32\drivers\fnwg.sys

[2012/06/26 11:50:55 | 000,607,260 | R--- | M] (Swearware) -- C:\Users\Michael&Mary\Desktop\dds.scr

[2012/06/26 10:56:38 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012/06/26 10:56:26 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012/06/26 10:56:19 | 3622,363,136 | -HS- | M] () -- C:\hiberfil.sys

[2012/06/26 10:46:20 | 100,725,600 | ---- | M] () -- C:\Windows\System32\drivers\AVG\incavi.avm

[2012/06/25 21:50:15 | 000,000,406 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{E5B68E09-26C2-423A-B845-02510555A17D}.job

[2012/06/25 16:33:53 | 000,664,798 | ---- | M] () -- C:\Windows\System32\drivers\AVG\iavichjg.avm

[2012/06/18 02:28:21 | 000,287,289 | ---- | M] () -- C:\Users\Michael&Mary\Documents\Bolt Type-Chart.pdf

[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/06/26 11:56:59 | 000,018,944 | ---- | C] () -- C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\800000cb.@

[2012/06/26 11:56:59 | 000,012,288 | ---- | C] () -- C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\80000000.@

[2012/06/26 11:56:57 | 000,001,648 | ---- | C] () -- C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\U\00000001.@

[2012/06/26 11:53:59 | 000,054,016 | ---- | C] () -- C:\Windows\System32\drivers\fnwg.sys

[2012/06/18 02:28:21 | 000,287,289 | ---- | C] () -- C:\Users\Michael&Mary\Documents\Bolt Type-Chart.pdf

[2012/01/10 16:45:11 | 000,002,048 | -HS- | C] () -- C:\Windows\Installer\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\@

[2012/01/10 16:45:11 | 000,002,048 | -HS- | C] () -- C:\Users\Michael&Mary\AppData\Local\{7545cdec-4528-ad10-63ef-2b0029fa9fc4}\@

[2011/12/16 18:35:42 | 000,000,358 | ---- | C] () -- C:\Users\Michael&Mary\AppData\Roaming\com.mcmguides.pdg.NCO.2011_state.xml

[2010/12/25 23:06:02 | 3622,363,136 | -HS- | C] () -- \hiberfil.sys

[2010/12/15 12:26:15 | 000,000,258 | RHS- | C] () -- C:\ProgramData\ntuser.pol

[2010/07/13 06:15:03 | 000,000,054 | ---- | C] () -- C:\Windows\System32\rp_stats.dat

[2010/07/13 06:15:03 | 000,000,039 | ---- | C] () -- C:\Windows\System32\rp_rules.dat

[2009/03/29 18:38:47 | 000,077,973 | ---- | C] () -- C:\Users\Michael&Mary\water2.jpg

[2009/03/29 18:38:29 | 000,048,359 | ---- | C] () -- C:\Users\Michael&Mary\water1.jpg

[2009/03/29 16:54:11 | 000,043,626 | ---- | C] () -- C:\Users\Michael&Mary\brook-header.jpg

[2009/01/24 11:01:45 | 000,000,094 | ---- | C] () -- C:\Users\Michael&Mary\couponmanager.properties

[2008/07/09 11:45:51 | 000,000,064 | ---- | C] () -- C:\Users\Michael&Mary\AppData\Roaming\Statdisk.prefs

[2008/05/22 22:43:15 | 000,000,058 | ---- | C] () -- C:\Users\Michael&Mary\1.feq

[2007/08/28 09:56:38 | 000,000,000 | ---- | C] () -- C:\Users\Michael&Mary\AppData\Roaming\wklnhst.dat

[2007/04/22 02:04:18 | 000,000,000 | RHS- | C] () -- \MSDOS.SYS

[2007/04/22 02:04:18 | 000,000,000 | RHS- | C] () -- \IO.SYS

[2006/12/26 04:00:36 | 000,008,192 | R-S- | C] () -- \BOOTSECT.BAK

[2006/12/26 04:00:34 | 000,333,257 | RHS- | C] () -- \bootmgr

[2006/11/02 05:23:09 | 000,000,074 | ---- | C] () -- \autoexec.bat

[2006/11/02 01:25:08 | 000,000,010 | ---- | C] () -- \config.sys

========== LOP Check ==========

[2009/03/28 15:04:54 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Alien Skin

[2008/12/15 21:26:07 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Amazon

[2012/05/24 19:14:52 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\AVG2012

[2011/01/04 19:36:41 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Barnes & Noble

[2011/02/26 02:04:51 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Catalina Marketing Corp

[2011/12/16 18:27:47 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\com.mcmguides.pdg.NCO.2011

[2008/03/14 20:35:39 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Design Science

[2010/01/18 15:50:31 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\E-centives

[2008/11/06 12:05:39 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\foobar2000

[2008/09/19 18:50:27 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Gamelab

[2008/06/03 14:02:17 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Hoyle Casino

[2008/06/03 13:22:55 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Hoyle FaceCreator

[2007/02/17 11:13:03 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\ICAClient

[2008/07/03 18:51:04 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Jane s Hotel Family Hero

[2009/03/21 20:45:23 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\KompoZer

[2008/05/20 09:24:45 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\LimeWire

[2008/11/11 13:08:02 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Math Mechanixs

[2007/04/21 00:06:26 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\muvee Technologies

[2011/03/02 22:04:39 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\PDG Studyware

[2008/12/19 14:21:57 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\PlayFirst

[2009/04/22 20:39:27 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\PoBros

[2007/03/12 09:48:59 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\PureEdge

[2010/06/02 13:16:01 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Skip-Bo

[2007/08/28 09:57:30 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Template

[2010/11/16 01:40:49 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\TweakNow PowerPack 2010

[2009/12/23 19:24:17 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\TweakNow RegCleaner

[2008/12/19 17:18:02 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Valusoft

[2008/09/24 08:05:12 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\Wildgames_JanesRealty

[2009/04/20 22:02:03 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\WildTangentv1002

[2007/07/12 15:29:45 | 000,000,000 | ---D | M] -- C:\Users\Michael&Mary\AppData\Roaming\WinBatch

[2012/06/26 10:55:22 | 000,032,622 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[2012/06/25 21:50:15 | 000,000,406 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{E5B68E09-26C2-423A-B845-02510555A17D}.job

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\ProgramData\TEMP:7E95B6FD

< End of report >

OTL Extras logfile created on: 6/26/2012 1:21:28 PM - Run 1