Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Win32/Kryptik.BCY Trojan [Solved]

Started by AnimeFanatic , May 16 2012 05:46 PM

This topic is locked

#16
jeffce

Posted 18 May 2012 - 01:18 PM

Trusted Helper

Malware Removal
216 posts

Hi,

Download Combofix from either of the links below, and save it to your desktop.
Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here

--------------------------------------------------------------------

Right-Click and Run as Administrator on ComboFix.exe & follow the prompts.

When finished, it will produce a report for you.
Please post the C:\ComboFix.txt for further review.

#17
AnimeFanatic

Posted 18 May 2012 - 01:49 PM

Member

Topic Starter
Member
15 posts

Ran ComboFix...tried getting on the internet to post the log, double clicked firefox and got a message saying illegal process on a file marked for deletion, the same thing happened when i tried IE...had to right click Firefox and run as administrator for it to work. Here is the ComboFix log:

ComboFix 12-05-18.03 - SainT 05/18/2012 15:24:44.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1041 [GMT -4:00]
Running from: c:\users\SainT\Desktop\ComboFix.exe
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
C:\data
c:\data\Lp_setup.exe
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\hpoddt01.exe.lnk
c:\users\SainT\AppData\Local\temp\jna3872126052583775411.dll
c:\users\SainT\AppData\Roaming\C2F886
.
.
((((((((((((((((((((((((( Files Created from 2012-04-18 to 2012-05-18 )))))))))))))))))))))))))))))))
.
.
2012-05-18 19:34 . 2012-05-18 19:34 -------- d-----w- c:\users\Uno\AppData\Local\temp
2012-05-18 19:34 . 2012-05-18 19:34 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-05-18 19:34 . 2012-05-18 19:34 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-17 19:26 . 2012-05-17 19:26 -------- d-----w- C:\_OTL
2012-05-10 03:27 . 2012-05-10 03:27 -------- d-----w- c:\program files\ESET
2012-05-06 20:55 . 2012-05-06 20:55 -------- d-----w- c:\program files\IK Multimedia
2012-05-06 20:26 . 2012-05-06 20:26 -------- d-----w- c:\users\SainT\AppData\Roaming\AVG2012
2012-05-06 20:25 . 2012-05-18 17:16 -------- d-----w- c:\windows\system32\drivers\AVG
2012-05-06 20:24 . 2012-05-06 20:24 -------- d-----w- c:\program files\AVG
2012-05-06 20:00 . 2012-05-18 09:17 -------- d-----w- c:\programdata\MFAData
2012-05-06 06:50 . 2012-05-06 06:50 -------- d-----w- c:\program files\uTorrent
2012-05-06 06:49 . 2012-05-16 19:31 -------- d-----w- c:\users\SainT\AppData\Roaming\uTorrent
2012-05-05 08:01 . 2012-05-05 08:01 4140192 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-05-03 16:51 . 2012-05-03 16:51 -------- d-----w- c:\users\SainT\AppData\Local\CRE
2012-04-30 23:17 . 2012-04-30 23:18 -------- d-----w- c:\programdata\Systweak
2012-04-30 23:16 . 2012-04-30 23:16 -------- d-----w- c:\windows\Repair
2012-04-30 23:16 . 2012-04-30 23:18 -------- d-----w- c:\users\SainT\AppData\Roaming\Systweak
2012-04-28 05:59 . 2012-04-18 07:06 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1046DDB8-7E3E-4383-835D-02ED704A48D1}\mpengine.dll
2012-04-26 04:48 . 2012-04-26 04:48 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-04-26 04:48 . 2012-04-26 04:48 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-26 04:48 . 2012-04-26 04:48 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-22 22:13 . 2012-04-22 22:13 -------- d-----w- c:\users\SainT\AppData\Local\ArcSoft
2012-04-22 22:13 . 2012-05-08 23:44 -------- d-----w- c:\programdata\ArcSoft
2012-04-22 22:13 . 2012-05-08 23:42 -------- d-----w- c:\program files\Common Files\ArcSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 08:01 . 2012-03-29 18:48 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 08:01 . 2011-05-18 17:27 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 19:56 . 2011-06-15 03:41 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-29 15:11 . 2012-04-12 07:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-12 07:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-12 07:11 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-12 07:11 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-02-28 01:18 . 2012-04-12 07:11 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-12 07:11 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 07:11 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-12 07:11 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-23 14:18 . 2009-10-02 19:26 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-21 23:06 . 2010-05-19 07:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2009-10-24 04:00 . 2011-12-03 23:09 5811712 ----a-w- c:\program files\Nexus.dll
2012-04-26 04:48 . 2011-05-02 02:20 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"EaseUs Watch"="c:\program files\EASEUS\Todo Backup\bin\EuWatch.exe" [2011-04-22 69000]
"EaseUs Tray"="c:\program files\EASEUS\Todo Backup\bin\TrayNotify.exe" [2011-04-26 733576]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-12-18 307200]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/w...a33b736828b7ee" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AOL Fast Start"="c:\progra~1\AOL9~1.0\AOL.EXE" [2006-10-21 50736]
.
c:\users\SainT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - r:\erunt\AUTOBACK.EXE [2005-10-20 38912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5.5ServiceManager]
2011-01-12 12:08 1523360 ----a-w- c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-09-27 11:22 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
2011-03-17 08:15 842048 ----a-w- c:\program files\DAEMON Tools Pro\DTAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\users\SainT\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
2005-12-18 19:18 307200 ----a-w- c:\program files\Syncrosoft\POS\H2O\cledx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2012-04-04 19:56 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MegakeyUpdater]
2011-01-13 05:38 64000 ----a-w- c:\users\SainT\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 01:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 20:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2008-09-30 19:06 485208 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-09-01 21:47 90448 ----a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 ADExchange;ArcSoft Exchange Service;c:\program files\Common Files\ArcSoft\esinter\Bin\eservutil.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-18 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 08:01]
.
2012-05-14 c:\windows\Tasks\HPCeeScheduleForSainT.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2006-12-28 23:04]
.
2009-09-28 c:\windows\Tasks\HPCeeScheduleFor©L°Se®.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2006-12-28 23:04]
.
2012-05-18 c:\windows\Tasks\User_Feed_Synchronization-{E19E73CE-0F1C-4E23-A916-63BE87006EDB}.job
- c:\windows\system32\msfeedssync.exe [2011-04-19 06:13]
.
.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Capture Web Page - c:\users\SainT\AppData\Local\Megamedia\Megakey\CaptureWebPage.htm
IE: Fetch to Megaupload - c:\users\SainT\AppData\Local\Megamedia\Megakey\MegaUpload.htm
IE: {{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\AVG\AVG2012\avgdtiex.dll
LSP: c:\programdata\Megamedia\Megakey\msadm.dll
TCP: DhcpNameServer = 167.206.254.1 167.206.254.2
FF - ProfilePath - c:\users\SainT\AppData\Roaming\Mozilla\Firefox\Profiles\arhq8zbo.default\
FF - prefs.js: browser.startup.homepage - aol.com
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-CPN Notifier - c:\program files\Cake Poker 2.0\PokerNotifier.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-18 15:38
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
EaseUs Tray = "c:\program files\EASEUS\Todo Backup\bin\TrayNotify.exe"?????????????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,55,1d,cd,08,64,f7,43,a1,ee,3f,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,52,55,1d,cd,08,64,f7,43,a1,ee,3f,\
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(5944)
c:\program files\Hewlett-Packard\HP Advisor\Pillars\Market\MLDeskBand.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\AVG\AVG2012\avgfws.exe
c:\program files\AVG\AVG2012\avgwdsvc.exe
c:\program files\Microsoft\BingBar\BBSvc.EXE
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\EASEUS\Todo Backup\bin\Agent.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\AVG\AVG2012\AVGIDSAgent.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\windows\system32\iashost.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2012-05-18 15:43:42 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-18 19:43
.
Pre-Run: 99,173,949,440 bytes free
Post-Run: 98,876,518,400 bytes free
.
- - End Of File - - FE4378D8E59D20F2E879755904B6EEAE

#18
jeffce

Posted 18 May 2012 - 01:50 PM

Trusted Helper

Malware Removal
216 posts

got a message saying illegal process on a file marked for deletion

Just go ahead and reboot your system and that should clear that up...it is not a problem.

#19
jeffce

Posted 19 May 2012 - 09:25 PM

Trusted Helper

Malware Removal
216 posts

Hi,

Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

ClearJavaCache::

RegLock::
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]

Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before following the steps below. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
----------

In your next reply please post the log made by ComboFix and let me know if AVG is still detecting that file.

#20
AnimeFanatic

Posted 19 May 2012 - 10:03 PM

Member

Topic Starter
Member
15 posts

Hi Jeff, i haven't seen AVG detect that file anymore. Here is the ComboFix log:

ComboFix 12-05-19.02 - SainT 05/19/2012 23:35:37.2.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.1.1033.18.2942.1329 [GMT -4:00]
Running from: c:\users\SainT\Desktop\ComboFix.exe
Command switches used :: c:\users\SainT\Desktop\CFScript.txt
AV: AVG Internet Security 2012 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
FW: AVG Firewall *Disabled* {621CC794-9486-F902-D092-0484E8EA828B}
SP: AVG Internet Security 2012 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\SainT\AppData\Local\temp\jna7324150688201182297.dll
.
.
((((((((((((((((((((((((( Files Created from 2012-04-20 to 2012-05-20 )))))))))))))))))))))))))))))))
.
.
2012-05-20 03:45 . 2012-05-20 03:45 -------- d-----w- c:\users\Uno\AppData\Local\temp
2012-05-20 03:45 . 2012-05-20 03:45 -------- d-----w- c:\users\Public\AppData\Local\temp
2012-05-20 03:45 . 2012-05-20 03:45 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-19 16:31 . 2012-05-19 16:31 -------- d-----w- c:\users\SainT\AppData\Local\HP Guide
2012-05-18 19:43 . 2012-05-20 03:53 -------- d-----w- c:\users\SainT\AppData\Local\temp
2012-05-17 19:26 . 2012-05-17 19:26 -------- d-----w- C:\_OTL
2012-05-10 03:27 . 2012-05-10 03:27 -------- d-----w- c:\program files\ESET
2012-05-06 20:55 . 2012-05-06 20:55 -------- d-----w- c:\program files\IK Multimedia
2012-05-06 20:26 . 2012-05-06 20:26 -------- d-----w- c:\users\SainT\AppData\Roaming\AVG2012
2012-05-06 20:25 . 2012-05-20 01:17 -------- d-----w- c:\windows\system32\drivers\AVG
2012-05-06 20:24 . 2012-05-06 20:24 -------- d-----w- c:\program files\AVG
2012-05-06 20:00 . 2012-05-20 01:17 -------- d-----w- c:\programdata\MFAData
2012-05-06 06:50 . 2012-05-06 06:50 -------- d-----w- c:\program files\uTorrent
2012-05-06 06:49 . 2012-05-16 19:31 -------- d-----w- c:\users\SainT\AppData\Roaming\uTorrent
2012-05-05 08:01 . 2012-05-05 08:01 4140192 ----a-w- c:\windows\system32\FlashPlayerInstaller.exe
2012-05-03 16:51 . 2012-05-03 16:51 -------- d-----w- c:\users\SainT\AppData\Local\CRE
2012-04-30 23:17 . 2012-04-30 23:18 -------- d-----w- c:\programdata\Systweak
2012-04-30 23:16 . 2012-04-30 23:16 -------- d-----w- c:\windows\Repair
2012-04-30 23:16 . 2012-04-30 23:18 -------- d-----w- c:\users\SainT\AppData\Roaming\Systweak
2012-04-28 05:59 . 2012-04-18 07:06 6734704 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{1046DDB8-7E3E-4383-835D-02ED704A48D1}\mpengine.dll
2012-04-26 04:48 . 2012-04-26 04:48 -------- d-----w- c:\program files\Mozilla Maintenance Service
2012-04-26 04:48 . 2012-04-26 04:48 157352 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice_installer.exe
2012-04-26 04:48 . 2012-04-26 04:48 129976 ----a-w- c:\program files\Mozilla Firefox\maintenanceservice.exe
2012-04-22 22:13 . 2012-04-22 22:13 -------- d-----w- c:\users\SainT\AppData\Local\ArcSoft
2012-04-22 22:13 . 2012-05-08 23:44 -------- d-----w- c:\programdata\ArcSoft
2012-04-22 22:13 . 2012-05-08 23:42 -------- d-----w- c:\program files\Common Files\ArcSoft
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 08:01 . 2012-03-29 18:48 419488 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-05-05 08:01 . 2011-05-18 17:27 70304 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-04-04 19:56 . 2011-06-15 03:41 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-02-29 15:11 . 2012-04-12 07:11 5120 ----a-w- c:\windows\system32\wmi.dll
2012-02-29 15:11 . 2012-04-12 07:11 172032 ----a-w- c:\windows\system32\wintrust.dll
2012-02-29 15:09 . 2012-04-12 07:11 157696 ----a-w- c:\windows\system32\imagehlp.dll
2012-02-29 13:32 . 2012-04-12 07:11 12800 ----a-w- c:\windows\system32\drivers\fs_rec.sys
2012-02-28 01:18 . 2012-04-12 07:11 1799168 ----a-w- c:\windows\system32\jscript9.dll
2012-02-28 01:11 . 2012-04-12 07:11 1427456 ----a-w- c:\windows\system32\inetcpl.cpl
2012-02-28 01:11 . 2012-04-12 07:11 1127424 ----a-w- c:\windows\system32\wininet.dll
2012-02-28 01:03 . 2012-04-12 07:11 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-02-23 14:18 . 2009-10-02 19:26 237072 ------w- c:\windows\system32\MpSigStub.exe
2012-02-21 23:06 . 2010-05-19 07:51 472808 ----a-w- c:\windows\system32\deployJava1.dll
2009-10-24 04:00 . 2011-12-03 23:09 5811712 ----a-w- c:\program files\Nexus.dll
2012-04-26 04:48 . 2011-05-02 02:20 97208 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-01-15 4874240]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-22 13539872]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-22 92704]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2006-09-28 65536]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"EaseUs Watch"="c:\program files\EASEUS\Todo Backup\bin\EuWatch.exe" [2011-04-22 69000]
"EaseUs Tray"="c:\program files\EASEUS\Todo Backup\bin\TrayNotify.exe" [2011-04-26 733576]
"H2O"="c:\program files\SyncroSoft\Pos\H2O\cledx.exe" [2005-12-18 307200]
"AdobeAAMUpdater-1.0"="c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2011-03-15 499608]
"SwitchBoard"="c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe" [2010-02-19 517096]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2011-10-24 421888]
"AVG_TRAY"="c:\program files\AVG\AVG2012\avgtray.exe" [2012-01-24 2416480]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"AvgUninstallURL"="start http://www.avg.com/w...a33b736828b7ee" [?]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AOL Fast Start"="c:\progra~1\AOL9~1.0\AOL.EXE" [2006-10-21 50736]
.
c:\users\SainT\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - r:\erunt\AUTOBACK.EXE [2005-10-20 38912]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"EnableLinkedConnections"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0c:\progra~1\AVG\AVG2012\avgrsx.exe /sync /restart
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5.5ServiceManager]
2011-01-12 12:08 1523360 ----a-w- c:\program files\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim]
2011-01-05 17:11 4321112 ----a-w- c:\program files\AIM\aim.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APSDaemon]
2011-09-27 11:22 59240 ----a-w- c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent]
2011-03-17 08:15 842048 ----a-w- c:\program files\DAEMON Tools Pro\DTAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
2007-01-01 21:22 3739648 ----a-w- c:\users\SainT\AppData\Roaming\Google\Google Talk\googletalk.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H2O]
2005-12-18 19:18 307200 ----a-w- c:\program files\Syncrosoft\POS\H2O\cledx.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes' Anti-Malware (reboot)]
2012-04-04 19:56 981680 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MegakeyUpdater]
2011-01-13 05:38 64000 ----a-w- c:\users\SainT\AppData\Local\Megamedia\Megakey\MegakeyUpdater.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Messenger (Yahoo!)]
2009-05-27 01:06 4351216 ----a-w- c:\program files\Yahoo!\Messenger\YahooMessenger.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
2009-07-26 20:44 3883856 ----a-w- c:\program files\Windows Live\Messenger\msnmsgr.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2008-09-30 19:06 485208 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RIMBBLaunchAgent.exe]
2011-09-01 21:47 90448 ----a-w- c:\program files\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R2 ADExchange;ArcSoft Exchange Service;c:\program files\Common Files\ArcSoft\esinter\Bin\eservutil.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-05 257696]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
Contents of the 'Scheduled Tasks' folder
.
2012-05-20 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-29 08:01]
.
2012-05-14 c:\windows\Tasks\HPCeeScheduleForSainT.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2006-12-28 23:04]
.
2009-09-28 c:\windows\Tasks\HPCeeScheduleFor©L°Se®.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2006-12-28 23:04]
.
2012-05-20 c:\windows\Tasks\User_Feed_Synchronization-{E19E73CE-0F1C-4E23-A916-63BE87006EDB}.job
- c:\windows\system32\msfeedssync.exe [2011-04-19 06:13]
.
.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=desktop
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Capture Web Page - c:\users\SainT\AppData\Local\Megamedia\Megakey\CaptureWebPage.htm
IE: Fetch to Megaupload - c:\users\SainT\AppData\Local\Megamedia\Megakey\MegaUpload.htm
IE: {{68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - {68BCFFE1-A2DA-4B40-9068-87ECBFC19D16} - c:\program files\AVG\AVG2012\avgdtiex.dll
LSP: c:\programdata\Megamedia\Megakey\msadm.dll
TCP: DhcpNameServer = 167.206.254.1 167.206.254.2
FF - ProfilePath - c:\users\SainT\AppData\Roaming\Mozilla\Firefox\Profiles\arhq8zbo.default\
FF - prefs.js: browser.startup.homepage - aol.com
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false);user_pref(network.protocol-handler.warn-external.dnupdate, false
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-05-19 23:53
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
EaseUs Tray = "c:\program files\EASEUS\Todo Backup\bin\TrayNotify.exe"?????????????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'Explorer.exe'(6104)
c:\program files\Hewlett-Packard\HP Advisor\Pillars\Market\MLDeskBand.dll
.
------------------------ Other Running Processes ------------------------
.
c:\progra~1\AVG\AVG2012\avgrsx.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\system32\nvvsvc.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
c:\program files\AVG\AVG2012\avgfws.exe
c:\program files\AVG\AVG2012\avgwdsvc.exe
c:\program files\Microsoft\BingBar\BBSvc.EXE
c:\program files\Microsoft\BingBar\SeaPort.EXE
c:\program files\EASEUS\Todo Backup\bin\Agent.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
c:\program files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
c:\program files\AVG\AVG2012\avgnsx.exe
c:\program files\AVG\AVG2012\avgemcx.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\AVG\AVG2012\AVGIDSAgent.exe
c:\windows\system32\iashost.exe
c:\program files\AVG\AVG2012\avgcsrvx.exe
c:\windows\RtHDVCpl.exe
c:\windows\System32\rundll32.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\Hewlett-Packard\HP Health Check\hphc_service.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Completion time: 2012-05-19 23:58:36 - machine was rebooted
ComboFix-quarantined-files.txt 2012-05-20 03:58
ComboFix2.txt 2012-05-18 19:43
.
Pre-Run: 99,182,149,632 bytes free
Post-Run: 98,937,397,248 bytes free
.
- - End Of File - - DA6E0E4AC7E18198EE3D4F4A33E59DD6

#21
jeffce

Posted 20 May 2012 - 07:13 AM

Trusted Helper

Malware Removal
216 posts

Hi,

i haven't seen AVG detect that file anymore.

Great!

-------------

Please download JavaRa to your desktop and unzip it to its own
folder

Run JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista), pick the language of your choice and click Select. Then
click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe (double-click for XP/right-click and Run as Administrator for Vista) again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest
Java Runtime Environment (JRE) version for your computer.

----------

Please open OTL.

Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, click the None button near the top (it may looked greyed out)
In the Extra Registry section change it to All
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

When the scan completes, it will open 2 notepad windows, OTL.Txt and Extra.txt. Please post the Extra.txt.
----------

#22
AnimeFanatic

Posted 20 May 2012 - 07:37 AM

Member

Topic Starter
Member
15 posts

Good morning Jeff, here is the Extra.txt you requested:

OTL Extras logfile created on: 5/20/2012 9:33:21 AM - Run 4
OTL by OldTimer - Version 3.2.43.0 Folder = C:\Users\SainT\Desktop
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.87 Gb Total Physical Memory | 1.86 Gb Available Physical Memory | 64.69% Memory free
5.95 Gb Paging File | 4.95 Gb Available in Paging File | 83.17% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 226.62 Gb Total Space | 92.59 Gb Free Space | 40.86% Space Free | Partition Type: NTFS
Drive D: | 6.26 Gb Total Space | 0.59 Gb Free Space | 9.39% Space Free | Partition Type: NTFS
Drive R: | 698.63 Gb Total Space | 264.37 Gb Free Space | 37.84% Space Free | Partition Type: NTFS

Computer Name: HOME-PC | User Name: SainT | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Extra Registry (All) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.bat [@ = batfile] -- "%1" %*
.chm [@ = chm.file] -- C:\Windows\hh.exe (Microsoft Corporation)
.cmd [@ = cmdfile] -- "%1" %*
.com [@ = ComFile] -- "%1" %*
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.exe [@ = exefile] -- "%1" %*
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.hta [@ = htafile] -- C:\Windows\System32\mshta.exe (Microsoft Corporation)
.html [@ = aolfile_HTM] -- C:\Program Files\AOL 9.0\aol.exe (AOL, LLC.)
.inf [@ = inffile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.ini [@ = inifile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.url [@ = InternetShortcut] -- C:\Windows\System32\rundll32.exe (Microsoft Corporation)
.js [@ = JSFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.jse [@ = JSEFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.pif [@ = piffile] -- "%1" %*
.reg [@ = regfile] -- C:\Windows\regedit.exe (Microsoft Corporation)
.scr [@ = scrfile] -- "%1" /S
.txt [@ = txtfile] -- C:\Windows\System32\NOTEPAD.EXE (Microsoft Corporation)
.vbe [@ = VBEFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.vbs [@ = VBSFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsf [@ = WSFFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)
.wsh [@ = WSHFile] -- C:\Windows\System32\WScript.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
batfile [open] -- "%1" %*
batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
chm.file [open] -- "%SystemRoot%\hh.exe" %1 (Microsoft Corporation)
cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
cmdfile [open] -- "%1" %*
cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htafile [open] -- C:\Windows\system32\mshta.exe "%1" %* (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation)
https [open] -- C:\PROGRA~1\AOL9~1.0\aol.exe -u"%1" (AOL, LLC.)
inffile [install] -- %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection DefaultInstall 132 %1 (Microsoft Corporation)
inffile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 (Microsoft Corporation)
inffile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
inifile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
inifile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsfile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
jsefile [edit] -- C:\Windows\System32\Notepad.exe %1 (Microsoft Corporation)
jsefile [open] -- C:\Windows\System32\WScript.exe "%1" %* (Microsoft Corporation)
jsefile [print] -- C:\Windows\System32\Notepad.exe /p %1 (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [edit] -- %SystemRoot%\system32\notepad.exe "%1" (Microsoft Corporation)
regfile [open] -- regedit.exe "%1" (Microsoft Corporation)
regfile [merge] -- Reg Error: Key error.
regfile [print] -- %SystemRoot%\system32\notepad.exe /p "%1" (Microsoft Corporation)
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 (Microsoft Corporation)
txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 (Microsoft Corporation)
txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" (Microsoft Corporation)
vbefile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbefile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbefile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
vbsfile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
vbsfile [open] -- %SystemRoot%\System32\WScript.exe "%1" %* (Microsoft Corporation)
vbsfile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wsffile [edit] -- "%SystemRoot%\System32\Notepad.exe" %1 (Microsoft Corporation)
wsffile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
wsffile [print] -- "%SystemRoot%\System32\Notepad.exe" /p %1 (Microsoft Corporation)
wshfile [open] -- "%SystemRoot%\System32\WScript.exe" "%1" %* (Microsoft Corporation)
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- C:\Program Files\Adobe\Adobe Bridge CS5.1\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\CA Personal Firewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\EarthLink TotalAccess\TaskPanl.exe" = C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink -- (EarthLink, Inc.)

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B0EBBB4-98C1-4272-9653-937913F87EFE}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{0B0FB93B-12BA-45F2-B115-3EAC84908077}" = lport=10243 | protocol=6 | dir=in | app=system |
"{22778E6E-36E2-406C-A0E2-AF042C8BCED8}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{37F929F7-7CF1-4BE8-BDD7-4793D776BB37}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{38A983F9-A4F4-4551-9779-A879C0250A04}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{4A672F67-F4F2-46F2-B179-DDFD6D3E2325}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{5BB14E86-3113-4E55-9CB4-D52B14FA649A}" = lport=23426 | protocol=6 | dir=in | name=utorrent |
"{6232B3D1-B6F2-493B-A6D8-8DD14C0FFEA0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{63C09D63-A1C2-4689-B138-9907A7E9F1E7}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6A50F911-6902-4D90-82B2-FA8F6C843AC3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6B8CD65B-BD47-4C43-96B0-1016650EA35C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{78A32FF2-22E0-4FB8-A558-173A667FA5D2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{82D69C79-478F-4F36-8859-F82D7BEC357E}" = lport=4482 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{88760A9F-A081-414D-9E8E-6CCF898952BA}" = lport=4481 | protocol=17 | dir=in | name=blackberry desktop software wireless music sync discovery |
"{8EB2E988-F4AF-487F-81FF-B002DA03E0F1}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{9D441B67-D6F5-4463-BB50-6148493D11A8}" = rport=10243 | protocol=6 | dir=out | app=system |
"{A2E61265-3544-4988-BE31-8D44A7CB3E4A}" = lport=40279 | protocol=6 | dir=in | name=limewire |
"{BF7DEA81-269A-4CE0-A688-834D7F1054CF}" = lport=4481 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{CC3CDE73-DC05-44F0-8E1A-F7010D24C992}" = lport=4482 | protocol=6 | dir=in | name=blackberry desktop software wireless music sync data transfer |
"{E669C7D8-54C1-4AE6-8F17-4F606B3BFABF}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{E8D9C041-A76B-43A6-92C3-0F21D4AB29EE}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F1A784DE-3B07-4688-98FE-5CBD7A6CA04D}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{F677A1B3-D6D4-49C6-B4B6-B111CC86618B}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F7B826ED-DB4E-43D0-93D2-7059134D341C}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{F8001959-813A-4ABB-902F-357AD3BAE3BA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00838E70-982C-45F3-B8DA-AF75B81F6430}" = protocol=6 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{00F21BB4-1A38-4236-BA94-1D88644EA1A8}" = protocol=6 | dir=in | app=c:\program files\aim\aim.exe |
"{07D04B80-3EC5-4C14-BB00-9E1258A17108}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{0F9EDACA-2DFC-439A-B029-749FD9C63F8C}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{100B32D6-1DFE-4390-BC59-EE828DE37EFC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{101337E3-C053-4AED-AE17-4E675B456EE1}" = protocol=17 | dir=in | app=c:\program files\aol 9.0\waol.exe |
"{145CBC4C-4B27-42BB-B8D3-B3134460B16E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{175B0CF2-C2D3-453D-A8C0-412653BC79EF}" = protocol=6 | dir=out | app=system |
"{19940095-40B8-496A-8AB2-6D55E0E0A685}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{1A553CE1-9082-45A3-A224-42CB6029E358}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{1C28696A-B8D6-4F64-869D-1A3650ABE78E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1C4D1198-FFBF-4944-8643-1D3DA25C9E4A}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{1E6D5F5B-88DA-4B2E-8593-27A43DAEB97C}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{203326C4-49A6-4B1D-8DB6-46F60E879D88}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{230E9031-0E76-419A-9E54-C199B94D33A3}" = protocol=17 | dir=in | app=c:\program files\aim\aim.exe |
"{23185C78-63DF-4FBB-BA2B-2B92BE3BFBE5}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe |
"{266C5DD4-2944-4048-A8B0-4C8664D3B356}" = protocol=17 | dir=in | app=c:\program files\common files\aol\system information\sinf.exe |
"{28311210-F7EE-4016-833F-B5D4D154DEF4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{29BE6376-378D-4216-9E52-C65F30EE78B2}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
"{32F77728-5AE0-4401-BFB8-1F3E50F344FF}" = protocol=6 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{355014B3-464D-4767-B8A8-0120D549F4B1}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgnsx.exe |
"{3609C064-4670-4FF9-9CBB-90673011A50B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3D87DBD5-4913-493A-8CEF-F794FD6BFB4F}" = protocol=6 | dir=in | app=c:\program files\research in motion\blackberry desktop\rim.desktop.exe |
"{40F4689B-D29C-4824-8445-18F13E32C0A6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{46A9199C-069B-48A8-877D-515B886805AB}" = protocol=17 | dir=in | app=c:\program files\research in motion\blackberry desktop\rim.desktop.exe |
"{48FBB6B7-1F92-4377-BD4E-FF49B08E9106}" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{4930B2A9-4D79-44C8-AA43-9612F55D0C8E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4A5F8544-74FF-4FCE-AFC0-7F74850CA2F5}" = protocol=17 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{54FBF7DD-429E-4A14-A35C-29D534BEFCEA}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
"{60B55825-C6E0-415C-8C0E-07686521D70E}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{618FA9A5-1136-4B49-AA34-2FC62ED080E1}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgdiagex.exe |
"{6B9F68EA-EA32-449A-A64E-FBF285633820}" = protocol=6 | dir=in | app=c:\program files\aol 9.0\waol.exe |
"{6C4CA723-8EAB-4B4C-A027-393CF965DC8B}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{6D2B6600-AE32-4F52-B5B8-6501BA88F5E5}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
"{733BAF0D-0C9F-4AE6-8894-02C0A0853AF3}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{99EB0D33-7DF1-49FF-B233-8966907C5A80}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{A1B3FF47-5E9B-4865-A55C-267CA6EFFE31}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aoldial.exe |
"{A4E2CD94-03B0-43DB-B41D-4238B41509A2}" = protocol=6 | dir=in | app=c:\program files\common files\aol\topspeed\3.0\aoltpsd3.exe |
"{A50FAA61-49DD-411A-8EC5-3CA8B5C10307}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A7577D8E-D58C-4C94-AA61-3D953BF9396E}" = protocol=17 | dir=in | app=c:\program files\common files\aol\1170385710\ee\aolsoftware.exe |
"{A8B1324D-CD5D-4F8A-B7FE-617B05A7D6F0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{B984453F-4E6C-40D8-8101-E812ED4E3DBA}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{BA4B91C9-B680-4632-AAFE-692BF4045CFB}" = protocol=17 | dir=in | app=c:\program files\dna\btdna.exe |
"{BCC54F76-67A7-4283-A957-2671ED994437}" = protocol=17 | dir=in | app=c:\program files\intertops poker\pokerclient.exe |
"{BDB1E95A-8498-4F99-A1B9-D13A8468C636}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BED98894-5180-4DDC-9E23-6B8202A086C0}" = protocol=6 | dir=in | app=c:\program files\common files\aol\1170385710\ee\aolsoftware.exe |
"{C64FF289-571F-4857-97AD-68D188C2139C}" = protocol=6 | dir=in | app=c:\program files\intertops poker\pokerclient.exe |
"{C9F39578-E24C-4CC2-97D8-88801E87CAFD}" = protocol=6 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{CABD58A8-9419-44E9-A138-E37D9D00D7D4}" = protocol=17 | dir=in | app=c:\program files\cake poker 2.0\pokerclient.exe |
"{D945D22B-E976-4C18-AEBD-FD91081E6158}" = protocol=17 | dir=in | app=c:\program files\common files\aol\loader\aolload.exe |
"{DA6D452B-456E-48F4-92E8-4A3C0095417D}" = protocol=6 | dir=in | app=c:\program files\dna\btdna.exe |
"{DC138957-06CD-4B55-9701-6BFEAD72E318}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E361035F-AB12-4ADF-977E-91CAFB56CCF5}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{E3B98F56-099A-4297-BDD6-772CB9D22D1F}" = protocol=17 | dir=in | app=c:\program files\common files\aol\acs\aolacsd.exe |
"{E4927D7A-2867-4852-B439-D0EA34CF21A4}" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"{E7D758B8-EC78-4AE6-9160-CE275424E562}" = protocol=6 | dir=in | app=c:\program files\cake poker 2.0\pokerclient.exe |
"{E98FA55F-C187-4783-8CD0-41E72F056C8E}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgemcx.exe |
"{F5CEB000-C2E0-4898-9C0F-7FC12A8FA059}" = protocol=17 | dir=in | app=c:\program files\earthlink totalaccess\taskpanl.exe |
"{F753BE78-2081-4B20-9373-6C79921CD737}" = protocol=6 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
"{F9B73A80-5CB3-4109-AEAF-FFC440A62E88}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{FC912EAD-AB68-4401-A404-4810499FDE85}" = protocol=17 | dir=in | app=c:\program files\avg\avg2012\avgmfapx.exe |
"TCP Query User{526D52B9-F61E-4EE0-9B1C-80DA4E71F826}C:\program files\sopcast\adv\sopadver.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |
"TCP Query User{AF3EB264-C573-4075-83D3-CA3919F40D78}C:\program files\sopcast\sopcast.exe" = protocol=6 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{40CD11E9-6B72-4E19-8322-1EFDBCA4933C}C:\program files\sopcast\sopcast.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\sopcast.exe |
"UDP Query User{FDA39BD4-7065-45B5-8035-08E64D35886B}C:\program files\sopcast\adv\sopadver.exe" = protocol=17 | dir=in | app=c:\program files\sopcast\adv\sopadver.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}" = Status
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0373779B-A362-4B2E-B8E9-7442F19F9394}" = HP Total Care Advisor
"{0394CDC8-FABD-4ed8-B104-03393876DFDF}" = Roxio Creator Tools
"{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC
"{0886900B-B2F3-452C-B580-60F1253F7F80}" = Native Instruments Controller Editor
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D397393-9B50-4c52-84D5-77E344289F87}" = Roxio Creator Data
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox
"{11F93B4B-48F0-4A4E-AE77-DFA96A99664B}" = Roxio Creator EasyArchive
"{147944FC-6A9E-4DD9-9EC3-A242EE6C16FD}" = BlackBerry App World Browser Plugin
"{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD
"{15262012-213A-4f65-9019-C8A409EC0156}" = HP Officejet J6400 Series
"{18669FF9-C8FE-407a-9F70-E674896B1DB4}" = GPBaseService
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{237CD223-1B9D-47E8-A76C-E478B83CCEA2}" = File Uploader
"{254C37AA-6B72-4300-84F6-98A82419187E}" = ActiveCheck component for HP Active Support Library
"{2614F54E-A828-49FA-93BA-45A3F756BFAA}" = 32 Bit HP CIO Components Installer
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java™ 6 Update 31
"{279D3818-7287-4ab4-A927-542EBEA9E365}" = ProductContext
"{27CC6AB1-E72B-4179-AF1A-EAE507EBAF51}_is1" = ConvertHelper 2.2
"{2930FB47-6452-4476-BF16-D77F748646DB}" = Native Instruments Guitar Rig Mobile IO Driver
"{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2FA94A64-C84E-49d1-97DD-7BF06C7BBFB2}.WildTangent Games App" = Update Installer for WildTangent Games App
"{34BFB099-07B2-4E95-A673-7362D60866A2}" = PSSWCORE
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{3700194C-C5DD-439A-BE06-A66960CA4C70}" = MSVCSetup
"{380CC749-8C28-4C74-BE01-45921D062302}" = BPDSoftware_Ini
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3B6E3FC6-274C-4B6C-BC85-5C3B15DE18E2}" = Mega Manager
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{40F7AED3-0C7D-4582-99F6-484A515C73F2}" = HP Easy Setup - Frontend
"{41853D20-40CC-4266-978D-F128BB97CA96}" = 6400_Help
"{423C4130-EBC3-410A-B3A0-37BBF9D607D5}" = T-RackS 3 Deluxe
"{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore
"{44CDBD1B-89FB-4E02-8319-2A4C550F664A}" = RTC Client API v1.2
"{45338B07-A236-4270-9A77-EBB4115517B5}" = Windows Live Sign-in Assistant
"{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A70EF07-7F88-4434-BB61-D1DE8AE93DD4}" = SolutionCenter
"{4EFC72DA-2314-4E5D-AC8E-1C954CDB8BBF}" = AVG 2012
"{4F1CECBC-670F-4DAA-81D6-944B12450917}" = DIGOpt
"{5109C064-813E-4e87-B0DE-C8AF7B5BC02B}" = SmartWebPrintingOC
"{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001
"{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}" = HP Picasso Media Center Add-In
"{5BB4D7C1-52F2-4BFD-9E40-0D419E2E3021}" = bpd_scan
"{5D934326-165A-413b-B056-26BE1EC082AF}" = J6400
"{5DAA9C36-8F8B-462F-8CCA-E205BC3751F5}" = HP Active Support Library
"{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA
"{607169F0-07F6-4797-99D2-D5E7C4715E20}" = Mega Manager
"{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}" = Roxio Creator Copy
"{628AA77D-DFC9-4B3D-BE8E-CF9F7CD4C3C7}" = BlackBerry Device Software Updater
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{63FF21C9-A810-464F-B60A-3111747B1A6D}" = GPBaseService2
"{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr
"{6559654F-2F38-491F-8411-211517C3E635}" = SampleTank 2
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{669D4A35-146B-4314-89F1-1AC3D7B88367}" = HPAsset component for HP Active Support Library
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{676981B7-A2D9-49D0-9F4C-03018F131DA9}" = DocProc
"{687FEF8A-8597-40b4-832C-297EA3F35817}" = BufferChm
"{691B06EC-F84C-4103-B4D4-3FC5BC4941E9}" = OLYMPUS muvee theaterPack
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6D52C408-B09A-4520-9B18-475B81D393F1}" = Microsoft Works
"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = HP Photo and Imaging 2.0 - All-in-One Drivers
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{70B446D1-E03B-4ab0-9B3C-0832142C9AA8}.WildTangent Games App-hp" = WildTangent Games App (HP Games)
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75E71ADD-042C-4F30-BFAC-A9EC42351313}" = Python 2.4.3
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7930FB47-6452-4476-BF16-D77F748646DB}" = Native Instruments Guitar Rig Session IO Driver
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan
"{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}" = Windows Live Essentials
"{82BEEB3F-D0BF-42EE-8739-F4827C4805B7}" = VirtualDJ PRO Full
"{82DFB852-9594-4668-9C66-28BB6E94BCB2}" = hp psc 2100 series
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83FFCFC7-88C6-41c6-8752-958A45325C82}" = Roxio Creator Audio
"{85C8D391-0EAE-4492-8A0A-2EE8B0B6DA03}" = BPDSoftware
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS
"{8A62A068-3FD6-495A-9F66-26FE94F32EC9}" = Rhapsody Player Engine
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8A85DEAD-7C1F-4368-881C-72AC74CB2E91}" = UnloadSupport
"{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini
"{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui
"{9158FF30-78D7-40EF-B83E-451AC5334640}" = Adobe Photoshop CS5.1
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = HP Photo and Imaging 2.0 - All-in-One
"{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}" = TrayApp
"{9DBA770F-BF73-4D39-B1DF-6035D95268FC}" = HP Customer Feedback
"{A7836FF5-7293-40A4-B86E-E2038F82E8F3}" = AVG 2012
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{A85FD55B-891B-4314-97A5-EA96C0BD80B5}" = Windows Live Messenger
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AB5E289E-76BF-4251-9F3F-9B763F681AE0}" = HP Customer Experience Enhancements
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.3)
"{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK
"{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI
"{B23F12D4-17DE-453A-B1F4-55E501FE0EBF}" = BBSAK
"{B4089055-D468-45A4-A6BA-5A138DD715FC}" = Bing Bar
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B83A15A7-2BD5-4416-BC43-AF5F9A4B08A9}" = muvee autoProducer 5.0
"{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}" = HPSSupply
"{B962AD08-335F-46f7-A182-257D37672E5C}" = Native Instruments Rig Kontrol 3 Driver
"{BA0D0121-A3BA-487D-9C78-7AB0E676C722}" = Miroslav Philharmonik
"{BAD0FA60-09CF-4411-AE6A-C2844C8812FA}" = HP Photosmart Essential 2.5
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{C3DC29BC-A8CF-4578-9DFC-37F049C44771}" = OcxSetup
"{C4124E95-5061-4776-8D5D-E3D931C778E1}" = Microsoft VC9 runtime libraries
"{C43326F5-F135-4551-8270-7F7ABA0462E1}" = HPProductAssistant
"{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}" = Roxio Creator Basic v9
"{C8FD5BC1-92EF-4C15-92A9-F9AC7F61985F}" = HP Update
"{CCB9B81A-167F-4832-B305-D2A0430840B3}" = WebReg
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CF40ACC5-E1BB-4aff-AC72-04C2F616BCA7}" = getPlus®
"{D142FE39-3386-4d82-9AD3-36D4A92AC3C2}" = DocMgr
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2E0F0CC-6BE0-490b-B08B-9267083E34C9}" = MarketResearch
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Kodak EasyShare software
"{D45E8C45-B601-4A80-AFD8-E16338744DE1}" = ArcSoft Panorama Maker 4
"{D6843E88-AFE9-47AC-A024-5C0D79D1E93A}" = BlackBerry v4.2.2 for the 8310 Series Wireless Handheld
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{D99A8E3A-AE5A-4692-8B19-6F16D454E240}" = Destination Component
"{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{E08DC77E-D09A-4e36-8067-D6DBBCC5F8DC}" = VideoToolkit01
"{E1180142-3B31-4DCC-9D27-7AC2D37662BF}" = LightScribe 1.4.124.1
"{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{EEEB604C-C1A7-4f8c-B03F-56F9C1C9C45F}" = Fax
"{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}" = DeviceDiscovery
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0FC1E09-AF67-47BC-9E61-90ECFEB4CE82}" = OLYMPUS Master 2
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase
"{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK
"{F6BD194C-4190-4D73-B1B1-C48C99921BFE}" = Windows Live Call
"{F909BB1B-3FC1-4EDA-AF1F-8F1A89163591}" = BlackBerry Desktop Software 6.1
"{F94234DB-FD06-42C3-B88D-6FC4DC9F988C}" = HP Easy Setup - Core
"{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"8F14F2ECEDE68D26EA515B48DC25B39103C4FE8D" = Windows Driver Package - Leapfrog (Leapfrog-USBLAN) Net (09/10/2009 02.03.05.012)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"AIM_7" = AIM 7
"AOL Uninstaller" = AOL Uninstaller (Choose which Products to Remove)
"ASIO4ALL" = ASIO4ALL
"AVG" = AVG 2012
"BlackBerry_Desktop" = BlackBerry Desktop Software 6.1
"CCleaner" = CCleaner
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1" = Soft Data Fax Modem with SmartCP
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.56
"DAEMON Tools Pro" = DAEMON Tools Pro
"DriverAgent.exe" = DriverAgent by eSupport.com
"Drumaxx" = Drumaxx
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 8.0.1 Home Edition
"EASEUS Todo Backup Free 2.5.1_is1" = EASEUS Todo Backup Free 2.5.1
"East West EWQLSO Gold Edition" = East West EWQLSO Gold Edition
"Edirol HQ Orchestral v1.01" = Edirol HQ Orchestral v1.01
"ERUNT_is1" = ERUNT 1.1j
"ESET Online Scanner" = ESET Online Scanner v3
"Free Mp3 Wma Converter_is1" = Free Mp3 Wma Converter V 1.9
"HP Document Manager" = HP Document Manager 1.0
"HP Imaging Device Functions" = HP Imaging Device Functions 10.0
"HP Photosmart Essential" = HP Photosmart Essential 2.5
"HP PSC 2100 Series" = HP Photo and Imaging 2.0 - hp psc 2100 series
"HP Smart Web Printing" = HP Smart Web Printing
"HP Solution Center & Imaging Support Tools" = HP Solution Center 13.0
"HPExtendedCapabilities" = HP Customer Participation Program 10.0
"HPOCR" = OCR Software by I.R.I.S. 10.0
"HS2_is1" = Steinberg Hypersonic 2
"IL Download Manager" = IL Download Manager
"iTLG Grade 3" = iTLG Grade 3
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"Luxonix Purity VSTi_is1" = Luxonix Purity VSTi v1.1.2
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.61.0.1400
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 12.0 (x86 en-US)" = Mozilla Firefox 12.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MSNINST" = MSN
"Native Instruments Controller Editor" = Native Instruments Controller Editor
"Native Instruments Guitar Rig Mobile IO Driver" = Native Instruments Guitar Rig Mobile IO Driver
"Native Instruments Guitar Rig Session IO Driver" = Native Instruments Guitar Rig Session IO Driver
"Native Instruments Rig Kontrol 3 Driver" = Native Instruments Rig Kontrol 3 Driver
"Nero8Lite_is1" = Nero 8 Lite 8.1.1.3
"NVIDIA Drivers" = NVIDIA Drivers
"PC-Doctor 5 for Windows" = Hardware Diagnostic Tools
"PoiZone" = PoiZone
"PS3 Media Server" = PS3 Media Server
"Quickstudy Trigonometry" = Quickstudy Trigonometry
"reFX Nexus_is1" = reFX Nexus VSTi RTAS v2.2.0
"reFX Vanguard 1.7.2_is1" = reFX Vanguard 1.7.2
"Sakura" = Sakura
"Sawer" = Sawer
"Shop for HP Supplies" = Shop for HP Supplies
"Smart Defrag 2_is1" = Smart Defrag 2
"SoftwareUpdUtility" = Download Updater (AOL LLC)
"Sonik Synth 2" = Sonik Synth 2
"Sonnox Oxford R3 Dynamics Native VST_is1" = Sonnox Oxford R3 Dynamics Native VST v1.3.1
"Sonnox Oxford R3 EQ Native VST_is1" = Sonnox Oxford R3 EQ Native VST v1.6.1
"Sonnox Oxford TransMod Native VST_is1" = Sonnox Oxford TransMod Native VST v1.3.1
"SopCast" = SopCast 3.2.9
"SyncroSoft Emu" = SyncroSoft Emu (Remove only)
"Syncrosoft's License Control" = Syncrosoft's License Control
"Toxic Biohazard" = Toxic Biohazard
"Trilogy_is1" = Trilogy
"Ultra DVD Creator_is1" = Ultra DVD Creator 2.6.1008
"uTorrent" = µTorrent
"Verizon Online DSL_is1" = Verizon Online DSL
"Verizon SmartCall" = Verizon SmartCall
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"Wave Arts Power Suite" = Wave Arts Power Suite
"Waves Complete V8_is1" = Waves Complete v8.0.11
"WildTangent hp Master Uninstall" = HP Games
"WildTangent hpdesktop Master Uninstall" = My HP Games
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR archiver
"WTA-2ca5214a-b728-4930-a0a4-c5137f81d1e6" = Jojo's Fashion Show 2 - Las Cruces
"WTA-33256b79-b23d-4122-8547-0e49a6ff0ebc" = Smiling Pasta
"WTA-59f950af-1c09-498b-9fcb-104f6958a64c" = Wedding Salon
"WTA-8c6dda01-0344-4174-9efb-ee459773ed4a" = Ice Cream Mania
"WTA-e7959e2e-7552-4e60-88ce-abcafb30fc49" = Blue's Clues: Meet Blue's Baby Brother
"Yahoo! Companion" = Yahoo! Toolbar
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Mail" = Yahoo! Internet Mail
"Yahoo! Messenger" = Yahoo! Messenger
"Yahoo! Toolbar" = Yahoo! Toolbar
"YInstHelper" = Yahoo! Install Manager

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{226b64e8-dc75-4eea-a6c8-abcb496320f2}-Google Talk" = Google Talk (remove only)
"a083cadcaa9fb6fb" = Prn File sender
"Facebook Plug-In" = Facebook Plug-In
"Megakey" = Megakey
"Yahoo! BrowserPlus" = Yahoo! BrowserPlus 2.9.2

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 5/20/2012 8:41:39 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 8:46:39 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 8:51:40 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 8:56:40 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 9:01:40 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 9:06:40 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 9:11:41 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 9:16:41 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 9:21:41 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

Error - 5/20/2012 9:26:43 AM | Computer Name = Home-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Failed launching Automatic LiveUpdate: err:0x3fa;
Illegal operation attempted on a registry key that has been marked for deletion.

[ Media Center Events ]
Error - 12/21/2008 4:35:47 PM | Computer Name = Home-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 4/29/2009 10:28:08 PM | Computer Name = Home-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

Error - 7/20/2009 9:17:58 PM | Computer Name = Home-PC | Source = MCUpdate | ID = 0
Description = DownloadPackgeTask.SubTasksComplete: failed downloading package SportsSchedule.

[ System Events ]
Error - 5/19/2012 11:52:33 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 5/19/2012 11:52:33 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 5/19/2012 11:52:40 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 5/19/2012 11:52:40 PM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7026
Description =

Error - 5/20/2012 9:27:47 AM | Computer Name = Home-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 5/20/2012 9:28:02 AM | Computer Name = Home-PC | Source = volmgr | ID = 262190
Description = Crash dump initialization failed!

Error - 5/20/2012 9:29:40 AM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 5/20/2012 9:29:40 AM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7000
Description =

Error - 5/20/2012 9:29:45 AM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7022
Description =

Error - 5/20/2012 9:29:45 AM | Computer Name = Home-PC | Source = Service Control Manager | ID = 7026
Description =

< End of report >

#23
jeffce

Posted 20 May 2012 - 12:26 PM

Trusted Helper

Malware Removal
216 posts

Thanks... that is just what I wanted to see.

How is your system running?

#24
AnimeFanatic

Posted 20 May 2012 - 12:29 PM

Member

Topic Starter
Member
15 posts

Thanks... that is just what I wanted to see.

How is your system running?

System is running in tip top shape thanks to your expertise :thumbsup:

#25
jeffce

Posted 20 May 2012 - 12:55 PM

Trusted Helper

Malware Removal
216 posts

System is running in tip top shape

Providing there are no other malware related problems...

IT APPEARS THAT YOUR LOGS ARE NOW CLEAN

SO LETS DO A COUPLE OF THINGS TO WRAP THIS UP!!

This infection appears to have been cleaned, but I can not give you any absolute guarantees. As a precaution, I would go ahead and change all of your passwords as this is especially important after an infection.
----------

The following will implement some cleanup procedures as well as reset System Restore points:

Click Start > Run and copy/paste the following text into the Run box as shown and click OK.
Combofix /Uninstall
(Note: There is a space between the ..X and the /U that needs to be there.)

Posted Image

----------

Clean up with OTL:

Right-click and Run as Administrator OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

----------

Any of the logs that you created for use in the forums or remaining tools that have not yet been removed can be deleted so they aren't cluttering up your desktop.

Here are some tips to reduce the potential for spyware infection in the future:

1. Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialize and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

2. Enable Protected Mode in Internet Explorer. This helps Windows Vista users stay more protected from attack by running Internet Explorer with restricted privileges as well as reducing the ability to write, alter or destroy data on your system or install malicious code. To make sure this is running follow these steps:

Open Internet Explorer
Click on Tools > Internet Options
Press Security tab
Select Internet zone then place check next to Enable Protected Mode if not already done
Do the same for Local Intranet, Trusted Sites and Restricted Sites and then press Apply
Restart Internet Explorer and in the bottom right corner of your screen you will see Protected Mode: On showing you it is enabled.

3. Use and update an anti-virus software - I can not overemphasize the need for you to use and update your anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Firewall
Using a third-party firewall will allow you to give/deny access for applications that want to go online. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a firewall in its default configuration can lower your risk greatly. A tutorial on firewalls can be found here. **There are firewalls listed in this tutorial that could be downloaded and used but I would personally only recommend using one of the following two below:
Online Armor Free
Agnitum Outpost Firewall Free

5. Make sure you keep your Windows OS current. Windows XP users can visit Windows update regularly to download and install any critical updates and service packs. Windows Vista/7 users can open the Start menu > All Programs > Windows Update > Check for Updates (in left hand task pane) to update these systems. Without these you are leaving the back door open.

6. WOT (Web of Trust) As "Googling" is such an integral part of internet life, this free browser add on warns you about risky websites that try to scam visitors, deliver malware or send spam. It is especially helpful when browsing or searching in unfamiliar territory. WOT's color-coded icons show you ratings for 21 million websites, helping you avoid the dangerous sites. WOT has an add-on available for Firefox, Internet Explorer as well as Google Chrome.

7.Finally, I strongly recommend that you read TonyKlein's good advice So how did I get infected in the first place?

Please reply to this thread once more if you are satisfied so that we can mark the problem as resolved.