Spyware / Malware / Virus Removal

[Resolved] Coupon B malware not Removed by SPYBOT

15 min read

Looking for the outcome? Ask AI

JohnDJ Topic Starter

Post #1February 26, 2010, 1:31 AM UTC

Dear Whatthetech, I run SPYBOT once a month or so. It found Coupon B malware but could not remove. I was in the adminsrator segment of my computer but SPYBOT told me I couldn't eliminate the malware as I wasn't the administrator. I have used your services once before and was very pleased. I went to the web site and followed the instuctions for Infections Removal. Erunt went fine. Malwarebytes showed no infections. - I run this when I run SPYBOT and it showed no infections when SPYBOT found the Coupon B malware. GMER was a problem. When I ran it the computer froze. I disconected power and restarted, tried again, and it froze again. Defogger worked and I have the two texts. Neither the defogger nor the malware log will attach to this document. Error statement say you are not permitted to attach this kind of file. They are 472 bytes, 242bytes, and 18.0 KB respectively. Appreciate any help you can offer. Thanks JohnDJ

inzanity

Post #2February 28, 2010, 4:31 AM UTC

Hello and

Please be advised, as I am still in training, all my replies to you will be checked for accuracy by one of our experts to ensure that I am giving you the best possible advise. This may cause a delay, but I will do my best to keep it as short as possible. I will post back shortly with instructions.

inzanity

Post #3March 1, 2010, 2:10 AM UTC

Hi,

I will be helping you on removing malwares on your computer. Log research takes time, so please be patient and I'd be grateful if you would note the following:

The fixes are specific to your problem and should only be used for the issues on this machine.
Do not install/uninstall anything on your computer unless advised.
Do not run any other scanning tools other than those instructed for you to use.
Follow the instructions on the order they are given.
Stay with this thread until advised when your computer is clean. Absence of symptoms does not necessarily mean a clean computer.
If you are being helped regarding this problem on another forum please advice us so that we can close this thread.
And lastly, if you have any questions, please ask before proceeding with any of the advised fixes.

_________________________________________________

You will need to right click and choose "Run as Administrator" to run the tools we will use.

Have you tried running GMER in safe mode?
To do this,

Restart your computer.
Keep on tapping f8 when windows starts to boot. Do this before you see the windows screen.
When a list of menu appears, scroll to Windows 7 Safe Mode Option using the arrow keys then press Enter.
Log in with an Administrator account.

Try running GMER again please then post the content of the log.

If the above procedure fails then please do the following:
We Need to check for Rootkits with RootRepeal
Please download RootRepeal one of these locations and save it to your desktop
Here
Here
Here

Right click [external image: Posted Image] then choose "Run as Administrator" on your desktop to run the tool.
Click the [external image: Posted Image] tab.
Click the [external image: Posted Image] button.
Check just these boxes:
[external image: Posted Image]
Push Ok
Check the box for your main system drive (Usually C:, and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post.

–Next–

Open the Defogger and Malwarebytes' logs. Post the contents of each in your next reply. No need to attach.

To post in your next reply:
1. GMER log or RootRepeal log.
2. Defogger log.
3. Malwarebytes' log.

JohnDJ

Post #4March 1, 2010, 7:03 AM UTC

Inzanity, I ran GMER in safe mode and saved the result, but I can't find it, even using advanced search etc. I tried to rerun GMER in safe mode but GMER stoped working. Is there a way to find this file that I'm not trying??? Below are Malware and Defogger results Malwarebytes' Anti-Malware 1.44 Database version: 3772 Windows 6.0.6001 Service Pack 1 Internet Explorer 8.0.6001.18882 2/24/2010 11:17:42 PM mbam-log-2010-02-24 (23-17-42).txt Scan type: Quick Scan Objects scanned: 102065 Time elapsed: 3 minute(s), 16 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) De-Fogger Log defogger_disable by jpshortstuff (23.02.10.1) Log created at 23:58 on 24/02/2010 (John) Checking for autostart values… HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers… -=E.O.F=- defogger_enable by jpshortstuff (23.02.10.1) Log created at 00:00 on 25/02/2010 (John) Parsing file… -=E.O.F=- defogger_disable by jpshortstuff (23.02.10.1) Log created at 23:58 on 24/02/2010 (John) Checking for autostart values… HKCU\~\Run values retrieved. HKLM\~\Run values retrieved. Checking for services/drivers… -=E.O.F=-

inzanity

Post #5March 1, 2010, 11:33 AM UTC

Hi,

Have you saved GMER's log as "Gmer.txt"? If so then proceed with the following:
Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

Right-click SystemLook.exe then choose "Run as Administrator" to run it.
Copy the content of the following codebox into the main textfield:
```
:filefind
Gmer.*
```
Click the Look button to start the scan.
When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.

Note: The log can also be found on your Desktop entitled SystemLook.txt

The contents of Systemlooks' log will show where "Gmer.txt" can be found, if it has located it.

–Next–

Please run RootRepeal:
We Need to check for Rootkits with RootRepeal
Please download RootRepeal one of these locations and save it to your desktop
Here
Here
Here

Right click [external image: Posted Image] then choose "Run as Administrator" on your desktop to run the tool.
Click the [external image: Posted Image] tab.
Click the [external image: Posted Image] button.
Check just these boxes:
[external image: Posted Image]
Push Ok
Check the box for your main system drive (Usually C:, and press Ok.
Allow RootRepeal to run a scan of your system. This may take some time.
Once the scan completes, push the [external image: Posted Image] button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your post.

–Next–

OTL:

Download OTL to your desktop.
Right click on the icon then choose "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt.
Note:These logs can be located in the OTL. folder on you C:\ drive if they fail to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them both in.

To post in your next reply:
1. SystemLook log or the contents of GMER log.
2. RootRepeal log.
3. OTL logs.

JohnDJ

Post #6March 2, 2010, 1:02 AM UTC

Hello Again,

It seems GMER doesn't exist. When I ran it and pressed save there was no dialouge box that poped up.and the contents of the log just diappeared.(2 days ago)

Requested scans are below.

SystemLook

SystemLook v1.0 by jpshortstuff (11.01.10)
Log created at 16:50 on 01/03/2010 by John (Administrator - Elevation successful)

========== filefind ==========

Searching for "Gmer.*"
No files found.

-=End Of File=-

OTL Extras logfile created on: 3/1/2010 4:41:54 PM - Run 1
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Users\John STD\Desktop
Windows Vista Business Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18882)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 594.12 Gb Total Space | 470.90 Gb Free Space | 79.26% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.13 Gb Free Space | 56.52% Space Free | Partition Type: NTFS
Drive E: | 654.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JOHN-PC
Current User Name: John
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Extra Registry (SafeList) ==========

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.cpl [@ = cplfile] – C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
cplfile [cplopen] – %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile – Reg Error: Key error.
inffile [install] – %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0

========== Authorized Applications List ==========

========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0FA41B74-515C-4E73-AD39-1F0DE9D1AA75}" = rport=80 | protocol=6 | dir=out | app=c:\program files\common files\intuit\update service\intuitupdater.exe |
"{722EBF63-7E72-4F10-B460-F00DF912A7A3}" = rport=80 | protocol=6 | dir=out | app=c:\program files\common files\intuit\update service\intuitupdateservice.exe |
"{827C5CFA-3F92-4AF5-8CA7-452BDDCD3FCA}" = lport=2869 | protocol=6 | dir=in | app=system |
"{F08168EC-1B66-40C5-9463-BC8955F540C1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{124B6DCB-8B5A-424B-9744-E72967A4F922}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{15E2678F-6195-469C-B8BD-D665AAC45B65}" = dir=in | app=c:\program files\avg\avg8\avgnsx.exe |
"{275E120D-E15F-403A-A857-789D4CD1455C}" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{2ADF3A8E-C727-4FF8-AF79-80BDA3A42B53}" = dir=in | app=c:\program files\avg\avg8\avgupd.exe |
"{41F55791-1FF6-43CF-B7CC-C77C6161C2F4}" = dir=in | app=c:\program files\windows live\sync\windowslivesync.exe |
"{489D64A0-9A81-45BE-9E5C-9885AA33615F}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{51CE67C2-A5BF-45B1-AB5E-A7D8884B3B97}" = protocol=17 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |
"{7145A7BD-D6EC-44B3-B5EB-20CA3376C7AB}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{77C76CA1-20C9-40FB-8636-3C01EEFBA93D}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{7CCA0378-5BBF-469B-8A36-831E54B565E1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{88A4F375-C185-4A04-91BD-99569F29E900}" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"{905FD1AA-E26C-43A3-B0EA-175CE300B860}" = protocol=6 | dir=in | app=c:\program files\rhapsody\rhapsody.exe |
"{A99166E8-143C-4A20-AE7C-EB67EEBEA9DD}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{AAE8032D-D82B-4B8E-BF4F-671100B04583}" = dir=in | app=c:\program files\windows live\messenger\wlcsdk.exe |
"{C240F877-47EB-4540-BA4A-7DDC05B74B90}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\pdvddxsrv.exe |
"{E9DBA392-D830-4EB5-8939-BE8A1DA5A50C}" = dir=in | app=c:\program files\cyberlink\powerdvd dx\powerdvd.exe |
"{F09E5D2A-B77C-4AE7-B06D-8A740EC16BF2}" = dir=in | app=c:\program files\avg\avg8\avgemc.exe |
"TCP Query User{7D1BF0A4-D5FB-4449-BA71-F5F64B385149}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=6 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"TCP Query User{A0D049BD-A758-46A6-A4A9-FA81124B4CA6}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{5F66F6EF-FA61-4BF8-B020-2860563686CF}C:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe" = protocol=17 | dir=in | app=c:\program files\logitech\desktop messenger\8876480\program\logitechdesktopmessenger.exe |
"UDP Query User{8D074CC9-09BC-4AE7-89FE-E0C49DF7E5FB}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{001AB29C-5468-4972-8D24-2EBDB2B12133}" = Camera Window DVC
"{001E7FB6-BB6B-4ED0-BEDC-B5404ED96D4E}" = DocProc
"{001EB665-D9EC-415E-9E13-AD2125B2B992}" = RAW Image Task 2.1
"{00203668-8170-44A0-BE44-B632FA4D780F}" = Adobe AIR
"{020D8396-D6D9-4B53-A9A1-83C47E2E27AA}" = Windows Live Call
"{08E81ABD-79F7-49C2-881F-FD6CB0975693}" = Roxio Creator Data
"{09760D42-E223-42AD-8C3E-55B47D0DDAC3}" = Roxio Creator DE
"{0AAA9C97-74D4-47CE-B089-0B147EF3553C}" = Windows Live Messenger
"{10E1E87C-656C-4D08-86D6-5443D28583BE}" = TrayApp
"{13F00518-807A-4B3A-83B0-A7CD90F3A398}" = MarketResearch
"{1451DE6B-ABE1-4F62-BE9A-B363A17588A2}" = QuickTime
"{15BC8CD0-A65B-47D0-A2DD-90A824590FA8}" = Microsoft Works
"{1753255A-0AEB-4220-8C75-607B73F0C133}" = Copy
"{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}" = Roxio Creator Tools
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live Upload Tool
"{218BBBE3-FE63-4BB2-81A8-7435575A84FA}" = PhotoStitch
"{22466889-7642-488d-AA0E-F619704CF7AB}" = DeviceDiscovery
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216011FF}" = Java™ 6 Update 11
"{29FA38B4-0AE4-4D0D-8A51-6165BB990BB0}" = WebReg
"{2B4C7E1E-E446-4740-ADB5-9842E742EE8A}" = Windows Live Toolbar
"{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}" = Rhapsody Player Engine
"{2E4E8905-5F24-4AEA-84E2-923CC12E3AB1}" = iPod for Windows 2005-09-06
"{2F28B3C9-2C89-4206-8B33-8ADC9577C49B}" = Scan
"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Roxio Update Manager
"{3138EAD3-700B-4A10-B617-B3F8096EE30D}" = Dell Edoc Viewer
"{360EDFB0-EAA2-012B-AD16-000000000000}" = TurboTax 2009 wcaiper
"{3881DB80-EAA2-012B-ADAE-000000000000}" = TurboTax 2009 WinPerFedFormset
"{38975F50-EAA2-012B-ADB4-000000000000}" = TurboTax 2009 WinPerReleaseEngine
"{38A34630-EAA2-012B-ADB6-000000000000}" = TurboTax 2009 WinPerTaxSupport
"{3AF8FCCD-F51A-4014-9002-F195E1CBC876}" = Logitech QuickCam
"{3B1D6DF0-EAA2-012B-AE51-000000000000}" = TurboTax 2009 wnjiper
"{3C5A81D0-EAA2-012B-AE9F-000000000000}" = TurboTax 2009 wrapper
"{3EB3B7E8-1466-405A-B5BC-44513AF85E34}_is1" = UltimateBet
"{3FA365DF-2D68-45ED-8F83-8C8A33E65143}" = Apple Application Support
"{42D68A86-DB1C-4256-B8C9-5D0D92919AF5}" = Banctec Service Agreement
"{47808F78-F178-49DC-B708-15FE538B16FF}" = iTunes
"{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}" = HPSSupply
"{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}" = Junk Mail filter update
"{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}" = Microsoft Search Enhancement Pack
"{53735ECE-E461-4FD0-B742-23A352436D3A}" = Logitech Updater
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{543E938C-BDC4-4933-A612-01293996845F}" = UnloadSupport
"{63C1109E-D977-49ED-BCE3-D00D0BF187D6}" = Windows Live Mail
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{6693BD7C-CB4E-43AC-A0D6-10D1A1B88DCF}" = Canon PhotoRecord
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{68D27126-BF6A-457D-8DD0-5F35E8D41310}" = MovieEdit Task
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6A92E5C5-0578-443D-91F3-92ECE5F2CAE2}" = Windows Live Writer
"{6B8BDABA-6737-4998-AEE4-E218EDE5FC7A}" = Camera Window DS
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}" = Roxio Creator Audio
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{777CA40C-0206-4EF6-A0FC-618BF06BF8D0}" = Intel® PRO Network Connections 12.1.11.0
"{77DCDCE3-2DED-62F3-8154-05E745472D07}" = Acrobat.com
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{824D3839-DAA1-4315-A822-7AE3E620E528}" = VideoToolkit01
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{8389382B-53BA-4A87-8854-91E3D80A5AC7}" = HP Photosmart Essential2.01
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89EB3ED7-225A-412E-B048-623D502C000F}" = Camera Window MC
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A74E887-8F0F-4017-AF53-CBA42211AAA5}" = Microsoft Sync Framework Runtime Native v1.0 (x86)
"{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}" = Choice Guard
"{900B1197-53F5-4F46-A882-2CFFFE2EEDCB}" = Logitech Desktop Messenger
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{9422C8EA-B0C6-4197-B8FC-DC797658CA00}" = Windows Live Sign-in Assistant
"{95120000-00AF-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (English)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9E5A03E3-6246-4920-9630-0527D5DA9B07}" = iSEEK AnswerWorks English Runtime
"{A1D0D14A-B776-4907-BC00-5149F2298086}" = Camera Support Core Library
"{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}" = HP Update
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-7AD7-1033-7B44-A93000000001}" = Adobe Reader 9.3
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ACA85783-8EEA-4f0a-B2A3-A8173F30209F}" = C4200_doccd
"{AEA07F97-9088-497c-8821-0F36BD5DC251}" = HPProductAssistant
"{AF7FC1CA-79DF-43c3-90A3-33EFEB9294CE}" = AIO_Scan
"{B09BCBF6-87EE-4403-A336-3A9510856535}" = HP Photosmart All-In-One Software 9.0
"{B2544A03-10D0-4E5E-BA69-0362FFC20D18}" = OGA Notifier 2.0.0048.0
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}" = Roxio Creator Copy
"{BCD6CD1A-0DBE-412E-9F25-3B500D1E6BA1}" = SolutionCenter
"{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}" = Microsoft Sync Framework Services Native v1.0 (x86)
"{BFDE4176-5DFE-4db9-AA00-8F30CB001BDA}" = c4200_Help
"{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}" = Canon ZoomBrowser EX
"{C39E671D-0528-4c5e-A034-8470C5BC393A}" = C4200
"{C7239ACC-601B-46BC-B48D-3998303A326D}" = OverDrive Media Console
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}" = Destination Component
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1
"{D8B7A682-20DA-4797-8415-B1FB14D4D32B}" = PS_AIO_Software
"{D9D754A1-EAC5-406C-A28B-C49B1E846711}" = Windows Live Essentials
"{E2662C24-B31E-4349-A084-32EB76E8B760}" = BufferChm
"{E28750A2-45F2-4b63-99F7-9F81A94B1E2D}" = PS_AIO_Software_min
"{E3BFEE55-39E2-4BE0-B966-89FE583822C1}" = Dell Support Center (Support Software)
"{E9C18EBD-85BE-47D0-AA73-3FEDCC976B04}" = Toolbox
"{ED439A64-F018-4DD4-8BA5-328D85AB09AB}" = Roxio Creator DE
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F69E83CF-B440-43F8-89E6-6EA80712109B}" = Windows Live Communications Platform
"{F72E2DDC-3DB8-4190-A21D-63883D955FE7}" = PSSWCORE
"{F73A5B18-EB75-4B2C-B32D-9457576E2417}" = Windows Live Photo Gallery
"{FD7F242B-9AA0-40c3-941E-3A9821D19C09}" = PS_AIO_ProductContext
"{FD8D8B04-BEAD-4A55-AA1D-62D2373E7DEA}" = Status
"{FDD810CA-D5E3-40E9-AB7B-36440B0D41EF}" = Windows Live Sync
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"AVG9Uninstall" = AVG Free 9.0
"Bridge_Base_Online" = Bridge Base Online
"com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Acrobat.com
"Coupon Printer for Windows5.0.0.0" = Coupon Printer for Windows
"ERUNT_is1" = ERUNT 1.1j
"GoToAssist" = GoToAssist 8.0.0.514
"HP Imaging Device Functions" = HP Imaging Device Functions 9.0
"HP Photosmart Essential" = HP Photosmart Essential 2.01
"HP Solution Center & Imaging Support Tools" = HP Solution Center 9.0
"HPExtendedCapabilities" = HP Customer Participation Program 9.0
"HPOCR" = HP OCR Software 9.0
"InstallShield_{001AB29C-5468-4972-8D24-2EBDB2B12133}" = Canon Camera Window DC_DV 5 for ZoomBrowser EX
"InstallShield_{001EB665-D9EC-415E-9E13-AD2125B2B992}" = Canon RAW Image Task for ZoomBrowser EX
"InstallShield_{218BBBE3-FE63-4BB2-81A8-7435575A84FA}" = Canon Utilities PhotoStitch 3.1
"InstallShield_{2E4E8905-5F24-4AEA-84E2-923CC12E3AB1}" = iPod for Windows 2005-09-06
"InstallShield_{47808F78-F178-49DC-B708-15FE538B16FF}" = iTunes
"InstallShield_{68D27126-BF6A-457D-8DD0-5F35E8D41310}" = Canon MovieEdit Task for ZoomBrowser EX
"InstallShield_{6B8BDABA-6737-4998-AEE4-E218EDE5FC7A}" = Canon Camera Window DS for ZoomBrowser EX
"InstallShield_{89EB3ED7-225A-412E-B048-623D502C000F}" = Canon Camera Window MC 5 for ZoomBrowser EX
"InstallShield_{A1D0D14A-B776-4907-BC00-5149F2298086}" = Canon Camera Support Core Library
"lvdrivers_11.80" = Logitech QuickCam Driver Package
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"PROSetDX" = Intel® PRO Network Connections 12.1.11.0
"Rhapsody" = Rhapsody
"SolSuite_is1" = SolSuite 2009 v9.6
"TurboTax 2009" = TurboTax 2009
"WinLiveSuite_Wave3" = Windows Live Essentials

========== HKEY_CURRENT_USER Uninstall List ==========

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Jack" = Jack

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/15/2010 11:33:46 PM | Computer Name = John-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18882, time stamp
0x4b3ed243, faulting module SkypeIEPlugin.dll_unloaded, version 0.0.0.0, time stamp
0x4a5c7a42, exception code 0xc0000005, fault offset 0x03504294, process id 0x74b8,
application start time 0x01caaeb5c9064f60.

Error - 2/18/2010 10:34:12 AM | Computer Name = John-PC | Source = WinMgmt | ID = 10
Description =

Error - 2/20/2010 5:55:48 PM | Computer Name = John-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18882, time stamp
0x4b3ed243, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6,
exception code 0xc0000005, fault offset 0x0003d13a, process id 0x3b04, application
start time 0x01cab2768caa71d0.

Error - 2/23/2010 3:14:33 AM | Computer Name = John-PC | Source = WinMgmt | ID = 10
Description =

Error - 2/23/2010 3:18:21 AM | Computer Name = John-PC | Source = WinMgmt | ID = 10
Description =

Error - 2/23/2010 7:28:35 PM | Computer Name = John-PC | Source = WinMgmt | ID = 10
Description =

Error - 2/24/2010 11:41:58 PM | Computer Name = John-PC | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe_Pml Driver HPZ12, version 6.0.6001.18000,
time stamp 0x47918b89, faulting module hpzipm12.dll, version 12.1.1.54, time stamp
0x4551ba01, exception code 0xc0000005, fault offset 0x000040b0, process id 0x2a88,
application start time 0x01cab5c398af35b0.

Error - 2/25/2010 12:58:20 AM | Computer Name = John-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18882, time stamp
0x4b3ed243, faulting module SkypeIEPlugin.dll_unloaded, version 0.0.0.0, time stamp
0x4a5c7a42, exception code 0xc0000005, fault offset 0x04334294, process id 0x430,
application start time 0x01cab5d611796670.

Error - 2/25/2010 1:00:38 AM | Computer Name = John-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18882, time stamp
0x4b3ed243, faulting module ntdll.dll, version 6.0.6001.18000, time stamp 0x4791a7a6,
exception code 0xc0000005, fault offset 0x0003d0cf, process id 0x3df8, application
start time 0x01cab5d73f27bf30.

Error - 2/25/2010 1:10:54 AM | Computer Name = John-PC | Source = EventSystem | ID = 4621
Description =

[ System Events ]
Error - 10/24/2009 7:15:08 PM | Computer Name = John-PC | Source = HTTP | ID = 15016
Description =

Error - 10/28/2009 6:17:37 AM | Computer Name = John-PC | Source = HTTP | ID = 15016
Description =

Error - 11/1/2009 12:50:56 PM | Computer Name = John-PC | Source = Microsoft-Windows-GroupPolicy | ID = 1030
Description = The processing of Group Policy failed. Windows attempted to retrieve
new Group Policy settings for this user or computer. Look in the details tab for
error code and description. Windows will automatically retry this operation at
the next refresh cycle. Computers joined to the domain must have proper name resolution
and network connectivity to a domain controller for discovery of new Group Policy
objects and settings. An event will be logged when Group Policy is successful.

Error - 11/5/2009 3:17:58 AM | Computer Name = John-PC | Source = Microsoft-Windows-GroupPolicy | ID = 1030
Description = The processing of Group Policy failed. Windows attempted to retrieve
new Group Policy settings for this user or computer. Look in the details tab for
error code and description. Windows will automatically retry this operation at
the next refresh cycle. Computers joined to the domain must have proper name resolution
and network connectivity to a domain controller for discovery of new Group Policy
objects and settings. An event will be logged when Group Policy is successful.

Error - 11/5/2009 7:16:56 AM | Computer Name = John-PC | Source = HTTP | ID = 15016
Description =

Error - 11/12/2009 7:19:28 AM | Computer Name = John-PC | Source = HTTP | ID = 15016
Description =

Error - 11/16/2009 12:51:14 AM | Computer Name = John-PC | Source = HTTP | ID = 15016
Description =

Error - 11/16/2009 11:46:43 PM | Computer Name = John-PC | Source = Microsoft-Windows-GroupPolicy | ID = 1030
Description = The processing of Group Policy failed. Windows attempted to retrieve
new Group Policy settings for this user or computer. Look in the details tab for
error code and description. Windows will automatically retry this operation at
the next refresh cycle. Computers joined to the domain must have proper name resolution
and network connectivity to a domain controller for discovery of new Group Policy
objects and settings. An event will be logged when Group Policy is successful.

Error - 11/21/2009 8:37:14 PM | Computer Name = John-PC | Source = HTTP | ID = 15016
Description =

Error - 11/24/2009 2:57:37 PM | Computer Name = John-PC | Source = Microsoft-Windows-GroupPolicy | ID = 1030
Description = The processing of Group Policy failed. Windows attempted to retrieve
new Group Policy settings for this user or computer. Look in the details tab for
error code and description. Windows will automatically retry this operation at
the next refresh cycle. Computers joined to the domain must have proper name resolution
and network connectivity to a domain controller for discovery of new Group Policy
objects and settings. An event will be logged when Group Policy is successful.

< End of report >

ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2010/03/01 16:31
Program Version: Version 1.3.5.0
Windows Version: Windows Vista SP1
==================================================

Drivers
——————-
Name: dump_atapi.sys
Image Path: C:\Windows\System32\Drivers\dump_atapi.sys
Address: 0x8F6F1000 Size: 32768 File Visible: No Signed: -
Status: -

Name: dump_dumpata.sys
Image Path: C:\Windows\System32\Drivers\dump_dumpata.sys
Address: 0x8F6E6000 Size: 45056 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\Windows\system32\drivers\rootrepeal.sys
Address: 0xAABB6000 Size: 49152 File Visible: No Signed: -
Status: -

Processes
——————-
Path: System
PID: 4 Status: Locked to the Windows API!

Path: C:\Windows\System32\audiodg.exe
PID: 1488 Status: Locked to the Windows API!

==EOF==

OTL logfile created on: 3/1/2010 4:41:54 PM - Run 1
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Users\John STD\Desktop
Windows Vista Business Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18882)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 60.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 70.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 594.12 Gb Total Space | 470.90 Gb Free Space | 79.26% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.13 Gb Free Space | 56.52% Space Free | Partition Type: NTFS
Drive E: | 654.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JOHN-PC
Current User Name: John
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\John STD\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxtray.exe (Intel Corporation)
PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\wercon.exe (Microsoft Corporation)
PRC - C:\Windows\System32\mobsync.exe (Microsoft Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

========== Modules (SafeList) ==========

MOD - C:\Users\John STD\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Windows\System32\WindowsCodecs.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18175_none_9e7bbe54
c9c04bca\GdiPlus.dll (Microsoft Corporation)
MOD - C:\Windows\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.)
MOD - C:\Windows\System32\cscapi.dll (Microsoft Corporation)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (stllssvr) – C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (PxHelp20) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (iaStor) – C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2006/09/18 13:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKLM..\RunOnce: [*WerKernelReporting] C:\Windows\System32\WerFault.exe (Microsoft Corporation)
O4 - HKCU..\RunOnce: [FlashPlayerUpdate] C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe (Adobe Systems, Inc.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed] 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/11/26 19:00:00 | 000,000,058 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{ff3bfd05-5d35-11de-9394-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ff3bfd05-5d35-11de-9394-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Install.exe – [2007/11/26 19:00:00 | 001,050,305 | R— | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/02/24 23:01:30 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/02/24 22:59:25 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/24 21:13:42 | 000,000,000 | —D | C] – C:\ProgramData\Office Genuine Advantage
[2010/02/24 05:23:01 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2010/02/24 05:22:40 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/02/24 05:21:57 | 000,523,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2010/02/24 05:21:56 | 000,511,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2010/02/24 05:21:53 | 000,472,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2010/02/24 05:21:53 | 000,472,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2010/02/24 05:21:53 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2010/02/24 05:21:53 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2010/02/24 05:21:52 | 000,329,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdrm.dll
[2010/02/24 05:21:52 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2010/02/24 05:21:52 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2010/02/21 18:03:41 | 000,000,000 | —D | C] – C:\Users\John\AppData\Roaming\Intuit
[2010/02/21 18:03:33 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AnswerWorks 5.0
[2010/02/21 17:59:37 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\IsolatedStorage
[2010/02/21 17:59:35 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intuit
[2010/02/21 17:58:25 | 000,000,000 | —D | C] – C:\Program Files\TurboTax
[2010/02/21 17:58:07 | 000,000,000 | —D | C] – C:\ProgramData\Intuit
[2010/02/10 18:16:38 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2010/02/10 18:16:37 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvfw32.dll
[2010/02/10 18:16:37 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avifil32.dll
[2010/02/10 18:16:37 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2010/02/10 18:16:37 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avicap32.dll

========== Files - Modified Within 30 Days ==========

[2010/03/01 16:41:16 | 001,572,864 | -HS- | M] () – C:\Users\John\NTUSER.DAT
[2010/03/01 16:24:23 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/03/01 16:24:23 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/03/01 16:23:08 | 000,524,288 | -HS- | M] () – C:\Users\John\NTUSER.DAT{3d4e88f1-6a70-11db-b1ba-d64300c9c793}.TMContainer00000000000000000001.regtrans-ms
[2010/03/01 16:23:08 | 000,065,536 | -HS- | M] () – C:\Users\John\NTUSER.DAT{3d4e88f1-6a70-11db-b1ba-d64300c9c793}.TM.blf
[2010/03/01 16:00:39 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/03/01 14:29:58 | 056,500,284 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/03/01 14:29:13 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2010/03/01 08:43:23 | 000,000,432 | —- | M] () – C:\Windows\tasks\MalwareRemovalBot System Startup.job
[2010/02/28 22:43:46 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/02/28 22:43:43 | 3478,310,912 | -HS- | M] () – C:\hiberfil.sys
[2010/02/28 22:26:29 | 266,078,822 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/02/28 21:48:44 | 000,000,416 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{ACFFD9E5-CC5B-4EF1-951E-866FC6F5EE57}.job
[2010/02/24 22:59:29 | 000,000,735 | —- | M] () – C:\Users\John\Desktop\NTREGOPT.lnk
[2010/02/24 22:59:28 | 000,000,716 | —- | M] () – C:\Users\John\Desktop\ERUNT.lnk
[2010/02/24 21:13:47 | 000,068,912 | —- | M] () – C:\Users\John\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/02/24 21:13:00 | 000,288,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/02/23 15:29:01 | 000,005,216 | —- | M] () – C:\Users\John\AppData\Local\d3d9caps.dat
[2010/02/21 18:01:17 | 000,001,882 | —- | M] () – C:\Users\Public\Desktop\TurboTax 2009.lnk
[2010/02/10 21:33:15 | 000,000,266 | —- | M] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2010/02/07 08:55:29 | 000,001,889 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk

========== Files Created - No Company Name ==========

[2010/02/28 22:43:43 | 3478,310,912 | -HS- | C] () – C:\hiberfil.sys
[2010/02/24 22:59:29 | 000,000,735 | —- | C] () – C:\Users\John\Desktop\NTREGOPT.lnk
[2010/02/24 22:59:28 | 000,000,716 | —- | C] () – C:\Users\John\Desktop\ERUNT.lnk
[2010/02/21 18:01:17 | 000,001,882 | —- | C] () – C:\Users\Public\Desktop\TurboTax 2009.lnk
[2010/02/07 08:55:29 | 000,001,889 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/02/05 08:06:56 | 000,000,418 | -H– | C] () – C:\Windows\tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/02 06:52:35 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/08/02 06:40:16 | 000,066,482 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2009/07/28 20:19:15 | 000,010,752 | —- | C] () – C:\Users\John\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/08 21:12:01 | 000,005,216 | —- | C] () – C:\Users\John\AppData\Local\d3d9caps.dat
[2009/06/29 23:10:03 | 000,002,817 | —- | C] () – C:\ProgramData\hpzinstall.log
[2009/06/29 22:52:47 | 000,000,266 | —- | C] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2009/06/29 11:08:42 | 000,000,000 | —- | C] () – C:\Windows\OpPrintServer.INI
[2009/06/20 00:59:41 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2009/06/20 00:59:41 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2009/06/20 00:59:41 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2009/06/20 00:59:41 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2009/06/20 00:59:39 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/07/26 07:25:02 | 000,025,624 | —- | C] () – C:\Windows\System32\drivers\LVPr2Mon.sys
[2006/11/02 02:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/08/02 06:40:38 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Leadertech
[2009/07/27 20:27:07 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\SolSuite
[2009/06/29 22:52:48 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Template
[2010/03/01 08:43:23 | 000,000,432 | —- | M] () – C:\Windows\Tasks\MalwareRemovalBot System Startup.job
[2010/02/28 21:51:23 | 000,032,552 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/03/01 14:29:13 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2010/02/28 21:48:44 | 000,000,416 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{ACFFD9E5-CC5B-4EF1-951E-866FC6F5EE57}.job

========== Purity Check ==========

< End of report >

inzanity

Post #7March 3, 2010, 5:05 AM UTC

Hi,

While TeaTimer is an excellent tool for the prevention of spyware, it can sometimes prevent our tools from fixing certain things.
Please disable TeaTimer for now until you are clean. TeaTimer can be re-activated once your log is clean.

Open Spybot Search & Destroy.
In the Mode menu click Advanced mode if not already selected.
Choose Yes at the Warning prompt.
Expand the Tools menu.
Click Resident.
Uncheck the Resident TeaTimer (Protection of overall system settings) active. box.
In the File menu click Exit to exit Spybot Search & Destroy.

–Next–

Right click OTL.exe then choose "Run as Administrator" to run the tool.

Copy/paste the following text written inside of the code box into the Custom Scans/Fixes box located at the bottom of OTL

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
IE - HKCU\..\URLSearchHook: *{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - Reg Error: Key error. File not found

:Files
C:\Windows\tasks\MalwareRemovalBot System Startup.job

:Commands
[purity]
[emptytemp]
[start explorer]
[Reboot]

Then click the Run Fix button at the top.
Let the program run unhindered, reboot when it is done.
Then post the result and a new OTL log in your next reply. ( don't check the boxes beside LOP Check or Purity this time )

–Next–

Open Malwarebytes.
Click on the Update tab.
Click Check for Updates button.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform quick scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. Please save it to a convenient location and post back the log.

–Next–

Open OTL.exe.
Right click on the icon then choose "Run as Administrator" to run it. Make sure all other windows are closed and to let it run uninterrupted.
When the window appears, underneath Output at the top change it to Minimal Output.
Check the boxes beside LOP Check and Purity Check.
Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
There will only be a single log produced. OTL.Txt.
Note:This log can be located in the OTL. folder on your C:\ drive if it fails to open automatically.
Please copy (Edit->Select All, Edit->Copy) the contents of this file and post it with your next reply.

To post in your next reply:
1. OTL fix log.
2. Malwarebytes' log.
3. Fresh OTL log.
4. How is your computer?

JohnDJ

Post #8March 3, 2010, 6:11 AM UTC

Hi inzanity

I do not find Tea Timer anywhere, nor on Spybots menu.

The logs requested are posted below, A log showed up on OTLafter reboot, as well as another before reboot. I included both.

Coupon B still shows up on Spybot scan

OTL logfile created on: 3/2/2010 9:51:27 PM - Run 2
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Users\John STD\Desktop
Windows Vista Business Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18882)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 59.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 594.12 Gb Total Space | 470.47 Gb Free Space | 79.19% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.13 Gb Free Space | 56.52% Space Free | Partition Type: NTFS
Drive E: | 654.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JOHN-PC
Current User Name: John
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\John STD\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxtray.exe (Intel Corporation)
PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Works\WksWP.exe (Microsoft® Corporation)
PRC - C:\Program Files\Microsoft Works\wkgdcach.exe (Microsoft® Corporation)
PRC - C:\Program Files\Microsoft Works\WkDStore.exe (Microsoft® Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

========== Modules (SafeList) ==========

MOD - C:\Users\John STD\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Windows\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (stllssvr) – C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (PxHelp20) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (iaStor) – C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2006/09/18 13:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed] 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/11/26 19:00:00 | 000,000,058 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{ff3bfd05-5d35-11de-9394-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ff3bfd05-5d35-11de-9394-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Install.exe – [2007/11/26 19:00:00 | 001,050,305 | R— | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/02 21:30:44 | 000,000,000 | —D | C] – C:\_OTL
[2010/02/24 23:01:30 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/02/24 22:59:25 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/24 21:13:42 | 000,000,000 | —D | C] – C:\ProgramData\Office Genuine Advantage
[2010/02/24 05:23:01 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2010/02/24 05:22:40 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/02/24 05:21:57 | 000,523,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2010/02/24 05:21:56 | 000,511,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2010/02/24 05:21:53 | 000,472,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2010/02/24 05:21:53 | 000,472,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2010/02/24 05:21:53 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2010/02/24 05:21:53 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2010/02/24 05:21:52 | 000,329,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdrm.dll
[2010/02/24 05:21:52 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2010/02/24 05:21:52 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2010/02/21 18:03:41 | 000,000,000 | —D | C] – C:\Users\John\AppData\Roaming\Intuit
[2010/02/21 18:03:33 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AnswerWorks 5.0
[2010/02/21 17:59:37 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\IsolatedStorage
[2010/02/21 17:59:35 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intuit
[2010/02/21 17:58:25 | 000,000,000 | —D | C] – C:\Program Files\TurboTax
[2010/02/21 17:58:07 | 000,000,000 | —D | C] – C:\ProgramData\Intuit
[2010/02/10 18:16:38 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2010/02/10 18:16:37 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvfw32.dll
[2010/02/10 18:16:37 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avifil32.dll
[2010/02/10 18:16:37 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2010/02/10 18:16:37 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avicap32.dll

========== Files - Modified Within 30 Days ==========

[2010/03/02 21:50:49 | 001,572,864 | -HS- | M] () – C:\Users\John\NTUSER.DAT
[2010/03/02 21:47:24 | 000,524,288 | -HS- | M] () – C:\Users\John\NTUSER.DAT{3d4e88f1-6a70-11db-b1ba-d64300c9c793}.TMContainer00000000000000000001.regtrans-ms
[2010/03/02 21:47:24 | 000,065,536 | -HS- | M] () – C:\Users\John\NTUSER.DAT{3d4e88f1-6a70-11db-b1ba-d64300c9c793}.TM.blf
[2010/03/02 21:35:43 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/03/02 21:35:43 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/03/02 21:35:42 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/03/02 21:35:41 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/03/02 21:35:36 | 3476,226,048 | -HS- | M] () – C:\hiberfil.sys
[2010/03/02 21:22:02 | 000,000,402 | —- | M] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2010/03/02 21:20:12 | 000,000,416 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{ACFFD9E5-CC5B-4EF1-951E-866FC6F5EE57}.job
[2010/03/02 19:09:01 | 056,574,676 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/03/02 15:10:49 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2010/02/28 22:26:29 | 266,078,822 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/02/24 22:59:29 | 000,000,735 | —- | M] () – C:\Users\John\Desktop\NTREGOPT.lnk
[2010/02/24 22:59:28 | 000,000,716 | —- | M] () – C:\Users\John\Desktop\ERUNT.lnk
[2010/02/24 21:13:47 | 000,068,912 | —- | M] () – C:\Users\John\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/02/24 21:13:00 | 000,288,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/02/23 15:29:01 | 000,005,216 | —- | M] () – C:\Users\John\AppData\Local\d3d9caps.dat
[2010/02/21 18:01:17 | 000,001,882 | —- | M] () – C:\Users\Public\Desktop\TurboTax 2009.lnk
[2010/02/07 08:55:29 | 000,001,889 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk

========== Files Created - No Company Name ==========

[2010/02/28 22:43:43 | 3476,226,048 | -HS- | C] () – C:\hiberfil.sys
[2010/02/24 22:59:29 | 000,000,735 | —- | C] () – C:\Users\John\Desktop\NTREGOPT.lnk
[2010/02/24 22:59:28 | 000,000,716 | —- | C] () – C:\Users\John\Desktop\ERUNT.lnk
[2010/02/21 18:01:17 | 000,001,882 | —- | C] () – C:\Users\Public\Desktop\TurboTax 2009.lnk
[2010/02/07 08:55:29 | 000,001,889 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/02/05 08:06:56 | 000,000,418 | -H– | C] () – C:\Windows\tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/02 06:52:35 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/08/02 06:40:16 | 000,066,482 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2009/07/28 20:19:15 | 000,010,752 | —- | C] () – C:\Users\John\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/08 21:12:01 | 000,005,216 | —- | C] () – C:\Users\John\AppData\Local\d3d9caps.dat
[2009/06/29 23:10:03 | 000,002,817 | —- | C] () – C:\ProgramData\hpzinstall.log
[2009/06/29 22:52:47 | 000,000,402 | —- | C] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2009/06/29 11:08:42 | 000,000,000 | —- | C] () – C:\Windows\OpPrintServer.INI
[2009/06/20 00:59:41 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2009/06/20 00:59:41 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2009/06/20 00:59:41 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2009/06/20 00:59:41 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2009/06/20 00:59:39 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/07/26 07:25:02 | 000,025,624 | —- | C] () – C:\Windows\System32\drivers\LVPr2Mon.sys
[2006/11/02 02:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/08/02 06:40:38 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Leadertech
[2009/07/27 20:27:07 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\SolSuite
[2009/06/29 22:52:48 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Template
[2010/03/02 21:34:46 | 000,032,552 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/03/02 15:10:49 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2010/03/02 21:20:12 | 000,000,416 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{ACFFD9E5-CC5B-4EF1-951E-866FC6F5EE57}.job

========== Purity Check ==========

< End of report >

Malwarebytes' Anti-Malware 1.44
Database version: 3772
Windows 6.0.6001 Service Pack 1
Internet Explorer 8.0.6001.18882

3/2/2010 9:42:29 PM
mbam-log-2010-03-02 (21-42-29).txt

Scan type: Quick Scan
Objects scanned: 102031
Time elapsed: 3 minute(s), 21 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

All processes killed
========== OTL ==========
No active process named explorer.exe was found!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\*{CFBFAE00-17A6-11D0-99CB-00C04FD64497} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\*{CFBFAE00-17A6-11D0-99CB-00C04FD64497}\ not found.
========== FILES ==========
C:\Windows\tasks\MalwareRemovalBot System Startup.job moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: John
->Temp folder emptied: 21482560 bytes
->Temporary Internet Files folder emptied: 378698778 bytes
->Flash cache emptied: 8388 bytes

User: John STD
->Temp folder emptied: 1913917 bytes
->Temporary Internet Files folder emptied: 371389679 bytes
->Flash cache emptied: 28881 bytes

User: Linda
->Temp folder emptied: 23608484 bytes
->Temporary Internet Files folder emptied: 171370028 bytes
->Java cache emptied: 42403 bytes
->Flash cache emptied: 25944 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 1885474 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 1380779633 bytes

Total Files Cleaned = 2,242.00 mb

OTL by OldTimer - Version 3.1.32.0 log created on 03022010_213044

Files\Folders moved on Reboot…
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YOC8EA67\ads[2].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\YOC8EA67\mail[3].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KZ8EWL92\Coupon_B_malware_not_Removed_SPYBOT_t110544[1].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KZ8EWL92\mail[3].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KZ8EWL92\signin[1].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\F78RSV75\ads[1].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\F78RSV75\iframe[1].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\F78RSV75\mail[2].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0UMGKVIT\mail[3].htm moved successfully.
C:\Users\John\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\0UMGKVIT\mail[4].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VFIFP9PU\blank_quirks[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VFIFP9PU\mail[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\VFIFP9PU\mail[2].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O3J48YX1\Coupon_B_malware_not_Removed_SPYBOT_t110544[2].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\O3J48YX1\mail[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LOP0KJ1R\iframe[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LOP0KJ1R\mail[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LOP0KJ1R\mail[2].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LOP0KJ1R\mail[4].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LOP0KJ1R\mail[5].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\LOP0KJ1R\mail[6].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CLNFYC4C\ContactManager[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CLNFYC4C\mail[1].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CLNFYC4C\mail[2].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CLNFYC4C\mail[3].htm moved successfully.
C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\CLNFYC4C\mail[4].htm moved successfully.
File move failed. C:\Users\John STD\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat scheduled to be moved on reboot.
File move failed. C:\Windows\temp\logishrd\LVPrcInj01.dll scheduled to be moved on reboot.

Registry entries deleted on Reboot…

OTL logfile created on: 3/2/2010 9:51:27 PM - Run 2
OTL by OldTimer - Version 3.1.32.0 Folder = C:\Users\John STD\Desktop
Windows Vista Business Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18882)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 59.00% Memory free
7.00 Gb Paging File | 5.00 Gb Available in Paging File | 79.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 594.12 Gb Total Space | 470.47 Gb Free Space | 79.19% Space Free | Partition Type: NTFS
Drive D: | 2.00 Gb Total Space | 1.13 Gb Free Space | 56.52% Space Free | Partition Type: NTFS
Drive E: | 654.81 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: JOHN-PC
Current User Name: John
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Minimal

========== Processes (SafeList) ==========

PRC - C:\Users\John STD\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgnsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgrsx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgcsrvx.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
PRC - C:\Windows\System32\Macromed\Flash\FlashUtil10d.exe (Adobe Systems, Inc.)
PRC - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
PRC - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
PRC - C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
PRC - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
PRC - C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
PRC - C:\Program Files\Common Files\LogiShrd\LQCVFX\COCIManager.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
PRC - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
PRC - C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
PRC - C:\Windows\System32\igfxsrvc.exe (Intel Corporation)
PRC - C:\Windows\System32\igfxtray.exe (Intel Corporation)
PRC - C:\Windows\System32\WUDFHost.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Works\WksWP.exe (Microsoft® Corporation)
PRC - C:\Program Files\Microsoft Works\wkgdcach.exe (Microsoft® Corporation)
PRC - C:\Program Files\Microsoft Works\WkDStore.exe (Microsoft® Corporation)
PRC - C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)

========== Modules (SafeList) ==========

MOD - C:\Users\John STD\Desktop\OTL.exe (OldTimer Tools)
MOD - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
MOD - C:\Windows\Temp\logishrd\LVPrcInj01.dll (Logitech Inc.)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll (Microsoft Corporation)

========== Win32 Services (SafeList) ==========

SRV - (avg9emc) – C:\Program Files\AVG\AVG9\avgemc.exe (AVG Technologies CZ, s.r.o.)
SRV - (avg9wd) – C:\Program Files\AVG\AVG9\avgwdsvc.exe (AVG Technologies CZ, s.r.o.)
SRV - (IntuitUpdateService) – C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe (Intuit Inc.)
SRV - (GoToAssist) – C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe (Citrix Online, a division of Citrix Systems, Inc.)
SRV - (SeaPort) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe (Microsoft Corporation)
SRV - (sprtsvc_DellSupportCenter) SupportSoft Sprocket Service (DellSupportCenter) – C:\Program Files\Dell Support Center\bin\sprtsvc.exe (SupportSoft, Inc.)
SRV - (SBSDWSCService) – C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
SRV - (LVPrcSrv) – C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe (Logitech Inc.)
SRV - (LVCOMSer) – C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe (Logitech Inc.)
SRV - (stllssvr) – C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (MicroVision Development, Inc.)
SRV - (WinDefend) – C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AvgTdiX) – C:\Windows\System32\Drivers\avgtdix.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgLdx86) – C:\Windows\System32\Drivers\avgldx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (AvgMfx86) – C:\Windows\System32\Drivers\avgmfx86.sys (AVG Technologies CZ, s.r.o.)
DRV - (usbaudio) USB Audio Driver (WDM) – C:\Windows\System32\drivers\USBAUDIO.sys (Microsoft Corporation)
DRV - (PCD5SRVC{3F6A8B78-EC003E00-05040104}) – C:\Program Files\Dell Support Center\HWDiag\bin\pcd5srvc.pkms (PC-Doctor, Inc.)
DRV - (LVUSBSta) – C:\Windows\System32\drivers\LVUSBSta.sys (Logitech Inc.)
DRV - (LVRS) – C:\Windows\System32\drivers\lvrs.sys (Logitech Inc.)
DRV - (LVPr2Mon) – C:\Windows\System32\drivers\LVPr2Mon.sys ()
DRV - (PID_PEPI) Logitech QuickCam IM(PID_PEPI) – C:\Windows\System32\drivers\LV302V32.SYS (Logitech Inc.)
DRV - (pepifilter) – C:\Windows\System32\drivers\lv302af.sys (Logitech Inc.)
DRV - (igfx) – C:\Windows\System32\drivers\igdkmd32.sys (Intel Corporation)
DRV - (MegaSR) – C:\Windows\system32\drivers\megasr.sys (LSI Corporation, Inc.)
DRV - (adpu320) – C:\Windows\system32\drivers\adpu320.sys (Adaptec, Inc.)
DRV - (SiSRaid4) – C:\Windows\system32\drivers\sisraid4.sys (Silicon Integrated Systems)
DRV - (HpCISSs) – C:\Windows\system32\drivers\hpcisss.sys (Hewlett-Packard Company)
DRV - (megasas) – C:\Windows\system32\drivers\megasas.sys (LSI Corporation)
DRV - (adpahci) – C:\Windows\system32\drivers\adpahci.sys (Adaptec, Inc.)
DRV - (adpu160m) – C:\Windows\system32\drivers\adpu160m.sys (Adaptec, Inc.)
DRV - (LSI_SAS) – C:\Windows\system32\drivers\lsi_sas.sys (LSI Logic)
DRV - (ql2300) – C:\Windows\system32\drivers\ql2300.sys (QLogic Corporation)
DRV - (E1G60) Intel® – C:\Windows\System32\drivers\E1G60I32.sys (Intel Corporation)
DRV - (arcsas) – C:\Windows\system32\drivers\arcsas.sys (Adaptec, Inc.)
DRV - (vsmraid) – C:\Windows\system32\drivers\vsmraid.sys (VIA Technologies Inc.,Ltd)
DRV - (LSI_FC) – C:\Windows\system32\drivers\lsi_fc.sys (LSI Logic)
DRV - (arc) – C:\Windows\system32\drivers\arc.sys (Adaptec, Inc.)
DRV - (iaStorV) – C:\Windows\system32\drivers\iastorv.sys (Intel Corporation)
DRV - (ulsata2) – C:\Windows\system32\drivers\ulsata2.sys (Promise Technology, Inc.)
DRV - (LSI_SCSI) – C:\Windows\system32\drivers\lsi_scsi.sys (LSI Logic)
DRV - (elxstor) – C:\Windows\system32\drivers\elxstor.sys (Emulex)
DRV - (adp94xx) – C:\Windows\system32\drivers\adp94xx.sys (Adaptec, Inc.)
DRV - (uliahci) – C:\Windows\system32\drivers\uliahci.sys (ULi Electronics Inc.)
DRV - (nvraid) – C:\Windows\system32\drivers\nvraid.sys (NVIDIA Corporation)
DRV - (nvstor) – C:\Windows\system32\drivers\nvstor.sys (NVIDIA Corporation)
DRV - (viaide) – C:\Windows\system32\drivers\viaide.sys (VIA Technologies, Inc.)
DRV - (cmdide) – C:\Windows\system32\drivers\cmdide.sys (CMD Technology, Inc.)
DRV - (aliide) – C:\Windows\system32\drivers\aliide.sys (Acer Laboratories Inc.)
DRV - (PxHelp20) – C:\Windows\System32\Drivers\PxHelp20.sys (Sonic Solutions)
DRV - (IntcAzAudAddService) Service for Realtek HD Audio (WDM) – C:\Windows\System32\drivers\RTKVHDA.sys (Realtek Semiconductor Corp.)
DRV - (e1express) Intel® – C:\Windows\System32\drivers\e1e6032.sys (Intel Corporation)
DRV - (iaStor) – C:\Windows\system32\drivers\iastor.sys (Intel Corporation)
DRV - (ql40xx) – C:\Windows\system32\drivers\ql40xx.sys (QLogic Corporation)
DRV - (UlSata) – C:\Windows\system32\drivers\ulsata.sys (Promise Technology, Inc.)
DRV - (nfrd960) – C:\Windows\system32\drivers\nfrd960.sys (IBM Corporation)
DRV - (iirsp) – C:\Windows\system32\drivers\iirsp.sys (Intel Corp./ICP vortex GmbH)
DRV - (aic78xx) – C:\Windows\system32\drivers\djsvs.sys (Adaptec, Inc.)
DRV - (iteraid) – C:\Windows\system32\drivers\iteraid.sys (Integrated Technology Express, Inc.)
DRV - (iteatapi) – C:\Windows\system32\drivers\iteatapi.sys (Integrated Technology Express, Inc.)
DRV - (Symc8xx) – C:\Windows\system32\drivers\symc8xx.sys (LSI Logic)
DRV - (Sym_u3) – C:\Windows\system32\drivers\sym_u3.sys (LSI Logic)
DRV - (Mraid35x) – C:\Windows\system32\drivers\mraid35x.sys (LSI Logic Corporation)
DRV - (Sym_hi) – C:\Windows\system32\drivers\sym_hi.sys (LSI Logic)
DRV - (Brserid) Brother MFC Serial Port Interface Driver (WDM) – C:\Windows\system32\drivers\brserid.sys (Brother Industries Ltd.)
DRV - (BrUsbSer) – C:\Windows\system32\drivers\brusbser.sys (Brother Industries Ltd.)
DRV - (BrFiltUp) – C:\Windows\system32\drivers\brfiltup.sys (Brother Industries, Ltd.)
DRV - (BrFiltLo) – C:\Windows\system32\drivers\brfiltlo.sys (Brother Industries, Ltd.)
DRV - (BrSerWdm) – C:\Windows\system32\drivers\brserwdm.sys (Brother Industries Ltd.)
DRV - (BrUsbMdm) – C:\Windows\system32\drivers\brusbmdm.sys (Brother Industries Ltd.)
DRV - (ntrigdigi) – C:\Windows\system32\drivers\ntrigdigi.sys (N-trig Innovative Technologies)
DRV - (R300) – C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (secdrv) – C:\Windows\System32\drivers\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (GEARAspiWDM) – C:\Windows\System32\drivers\GEARAspiWDM.sys (GEAR Software Inc.)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USCON/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

O1 HOSTS File: ([2006/09/18 13:41:30 | 000,000,761 | —- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation)
O2 - BHO: (Java™ Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (no name) - - No CLSID value found.
O3 - HKLM\..\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation)
O3 - HKCU\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll ()
O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [dellsupportcenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
O4 - HKLM..\Run: [HotKeysCmds] C:\Windows\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\hpwuSchd2.exe (Hewlett-Packard Co.)
O4 - HKLM..\Run: [IgfxTray] C:\Windows\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Computer, Inc.)
O4 - HKLM..\Run: [LogitechCommunicationsManager] C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe ()
O4 - HKLM..\Run: [LogitechQuickCamRibbon] C:\Program Files\Logitech\QuickCam\Quickcam.exe ()
O4 - HKLM..\Run: [PDVDDXSrv] C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [Persistence] C:\Windows\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.)
O4 - HKCU..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: real.com ([rhap-app-4-0] https in Trusted sites)
O15 - HKCU\..Trusted Domains: real.com ([rhapreg] https in Trusted sites)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_11)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = [removed] [removed] [removed] 192.168.1.1
O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech Inc.)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\GoToAssist: DllName - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll - C:\Program Files\Citrix\GoToAssist\514\g2awinlogon.dll (Citrix Online, a division of Citrix Systems, Inc.)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img24.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/09/18 13:43:36 | 000,000,024 | —- | M] () - C:\autoexec.bat – [ NTFS ]
O32 - AutoRun File - [2007/11/26 19:00:00 | 000,000,058 | R— | M] () - E:\AUTORUN.INF – [ CDFS ]
O33 - MountPoints2\{ff3bfd05-5d35-11de-9394-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{ff3bfd05-5d35-11de-9394-806e6f6e6963}\Shell\AutoRun\command - "" = E:\Install.exe – [2007/11/26 19:00:00 | 001,050,305 | R— | M] ()
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] – "%1" %*
O35 - exefile [open] – "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010/03/02 21:30:44 | 000,000,000 | —D | C] – C:\_OTL
[2010/02/24 23:01:30 | 000,000,000 | —D | C] – C:\Windows\ERDNT
[2010/02/24 22:59:25 | 000,000,000 | —D | C] – C:\Program Files\ERUNT
[2010/02/24 21:13:42 | 000,000,000 | —D | C] – C:\ProgramData\Office Genuine Advantage
[2010/02/24 05:23:01 | 000,726,528 | —- | C] (Microsoft Corporation) – C:\Windows\System32\jscript.dll
[2010/02/24 05:22:40 | 000,002,048 | —- | C] (Microsoft Corporation) – C:\Windows\System32\tzres.dll
[2010/02/24 05:21:57 | 000,523,776 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_isv.exe
[2010/02/24 05:21:56 | 000,511,488 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate.exe
[2010/02/24 05:21:53 | 000,472,576 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_isv.dll
[2010/02/24 05:21:53 | 000,472,064 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc.dll
[2010/02/24 05:21:53 | 000,347,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp.exe
[2010/02/24 05:21:53 | 000,346,624 | —- | C] (Microsoft Corporation) – C:\Windows\System32\RMActivate_ssp_isv.exe
[2010/02/24 05:21:52 | 000,329,216 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msdrm.dll
[2010/02/24 05:21:52 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp_isv.dll
[2010/02/24 05:21:52 | 000,151,040 | —- | C] (Microsoft Corporation) – C:\Windows\System32\secproc_ssp.dll
[2010/02/21 18:03:41 | 000,000,000 | —D | C] – C:\Users\John\AppData\Roaming\Intuit
[2010/02/21 18:03:33 | 000,000,000 | —D | C] – C:\Program Files\Common Files\AnswerWorks 5.0
[2010/02/21 17:59:37 | 000,000,000 | —D | C] – C:\Users\John\AppData\Local\IsolatedStorage
[2010/02/21 17:59:35 | 000,000,000 | —D | C] – C:\Program Files\Common Files\Intuit
[2010/02/21 17:58:25 | 000,000,000 | —D | C] – C:\Program Files\TurboTax
[2010/02/21 17:58:07 | 000,000,000 | —D | C] – C:\ProgramData\Intuit
[2010/02/10 18:16:38 | 001,314,816 | —- | C] (Microsoft Corporation) – C:\Windows\System32\quartz.dll
[2010/02/10 18:16:37 | 000,123,904 | —- | C] (Microsoft Corporation) – C:\Windows\System32\msvfw32.dll
[2010/02/10 18:16:37 | 000,091,136 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avifil32.dll
[2010/02/10 18:16:37 | 000,082,944 | —- | C] (Microsoft Corporation) – C:\Windows\System32\mciavi32.dll
[2010/02/10 18:16:37 | 000,065,024 | —- | C] (Microsoft Corporation) – C:\Windows\System32\avicap32.dll

========== Files - Modified Within 30 Days ==========

[2010/03/02 21:50:49 | 001,572,864 | -HS- | M] () – C:\Users\John\NTUSER.DAT
[2010/03/02 21:47:24 | 000,524,288 | -HS- | M] () – C:\Users\John\NTUSER.DAT{3d4e88f1-6a70-11db-b1ba-d64300c9c793}.TMContainer00000000000000000001.regtrans-ms
[2010/03/02 21:47:24 | 000,065,536 | -HS- | M] () – C:\Users\John\NTUSER.DAT{3d4e88f1-6a70-11db-b1ba-d64300c9c793}.TM.blf
[2010/03/02 21:35:43 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/03/02 21:35:43 | 000,003,616 | -H– | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/03/02 21:35:42 | 000,000,006 | -H– | M] () – C:\Windows\tasks\SA.DAT
[2010/03/02 21:35:41 | 000,067,584 | –S- | M] () – C:\Windows\bootstat.dat
[2010/03/02 21:35:36 | 3476,226,048 | -HS- | M] () – C:\hiberfil.sys
[2010/03/02 21:22:02 | 000,000,402 | —- | M] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2010/03/02 21:20:12 | 000,000,416 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{ACFFD9E5-CC5B-4EF1-951E-866FC6F5EE57}.job
[2010/03/02 19:09:01 | 056,574,676 | —- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm
[2010/03/02 15:10:49 | 000,000,418 | -H– | M] () – C:\Windows\tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2010/02/28 22:26:29 | 266,078,822 | —- | M] () – C:\Windows\MEMORY.DMP
[2010/02/24 22:59:29 | 000,000,735 | —- | M] () – C:\Users\John\Desktop\NTREGOPT.lnk
[2010/02/24 22:59:28 | 000,000,716 | —- | M] () – C:\Users\John\Desktop\ERUNT.lnk
[2010/02/24 21:13:47 | 000,068,912 | —- | M] () – C:\Users\John\AppData\Local\GDIPFONTCACHEV1.DAT
[2010/02/24 21:13:00 | 000,288,120 | —- | M] () – C:\Windows\System32\FNTCACHE.DAT
[2010/02/23 15:29:01 | 000,005,216 | —- | M] () – C:\Users\John\AppData\Local\d3d9caps.dat
[2010/02/21 18:01:17 | 000,001,882 | —- | M] () – C:\Users\Public\Desktop\TurboTax 2009.lnk
[2010/02/07 08:55:29 | 000,001,889 | —- | M] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk

========== Files Created - No Company Name ==========

[2010/02/28 22:43:43 | 3476,226,048 | -HS- | C] () – C:\hiberfil.sys
[2010/02/24 22:59:29 | 000,000,735 | —- | C] () – C:\Users\John\Desktop\NTREGOPT.lnk
[2010/02/24 22:59:28 | 000,000,716 | —- | C] () – C:\Users\John\Desktop\ERUNT.lnk
[2010/02/21 18:01:17 | 000,001,882 | —- | C] () – C:\Users\Public\Desktop\TurboTax 2009.lnk
[2010/02/07 08:55:29 | 000,001,889 | —- | C] () – C:\Users\Public\Desktop\Adobe Reader 9.lnk
[2010/02/05 08:06:56 | 000,000,418 | -H– | C] () – C:\Windows\tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2009/08/03 15:07:42 | 000,403,816 | —- | C] () – C:\Windows\System32\OGACheckControl.dll
[2009/08/02 06:52:35 | 000,000,056 | -H– | C] () – C:\ProgramData\ezsidmv.dat
[2009/08/02 06:40:16 | 000,066,482 | —- | C] () – C:\Windows\System32\lvcoinst.ini
[2009/07/28 20:19:15 | 000,010,752 | —- | C] () – C:\Users\John\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/07/08 21:12:01 | 000,005,216 | —- | C] () – C:\Users\John\AppData\Local\d3d9caps.dat
[2009/06/29 23:10:03 | 000,002,817 | —- | C] () – C:\ProgramData\hpzinstall.log
[2009/06/29 22:52:47 | 000,000,402 | —- | C] () – C:\Users\John\AppData\Roaming\wklnhst.dat
[2009/06/29 11:08:42 | 000,000,000 | —- | C] () – C:\Windows\OpPrintServer.INI
[2009/06/20 00:59:41 | 001,953,696 | —- | C] () – C:\Windows\System32\igklg400.dll
[2009/06/20 00:59:41 | 001,533,360 | —- | C] () – C:\Windows\System32\igklg450.dll
[2009/06/20 00:59:41 | 000,147,456 | —- | C] () – C:\Windows\System32\igfxCoIn_v1409.dll
[2009/06/20 00:59:41 | 000,104,636 | —- | C] () – C:\Windows\System32\igmedcompkrn.dll
[2009/06/20 00:59:39 | 000,876,544 | —- | C] () – C:\Windows\System32\TEACico2.dll
[2008/07/26 07:25:02 | 000,025,624 | —- | C] () – C:\Windows\System32\drivers\LVPr2Mon.sys
[2006/11/02 02:25:44 | 000,159,744 | —- | C] () – C:\Windows\System32\atitmmxx.dll
[2006/11/01 23:40:29 | 000,013,750 | —- | C] () – C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009/08/02 06:40:38 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Leadertech
[2009/07/27 20:27:07 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\SolSuite
[2009/06/29 22:52:48 | 000,000,000 | —D | M] – C:\Users\John\AppData\Roaming\Template
[2010/03/02 21:34:46 | 000,032,552 | —- | M] () – C:\Windows\Tasks\SCHEDLGU.TXT
[2010/03/02 15:10:49 | 000,000,418 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{A3CB94D4-37D2-4B3D-92A7-99E036B6F6FC}.job
[2010/03/02 21:20:12 | 000,000,416 | -H– | M] () – C:\Windows\Tasks\User_Feed_Synchronization-{ACFFD9E5-CC5B-4EF1-951E-866FC6F5EE57}.job

========== Purity Check ==========

< End of report >

JohnDJ

Post #9March 3, 2010, 8:37 AM UTC

Hi inzanity, Before my last post I ran Spybot as administrator. After my post I let spybot control the restart. It took about 1.5 hours but spyvbot now says there are no problems in the report. What do I do now? Johndj

inzanity

Post #10March 4, 2010, 2:24 AM UTC

Hi,

What version of spybot do you have?

Let's try to see some of Spybot's log.

Click on Start then Start Search.
Copy and paste the following command (except the word "Quote:") into the Start Search box and press Enter key.

%APPDATA%\Spybot - Search & Destroy\Logs
If there are several logs, open the current dated log and post the contents of the log in your next reply.

–Next–

Run an on-line scan with Kaspersky

Right click Internet Explorer or Firefox then choose "Run as Administrator" to run the program.

NOTE: After scanning with Kaspersky, close your browser then run it without administrator privileges for your browsing.

Using Internet Explorer or Firefox, visit Kaspersky On-line Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.
2. To optimize scanning time and produce a more sensible report for review:

Close any open programs
Turn off the real time scanner of any existing antivirus program while performing the online scan

3. Click Run at the Security prompt.
The program will then begin downloading and installing and will also update the database.
Please be patient as this can take several minutes.

Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
Click View scan report at the bottom.

[external image: Posted Image]
Click the Save as Text button to save the file to your desktop so that you may post it in your next reply

To post in your next reply:
1. Spybot version and log.
2. Kaspersky log.
3. How is your computer?

inzanity

Post #11March 7, 2010, 7:41 AM UTC

Hi, It's been several days. Do you still need help on this? This thread will be closed if you don't respond within 24 hours.

JohnDJ

Post #12March 8, 2010, 2:09 PM UTC

Hi, Sorry I was away from home. My version of Spybot Search and Destroy is 1.6.2, it does not have the features you suggest. Once opened pressing Check for Problems the search starts immediately with no window opening. I ran it and "No immediate threats were found", I don't see a LOG option. The Kasp log follows KASPERSKY ONLINE SCANNER 7.0: scan report Monday, March 8, 2010 Operating system: Microsoft Windows Vista Business Edition, 32-bit Service Pack 1 (build 6001) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Monday, March 08, 2010 03:07:44 Records in database: 3734393 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ E:\ F:\ G:\ H:\ I:\ J:\ Scan statistics: Objects scanned: 134295 Threats found: 0 Infected objects found: 0 Suspicious objects found: 0 Scan duration: 01:21:44 No threats found. Scanned area is clean. Selected area has been scanned. It seems I clear. Computer is running fine. Are we done? Thanks, JohnDJ

inzanity

Post #13March 10, 2010, 1:05 AM UTC

Hi,

Your computer now looks clean!

Please delete Defogger, GMER, RootRepeal, SystemLook and all the logs we've created.

You can keep Malwarebytes, it is an excellent malware removal tool. Update atleast once a week then run a complete scan.

–Next–

You need to create a new Clean restore point.
Click Start Menu > Run > copy and paste

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it (something you'll remember) and click Create, when the confirmation screen shows the restore point has been created click Close.

Remove all previous Restore Points
Click Start Menu > Run > copy and paste

cleanmgr

At top, click on More Options tab. Click Clean up… button in the System Restore box. Click on Yes button. When finished, click on Cancel button to exit.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.

–Next–

Java
Your Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system. Please follow these steps to remove older version Java components and update:

Please download JavaRa to your desktop and unzip it to its own folder

Run JavaRa.exe, pick the language of your choice and click Select. Then click Remove Older Versions.
Accept any prompts.
Open JavaRa.exe again and select Search For Updates.
Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

The latest update is Java 6 update 18.

Now to Clean out the Java cache:

Go into the Control Panel and double-click the Java Icon.

Under Temporary Internet Files, click the Settings… button
click the Delete Files button.
There are two options in the window to clear the cache - Leave both Checked
Applications and Applets
Trace and Log Files
Click OK on Delete Temporary Files Window
Note: This deletes ALL the Downloaded Applications and Applets from the CACHE.
Click OK to leave the Temporary Files Settings
Click OK to leave the Java Control Panel.

To keep your operating system up to date visit

Secunia Software inspector to check your program update status.
Microsoft Windows Update .

Here are some tips to reduce the potential for spyware infection in the future:

1. It is good security practice to change your passwords to all your online accounts on a fairly regular basis, this is especially true after an infection. Refer to this Microsoft article
Strong passwords: How to create and use them
Then consider a password keeper, to keep all your passwords safe.

2. Make your Internet Explorer More Secure

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab.
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
- Change the Download signed ActiveX controls to Prompt.
- Change the Download unsigned ActiveX controls to Disable.
- Change the Initialise and script ActiveX controls not marked as safe to Disable.
- Change the Installation of desktop items to Prompt.
- Change the Launching programs and files in an IFRAME to Prompt.
- Change the Navigate sub-frames across different domains to Prompt.
- When all these settings have been made, click on the OK button.
- If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

3. Update your Anti-Virus Software - I can not overemphasize the need for you to update your Anti-virus application on a regular basis. With the ever increasing number of new variants of malware arriving on the scene daily, you become very susceptible to an attack without updated protection.

4. Make sure you keep your Windows OS current by visiting Windows update regularly to download and install any critical updates and service packs. Without these you are leaving the back door open.

5. Consider a custom hosts file such as MVPS HOSTS. This custom hosts file effectively blocks a wide range of unwanted ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
For information on how to download and install, please read this tutorial by WinHelp2002
Note: Be sure to follow the instructions to disable the DNS Client service before installing a custom hosts file.

6. Download and install the free version of WinPatrol. This program protects your computer in a variety of ways and will work well with your existing security software. Have a look at this tutorial to help you get started with the program.

7. SpywareBlaster - Download and install SpywareBlaster. This program prevents the installation of ActiveX-based spyware and other potentially unwanted programs.

8. Protect your computer from internet threats with SandboxIE. This program isolates Internet Explorer from the rest of your operating system, 'sandboxing' it away - so malicious websites can't do damage to the rest of your system. There is a Getting Started guide on their website.

9. Some excellent free firewalls. Note: Use only one firewall at a time.
Agnitum Outpost Firewall
Comodo Firewall - If you are installing this and already have an anti spyware then please do not install Comodo's anti spyware program.
Online Armor Personal Firewall

10. And finally, please read these excellent articles:
Malware: Help prevent the Infection by Sandi Hardmeier,
Preventing Malware - Tools and Practices for Safe Computing

For more safe computing tips please read the guide by Rorschach112 on how to prevent malware and about safe computing here.

Good luck, happy computing and stay clean!

JohnDJ

Post #14March 10, 2010, 4:26 AM UTC

Will do as you suggest but can't until 2 weeks from now. Will be traveling. Please forward information on how I can contribute to "Whatthetechs efforts. Thanks, JonDJ

inzanity

Post #15March 10, 2010, 7:21 AM UTC

Hi,

The work we do here is free, however if you wish to donate please read here. Thank you.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

[Resolved] Coupon B malware not Removed by SPYBOT

✨ Ask AI

Ask AI