Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1]   Go Down

Author Topic: Virus problem with computer  (Read 8488 times)

0 Members and 1 Guest are viewing this topic.

jdohe003

    Topic Starter


    Starter

    Virus problem with computer
    « on: June 03, 2010, 01:51:41 AM »
    Hello, I run Windows Vista on a HP Pavilion a6110n computer I've had for around 2 years. This is the first time I've had a virus show up and appreciate any help in resolving the matter. When I turn the computer on the majority of the time the computer prompts me that various programs are infected. The computer then proceeds to crash to a blue screen before restarting itself to do the same process over again. I have installed and provided the following logs from the necessary programs from the forum header. Thanks for any info regarding this matter.


    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 06/02/2010 at 11:14 PM

    Application Version : 4.38.1004

    Core Rules Database Version : 4951
    Trace Rules Database Version: 2763

    Scan type       : Complete Scan
    Total Scan Time : 02:12:18

    Memory items scanned      : 573
    Memory threats detected   : 1
    Registry items scanned    : 8003
    Registry threats detected : 27
    File items scanned        : 164778
    File threats detected     : 224

    Trojan.Agent/Gen-Faldesc
        C:\USERS\JOHN\APPDATA\LOCAL\ASAM.EXE
        C:\USERS\JOHN\APPDATA\LOCAL\ASAM.EXE
        [asam] C:\USERS\JOHN\APPDATA\LOCAL\ASAM.EXE
        [asam] C:\USERS\JOHN\APPDATA\LOCAL\ASAM.EXE
        C:\USERS\JOHN\APPDATA\LOCAL\SYSSVC.EXE
        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\ASAM.EXE
        C:\WINDOWS\SYSTEM32\CONFIG\SYSTEMPROFILE\APPDATA\LOCAL\SYSSVC.EXE

    Adware.MyWebSearch
        HKU\S-1-5-21-539128362-1406653621-4005209133-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{00A6FAF1-072E-44CF-8957-5838F569A31D}
        HKU\S-1-5-21-539128362-1406653621-4005209133-1000\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{07B18EA1-A523-4961-B6BB-170DE4475CCA}

    Adware.MyWebSearch/FunWebProducts
        HKCR\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}
        HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}
        HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0
        HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0
        HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\0\win32
        HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\FLAGS
        HKCR\TypeLib\{D518921A-4A03-425E-9873-B9A71756821E}\1.0\HELPDIR
        HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}
        HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid
        HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\ProxyStubClsid32
        HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib
        HKCR\Interface\{2E9937FC-CF2F-4F56-AF54-5A6A3DD375CC}\TypeLib#Version
        HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}
        HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid
        HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\ProxyStubClsid32
        HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib
        HKCR\Interface\{741DE825-A6F0-4497-9AA6-8023CF9B0FFF}\TypeLib#Version
        HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}
        HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid
        HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\ProxyStubClsid32
        HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib
        HKCR\Interface\{CF54BE1C-9359-4395-8533-1657CF209CFE}\TypeLib#Version

    Rogue.AntivirusSoft
        HKU\S-1-5-21-539128362-1406653621-4005209133-1000\Software\avsoft

    Adware.Tracking Cookie
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@247realmedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@247realmedia[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@247realmedia[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@247realmedia[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][10].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][11].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][9].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adbrite[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adbrite[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adbrite[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adcloudmedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adecn[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adecn[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@admedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][9].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertise[8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@advertising[7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adxpose[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adxpose[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@apmebf[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@apmebf[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@apmebf[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@atdmt[9].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@bizzclick[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@burstbeacon[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@burstbeacon[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@burstnet[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@burstnet[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@casalemedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@casalemedia[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@casalemedia[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@casalemedia[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@collective-media[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@collective-media[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][10].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[10].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@doubleclick[9].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@fastclick[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@fastclick[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@fastclick[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@fastclick[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@imrworldwide[8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@insightexpressai[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@insightexpressai[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@interclick[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@invitemedia[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@legolas-media[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@lucidmedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@lucidmedia[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@media6degrees[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@media6degrees[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@mediaplex[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pointroll[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pointroll[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pointroll[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pointroll[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@pro-market[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@questionmarket[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@questionmarket[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@questionmarket[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[10].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[5].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[7].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[8].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@realmedia[9].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@revsci[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@ru4[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@ru4[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@serving-sys[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@serving-sys[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@serving-sys[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@serving-sys[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@serving-sys[6].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificclick[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificclick[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificclick[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificmedia[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@specificmedia[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@statcounter[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@statcounter[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@statcounter[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@tacoda[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@tacoda[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@trafficmp[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@trafficmp[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@trafficmp[3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@trafficrevenue[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@tribalfusion[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@tribalfusion[2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@tribalfusion[4].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][2].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\[email protected][3].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@zedo[1].txt
        C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@zedo[2].txt




    Malwarebytes' Anti-Malware 1.46
    www.malwarebytes.org

    Database version: 4166

    Windows 6.0.6002 Service Pack 2
    Internet Explorer 8.0.6001.18904

    6/3/2010 2:55:38 AM
    mbam-log-2010-06-03 (02-55-38).txt

    Scan type: Quick scan
    Objects scanned: 131486
    Time elapsed: 6 minute(s), 11 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 17
    Registry Values Infected: 1
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 1

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{07b18eab-a523-4961-b6bb-170de4475cca} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\avsoft (Trojan.Fraudpack) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\avsuite (Rogue.AntivirusSuite) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWebSearch) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kpsexjsj (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Users\John\AppData\Local\qnsfuwgdm\jqdlibptssd.exe (Rogue.AntispywareSoft) -> Quarantined and deleted successfully.




    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 3:33:12 AM, on 6/3/2010
    Platform: Windows Vista SP2 (WinNT 6.00.1906)
    MSIE: Internet Explorer v8.00 (8.00.6001.18904)
    Boot mode: Normal

    Running processes:
    C:\Windows\system32\Dwm.exe
    C:\hp\support\hpsysdrv.exe
    C:\hp\KBD\KbdStub.exe
    C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
    C:\Windows\RtHDVCpl.exe
    C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
    C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
    C:\Windows\ehome\ehtray.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    C:\Windows\ehome\ehmsas.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Windows\explorer.exe
    C:\Program Files\Trend Micro\HiJackThis\sniper.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=desktop
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    O1 - Hosts: ::1 localhost
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)
    O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
    O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
    O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KbdStub.EXE
    O4 - HKLM\..\Run: [OsdMaestro] "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
    O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [D-Link Wireless G WDA-1320] C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
    O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
    O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
    O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
    O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
    O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
    O4 - HKCU\..\Run: [HPAdvisor] C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
    O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
    O4 - HKCU\..\Run: [NCsoft Launcher] C:\Program Files\NCSoft\Launcher\NCLauncher.exe /Minimized
    O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
    O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User '?')
    O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User '?')
    O4 - HKUS\S-1-5-21-539128362-1406653621-4005209133-1000\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun (User '?')
    O4 - S-1-5-21-539128362-1406653621-4005209133-1000 Startup: CurseClientStartup.ccip (User '?')
    O4 - Startup: CurseClientStartup.ccip
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
    O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (file missing)
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\Windows\system32\browseui.dll
    O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
    O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Jumpstart Wifi Protected Setup (jswpsapi) - Atheros Communications, Inc. - C:\Program Files\D-Link\Wireless G WDA-1320\JSWUtilVst\jswpsapi.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
    O23 - Service: stllssvr - Unknown owner - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
    O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

    --
    End of file - 9090 bytes

    Logged

    Dr Jay

    • Malware Removal Specialist


      • Specialist
    • Moderator emeritus
      • Thanked: 119
    • Experience: Guru
    • OS: Windows 10
    Re: Virus problem with computer
    « Reply #1 on: June 03, 2010, 02:42:09 PM »
    Hello, and welcome to Computer Hope.

    Please note the following information about the malware forum:
    • Only the Malware Specialist Team is allowed to give advice on removing malware from your computer.
    • From this point on, please do not make any more changes to your computer; such as install/uninstall programs, use special fix tools, delete files, edit the registry, etc. - unless advised by the staff I noted above.
    • Please do not attach logs or post them in Quote/Code boxes unless requested.
    • Please do not ask for help elsewhere (in this site or other sites). Doing so can result in system changes, which may not show up in the logs you post.
    • If you have already asked for help somewhere, please post the link to the topic you were helped.
    • We try our best to reply quickly, but for any reason we do not reply in two days, reply to this topic with the word BUMP
    • Lastly, keep in mind that we are volunteers, so you do not have to pay for malware removal. Persist in this topic until its close, and your computer is declared clean.

    Please download MySystem-Search from one of the following links:
      Download mirror 1 Download mirror 2[/list]
      • Save the file to your Desktop.
      • Double-click on mss.exe
      • Allow it to run, and follow the prompts.
      • Once done, it will launch a log.
      • Post it in your next reply.
      Note: the logs are long. Please use more than one post, if necessary.
      Logged
      ~Dr Jay

      jdohe003

        Topic Starter


        Starter

        Re: Virus problem with computer
        « Reply #2 on: June 04, 2010, 02:06:37 PM »
        Thanks for the reply. Here is the mss.exe log as requested

        MySystem-Search
         
        Run on 06/04/2010 at 15:57:44
         
        MSS v1.1
         
         
        Basic System Information
         

        Host Name:                 JOHN-PC
        OS Name:                   Microsoftr Windows VistaT Home Premium
        OS Version:                6.0.6002 Service Pack 2 Build 6002
        OS Manufacturer:           Microsoft Corporation
        OS Configuration:          Standalone Workstation
        OS Build Type:             Multiprocessor Free
        Registered Owner:          John
        Registered Organization:   Hewlett-Packard Company
        Product ID:                89578-OEM-7332157-00061
        Original Install Date:     5/23/2007, 9:04:25 PM
        System Boot Time:          6/4/2010, 3:27:47 PM
        System Manufacturer:       HP-Pavilion
        System Model:              GG781AA-ABA a6110n
        System Type:               X86-based PC
        Processor(s):              1 Processor(s) Installed.
                                   [01]: x64 Family 15 Model 107 Stepping 1 AuthenticAMD ~2300 Mhz
        BIOS Version:              Phoenix Technologies, LTD  5.08, 5/4/2007
        Windows Directory:         C:\Windows
        System Directory:          C:\Windows\system32
        Boot Device:               \Device\HarddiskVolume1
        System Locale:             en-us;English (United States)
        Input Locale:              en-us;English (United States)
        Time Zone:                 (GMT-05:00) Eastern Time (US & Canada)
        Total Physical Memory:     1,918 MB
        Available Physical Memory: 830 MB
        Page File: Max Size:       4,080 MB
        Page File: Available:      3,034 MB
        Page File: In Use:         1,046 MB
        Page File Location(s):     C:\pagefile.sys
        Domain:                    WORKGROUP
        Logon Server:              \\JOHN-PC
        Hotfix(s):                 224 Hotfix(s) Installed.
                                   [01]: {A73FDC4C-93C9-4AAE-A635-B9B318A94DA0} - Microsoft Works 8.0 installation.
                                   [02]: KB971513
                                   [03]: KB971512
                                   [04]: 944036
                                   [05]: KB960362
                                   [06]: KB971514
                                   [07]: KB925528
                                   [08]: KB925902
                                   [09]: KB929399
                                   [10]: KB929451
                                   [11]: KB929615
                                   [12]: KB929685
                                   [13]: KB929735
                                   [14]: KB929761
                                   [15]: KB929762
                                   [16]: KB929763
                                   [17]: KB929777
                                   [18]: KB930163
                                   [19]: KB930178
                                   [20]: KB930568
                                   [21]: KB930857
                                   [22]: KB931099
                                   [23]: KB931573
                                   [24]: KB932471
                                   [25]: KB933245
                                   [26]: KB933579
                                   [27]: KB933729
                                   [28]: KB935652
                                   [29]: KB936021
                                   [30]: KB936782
                                   [31]: KB936825
                                   [32]: KB937077
                                   [33]: KB938127
                                   [34]: KB939159
                                   [35]: KB941202
                                   [36]: KB941229
                                   [37]: KB941568
                                   [38]: KB941569
                                   [39]: KB941600
                                   [40]: KB941644
                                   [41]: KB943055
                                   [42]: KB943078
                                   [43]: KB945553
                                   [44]: KB946026
                                   [45]: KB946456
                                   [46]: KB947172
                                   [47]: KB905866
                                   [48]: KB928089
                                   [49]: KB929123
                                   [50]: KB929427
                                   [51]: KB929916
                                   [52]: KB931213
                                   [53]: KB931836
                                   [54]: KB932246
                                   [55]: KB933360
                                   [56]: KB933566
                                   [57]: KB933928
                                   [58]: KB935280
                                   [59]: KB935807
                                   [60]: KB936824
                                   [61]: KB937143
                                   [62]: KB937287
                                   [63]: KB938123
                                   [64]: KB938194
                                   [65]: KB938371
                                   [66]: KB938464
                                   [67]: KB938979
                                   [68]: KB939653
                                   [69]: KB941649
                                   [70]: KB941651
                                   [71]: KB941693
                                   [72]: KB942615
                                   [73]: KB942624
                                   [74]: KB942763
                                   [75]: KB943302
                                   [76]: KB943411
                                   [77]: KB943899
                                   [78]: KB944533
                                   [79]: KB946041
                                   [80]: KB947562
                                   [81]: KB947864
                                   [82]: KB948590
                                   [83]: KB948609
                                   [84]: KB948610
                                   [85]: KB948881
                                   [86]: KB950124
                                   [87]: KB950125
                                   [88]: KB950126
                                   [89]: KB950582
                                   [90]: KB950759
                                   [91]: KB950760
                                   [92]: KB950762
                                   [93]: KB950974
                                   [94]: KB951066
                                   [95]: KB951072
                                   [96]: KB951376
                                   [97]: KB951618
                                   [98]: KB951698
                                   [99]: KB951978
                                   [100]: KB952004
                                   [101]: KB952069
                                   [102]: KB952287
                                   [103]: KB952709
                                   [104]: KB953155
                                   [105]: KB953733
                                   [106]: KB953838
                                   [107]: KB953839
                                   [108]: KB954154
                                   [109]: KB954155
                                   [110]: KB954211
                                   [111]: KB954366
                                   [112]: KB954459
                                   [113]: KB955020
                                   [114]: KB955069
                                   [115]: KB955302
                                   [116]: KB955430
                                   [117]: KB955519
                                   [118]: KB955839
                                   [119]: KB956390
                                   [120]: KB956391
                                   [121]: KB956572
                                   [122]: KB956744
                                   [123]: KB956802
                                   [124]: KB956841
                                   [125]: KB957095
                                   [126]: KB957097
                                   [127]: KB957200
                                   [128]: KB957321
                                   [129]: KB957388
                                   [130]: KB958215
                                   [131]: KB958481
                                   [132]: KB958483
                                   [133]: KB958623
                                   [134]: KB958624
                                   [135]: KB958644
                                   [136]: KB958687
                                   [137]: KB958690
                                   [138]: KB959108
                                   [139]: KB959130
                                   [140]: KB959426
                                   [141]: KB959772
                                   [142]: KB960225
                                   [143]: KB960544
                                   [144]: KB960714
                                   [145]: KB960715
                                   [146]: KB960803
                                   [147]: KB961260
                                   [148]: KB961371
                                   [149]: KB961501
                                   [150]: KB963027
                                   [151]: KB967632
                                   [152]: KB967723
                                   [153]: KB968389
                                   [154]: KB968537
                                   [155]: KB968816
                                   [156]: KB969497
                                   [157]: KB969897
                                   [158]: KB969898
                                   [159]: KB969947
                                   [160]: KB970238
                                   [161]: KB970430
                                   [162]: KB970653
                                   [163]: KB970710
                                   [164]: KB971180
                                   [165]: KB971468
                                   [166]: KB971486
                                   [167]: KB971557
                                   [168]: KB971657
                                   [169]: KB971737
                                   [170]: KB971930
                                   [171]: KB971961
                                   [172]: KB972036
                                   [173]: KB972145
                                   [174]: KB972260
                                   [175]: KB972270
                                   [176]: KB972594
                                   [177]: KB972636
                                   [178]: KB973346
                                   [179]: KB973507
                                   [180]: KB973525
                                   [181]: KB973540
                                   [182]: KB973565
                                   [183]: KB973687
                                   [184]: KB973768
                                   [185]: KB973874
                                   [186]: KB973917
                                   [187]: KB974145
                                   [188]: KB974306
                                   [189]: KB974318
                                   [190]: KB974455
                                   [191]: KB974470
                                   [192]: KB974571
                                   [193]: KB975364
                                   [194]: KB975467
                                   [195]: KB975517
                                   [196]: KB975560
                                   [197]: KB975561
                                   [198]: KB975929
                                   [199]: KB976098
                                   [200]: KB976264
                                   [201]: KB976325
                                   [202]: KB976470
                                   [203]: KB976662
                                   [204]: KB976749
                                   [205]: KB977165
                                   [206]: KB977816
                                   [207]: KB978207
                                   [208]: KB978251
                                   [209]: KB978262
                                   [210]: KB978338
                                   [211]: KB978506
                                   [212]: KB978542
                                   [213]: KB978601
                                   [214]: KB979099
                                   [215]: KB979306
                                   [216]: KB979309
                                   [217]: KB979683
                                   [218]: KB980182
                                   [219]: KB980232
                                   [220]: KB980248
                                   [221]: KB980302
                                   [222]: KB981332
                                   [223]: KB948465
                                   [224]: 940157
        Network Card(s):           2 NIC(s) Installed.
                                   [01]: NVIDIA nForce Networking Controller
                                         Connection Name: Local Area Connection
                                         Status:          Media disconnected
                                   [02]: D-Link WDA-1320 Desktop Adapter
                                         Connection Name: Wireless Network Connection
                                         DHCP Enabled:    Yes
                                         DHCP Server:     192.168.2.1
                                         IP address(es)
                                         [01]: 192.168.2.4
                                         [02]: fe80::bd:ca49:2abc:5b48
         
         
        CD Emulation Drivers running?
         
         
         
        Peer-to-Peer applications?
         
        LimeWire found!
        uTorrent found!
         
         
        File associations
         
        .exe=exefile
        .scr=scrfile
        .pif=piffile
        .com=comfile
        .bat=batfile
        .cmd=cmdfile
        .log=txtfile
        .txt=txtfile
        .reg=regfile
        .sys=sysfile
        .dll=dllfile
         
         
        Running processes
         

        Image Name                     PID Session Name        Session#    Mem Usage
        ========================= ======== ================ =========== ============
        System Idle Process              0 Services                   0         24 K
        System                           4 Services                   0    103,604 K
        smss.exe                       428 Services                   0        576 K
        csrss.exe                      512 Services                   0      4,800 K
        wininit.exe                    564 Services                   0      3,680 K
        csrss.exe                      576 Console                    1     11,348 K
        services.exe                   608 Services                   0      6,668 K
        lsass.exe                      624 Services                   0      3,556 K
        lsm.exe                        632 Services                   0      3,480 K
        winlogon.exe                   708 Console                    1      4,836 K
        svchost.exe                    804 Services                   0      6,308 K
        nvvsvc.exe                     848 Services                   0      3,164 K
        svchost.exe                    876 Services                   0      6,128 K
        svchost.exe                    928 Services                   0     35,028 K
        svchost.exe                   1036 Services                   0     10,464 K
        svchost.exe                   1088 Services                   0     71,364 K
        svchost.exe                   1112 Services                   0     50,552 K
        audiodg.exe                   1184 Services                   0     12,960 K
        svchost.exe                   1248 Services                   0      3,984 K
        SLsvc.exe                     1264 Services                   0      3,524 K
        svchost.exe                   1288 Services                   0     12,352 K
        svchost.exe                   1420 Services                   0     18,128 K
        nvvsvc.exe                    1544 Console                    1      5,448 K
        spoolsv.exe                   1684 Services                   0      8,036 K
        svchost.exe                   1708 Services                   0      9,896 K
        svchost.exe                   2020 Services                   0      5,032 K
        AppleMobileDeviceService.      192 Services                   0      3,756 K
        AluSchedulerSvc.exe            260 Services                   0      1,056 K
        mDNSResponder.exe              452 Services                   0      4,076 K
        svchost.exe                    516 Services                   0      8,128 K
        LSSrvc.exe                    1276 Services                   0      2,768 K
        PIFSvc.exe                    1380 Services                   0      1,180 K
        MDM.EXE                       1448 Services                   0      4,188 K
        svchost.exe                   1844 Services                   0      2,524 K
        svchost.exe                   2068 Services                   0      2,352 K
        svchost.exe                   2084 Services                   0      4,280 K
        svchost.exe                   2112 Services                   0      5,136 K
        svchost.exe                   2156 Services                   0      4,444 K
        svchost.exe                   2192 Services                   0      2,136 K
        SearchIndexer.exe             2276 Services                   0     28,820 K
        XAudio.exe                    2368 Services                   0      2,040 K
        WUDFHost.exe                  2504 Services                   0      3,992 K
        taskeng.exe                   2736 Services                   0      4,900 K
        alg.exe                       3440 Services                   0      3,160 K
        taskeng.exe                   2292 Console                    1      8,892 K
        dwm.exe                       3360 Console                    1      3,100 K
        explorer.exe                  3216 Console                    1     33,820 K
        MSASCui.exe                   1588 Console                    1      9,672 K
        hpsysdrv.exe                  1164 Console                    1      1,836 K
        OSD.exe                       3544 Console                    1      2,560 K
        RtHDVCpl.exe                  3496 Console                    1      4,800 K
        hpwuSchd2.exe                 3312 Console                    1      2,272 K
        PIFSvc.exe                    3984 Console                    1        820 K
        AirGCFG.exe                   3960 Console                    1      5,296 K
        WZCSLDR2.exe                  2856 Console                    1      5,440 K
        GrooveMonitor.exe             2976 Console                    1      5,808 K
        jusched.exe                   1428 Console                    1      3,096 K
        iTunesHelper.exe              3176 Console                    1      6,664 K
        sidebar.exe                   3580 Console                    1      5,784 K
        ehtray.exe                    3584 Console                    1      1,252 K
        asam.exe                      3860 Console                    1     10,896 K
        hpqtra08.exe                  3196 Console                    1      9,028 K
        ehmsas.exe                    2844 Console                    1      3,264 K
        wuauclt.exe                   2920 Console                    1      4,752 K
        firefox.exe                   1736 Console                    1     87,944 K
        WmiPrvSE.exe                  3100 Services                   0     12,260 K
        hpqste08.exe                  3588 Console                    1      5,908 K
        hpqbam08.exe                  2316 Console                    1      5,052 K
        VSSVC.exe                     4800 Services                   0     15,484 K
        svchost.exe                   4924 Services                   0      6,452 K
        kbd.exe                       5628 Console                    1      9,004 K
        mss.exe                       2288 Console                    1      3,016 K
        cmd.exe                       3484 Console                    1      2,384 K
        WmiPrvSE.exe                  5036 Services                   0      5,124 K
        TrustedInstaller.exe          3236 Services                   0     33,892 K
        tasklist.exe                  4988 Console                    1      4,516 K
         
         
        Hidden objects
         
        PATH: C:\windows
         
        Installer
        msdownld.tmp
        PIF
        QTFont.qfn
        WindowsShell.Manifest
         
         
        PATH: C:\windows\system32
         
        7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
        7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
        desktop.ini
        GroupPolicy
         
         
        PATH: C:\windows\system32\drivers
         
        103C_HP_CPC_GG781AA-ABA a6110n_YC_0Pavi_QMXF721_E73NAv3PrA1_49_ INARRA2_SASUSTek Computer INC._V2.00_B5.08_T070504_WUH0_L409_M191 9_J320_7AMD_8Athlon 64 X2 Dual Core_92.3_#070709_N10DE03EF_Z14F12F20_G10DE03D0.MRK
        Msft_User_WpdFs_01_00_00.Wdf
        Msft_User_WpdFs_01_07_00.Wdf
         
         
        PATH: C:\
         
        $AVG
        $Recycle.Bin
        Boot
        bootmgr
        Documents and Settings
        hiberfil.sys
        hp
        IO.SYS
        MSDOS.SYS
        MSOCache
        pagefile.sys
        ProgramData
        System Volume Information
         
         
        User Profile check
         
        John
        Public
         

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList
            ProfilesDirectory    REG_EXPAND_SZ    %SystemDrive%\Users
            Default    REG_EXPAND_SZ    %SystemDrive%\Users\Default
            Public    REG_EXPAND_SZ    %SystemDrive%\Users\Public
            ProgramData    REG_EXPAND_SZ    %SystemDrive%\ProgramData

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18
            Flags    REG_DWORD    0xc
            State    REG_DWORD    0x0
            RefCount    REG_DWORD    0x1
            Sid    REG_BINARY    010100000000000512000000
            ProfileImagePath    REG_EXPAND_SZ    %systemroot%\system32\config\systemprofile

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-19
            ProfileImagePath    REG_EXPAND_SZ    %SystemRoot%\ServiceProfiles\LocalService
            Flags    REG_DWORD    0x0
            State    REG_DWORD    0x0

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-20
            ProfileImagePath    REG_EXPAND_SZ    %SystemRoot%\ServiceProfiles\NetworkService
            Flags    REG_DWORD    0x0
            State    REG_DWORD    0x0

        HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-539128362-1406653621-4005209133-1000
            ProfileImagePath    REG_EXPAND_SZ    C:\Users\John
            Flags    REG_DWORD    0x0
            State    REG_DWORD    0x100
            Sid    REG_BINARY    0105000000000005150000002A722220B5D4D75 32DA4BAEEE8030000
            ProfileLoadTimeLow    REG_DWORD    0x0
            ProfileLoadTimeHigh    REG_DWORD    0x0
            RefCount    REG_DWORD    0x1
            RunLogonScriptSync    REG_DWORD    0x0

         
         
        Current Scheduled Tasks
         
        PATH: C:\Windows\Tasks
         
        SCHEDLGU.TXT
        SA.DAT
         
         
        Windows Drivers and NT-Services
         
         Volume in drive C is HP
         Volume Serial Number is F00C-A5A5

         Directory of C:\Windows\System32\Drivers

        07/09/2007  07:14 PM             1,837 103C_HP_CPC_GG781AA-ABA a6110n_YC_0Pavi_QMXF721_E73NAv3PrA1_49_ INARRA2_SASUSTek Computer INC._V2.00_B5.08_T070504_WUH0_L409_M191 9_J320_7AMD_8Athlon 64 X2 Dual Core_92.3_#070709_N10DE03EF_Z14F12F20_G10DE03D0.MRK
        06/06/2008  01:37 PM                 0 Msft_User_WpdFs_01_00_00.Wdf
        11/18/2009  05:19 PM                 0 Msft_User_WpdFs_01_07_00.Wdf
                       3 File(s)          1,837 bytes
                       0 Dir(s)  219,491,282,944 bytes free
         Volume in drive C is HP
         Volume Serial Number is F00C-A5A5

         Directory of C:\Windows\System32\Drivers

        08/25/2005  03:00 PM           466,880 A3AB.sys
        12/12/2005  01:27 PM            19,072 PS2.sys
        06/19/2006  10:26 AM            12,672 mdmxsdk.sys
        09/18/2006  05:26 PM         3,440,660 gm.dls
        09/18/2006  05:26 PM               646 gmreadme.txt
        11/02/2006  02:37 AM            20,480 secdrv.sys
        11/02/2006  03:30 AM           117,760 E1G60I32.sys
        11/02/2006  03:30 AM           429,056 nvm60x32.sys
        11/02/2006  03:36 AM           235,520 HdAudio.sys
        11/02/2006  03:36 AM            20,608 ntrigdigi.sys
        11/02/2006  04:24 AM            62,336 BrSerWdm.sys
        11/02/2006  04:24 AM            12,160 BrUsbMdm.sys
        11/02/2006  04:24 AM            13,568 BrFiltLo.sys
        11/02/2006  04:24 AM             5,248 BrFiltUp.sys
        11/02/2006  04:24 AM            11,904 BrUsbSer.sys
        11/02/2006  04:25 AM            71,808 BrSerId.sys
        11/02/2006  04:30 AM            39,424 intelppm.sys
        11/02/2006  04:30 AM            38,400 processr.sys
        11/02/2006  04:30 AM            38,912 amdk7.sys
        11/02/2006  04:30 AM            38,912 crusoe.sys
        11/02/2006  04:30 AM            39,424 viac7.sys
        11/02/2006  04:35 AM            11,264 wmiacpi.sys
        11/02/2006  04:42 AM            65,536 IPMIDrv.sys
        11/02/2006  04:51 AM            15,872 kbdhid.sys
        11/02/2006  04:51 AM             8,704 parvdm.sys
        11/02/2006  04:51 AM            17,920 serenum.sys
        11/02/2006  04:51 AM            83,456 serial.sys
        11/02/2006  04:51 AM            79,360 parport.sys
        11/02/2006  04:51 AM            20,480 flpydisk.sys
        11/02/2006  04:51 AM            25,088 fdc.sys
        11/02/2006  04:51 AM            13,312 sffdisk.sys
        11/02/2006  04:51 AM            12,800 sffp_mmc.sys
        11/02/2006  04:51 AM            12,800 sffp_sd.sys
        11/02/2006  04:51 AM            13,312 sfloppy.sys
        11/02/2006  04:52 AM            20,608 wacompen.sys
        11/02/2006  04:53 AM            26,112 vgapnp.sys
        11/02/2006  04:55 AM            21,504 hidir.sys
        11/02/2006  04:55 AM            22,528 usbuhci.sys
        11/02/2006  04:55 AM            35,328 circlass.sys
        11/02/2006  04:55 AM            68,608 usbcir.sys
        11/02/2006  04:55 AM            29,184 hidbth.sys
        11/02/2006  04:55 AM            39,936 bthmodem.sys
        11/02/2006  05:03 AM           242,688 rdpdr.sys
        11/02/2006  05:04 AM           878,080 PEAuth.sys
        11/02/2006  05:49 AM            14,952 aliide.sys
        11/02/2006  05:49 AM            14,952 intelide.sys
        11/02/2006  05:49 AM            16,488 i2omgmt.sys
        11/02/2006  05:49 AM            15,464 amdide.sys
        11/02/2006  05:49 AM            16,488 cmdide.sys
        11/02/2006  05:49 AM            17,512 viaide.sys
        11/02/2006  05:49 AM            18,280 compbatt.sys
        11/02/2006  05:49 AM            19,560 wd.sys
        11/02/2006  05:49 AM            22,632 crcdisk.sys
        11/02/2006  05:49 AM            23,144 msahci.sys
        11/02/2006  05:49 AM            25,192 battc.sys
        11/02/2006  05:49 AM            27,752 i2omp.sys
        11/02/2006  05:49 AM            53,352 SISAGP.SYS
        11/02/2006  05:49 AM            53,864 AGP440.sys
        11/02/2006  05:49 AM            54,376 VIAAGP.SYS
        11/02/2006  05:49 AM            28,776 megasas.sys
        11/02/2006  05:49 AM            31,848 sym_hi.sys
        11/02/2006  05:49 AM            54,888 AMDAGP.SYS
        11/02/2006  05:49 AM            33,384 Mraid35x.sys
        11/02/2006  05:49 AM            56,936 UAGP35.SYS
        11/02/2006  05:50 AM            34,920 sym_u3.sys
        11/02/2006  05:50 AM            58,472 ULIAGPKX.SYS
        11/02/2006  05:50 AM            58,984 GAGP30KX.SYS
        11/02/2006  05:50 AM            65,640 lsi_fc.sys
        11/02/2006  05:50 AM            35,944 symc8xx.sys
        11/02/2006  05:50 AM            65,640 lsi_sas.sys
        11/02/2006  05:50 AM            35,944 iteatapi.sys
        11/02/2006  05:50 AM            35,944 iteraid.sys
        11/02/2006  05:50 AM            67,688 arc.sys
        11/02/2006  05:50 AM            65,640 lsi_scsi.sys
        11/02/2006  05:50 AM            37,480 HpCISSs.sys
        11/02/2006  05:50 AM            38,504 sisraid2.sys
        11/02/2006  05:50 AM            67,688 arcsas.sys
        11/02/2006  05:50 AM            71,272 djsvs.sys
        11/02/2006  05:50 AM            40,040 nvstor.sys
        11/02/2006  05:50 AM            76,392 sbp2port.sys
        11/02/2006  05:50 AM            71,784 sisraid4.sys
        11/02/2006  05:50 AM            78,952 mpio.sys
        11/02/2006  05:50 AM            41,576 iirsp.sys
        11/02/2006  05:50 AM            80,488 msdsm.sys
        11/02/2006  05:50 AM            45,160 nfrd960.sys
        11/02/2006  05:50 AM            47,208 isapnp.sys
        11/02/2006  05:50 AM            88,680 nvraid.sys
        11/02/2006  05:50 AM            98,408 ulsata.sys
        11/02/2006  05:50 AM            98,408 adpu160m.sys
        11/02/2006  05:50 AM           106,088 ql40xx.sys
        11/02/2006  05:50 AM           106,600 NV_AGP.SYS
        11/02/2006  05:50 AM           112,232 vsmraid.sys
        11/02/2006  05:50 AM           115,816 ulsata2.sys
        11/02/2006  05:51 AM           147,048 adpu320.sys
        11/02/2006  05:51 AM           167,528 pcmcia.sys
        11/02/2006  05:51 AM           232,040 iaStorV.sys
        11/02/2006  05:51 AM           235,112 uliahci.sys
        11/02/2006  05:51 AM           297,576 adpahci.sys
        11/02/2006  05:51 AM           316,520 elxstor.sys
        11/02/2006  05:51 AM           420,968 adp94xx.sys
        11/02/2006  05:51 AM           900,712 ql2300.sys
        01/03/2007  08:20 PM             1,732 nvphy.bin
        01/30/2007  02:53 PM            16,496 NVXBAR.SYS
        01/30/2007  02:53 PM           141,582 NVCAP.SYS
        02/02/2007  06:00 AM             9,336 cdr4_xp.sys
        02/02/2007  06:00 AM            43,528 pxhelp20.sys
        02/02/2007  06:00 AM             9,464 cdralw2k.sys
        05/04/2007  02:29 AM         1,065,384 nvmfdx32.sys
        06/30/2007  04:10 AM           738,304 A3ABv.sys
        07/27/2007  12:06 PM            20,352 jswpslwf.sys
        08/03/2007  11:40 AM           143,792 HSFProf.cty
        08/07/2007  02:26 PM             8,704 XAudio.sys
        08/07/2007  02:26 PM           386,560 XAudio.exe
        10/16/2007  05:51 PM           985,088 HSX_DP.sys
        10/16/2007  05:52 PM           660,992 HSX_CNXT.sys
        10/16/2007  05:53 PM           267,264 HSXHWBS2.sys
        10/26/2007  06:51 PM           110,624 nvstor32.sys
        01/05/2008  07:31 AM                 3 MsftWdf_Kernel_01007_Inbox_Critical.Wdf
        01/19/2008  01:27 AM            44,032 amdk8.sys
        01/19/2008  01:27 AM            12,800 fs_rec.sys
        01/19/2008  01:28 AM            70,144 cdfs.sys
        01/19/2008  01:28 AM            22,528 msfs.sys
        01/19/2008  01:28 AM            69,632 bowser.sys
        01/19/2008  01:30 AM            27,648 filetrace.sys
        01/19/2008  01:30 AM            84,480 luafv.sys
        01/19/2008  01:36 AM            13,312 dxapi.sys
        01/19/2008  01:49 AM            16,384 Dot4Prt.sys
        01/19/2008  01:49 AM            36,864 Dot4usb.sys
        01/19/2008  01:49 AM             6,144 beep.sys
        01/19/2008  01:49 AM             4,608 null.sys
        01/19/2008  01:49 AM           131,584 Dot4.sys
        01/19/2008  01:49 AM            19,968 sermouse.sys
        01/19/2008  01:49 AM            15,872 mouhid.sys
        01/19/2008  01:49 AM             5,888 mspclock.sys
        01/19/2008  01:49 AM            54,784 i8042prt.sys
        01/19/2008  01:49 AM             5,504 mspqm.sys
        01/19/2008  01:49 AM             6,016 mstee.sys
        01/19/2008  01:49 AM             8,192 mskssrv.sys
        01/19/2008  01:49 AM            17,408 smclib.sys
        01/19/2008  01:49 AM            24,576 tape.sys
        01/19/2008  01:49 AM            18,944 mcd.sys
        01/19/2008  01:52 AM            25,088 vga.sys
        01/19/2008  01:52 AM           110,080 videoprt.sys
        01/19/2008  01:52 AM            41,984 monitor.sys
        01/19/2008  01:52 AM            51,200 WUDFPf.sys
        01/19/2008  01:53 AM            83,328 WUDFRd.sys
        01/19/2008  01:53 AM             5,632 drmkaud.sys
        01/19/2008  01:53 AM            25,472 hidparse.sys
        01/19/2008  01:53 AM             5,888 usbd.sys
        01/19/2008  01:53 AM            53,376 1394bus.sys
        01/19/2008  01:53 AM            73,216 usbccgp.sys
        01/19/2008  01:53 AM            12,288 bdasup.sys
        01/19/2008  01:53 AM             7,680 umpass.sys
        01/19/2008  01:53 AM            34,816 umbus.sys
        01/19/2008  01:54 AM            64,000 mpsdrv.sys
        01/19/2008  01:55 AM            47,104 lltdio.sys
        01/19/2008  01:55 AM            60,416 rspndr.sys
        01/19/2008  01:55 AM            13,312 irenum.sys
        01/19/2008  01:55 AM            95,744 irda.sys
        01/19/2008  01:55 AM            16,896 ndisuio.sys
        01/19/2008  01:55 AM            15,360 TUNMP.SYS
        01/19/2008  01:55 AM            35,840 netbios.sys
        01/19/2008  01:55 AM            16,384 nsiproxy.sys
        01/19/2008  01:56 AM            31,232 qwavedrv.sys
        01/19/2008  01:56 AM            47,616 ipfltdrv.sys
        01/19/2008  01:56 AM            20,992 ndistapi.sys
        01/19/2008  01:56 AM            49,664 ndproxy.sys
        01/19/2008  01:56 AM           100,864 ipnat.sys
        01/19/2008  01:56 AM            17,408 asyncmac.sys
        01/19/2008  01:56 AM            11,776 rasacd.sys
        01/19/2008  01:56 AM            62,464 wanarp.sys
        01/19/2008  01:56 AM            76,288 rasl2tp.sys
        01/19/2008  01:56 AM            62,976 raspptp.sys
        01/19/2008  01:56 AM            15,872 ws2ifsl.sys
        01/19/2008  01:57 AM            20,992 tdi.sys
        01/19/2008  01:57 AM             8,192 rootmdm.sys
        01/19/2008  01:57 AM            31,744 modem.sys
        01/19/200
        Logged

        jdohe003

          Topic Starter


          Starter

          Re: Virus problem with computer
          « Reply #3 on: June 04, 2010, 02:07:57 PM »
          mss.exe log continued

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center
              cval    REG_DWORD    0x1
              UacDisableNotify    REG_DWORD    0x1
              InternetSettingsDisableNotify    REG_DWORD    0x1
              AutoUpdateDisableNotify    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring
              DisableMonitoring    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc
              AntiVirusOverride    REG_DWORD    0x1
              AntiSpywareOverride    REG_DWORD    0x0
              FirewallOverride    REG_DWORD    0x0
              VistaSp1    REG_NONE    FE115F30FCC7C801
              VistaSp2    REG_NONE    3A792BF7693ACA01

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol


          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile
              DisableNotifications    REG_DWORD    0x0
              EnableFirewall    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
              DisableNotifications    REG_DWORD    0x0
              EnableFirewall    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile
              DisableNotifications    REG_DWORD    0x0
              EnableFirewall    REG_DWORD    0x0

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List
              C:\Program Files\EarthLink TotalAccess\TaskPanl.exe    REG_SZ    C:\Program Files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

           
           
          Uninstall List
           

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AddressBook
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player ActiveX
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Shockwave Player
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200C14F1
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Connection Manager
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DirectDrawEx
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DivX Plus DirectShow Filters
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\DXM_Runtime
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ENTERPRISE
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Fontcore
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HOMESTUDENTR
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HP Imaging Device Functions
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HP Photosmart Essential
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HP Solution Center & Imaging Support Tools
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HPExtendedCapabilities
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\HPOCR
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE40
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE4Data
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IE5BAKEX
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IEData
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\InstallShield Uninstall Information
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KB931906
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\KBD
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LimeWire
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\LiveUpdate
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft .NET Framework 3.5 SP1
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MobileOptionPack
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Mozilla Firefox (3.6.3)
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\MPlayer2
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\NVIDIA Drivers
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\OsdMaestro
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PC-Doctor 5 for Windows
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealJukebox 1.0
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\RealPlayer 6.0
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Rhapsody
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SchedulingAgent
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Shockwave
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ShockwaveFlash
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Shop for HP Supplies
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SystemRequirementsLab
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\The KMPlayer
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Warhammer Online - Age of Reckoning
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WIC
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\WinRAR archiver
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0289B35E-DC07-4c7a-9710-BBD686EA4B7D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0CFD3BAF-9F4D-4D70-BD0B-638EA2504C25}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0D2E9DCB-9938-475E-B4DD-8851738852FF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{13F3917B56CD4C25848BDC69916971BB}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{1746EA69-DCB6-4408-B5A5-E75F55439CDF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{179C56A4-F57F-4561-8BBF-F911D26EB435}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{18D10072035C4515918F7E37EAFAACFC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2614F54E-A828-49FA-93BA-45A3F756BFAA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216012FF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216013FB}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216015FB}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{26A24AE4-039D-4CA4-87B4-2F83216017FB}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2CD2C0DB-81C3-416B-9FA6-589B9235359B}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{2DFF31F9-7893-4922-AF66-C9A1EB4EBB31}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160020}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160030}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160040}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160050}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160070}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{36FDBE6E-6684-462B-AE98-9A39A1B200CC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{38B39865-D988-4945-9A22-6107B8B40953}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{39CB30DB-27F8-4dd4-A294-CB4AE3B584FD}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3FC7CBBC4C1E11DCA1A752EA55D89593}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{40F7AED3-0C7D-4582-99F6-484A515C73F2}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{49F2B650-2D7B-4F59-B33D-346F63776BD3}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{4C590030-7469-453E-8589-D15DA9D03F52}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{508CE775-4BA4-4748-82DF-FE28DA9F03B0}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{50CE21D8-0F44-4f3f-A392-7F9AD3194DEF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{553255F3-78FD-40F1-A6F8-6882140265FE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{55979C41-7D6A-49CC-B591-64AC1BBE2C8B}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{62369F2F77534556AEF4C58152E3BDE5}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6AF49698-949A-4C89-9B31-041D2CCB5FBD}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6D52C408-B09A-4520-9B18-475B81D393F1}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7299052b-02a4-4627-81f2-1818da5d550d}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7585478E9D9B42108671C12F8714CEFE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{75E71ADD-042C-4F30-BFAC-A9EC42351313}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{770657D0-A123-3C07-8E44-1C83EC895118}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{787D1A33-A97B-4245-87C0-7174609A540C}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{7B63B2922B174135AFC0E1377DD81EC2}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8641C1CB-03B3-41d4-8DEC-79826A4B5C0E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{87E2B986-07E8-477a-93DC-AF0B6758B192}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8A253629-0511-4854-8B4E-46E57E66005C}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8ADFC4160D694100B5B8A22DE9DCABD9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{8CEA85DE-955B-4BF4-87F2-0BAA62821633}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{199DF7B6-169C-448C-B511-1054101BE9C9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0016-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0018-0409-0000-0000000FF1CE}_HOMESTUDENTR_{397B1D4F-ED7B-4ACA-A637-43B670843876}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2E40DE55-B289-4C8B-8901-5D369B16814F}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{0451F231-E3E3-4943-AB9F-58EB96171784}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001B-0409-0000-0000000FF1CE}_HOMESTUDENTR_{80E762AA-C921-4839-9D7D-DB62A72C0726}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{F580DDD5-8D37-4998-968E-EBB76BB86787}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-001F-0C0A-0000-0000000FF1CE}_HOMESTUDENTR_{187308AB-5FA7-4F14-9AB9-D290383A10D9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-002C-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{2C69BACE-1151-41C0-8C8D-F6026D510BD4}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{329050A9-EF80-40F9-B633-74508F54C1FF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{34573F17-DADE-4D0D-835F-A54A1DE8AC1F}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{432C5EE4-8096-4FF1-95E1-65219365DFF7}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{661B3F32-FFE4-4606-AE3A-DFA11DCC0D79}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{667A88D1-0369-4070-A62A-70672D68A9BF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6DE3DABF-0203-426B-B330-7287D1003E86}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{7559E742-FF9F-4FAE-B279-008ED296CB4D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{7F207DCA-3399-40CB-A968-6E5991B1421A}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{FCD742B9-7A55-44BC-A776-F795F21FEDDC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{716B81B8-B13C-41DF-8EAC-7A2F656CAB63}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{AB365889-0395-4FAD-B702-CA5985D53D42}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{CD11C6A2-FFC6-4271-8EAB-79C3582F505C}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-006E-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2744EF05-38E1-4D5D-B333-E021EDAEA245}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00A1-0409-0000-0000000FF1CE}_HOMESTUDENTR_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0115-0409-0000-0000000FF1CE}_HOMESTUDENTR_{DE5A002D-8122-4278-A7EE-3121E7EA254E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0117-0409-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{0CDDBAA2-2111-4A0E-A1B0-76C40C635331}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{329050A9-EF80-40F9-B633-74508F54C1FF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{3D019598-7B59-447A-80AE-815B703B84FF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{432C5EE4-8096-4FF1-95E1-65219365DFF7}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{661B3F32-FFE4-4606-AE3A-DFA11DCC0D79}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{667A88D1-0369-4070-A62A-70672D68A9BF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6DE3DABF-0203-426B-B330-7287D1003E86}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7559E742-FF9F-4FAE-B279-008ED296CB4D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{7F207DCA-3399-40CB-A968-6E5991B1421A}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{FCD742B9-7A55-44BC-A776-F795F21FEDDC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9C2D4047-0E40-499a-AC7A-C4B9BB12FE03}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9DBA770F-BF73-4D39-B1DF-6035D95268FC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A36CD345-625C-4d6c-B3E2-76E1248CB451}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A7E4ECCA-4A8E-4258-8EC8-2DCCF5B11320}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{A96E97134CA649888820BCDE5E300BBD}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AAC389499AEF40428987B3D30CFC76C9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB5D51AE-EBC3-438D-872C-705C7C2084B0}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AB5E289E-76BF-4251-9F3F-9B763F681AE0}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AC76BA86-7AD7-1033-7B44-A81200000003}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{AEF9DC35ADDF4825B049ACBFD1C6EB37}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B023185F-F1EF-4F97-B0BD-AE6D802226D1}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B13A7C41581B411290FBC0395694E2A9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B2544A03-10D0-4E5E-BA69-0362FFC20D18}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B668B2B8-70D4-4754-A890-17C1DDDA9418}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B7050CBDB2504B34BC2A9CA0A692CC29}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{B8DBED1E-8BC3-4d08-B94A-F9D7D88E9BBF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{BE77A81F-B315-4666-9BF3-AE70C0ADB057}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C04E32E0-0416-434D-AFB9-6969D703A9EF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C38C985C-266A-4CEE-BEC3-1A4270F09FD4}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C523D256-313D-4866-B36A-F3DE528246EF}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{C716522C-3731-4667-8579-40B098294500}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB350003
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB953595
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB958484
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB960043
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}.KB963707
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{CE386A4E-D0DA-4208-8235-BCE43275C694}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{D0E39A1D-0CEE-4D85-B4A2-E3BE990D075E}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E06F04B9-45E6-4AC0-8083-85F7515F40F7}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E65CA2A8-1F2A-4400-AE55-FFD43D3B6980}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EB21A812-671B-4D08-B974-2A347F0D8F70}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EC3B598C-1151-4191-B5B4-A9072ADE6259}_is1
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{EF1ADA5A-0B1A-4662-8C55-7475A61D8B65}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{FE0C305A-37EE-4499-B4CF-0182E37B20C4}

          HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\uTorrent
           
           
          Autorun
           

          HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
              Sidebar    REG_SZ    C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
              HPAdvisor    REG_SZ    C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe autoRun
              ehTray.exe    REG_SZ    C:\Windows\ehome\ehTray.exe
              NCsoft Launcher    REG_SZ    C:\Program Files\NCSoft\Launcher\NCLauncher.exe /Minimized
              asam    REG_SZ    C:\Users\John\AppData\Local\asam.exe

          HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\OsdMaestro

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
              Windows Defender    REG_EXPAND_SZ    %ProgramFiles%\Windows Defender\MSASCui.exe -hide
              hpsysdrv    REG_SZ    c:\hp\support\hpsysdrv.exe
              KBD    REG_SZ    C:\HP\KBD\KbdStub.EXE
              OsdMaestro    REG_SZ    "C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe"
              RtHDVCpl    REG_SZ    RtHDVCpl.exe
              HP Software Update    REG_SZ    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
              Symantec PIF AlertEng    REG_SZ    "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
              Adobe Reader Speed Launcher    REG_SZ    "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
              D-Link Wireless G WDA-1320    REG_SZ    C:\Program Files\D-Link\Wireless G WDA-1320\AirGCFG.exe
              ANIWZCS2Service    REG_SZ    C:\Program Files\ANI\ANIWZCS2 Service\WZCSLDR2.exe
              AVG8_TRAY    REG_SZ    C:\PROGRA~1\AVG\AVG8\avgtray.exe
              GrooveMonitor    REG_SZ    "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
              SunJavaUpdateSched    REG_SZ    "C:\Program Files\Java\jre6\bin\jusched.exe"
              QuickTime Task    REG_SZ    "C:\Program Files\QuickTime\QTTask.exe" -atboottime
              iTunesHelper    REG_SZ    "C:\Program Files\iTunes\iTunesHelper.exe"
              asam    REG_SZ    C:\Users\John\AppData\Local\asam.exe

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents
           
           
          Restrictions - Internet Explorer
           
           
           
          Restrictions - REGEDIT
           
           
           
          Restrictions - Explorer
           
          ActiveX
           

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{233C1507-6A77-46A4-9443-F871F945D258}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8FFBE65D-2C9C-4669-84BD-5829DC0B603C}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{B8BE5E93-A60C-4D26-A2DC-220313175592}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{D27CDB6E-AE6D-11CF-96B8-444553540000}
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{DF780F87-FF2B-4DF8-92D0-73DB16A1543A}
           
           
          DNS Settings
           

          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3a539854-6a70-11db-887c-806e6f6e6963}
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{C4A43D69-3DB9-4743-912D-FB9A4FE75953}
          HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{E7290651-9D3D-43CA-81B8-906877A714B3}

          Windows IP Configuration

             Host Name . . . . . . . . . . . . : John-PC
             Primary Dns Suffix  . . . . . . . :
             Node Type . . . . . . . . . . . . : Hybrid
             IP Routing Enabled. . . . . . . . : No
             WINS Proxy Enabled. . . . . . . . : No
             DNS Suffix Search List. . . . . . : Belkin

          Wireless LAN adapter Wireless Network Connection:

             Connection-specific DNS Suffix  . : Belkin
             Description . . . . . . . . . . . : D-Link WDA-1320 Desktop Adapter
             Physical Address. . . . . . . . . : 00-15-E9-89-65-ED
             DHCP Enabled. . . . . . . . . . . : Yes
             Autoconfiguration Enabled . . . . : Yes
             Link-local IPv6 Address . . . . . : fe80::bd:ca49:2abc:5b48%14(Preferred)
             IPv4 Address. . . . . . . . . . . : 192.168.2.4(Preferred)
             Subnet Mask . . . . . . . . . . . : 255.255.255.0
             Lease Obtained. . . . . . . . . . : Friday, June 04, 2010 3:28:25 PM
             Lease Expires . . . . . . . . . . : Monday, July 11, 2146 10:26:39 PM
             Default Gateway . . . . . . . . . : 192.168.2.1
             DHCP Server . . . . . . . . . . . : 192.168.2.1
             DHCPv6 IAID . . . . . . . . . . . : 318772713
             DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-0D-E6-9C-5A-00-1B-FC-40-7B-73
             DNS Servers . . . . . . . . . . . : 192.168.2.1
             NetBIOS over Tcpip. . . . . . . . : Enabled

          Ethernet adapter Local Area Connection:

             Media State . . . . . . . . . . . : Media disconnected
             Connection-specific DNS Suffix  . :
             Description . . . . . . . . . . . : NVIDIA nForce Networking Controller
             Physical Address. . . . . . . . . : 00-1B-FC-40-7B-73
             DHCP Enabled. . . . . . . . . . . : Yes
             Autoconfiguration Enabled . . . . : Yes

          Tunnel adapter Local Area Connection* 6:

             Media State . . . . . . . . . . . : Media disconnected
             Connection-specific DNS Suffix  . :
             Description . . . . . . . . . . . : 6TO4 Adapter
             Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
             DHCP Enabled. . . . . . . . . . . : No
             Autoconfiguration Enabled . . . . : Yes

          Tunnel adapter Local Area Connection* 7:

             Media State . . . . . . . . . . . : Media disconnected
             Connection-specific DNS Suffix  . :
             Description . . . . . . . . . . . : isatap.{E7290651-9D3D-43CA-81B8-906877A714B3}
             Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
             DHCP Enabled. . . . . . . . . . . : No
             Autoconfiguration Enabled . . . . : Yes

          Tunnel adapter Local Area Connection* 9:

             Media State . . . . . . . . . . . : Media disconnected
             Connection-specific DNS Suffix  . :
             Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
             Physical Address. . . . . . . . . : 02-00-54-55-4E-01
             DHCP Enabled. . . . . . . . . . . : No
             Autoconfiguration Enabled . . . . : Yes

          Tunnel adapter Local Area Connection* 10:

             Media State . . . . . . . . . . . : Media disconnected
             Connection-specific DNS Suffix  . : Belkin
             Description . . . . . . . . . . . : isatap.Belkin
             Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
             DHCP Enabled. . . . . . . . . . . : No
             Autoconfiguration Enabled . . . . : Yes
           
           
          AppInit DLLs
           


           
           
          Shell Service Object Delay Load
           

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad
              WebCheck    REG_SZ    {E6FB5E20-DE35-11CF-9C87-00AA005127ED}

           
           
           
          Shell Execute Hooks
           

          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks
              {B5A7F190-DDA6-4420-B3BA-52453494E6CD}    REG_SZ    Groove GFS Stub Execution Hook

           
           
          Image File Execution Options
           

          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DllNXOptions
          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IEInstal.exe
          HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe
           
           
          Security Providers
           
           
           
          Local Security Authority
           

          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
              auditbaseobjects    REG_DWORD    0x0
              auditbasedirectories    REG_DWORD    0x0
              crashonauditfail    REG_DWORD    0x0
              fullprivilegeauditing    REG_BINARY    00
              Bounds    REG_BINARY    0030000000200000
              LimitBlankPasswordUse    REG_DWORD    0x1
              LmCompatibilityLevel    REG_DWORD    0x3
              NoLmHash    REG_DWORD    0x1
              Notification Packages    REG_MULTI_SZ    scecli
              Security Packages    REG_MULTI_SZ    kerberos\0msv1_0\0schannel\0wdigest\0tspkg
              Authentication Packages    REG_MULTI_SZ    msv1_0
              LsaPid    REG_DWORD    0x270
              SecureBoot    REG_DWORD    0x1
              ProductType    REG_DWORD    0x3
              disabledomaincreds    REG_DWORD    0x0
              everyoneincludesanonymous    REG_DWORD    0x0
              forceguest    REG_DWORD    0x0
              restrictanonymous    REG_DWORD    0x0
              restrictanonymoussam    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\AccessProviders
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Audit
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Credssp
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Data
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\FipsAlgorithmPolicy
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\GBG
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\JD
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Kerberos
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\MSV1_0
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\Skew1
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\SSO
          HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa\SspiCache
           
           
          SafeBoot
           
           
           
          AppCert DLLs
           
           
           
          Extra
           

          HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0
          HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1
          HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2
          HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\3
          HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\4
          HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\5
           
           
          App Paths
           

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\AcroRd32.exe
              (Default)    REG_SZ    C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe
              Path    REG_SZ    C:\Program Files\Adobe\Reader 8.0\Reader\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\AVGSE.DLL
              (Default)    REG_SZ    C:\PROGRA~1\AVG\AVG8\avgse.dll
              Menu1    REG_SZ    Scan with &AVG Free
              Help1    REG_SZ    Scan against viruses with AVG Free

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\cmmgr32.exe
              CmstpExtensionDll    REG_SZ    C:\Windows\system32\cmcfg32.dll
              CmNative    REG_DWORD    0x2

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\dvdmaker.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Movie Maker\dvdmaker.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\excel.exe
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              SaveURL    REG_SZ    1
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\firefox.exe
              (Default)    REG_SZ    C:\Program Files\Mozilla Firefox\firefox.exe
              Path    REG_SZ    C:\Program Files\Mozilla Firefox

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\GROOVE.EXE
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\GROOVE.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\HpqApKil.exe
              Path    REG_SZ    C:\Program Files\HP\Digital Imaging\bin\
              (Default)    REG_SZ    C:\Program Files\HP\Digital Imaging\bin\HpqApKil.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\HpqPSApl.exe
              Path    REG_SZ    c:\Program Files\HP\Digital Imaging\bin\;c:\Program Files\Common Files\HP\Digital Imaging\bin
              (Default)    REG_SZ    c:\Program Files\HP\Digital Imaging\bin\HpqPSApl.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\hpqpsapp.exe
              Path    REG_SZ    c:\Program Files\Common Files\HP\Digital Imaging\bin
              (Default)    REG_SZ    c:\Program Files\HP\Digital Imaging\bin\hpqpsapp.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\hpqpse.exe
              (Default)    REG_SZ    c:\Program Files\HP\Digital Imaging\Bin\hpqpse.exe
              Path    REG_SZ    c:\Program Files\HP\Digital Imaging\Bin\;c:\Program Files\Common Files\HP\Digital Imaging\Bin

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\hpqqpawp.exe
              Path    REG_SZ    C:\Program Files\Common Files\HP\Digital Imaging\Bin
              (Default)    REG_SZ    C:\Program Files\HP\Digital Imaging\Bin\hpqqpawp.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\hpqSSupply.exe
              Path    REG_SZ    C:\Program Files\HP\Digital Imaging\
              (Default)    REG_SZ    C:\Program Files\HP\Digital Imaging\hpqSSupply.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\HpqTrMgr.exe
              Path    REG_SZ    C:\Program Files\HP\Digital Imaging\bin\
              (Default)    REG_SZ    C:\Program Files\HP\Digital Imaging\bin\HpqTrMgr.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\IEXPLORE.EXE
              (Default)    REG_SZ    C:\Program Files\Internet Explorer\IEXPLORE.EXE
              Path    REG_SZ    C:\Program Files\Internet Explorer;

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\infopath.exe
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\INFOPATH.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\inkball.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Microsoft Games\inkball\inkball.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\install.exe
              BlockOnTSNonInstallMode    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\iTunes.exe
              (Default)    REG_SZ    C:\Program Files\iTunes\iTunes.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\javaws.exe
              (Default)    REG_SZ    C:\Program Files\Java\jre6\bin\javaws.exe
              Path    REG_SZ    C:\Program Files\Java\jre6\bin

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Journal.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Journal\Journal.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\LUALL.EXE
              (Default)    REG_SZ    C:\Program Files\Symantec\LiveUpdate\LUALL.EXE
              Path    REG_SZ    C:\Program Files\Symantec\LiveUpdate

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\migwiz.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\moviemk.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Movie Maker\moviemk.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\mplayer2.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Media Player\wmplayer.exe
              Path    REG_EXPAND_SZ    %ProgramFiles%\Windows Media Player

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\MSACCESS.EXE
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\MSACCESS.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\msimn.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Mail\WinMail.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\MSNMSGR.EXE
              (Default)    REG_SZ    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
              Path    REG_SZ    C:\Program Files\Windows Live\Messenger\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\MsoHtmEd.exe
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\msoxmled.exe
              (Default)    REG_SZ    C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLED.EXE
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\MSPUB.EXE
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\MSPUB.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              useURL    REG_DWORD    0x1
              SaveURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\msworks.exe
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\msworks.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\ois.exe
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\OIS.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              SaveURL    REG_SZ    0
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\OneNote.exe
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\ONENOTE.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              SaveURL    REG_SZ    1
              useURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\OUTLOOK.EXE
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\OUTLOOK.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\pbrush.exe
              (Default)    REG_EXPAND_SZ    %SystemRoot%\System32\mspaint.exe
              Path    REG_EXPAND_SZ    %SystemRoot%\System32

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\pcdr5cuiw32.exe
              (Default)    REG_SZ    C:\Program Files\PC-Doctor 5 for Windows\pcdr5cuiw32.exe
              Path    REG_SZ    C:\Program Files\PC-Doctor 5 for Windows\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\PictureViewer.exe
              Path    REG_SZ    C:\Program Files\QuickTime\
              (Default)    REG_SZ    C:\Program Files\QuickTime\PictureViewer.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\powerpnt.exe
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\POWERPNT.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              useURL    REG_SZ    1
              SaveURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\QuickTimePlayer.exe
              (Default)    REG_SZ    C:\Program Files\QuickTime\QuickTimePlayer.exe
              Path    REG_SZ    C:\Program Files\QuickTime\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\RealPlay.exe
              (Default)    REG_SZ    C:\Program Files\Real\RealPlayer\realplay.exe
              Path    REG_SZ    C:\Program Files\Real\RealPlayer

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Rhapsody.exe
              Path    REG_SZ    C:\PROGRA~1\Rhapsody\
              (Default)    REG_SZ    C:\PROGRA~1\Rhapsody\rhapsody.exe
              Version    REG_SZ    4.0.0.911

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\rnxproc.exe
              (Default)    REG_SZ    C:\Program Files\Common Files\Real\Update_OB\rnxproc.exe
              Path    REG_SZ    C:\Program Files\Common Files\Real\Update_OB\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\sbase.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\sbase.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\scalc.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\scalc.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\sdraw.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\sdraw.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\setup.exe
              BlockOnTSNonInstallMode    REG_DWORD    0x1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\sidebar.exe
              (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Sidebar\sidebar.exe"

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\simpress.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\simpress.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\smath.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\smath.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\SnippingTool.exe
              (Default)    REG_EXPAND_SZ    C:\Windows\System32\SnippingTool.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\soffice.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\stikynot.exe
              (Default)    REG_EXPAND_SZ    C:\Windows\System32\stikynot.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\swriter.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\swriter.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\table30.exe
              UseShortName    REG_SZ   

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\TabTip.exe
              (Default)    REG_EXPAND_SZ    %CommonProgramFiles%\microsoft shared\ink\TabTip.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\unopkg.exe
              (Default)    REG_SZ    C:\Program Files\OpenOffice.org 2.4\program\unopkg.exe
              Path    REG_SZ    C:\Program Files\OpenOffice.org 2.4\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wab.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Mail\wab.exe
              Path    REG_EXPAND_SZ    %ProgramFiles%\Windows Mail

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wabmig.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Mail\wabmig.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Warhammer Online

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\warpatch.exe
              (Default)    REG_SZ    C:\Program Files\Electronic Arts\Warhammer Online - Age of Reckoning\warpatch.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinCal.exe
              (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows Calendar\wincal.exe"

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinMail.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Mail\WinMail.exe

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WinRAR.exe
              (Default)    REG_SZ    C:\Program Files\WinRAR\WinRAR.exe
              Path    REG_SZ    C:\Program Files\WinRAR

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\Winword.exe
              (Default)    REG_SZ    C:\PROGRA~1\MICROS~3\Office12\WINWORD.EXE
              Path    REG_SZ    C:\Program Files\Microsoft Office\Office12\
              useURL    REG_SZ    1
              SaveURL    REG_SZ    1

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WKPLMSTP.EXE
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\wkplmstp.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WKSAB.EXE
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\WKSAB.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wkscal.exe
              (Default)    REG_SZ    c:\Program Files\Common Files\Microsoft Shared\Works Shared\wkscal.exe
              Path    REG_SZ    c:\Program Files\Common Files\Microsoft Shared\Works Shared\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wksdb.exe
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\wksdb.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WKSSB.EXE
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\WKSSB.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wksss.exe
              (Default)    REG_SZ    C:\Program Files\Microsoft Works\wksss.exe
              Path    REG_SZ    C:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wkswp.exe
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\wkswp.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WKWCESTP.EXE
              (Default)    REG_SZ    c:\Program Files\Microsoft Works\wkwcestp.exe
              Path    REG_SZ    c:\Program Files\Microsoft Works\

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WLANMon.exe
              (Default)    REG_SZ    [INSTALLDIR]WLANMon.exe
              Path    REG_SZ    [INSTALLDIR]

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\wmplayer.exe
              (Default)    REG_EXPAND_SZ    %ProgramFiles%\Windows Media Player\wmplayer.exe
              Path    REG_EXPAND_SZ    %ProgramFiles%\Windows Media Player

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WORDPAD.EXE
              (Default)    REG_EXPAND_SZ    "%ProgramFiles%\Windows NT\Accessories\WORDPAD.EXE"

          HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\WRITE.EXE
              (Default)    REG_EXPAND_SZ&nbs
          Logged

          jdohe003

            Topic Starter


            Starter

            Re: Virus problem with computer
            « Reply #4 on: June 04, 2010, 02:16:15 PM »
            mss.exe log continued

            HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\XPSViewer.exe
                (Default)    REG_SZ    "C:\Windows\System32\XPSViewer\XPSViewer.exe"

            HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\app paths\YourApp.exe
                Path    REG_SZ    C:\Program Files\ANI\ANIWZCS2 Service
                (Default)    REG_SZ    C:\Program Files\ANI\ANIWZCS2 Service\YourApp.exe

             
             
            Mozilla
             

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\Extensions
                {3f963a5b-e555-4543-90e2-c3908898db71}    REG_SZ    C:\Program Files\AVG\AVG8\Firefox
                {20a82645-c095-46ed-80e3-08825760534b}    REG_SZ    C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox
                (Default)    REG_SZ    1.9.2.3
                CurrentVersion    REG_SZ    3.6.3 (en-US)

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\3.6.3 (en-US)
                (Default)    REG_SZ    3.6.3 (en-US)

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\3.6.3 (en-US)\Main
                Install Directory    REG_SZ    C:\Program Files\Mozilla Firefox
                PathToExe    REG_SZ    C:\Program Files\Mozilla Firefox\firefox.exe

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox\3.6.3 (en-US)\Uninstall
                Description    REG_SZ    Mozilla Firefox (3.6.3)

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.6.3
                GeckoVer    REG_SZ    1.9.2.3

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.6.3\bin
                PathToExe    REG_SZ    C:\Program Files\Mozilla Firefox\firefox.exe

            HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 3.6.3\extensions
                Components    REG_SZ    C:\Program Files\Mozilla Firefox\components
                Plugins    REG_SZ    C:\Program Files\Mozilla Firefox\plugins

             
             
            Shared Task Scheduler
             

            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler
                {8C7461EF-2B13-11d2-BE35-3078302C2030}    REG_SZ    Component Categories cache daemon

             
             
            SafeBootMinimal
             

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppInfo
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\KeyIso
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\NTDS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\ProfSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SWPRV
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TabletInputService
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TBS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\TrustedInstaller
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\VDS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgr.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\volmgrx.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}
             
             
            SafeBootNetwork
             

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AFD
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppInfo
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AppMgmt
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Base
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BFE
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot Bus Extender
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Boot file system
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\bowser
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Browser
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\CryptSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DcomLaunch
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\dfsc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dhcp
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\DnsCache
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Dot3Svc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Eaphost
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\EventLog
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\File system
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Filter
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\HelpSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\IKEEXT
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ipnat.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\KeyIso
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanServer
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LanmanWorkstation
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\LmHosts
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Messenger
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSDrv
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\MPSSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb10
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\mrxsmb20
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NativeWifiP
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NDIS Wrapper
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Ndisuio
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBIOSGroup
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetBT
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetDDEGroup
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Netlogon
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetMan
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\netprofm
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Network
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NetworkProvider
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NlaSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Nsi
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\nsiproxy.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\NTDS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PCI Configuration
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PlugPlay
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP Filter
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PNP_TDI
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\PolicyAgent
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Primary disk
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\ProfSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdbss
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdpencdd.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\rdsessmgr
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\RpcSs
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sacsvr
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCardSvr
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SCSI Class
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\sermouse.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SharedAccess
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Streams Drivers
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\SWPRV
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\System Bus Extender
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TabletInputService
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TBS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Tcpip
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TDI
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\TrustedInstaller
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\VDS
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vga.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vgasave.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgr.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\volmgrx.sys
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinDefend
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WinMgmt
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Wlansvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfPf
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfRd
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfSvc
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\WudfUsbccidDriver
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{36FC9E60-C465-11CF-8056-444553540000}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E965-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E967-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E969-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96A-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96B-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E96F-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E973-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E974-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E975-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E977-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97B-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E97D-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{4D36E980-E325-11CE-BFC1-08002BE10318}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{50DD5230-BA8A-11D1-BF5D-0000F805F530}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{6BDD1FC1-810F-11D0-BEC7-08002BE2092F}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D48179BE-EC20-11D1-B6B8-00C04FA372A7}
            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\{D94EE5D8-D189-4994-83D2-F68D7D41B0E6}
             
             
            File Rename Operations - Session
             

             
             
            Known DLLs - Session
             

            HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDlls
                clbcatq    REG_SZ    clbcatq.dll
                ole32    REG_SZ    ole32.dll
                advapi32    REG_SZ    advapi32.dll
                COMDLG32    REG_SZ    COMDLG32.dll
                DllDirectory    REG_EXPAND_SZ    %SystemRoot%\system32
                gdi32    REG_SZ    gdi32.dll
                IERTUTIL    REG_SZ    IERTUTIL.dll
                IMAGEHLP    REG_SZ    IMAGEHLP.dll
                IMM32    REG_SZ    IMM32.dll
                kernel32    REG_SZ    kernel32.dll
                LPK    REG_SZ    LPK.dll
                MSCTF    REG_SZ    MSCTF.dll
                MSVCRT    REG_SZ    MSVCRT.dll
                NORMALIZ    REG_SZ    NORMALIZ.dll
                NSI    REG_SZ    NSI.dll
                OLEAUT32    REG_SZ    OLEAUT32.dll
                rpcrt4    REG_SZ    rpcrt4.dll
                Setupapi    REG_SZ    Setupapi.dll
                SHELL32    REG_SZ    SHELL32.dll
                SHLWAPI    REG_SZ    SHLWAPI.dll
                URLMON    REG_SZ    URLMON.dll
                user32    REG_SZ    user32.dll
                USP10    REG_SZ    USP10.dll
                WININET    REG_SZ    WININET.dll
                WLDAP32    REG_SZ    WLDAP32.dll
                WS2_32    REG_SZ    WS2_32.dll

             
             
            Adobe Products
             

            HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\Adobe Flash Player Plugin
                DisplayName    REG_SZ    Adobe Flash Player 10 Plugin
                DisplayVersion    REG_SZ    10.0.45.2
                Publisher    REG_SZ    Adobe Systems Incorporated
                URLInfoAbout    REG_SZ    http://www.adobe.com/go/getflashplayer
                DisplayIcon    REG_SZ    C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
                UninstallString    REG_SZ    C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
                NoModify    REG_DWORD    0x1
                NoRepair    REG_DWORD    0x1

             
             
            {END OF FILE}
            Logged

            Dr Jay

            • Malware Removal Specialist


              • Specialist
            • Moderator emeritus
              • Thanked: 119
            • Experience: Guru
            • OS: Windows 10
            Re: Virus problem with computer
            « Reply #5 on: June 04, 2010, 04:28:25 PM »
            I see you are running uTorrent and LimeWire, P2P applications. I suggest to read the following, and then decide whether you want to keep it or not: http://www.helpmyos.com/learn-security-f40/p2p-programs-t1102.htm

            Please run a free online scan with the ESET Online Scanner
            • Tick the box next to YES, I accept the Terms of Use
            • Click Start
            • When asked, allow the ActiveX control to install
            • Click Start
            • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
            • Click Scan (This scan can take several hours, so please be patient)
            • Once the scan is completed, you may close the window
            • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
            • Copy and paste that log as a reply to this topic
            Logged
            ~Dr Jay
            Pages: [1]   Go Up
            « previous next »