# UPS Email Virus - Please help!



## Bozica (Feb 20, 2011)

Hi, I opened an email from what I thought was UPS.. I click on the attachment and now have it taking over my computer.
A system tool keeps wanting to run on my computer.. 

Can anything be done? Ive tryed to run programs but all are being block.. Have also tryed safe mode with no luck.
I really hope someone can help me.


----------



## Byteman (Jan 24, 2002)

Your best bet is to not use the computer now. The malware forum is very backlogged and there are very few helpers online this time of evening.

You can use a clean computer to come here and get started after someone replies to your thread probably tomorrow morning.

There is a thread with directions you need to visit to get some logs posted:

It's the first one at the very top of the Malware forum

http://forums.techguy.org/virus-other-malware-removal/943214-everyone-must-read-before-posting.html

Post those logs if you can, but most people have trouble doing them when the computer is infected with what you have.

My advice though is for you not to do anything else on your own.

I suggest turning the computer off for the night. What you have can get a lot worse by using the machine.

I would suggest also that you check on your bank account, credit cards, etc on a clean computer and change the passwords, as well to any other accounts that deal with money or game keys, work, etc.

Very often no one can get to you for a few days......that's how busy the malware dept. here is and has been for quite some time.


----------



## Bozica (Feb 20, 2011)

Hi byteman, thank you for your reply. 
I am on a clean computer now. I have tried the steps recommended with no luck at all. It is blocking all programs from starting. I have turned it off and I will wait on further instructions.


----------



## Bozica (Feb 20, 2011)

Finally managed to get in I hope someone can help.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:37:38 AM, on 25/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Value Plus\Application Data\dwm.exe
C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
C:\Documents and Settings\Value Plus\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ycomp/defaults/sp/*http://au.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ycomp/defaults/su/*http://au.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/postinstall/win/en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:56061
F3 - REG:win.ini: load=C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [conhost] C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [eOhOmEcNhDa18101] C:\Documents and Settings\All Users\Application Data\eOhOmEcNhDa18101\eOhOmEcNhDa18101.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Canon LASER SHOT LBP-1120 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280141732609
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe
--
End of file - 7773 bytes


----------



## Byteman (Jan 24, 2002)

You will need to be able to download some files on the clean computer and have a way to transfer them to the infected machine.....are you able to start that infected computer enough to transfer files, for example, from a burned CD? Flash drive?


----------



## Bozica (Feb 20, 2011)

I believe I can, I am happy to give it a go.. Thank you


----------



## Byteman (Jan 24, 2002)

On the infected machine, which I am fairly sure that HJT log is from, do this:

First, I will have you fix a couple of things with HJT that will probably help you stay connected etc:

Keep in mind, that the items sometimes will reappear, but we can take care of them later.

When you are sure of the items I have listed below, run Hijackthis, and on your Hijackthis scan result, put checks into each one I *list and then, with ALL OTHER windows closed on your computer, click on "Fix Checked" * Next, close Hijackthis. I will post a new reply in the meantime.

In Internet Explorer at the top click open Tools>Internet Options>Connections>LAN Settings> and take the check out of the Proxy. Make sure it stays out.....check it every once in a while, basically just after you fix items with HJT, and later to see if the proxy remains gone. Remove it any time you find it there.

F3 - REG:win.ini: load=C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
O4 - HKCU\..\RunOnce: [eOhOmEcNhDa18101] C:\Documents and Settings\All Users\Application Data\eOhOmEcNhDa18101\eOhOmEcNhDa18101.exe

Post a new HJT log and I will have some more for you to do.


----------



## Bozica (Feb 20, 2011)

Thanks Byteman, Ok done.
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:45:27 PM, on 25/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Value Plus\Application Data\dwm.exe
C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Value Plus\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ycomp/defaults/sp/*http://au.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ycomp/defaults/su/*http://au.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/postinstall/win/en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:56061
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [conhost] C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Canon LASER SHOT LBP-1120 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280141732609
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe
--
End of file - 7701 bytes


----------



## Byteman (Jan 24, 2002)

*Please read all through the info so you know what will be done.

You MUST temporarily turn off/disable the real-time protection your antivirus and sometimes firewalls provide.....directions are in the steps below, make sure you get I think it it PC Tools and/or AVG disabled.......before running Combofix

http://www.bleepingcomputer.com/combofix/how-to-use-combofix*

*There is a Printable Version* button up under the Thread Tools drop down menu that will let you print a nice text version of these instructions. 
*Alternate way to save directions:*Open Notepad> Copy and Paste any text you wish into Notepad, and Save the file as something you will recognize like TSGhelp.txt and save it onto your desktop.

*Please download ComboFix from **Here* or *Here* to your Desktop.

When you click on SAVE.....in the next box titled "SAVE As" please RENAME the download so that it is combat.exe  when it arrives on your desktop... .....we must do this so Combofix runs without being blocked etc

***Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop***

Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
-----------------------------------------------------------​
*Very Important!* Temporarily *disable* your *anti-virus*, *script blocking* and any *anti-malware* real-time protection _*before*_ performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause _"unpredictable results"_.
_Click on *this link* to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask._
-----------------------------------------------------------​

Close any open browsers. 
*WARNING: Combofix will disconnect your machine from the Internet as soon as it starts*
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
-----------------------------------------------------------​
Double click on *combofix.exe* & follow the prompts.
When finished, it will produce a report for you. 
Please post the *"C:\ComboFix.txt" * in your next reply..*And, after you are done posting the log from ComboFix....run Hijackthis again, Scan and Save a Log....post the brand new log*
***Note: Do not mouseclick combofix's window while it's running. That may cause it to stall***

If Combofix detects any Rootkit/Bootkit activity on your system it will give a warning and prompt for a reboot, you must allow it to do so. 
If Combofix reboot's due to a rootkit, the screen may stay black for several minutes on reboot, this is normal 
If after running Combofix you receive any type of warning message about registry key's being listed for deletion when trying to open certain items, reboot the system and this will fix the issue (Those items will not be deleted)


----------



## Byteman (Jan 24, 2002)

I knew I'd forget something.....you probably will have to restart to Normal mode to run Combofix!


Just be sure to disable the antivirus etc as directions tell you. Save the directions to Notepad file to refer to on your desktop.

Try it in Normal mode, if it does not work, restart to Safe Mode, you can use with networking mode....so the Recovery Console can install though that is not crucial, it is only a safeguard for you to have the Console installed.

Be patient with Combofix, it sometimes seems to stop, but just leave it alone until the text log comes up then copy and paste the whole log into a reply for me please. New HJT scan log after that also.


----------



## Bozica (Feb 20, 2011)

Ok wow, not sure what has happened I know I had AVG but cant find the program at all on the surface. I have done a file and folder search for it and there is some parts of it but Im not sure what i am looking for if its avg.exe, then its not there at all. 2 Folders are AVG9 & AVG10.

I tried to start ComboFix.exe in normal mode but it is saying something about AVG, and ComboFix cannot start. So I tryed it in safe mode with networking and its saying ComboFix "cannot run when AVG is installed. This is due to AVG' targeting of ComboFix's files/processes. It would be dangerous to continue. Please uninstall AVG." Then computer shuts down.


----------



## Bozica (Feb 20, 2011)

I just rebooted and it starts goes straight to the F8 option ( with no prompting by me ) wont start in safe mode, safe mode with networking or windows normal just shuts down and then restarts by itself..


----------



## Byteman (Jan 24, 2002)

Hi,

Do you have the Windows XP CD handy? (If your computer did not come with an XP CD, you can borrow one that will boot up the computer)....what we need to run is called the Recovery Console. We are not installing XP..... we need to run a few things that are used with the Recovery Console.

Have you ever booted up from an XP CD to the Console? You can use someone else's CD which should be at least an XP Service Pack 2 type. They are labeled if they contain SP1, 1a, SP2, SP3.


----------



## Bozica (Feb 20, 2011)

Hi,
I do have the Windows XP Professional disc - Version 2002 that was used to install XP on that computer. I have never booted from the disc before sorry I don&#8217;t have a clue how to start.


----------



## Byteman (Jan 24, 2002)

Hi, Good-

Do you need to rescue any files, from the hard drive before we start trying to get the machine to start up normally? Let me know!!!

If no files are needed to be rescued (I do not mean any installed programs, those cannot be saved and reused...I mean important files, pictures, docs etc like work or school stuff you have to keep!) then you are ready to go and do this below.

I am posting a guide for you to follow to run some things that may help you get back to being able to start the computer normally.
Read fully so you are aware of what to do in this process:

First,. try the *Last Known Good Configuration* menu item when you start up when the list of items appears. If that does not work or the computer just shuts off as before, continue with this.

Malware such as you have can modify the master boot area of the hard drive- basically, that can cause a non-booting situation.

There is a command to type that can fix the master boot area, the command is shown in a tutorial along with the others I need you to use.

•Fixboot - Writes a new boot sector to the system volume. Can sometimes completely repair a non-booting system. 
•Fixmbr - Repairs the master boot record of the system's boot partition. Can also sometimes completely repair a non-booting system.

Read about the Recovery Console here>> *http://www.techrepublic.com/article/solutionbase-using-the-windows-xp-recovery-console/5835305* Go down the page to where it has this:

Starting the Recovery Console from the Windows XP CD-ROM

This basically what you do: (There are pics at the link to show you how it looks)

To boot from your CD, you may first need to set the CDROM or DVD drive as the first boot device, in your BIOS. This may already be set as the first device...... if you know how to enter the BIOS you can check.. A lot of computers can use the *F 12* key at startup to bring up the menu to select the "Boot from CD" line where you would press the corresponding line, that is, you press the "Enter" key on your keyboard to do that function (Boot from the CD drive and CD)

You can just put the CD in the drive tray (you can use a straightened out paper clip to open the drive tray with the tiny hole your drive tray probably has-- just push gently into that small hole the the tray should slide out, some rare drives do not have this tray feature....)

Try restarting the computer with the XP CD in, if you see anything related to "Boot from CD" press what it says, or press Enter for Yes.

Setup will start, relax, it will not install anything unless you press the wrong thing- *you want to select "R" to Repair the XP installation you have using the Recovery Console* You have 1 installed, so press the 1 key at that prompt, * and if there is NO Administrator password, just press the Enter key since the password does not exist or is blank....*

Next at the prompt, type one command

*fixboot c:* (and then press the Enter key on your keyboard once)

and next, type the command:

*fixmbr c:* (same, press Enter once)

Next, you willl just type *exit* to restart--- you should *remove the CD* before it "starts up" again.....and hopefully, your computer will start to Windows.........

Be patient as it may take a minute to get up on the screen. I have seen also that a utility called chkdsk may run to fix errors in files on the drive now....let it finish and it also can take some time!!!!! Most likely it will not appear anyway.

Then, post here and I will try some other things to get you cleaned up.


----------



## Bozica (Feb 20, 2011)

*Last Known Good Configuration* No luck, just shuts down.
Booted via F12 option fine, 
　
*fixboot c:* (and then press the Enter key on your keyboard once)

*Response: 
The target partition is C: are you sure you want to write a new bootsector to the partition C:? Y ( hope Y is what I needed to put in there).
The file system on the startup partition is unknown.
FIXBOOT is attempting to detect the file system type.
The boot sector is corrupt.
FIXBOOT is checking the file system type…
The partition is using the NTFS file system.
FIXBOOT is writing a new boot sector.
The new boot sector was successfully written.
C:\>
*and next, type the command: 
*fixmbr c:* (same, press Enter once)
Next, you will just type *exit* to restart..

Sadly no luck still doing the same thing.


----------



## Byteman (Jan 24, 2002)

Hi, When you did fixmbr was there any message given you about "successful" or anything else?

Try the fixmbr command again....... write down what it says.

type just * fixmbr* ( and press Enter key)

Next: at the same command prompt type:

*chkdsk /p* (yes, press Enter key once) This will take some time, perhaps one half to an hour.

When done, remove the CD and "exit" to restart.


----------



## Bozica (Feb 20, 2011)

Byteman, I'm not sure if this is relevant but when the computer started up *NOT with CD-ROM …*I noticed at the start that *IDE CHANNEL 2 MASTER DISK HDD S.M.A.R.T CAPABILITY…. DISABLED ( before it shuts down). *Ive not seen this before so thought I should mention it.

_When you did fixmbr was there any message given you about "successful" or anything else? _*No just went to the next line with C:\>*
* 
*I did the *chkdsk /p *first…
*Response:
CHKDSK is checking the volume…
CHKDSK is preforming additional checking or recovery…
CHKDSK is preforming additional checking or recovery…
CHKDSK is preforming additional checking or recovery…
CHKDSK found one or more errors on the volume.
156280288 kilobytes total disk space.
97202140 kilobytes are available.
4096 bytes in each allocation unit.
39070092 total allocation units on disc.
24300535 allocation units available on disk.
　
*_Try the fixmber command again....... write down what it says. 
type just * fixmbr* ( and press Enter key)
_*Response:
**CAUTION**
This computer appears to have a non-standard or invalid master boot record.
FIXMBR may damage your partition tables if you proceed.
This could cause all partitions on the current hard disk to become inaccessible.
If you are not having problems accessing your drive, do not continue.
Are you sure you want to write a new MBR?
* 
Too scared to do anything else now until I get further instruction from you.


----------



## Byteman (Jan 24, 2002)

*Note: SMART drv is a hard drive diagnostic that when enabled, can warn you before a critical drive failure, mechanical failure I mean....*

If that is disabled, you don't get the 1 second or so delay in startup..... or the alert it makes, so I usually keep it ON> it is accurate so if you turn it on and DO GET a message about imminent drive failure, then believe it.

You should go ahead and run fixmbr command again......this time, looks like will be successful.

That message usually shows. At this point, a complete reinstall might be needed, or at least a repair install, and that requires some programs to be reinstalled as well, and a complete reinstall of course always does.

Make the decision based on: are there any files, such as financial or work or school stuff that you cannot afford to lose, still on that hard drive. That is all I can tell you. There is a slight chance the hard drive itself is damaged, and this is when repairs will fail. Files should be able to be rescued by connecting your hard drive to a computer and moving them. I have no way to tell you what to do.

I have run this command many times on various computers with malware, and the message you see is usually seen because of the rootkit that has corrrupted the master boot record area of your drive.


----------



## Bozica (Feb 20, 2011)

Good morning, it's a great day today! I kept the computer running all night I was too scared to shut it down. Just in case it didnt start again! I have run *fixmbr* successfully. The computer restarted with great results all programs are still there and running fine..
Thank you so much Byteman! 

I did manage to do a back up of most important doc's, pics and data however not all of them so you have save me months of work! Love your work!


----------



## Byteman (Jan 24, 2002)

Hi, Good, but malware is probably still present.

Give me a fresh Hijackthis log when you can. I am serious- malware like this can reappear and reinfect you.

A scan with SuperAntispyware or Malwarebytes would be a great idea, also, but be sure they get the latest definition updates before you scan.

You can post any logs you get here.


----------



## Bozica (Feb 20, 2011)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:45:27 PM, on 25/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Safe mode with network support
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Value Plus\Application Data\dwm.exe
C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Value Plus\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ycomp/defaults/sp/*http://au.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ycomp/defaults/su/*http://au.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/postinstall/win/en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:56061
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [conhost] C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\PC Tools Security\pctsGui.exe" /hideGUI
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Canon LASER SHOT LBP-1120 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280141732609
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\PC Tools Security\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\PC Tools Security\pctsSvc.exe
--
End of file - 7701 bytes


----------



## Bozica (Feb 20, 2011)

Oh, thought I would start in Normal mode. Not sure it will make a difference.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 11:59:27 AM, on 28/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\Value Plus\Application Data\dwm.exe
C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\CAP3RSK.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Documents and Settings\Value Plus\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ycomp/defaults/sp/*http://au.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ycomp/defaults/su/*http://au.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/postinstall/win/en
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:56061
F3 - REG:win.ini: load=C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKLM\..\Run: [conhost] C:\Documents and Settings\Value Plus\Application Data\Microsoft\conhost.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Canon LASER SHOT LBP-1120 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280141732609
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 7804 bytes


----------



## Byteman (Jan 24, 2002)

Hi, Normal mode is fine to work in

You can get this free program and keep it, this is only a scanner and remover unless you purchase the full version however there are things to know if you later on wish to buy a license................for now just use the Free version please. This is one of the best malware removers out there.








Download Malwarebytes' Anti-Malware from *Here*.

Double Click mbam-setup.exe to install the application.
Make sure a checkmark is placed next to *Update Malwarebytes' Anti-Malware* and *Launch Malwarebytes' Anti-Malware*, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "*Perform Quick Scan*", then click *Scan*.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that *everything is checked*, and click *Remove Selected*.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.
Extra Note:

*If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.*


----------



## Bozica (Feb 20, 2011)

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Database version: 6189
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
28/03/2011 1:31:58 PM
mbam-log-2011-03-28 (13-31-58).txt
Scan type: Quick scan
Objects scanned: 141307
Time elapsed: 4 minute(s), 30 second(s)
Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 4
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 8
Memory Processes Infected:
c:\documents and settings\value plus\application data\dwm.exe (Trojan.Downloader) -> 244 -> Unloaded process successfully.
c:\documents and settings\value plus\application data\microsoft\conhost.exe (Trojan.Agent) -> 460 -> Unloaded process successfully.
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\conhost (Trojan.Agent) -> Value: conhost -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Value: Load -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell.Gen) -> Value: Shell -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer (PUM.Bad.Proxy) -> Value: ProxyServer -> Quarantined and deleted successfully.
Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\Load (Trojan.Agent) -> Bad: (C:\DOCUME~1\VALUEP~1\LOCALS~1\Temp\csrss.exe) Good: () -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Spyware.Passwords.XGen) -> Bad: (mtqtwdgv.dll) Good: () -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SecurityProviders (Spyware.Passwords.XGen) -> Bad: (mdmwtqkh.dll) Good: () -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
c:\documents and settings\value plus\application data\dwm.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
c:\documents and settings\value plus\application data\microsoft\conhost.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Documents and Settings\Value Plus\Local Settings\Temp\csrss.exe (Trojan.Agent) -> Delete on reboot.
c:\WINDOWS\system32\mtqtwdgv.dll (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\mdmwtqkh.dll (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.
c:\documents and settings\value plus\local settings\Temp\pod.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\value plus\local settings\Temp\lol2.exe (Rogue.SystemTool) -> Quarantined and deleted successfully.
c:\documents and settings\value plus\local settings\Temp\spm.exe (Spyware.Passwords.XGen) -> Quarantined and deleted successfully.


----------



## Byteman (Jan 24, 2002)

Hi, Good that nabbed the malware

Now, one more fresh Hijackthis log please. To help ensure that you are posting the correct one, you can delete the old *logs *

And, I hope you see from the malware that was found, that the trojans you had were after passwords and other information. You must change all of the passwords you use that relate to banking, games, accounts where you buy or sell.....Ebay.....PayPal......credit cards......anything like that.

They really like game keys.....emails.......social sites, Facebook, etc .....you want to change just about every one you have!

Keep a good record but not on the computer.

Disinfect your other computers, flash drives.....and everyone else that uses the computers you have, check their USB drives too. Malwarebytes can scan flash drives but be careful.

Check your machine again after you use other flash drives on there.

You should do at least one online scan after we get the above done. There is no rush, reply when you can, I know you are located in different time zone. Then, after that we flush the System Restore Points and make sure you have the most updated plugins for Java and Adobe Flash Player and other software is the most secure versions. We use a site that checks your programs and notifies you of vulnerabilities so you can get updated.


----------



## Bozica (Feb 20, 2011)

Thank you, I am so grateful for all your help. Passwords are always kept in a book. I have so many it would be impossible to remember them. All passwords were changed as soon as you mentioned it at the start of this. No problems there. Look forward to further instructions when you are ready.

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:46:42 PM, on 28/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\WINDOWS\system32\CAP3RSK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Value Plus\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ycomp/defaults/sp/*http://au.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ycomp/defaults/su/*http://au.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/postinstall/win/en
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Canon LASER SHOT LBP-1120 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280141732609
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 7402 bytes

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:46:42 PM, on 28/03/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\WINDOWS\system32\CAP3RSK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\CAP3SWK.EXE
C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Value Plus\My Documents\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://au.rd.yahoo.com/customize/ycomp/defaults/sp/*http://au.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://au.rd.yahoo.com/customize/ycomp/defaults/su/*http://au.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.divx.com/postinstall/win/en
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: eBay Toolbar Helper - {22D8E815-4A5E-4DFB-845E-AAB64207F5BD} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O2 - BHO: Conduit Engine - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: eBay Toolbar - {92085AD4-F48A-450D-BD93-B28CC7DF67CE} - C:\Program Files\eBay\eBay Toolbar2\eBayTB.dll
O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [eBayToolbar] C:\Program Files\eBay\eBay Toolbar2\eBayTBDaemon.exe
O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Canon LASER SHOT LBP-1120 Status Window.LNK = C:\WINDOWS\system32\spool\drivers\w32x86\3\CAP3LAK.EXE
O8 - Extra context menu item: eBay Search - res://C:\Program Files\eBay\eBay Toolbar2\eBayTb.dll/RCSearch.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} (Device Detection) - http://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280141732609
O16 - DPF: {C1FDEE68-98D5-4F42-A4DD-D0BECF5077EB} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/eBay_Enhanced_Picture_Control_v1-0-31-0.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O20 - Winlogon Notify: avgrsstarter - avgrsstx.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: AVG Free E-mail Scanner (avg9emc) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgemc.exe
O23 - Service: AVG Free WatchDog (avg9wd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG9\avgwdsvc.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 7402 bytes


----------



## Byteman (Jan 24, 2002)

Hi, I've been fixing a bad cold I got probably from the grandkids.....much better today.

Here is a small free utiility that we use to help you clean out temporary files, Internet file leftovers, etc that you can keep and use every now and then.

Download *TFC by OldTimer* to your desktop

 Please double-click *TFC.exe* to run it. (*Note:* If you are running on Vista, right-click on the file and choose *Run As Administrator*).
It *will close all programs* when run, so make sure you have *saved all your work* before you begin.
Click the *Start* button to begin the process. Depending on how often you clean temp files, execution time should be anywhere from a few seconds to a minute or two. *Let it run uninterrupted to completion*. 
Once it's finished it should *reboot your machine*. If it does not, please *manually reboot the machine* yourself to ensure a complete clean.

NEXT: ((This set of directions is borrowed from a malware gold shield here at TSG > thanks go to *Cybertech* as I am very limited time-wise and not keeping up with typing up my own set of directions.....but, I promise to get tht taken care of soon!))

*ESET Online Scanner*

*Note:* You can use IE or FireFox for this scan. You need to disable your current installed Anti-Virus. If you need help with that look *here*.

*Vista users:* You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select *Run as Administrator* from the context menu.


Please go *ESET Online Scanner* and click on the ESET Online Scanner button
Select the option *YES, I accept the Terms of Use* then click on *Start*
When prompted allow the *Add-On/Active X* to install.
Make sure that the option *Remove found threats* is *NOT* checked, and the option *Scan archives* is checked.
Now click on Advanced Settings and select the following:


*Scan for potentially unwanted applications*
*Scan for potentially unsafe applications*
*Enable Anti-Stealth Technology*

Now click on *Start*
The *virus signature database... *will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the* Online Scan* will begin automatically. 
*Do not* touch either the Mouse or keyboard during the scan otherwise it may stall. 
When completed select *Uninstall application on close* if you so wish, *make sure you copy the logfile first!*
Now click on *Finish*
Use notepad to open the logfile located at *C:\Program Files\ESET\EsetOnlineScanner\log.txt*.
Copy and paste that log as a reply to this topic.
*Note:* Do not forget to re-enable your Anti-Virus application after running the above scan!


----------



## Bozica (Feb 20, 2011)

Sorry to hear you have been unwell, welcome back! 

I was using AVG Anti-virus but its gone as far as I can tell.
Can you advise what the best anti-virus program I should download and from where.
&#12288;
C:\Documents and Settings\Value Plus\Local Settings\Application Data\IM\Identities\{D94E3A90-389F-4AA7-97DF-F18A80E70F48}\Message Store\Attachments\UPS tracking number.zip Win32/TrojanDownloader.Stohil.J trojan
C:\Documents and Settings\Value Plus\Local Settings\Application Data\IM\Identities\{D94E3A90-389F-4AA7-97DF-F18A80E70F48}\Message Store\Attachments\UPS-tracking.zip a variant of Win32/TrojanDownloader.Stohil.J trojan
C:\Documents and Settings\Value Plus\Local Settings\Application Data\IM\Identities\{D94E3A90-389F-4AA7-97DF-F18A80E70F48}\Message Store\Attachments\{208E21AE-1E44-49FE-84CD-9D5CB3245A73}\UPS tracking number.zip Win32/TrojanDownloader.Stohil.J trojan
C:\WINDOWS\atonfg.dll a variant of Win32/Kryptik.LYY trojan
C:\WINDOWS\system32\atonfg.dll Win32/PSW.Papras.BO trojan
Operating memory a variant of Win32/Kryptik.LYY trojan


----------



## Byteman (Jan 24, 2002)

Hi, Don't be using that computer very much on the Internet-- get the two downloads shown below, one to help remove AVG and a new copy of ComboFix.

AVG is still very much present and active and is what prevented that one tool ComboFix from working correctly.....

Apparently, the program shortcut or main starter component is not working so you cannot bring up the window for it....perhaps it is slightly damaged from the malware or still being blocked.

I want you to remove it this way:

http://www.avg.com/us-en/download-tools

Get the 32-bit version which is the *first* item in that list, just download it to the Desktop area and start it up. (Close all other programs, don't be doing anything else, close browers, etc)

_ _ _ _Next_____

Please find and *delete the download of ComboFix we used previously if you have not deleted it already.*

You can look back in your thread here, back through the posts, and find the reply I posted with the directions for using CF and *download a new copy at the time you want to use it* remembering to rename the download file to something else....I use tool.exe or what ever....

You will not have to turn off / disable any antivirus program now because you do not have one at the momen, but in case you * have on your own downloaded and installed one, that one must be turned off as it says in CF's directions.

When you are ready, follow the steps you have back in the thread (Printed out, saved in text Notepad file, etc) and run the tool.

Post the log it makes here.*


----------



## Bozica (Feb 20, 2011)

Hi, I have another computer that I am using and will only use the infected one for the purpose of repair.

Ok, I'm having some troubles here. Downloaded AVG removal tool, ran it and it has placed 2 log files on the desktop. Let me know if you would like me to post them they are long.

Next - Downloaded ComboFix and save on the desktop as ComboFix.exe.
Started ComboFix.exe and was prompted with:
*ComboFix cannot run when AVG is installed. This is due to ACG's targeting of Combofix's files/processes.*
*Please uninstall AVG or use another tool.*


----------



## Bozica (Feb 20, 2011)

Opps... *ACG's should read AVG's*


----------



## Byteman (Jan 24, 2002)

Start up Hijackthis and I do not want a new scan log, I would like to see this log made that shows the Uninstall Manager list of programs please:



> Open Hijack This and click on the "Open the Misc Tools section" button. Click on the "Open Uninstall Manager" button. Click the "Save List" button. After you click the "Save List" button, you will be asked where to save the file. Pick a place to save it then the list should open in notepad. Copy and paste that list here.


Next:


 Download TDSSKiller from one of the links below:

*SAVE* the file directly onto your *DESKTOP*

*TDSSkiller*

If TDSSKiller asks you to close all programs please allow it to do so.

If you see the following:
To finalize removal of infection and avoid loosing of data program will reboot your PC now.
Close all programs and choose Y to restart or N to continue.

Please enter Y and allow TDSSKiller to reboot your computer.

Once completed it will create a log in your C:\ drive. An example of a log file and the location to find it is: C:\TDSSKiller.2.2.0_20.12.2009_15.31.43_log.txt.

Please post the content of the TDSSKiller log.


----------



## Bozica (Feb 20, 2011)

Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Ask Toolbar
Canon LASER SHOT LBP-1120
DivX Codec
eBay Toolbar
Foxit Reader
Google Update Helper
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB981793)
IncrediMail 2.0
Java(TM) 6 Update 24
Logitech Registration
Logitech SetPoint 6.20
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
Microsoft Office Small Business Edition 2003
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Works
Mozilla Firefox (3.6.10)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MYOB RetailManager Standard v6.5
Nero 7 Essentials
neroxml
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Picasa 3
Realtek High Definition Audio Driver
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player (KB979402)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982381)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
SUPERAntiSpyware
Turbo Lister 2
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB898461)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
Windows Feature Pack for Storage (32-bit) - IMAPI update for Blu-Ray
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
WinRAR archiver


Will start the other instructions now.


----------



## Bozica (Feb 20, 2011)

2011/04/02 13:33:57.0281 2356 TDSS rootkit removing tool 2.4.21.0 Mar 10 2011 12:26:28
2011/04/02 13:33:57.0843 2356 ================================================================================
2011/04/02 13:33:57.0843 2356 SystemInfo:
2011/04/02 13:33:57.0843 2356 
2011/04/02 13:33:57.0843 2356 OS Version: 5.1.2600 ServicePack: 3.0
2011/04/02 13:33:57.0843 2356 Product type: Workstation
2011/04/02 13:33:57.0843 2356 ComputerName: VALUE
2011/04/02 13:33:57.0843 2356 UserName: Value Plus
2011/04/02 13:33:57.0843 2356 Windows directory: C:\WINDOWS
2011/04/02 13:33:57.0843 2356 System windows directory: C:\WINDOWS
2011/04/02 13:33:57.0843 2356 Processor architecture: Intel x86
2011/04/02 13:33:57.0843 2356 Number of processors: 2
2011/04/02 13:33:57.0843 2356 Page size: 0x1000
2011/04/02 13:33:57.0843 2356 Boot type: Normal boot
2011/04/02 13:33:57.0843 2356 ================================================================================
2011/04/02 13:33:58.0171 2356 Initialize success
2011/04/02 13:34:30.0875 2376 ================================================================================
2011/04/02 13:34:30.0875 2376 Scan started
2011/04/02 13:34:30.0875 2376 Mode: Manual; 
2011/04/02 13:34:30.0875 2376 ================================================================================
2011/04/02 13:34:31.0109 2376 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/04/02 13:34:31.0171 2376 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
2011/04/02 13:34:31.0234 2376 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/04/02 13:34:31.0296 2376 AFD (7e775010ef291da96ad17ca4b17137d7) C:\WINDOWS\System32\drivers\afd.sys
2011/04/02 13:34:31.0468 2376 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/04/02 13:34:31.0484 2376 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/04/02 13:34:31.0531 2376 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/04/02 13:34:31.0578 2376 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/04/02 13:34:31.0625 2376 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/04/02 13:34:31.0671 2376 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/04/02 13:34:31.0718 2376 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/04/02 13:34:31.0734 2376 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/04/02 13:34:31.0765 2376 Cdrom (1f4260cc5b42272d71f79e570a27a4fe) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/04/02 13:34:32.0109 2376 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/04/02 13:34:32.0171 2376 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/04/02 13:34:32.0203 2376 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/04/02 13:34:32.0218 2376 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/04/02 13:34:32.0281 2376 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/04/02 13:34:32.0328 2376 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/04/02 13:34:32.0390 2376 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/04/02 13:34:32.0421 2376 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/04/02 13:34:32.0437 2376 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/04/02 13:34:32.0453 2376 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/04/02 13:34:32.0484 2376 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/04/02 13:34:32.0515 2376 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/04/02 13:34:32.0531 2376 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/04/02 13:34:32.0593 2376 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/04/02 13:34:32.0656 2376 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/04/02 13:34:32.0718 2376 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/04/02 13:34:32.0796 2376 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/04/02 13:34:32.0890 2376 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/04/02 13:34:32.0937 2376 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/04/02 13:34:33.0125 2376 IntcAzAudAddService (47f27af890da3e51c633fdd510910115) C:\WINDOWS\system32\drivers\RtkHDAud.sys
2011/04/02 13:34:33.0187 2376 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/04/02 13:34:33.0218 2376 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/04/02 13:34:33.0234 2376 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/04/02 13:34:33.0265 2376 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/04/02 13:34:33.0281 2376 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/04/02 13:34:33.0328 2376 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/04/02 13:34:33.0375 2376 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/04/02 13:34:33.0406 2376 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/04/02 13:34:33.0421 2376 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
2011/04/02 13:34:33.0484 2376 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/04/02 13:34:33.0515 2376 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/04/02 13:34:33.0546 2376 L8042Kbd (d88846f9f4f27ae9be584a6e5b6b8753) C:\WINDOWS\system32\DRIVERS\L8042Kbd.sys
2011/04/02 13:34:33.0562 2376 L8042mou (bea61fda2103f6f51b14eb0872e8a050) C:\WINDOWS\system32\DRIVERS\L8042mou.Sys
2011/04/02 13:34:33.0609 2376 LBeepKE (c99ba72106a858cb8b521bb4c02c93ed) C:\WINDOWS\system32\Drivers\LBeepKE.sys
2011/04/02 13:34:33.0656 2376 LHidFilt (318b3d608fbec44b7e0c23bf759dced5) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
2011/04/02 13:34:33.0687 2376 LMouFilt (84af069d219df3c43dc6792b2bbd7bed) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
2011/04/02 13:34:33.0703 2376 LMouKE (cab504e38fced9a56d87d838e9ba13e9) C:\WINDOWS\system32\DRIVERS\LMouKE.Sys
2011/04/02 13:34:33.0750 2376 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/04/02 13:34:33.0796 2376 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/04/02 13:34:33.0812 2376 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/04/02 13:34:33.0828 2376 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/04/02 13:34:33.0875 2376 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/04/02 13:34:33.0906 2376 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/04/02 13:34:33.0953 2376 MRxSmb (f3aefb11abc521122b67095044169e98) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/04/02 13:34:33.0984 2376 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/04/02 13:34:34.0046 2376 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/04/02 13:34:34.0078 2376 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/04/02 13:34:34.0109 2376 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/04/02 13:34:34.0156 2376 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/04/02 13:34:34.0171 2376 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/04/02 13:34:34.0187 2376 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/04/02 13:34:34.0250 2376 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/04/02 13:34:34.0296 2376 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/04/02 13:34:34.0312 2376 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/04/02 13:34:34.0343 2376 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/04/02 13:34:34.0375 2376 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/04/02 13:34:34.0390 2376 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/04/02 13:34:34.0437 2376 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/04/02 13:34:34.0484 2376 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/04/02 13:34:34.0531 2376 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/04/02 13:34:34.0687 2376 nv (eb2858f920b8135b807b5ccaa3ed73dc) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
2011/04/02 13:34:34.0812 2376 nvata (ef9941593b2e9b436f64a87ddb570d1a) C:\WINDOWS\system32\DRIVERS\nvata.sys
2011/04/02 13:34:34.0843 2376 NVENETFD (0ae6258709d58fb53638e8d28f4480d4) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys
2011/04/02 13:34:34.0859 2376 nvnetbus (1296b33c223a58485d5eaa779752216a) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys
2011/04/02 13:34:34.0906 2376 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/04/02 13:34:34.0921 2376 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/04/02 13:34:34.0984 2376 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
2011/04/02 13:34:35.0015 2376 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/04/02 13:34:35.0062 2376 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/04/02 13:34:35.0109 2376 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/04/02 13:34:35.0156 2376 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/04/02 13:34:35.0187 2376 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/04/02 13:34:35.0312 2376 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/04/02 13:34:35.0359 2376 Processor (a32bebaf723557681bfc6bd93e98bd26) C:\WINDOWS\system32\DRIVERS\processr.sys
2011/04/02 13:34:35.0390 2376 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/04/02 13:34:35.0406 2376 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/04/02 13:34:35.0484 2376 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/04/02 13:34:35.0500 2376 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/04/02 13:34:35.0515 2376 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/04/02 13:34:35.0531 2376 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/04/02 13:34:35.0562 2376 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/04/02 13:34:35.0578 2376 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/04/02 13:34:35.0609 2376 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/04/02 13:34:35.0656 2376 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/04/02 13:34:35.0703 2376 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/04/02 13:34:35.0828 2376 SASDIFSV (a3281aec37e0720a2bc28034c2df2a56) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/04/02 13:34:35.0843 2376 SASKUTIL (61db0d0756a99506207fd724e3692b25) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/04/02 13:34:35.0890 2376 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/04/02 13:34:35.0953 2376 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
2011/04/02 13:34:35.0968 2376 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
2011/04/02 13:34:36.0046 2376 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/04/02 13:34:36.0125 2376 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/04/02 13:34:36.0171 2376 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/04/02 13:34:36.0203 2376 Srv (0f6aefad3641a657e18081f52d0c15af) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/04/02 13:34:36.0250 2376 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/04/02 13:34:36.0281 2376 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/04/02 13:34:36.0375 2376 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/04/02 13:34:36.0437 2376 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/04/02 13:34:36.0484 2376 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/04/02 13:34:36.0500 2376 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/04/02 13:34:36.0515 2376 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/04/02 13:34:36.0593 2376 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/04/02 13:34:36.0640 2376 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/04/02 13:34:36.0687 2376 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/04/02 13:34:36.0703 2376 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/04/02 13:34:36.0718 2376 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/04/02 13:34:36.0734 2376 usbohci (0daecce65366ea32b162f85f07c6753b) C:\WINDOWS\system32\DRIVERS\usbohci.sys
2011/04/02 13:34:36.0781 2376 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/04/02 13:34:36.0812 2376 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/04/02 13:34:36.0843 2376 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/04/02 13:34:36.0906 2376 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/04/02 13:34:36.0937 2376 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/04/02 13:34:37.0000 2376 Wdf01000 (fd47474bd21794508af449d9d91af6e6) C:\WINDOWS\system32\DRIVERS\Wdf01000.sys
2011/04/02 13:34:37.0062 2376 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/04/02 13:34:37.0156 2376 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
2011/04/02 13:34:37.0203 2376 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/04/02 13:34:37.0250 2376 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/04/02 13:34:37.0390 2376 ================================================================================
2011/04/02 13:34:37.0390 2376 Scan finished
2011/04/02 13:34:37.0390 2376 ================================================================================


----------



## Byteman (Jan 24, 2002)

Good, you don't have that rootkit.

I want you to do the Eset online scan once more but this time, we will have it delete the bad files it found before.

If you go to this location, see if this log from the *first* scan is present, and delete it please> C:\Program Files\ESET\EsetOnlineScanner\log.txt

Please run a free online scan with the *ESET Online Scanner* 
*Note*_: You will need to use Internet Explorer for this scan_
Click *Eset Online Scanner* button.
Tick the box next to *YES, I accept the Terms of Use*

you probably will not have to re-do a lot of the Updates and Active-X allowing again, don't worry if you do or do not....just do the scan with these settings please)
If it wants to install an Addon, allow it.
If asked, allow the ActiveX control to install 
Click *Start* 
Make sure that the options *Remove found threats* and the option *Scan unwanted applications* is checked 
Click *Scan* (This scan can take several hours, so please be patient) 
Once the scan is completed, you may close the window 
Use *Notepad* to open the logfile located at C:\Program Files\EsetOnlineScanner\*log.txt*

make sure you are posting the right log, from this scan!
Copy and paste that log as a reply to this topic


----------



## Bozica (Feb 20, 2011)

[email protected] as CAB hook log:
OnlineScanner.ocx - registred OK
can not get scanner. e_gle=1001
DLLipe not connected. attempts=120
can not get scanner. e_gle=1001
DLLipe not connected. attempts=120
# version=7
# iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
# OnlineScanner.ocx=1.0.0.6425
# api_version=3.0.2
# EOSSerial=3f20be7aea9dae4aade6aae89ee25ab1
# end=finished
# remove_checked=true
# archives_checked=false
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2011-04-02 04:27:12
# local_time=2011-04-02 02:57:12 (+0930, Cen. Australia Daylight Time)
# country="Australia"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777215 100 0 0 0 0 0
# compatibility_mode=1029 16777174 0 75 0 20762788 0 0
# compatibility_mode=1797 16774142 0 6 2438789 34232922 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=73803
# found=2
# cleaned=2
# scan_time=1918
C:\WINDOWS\atonfg.dll a variant of Win32/Kryptik.LYY trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C
C:\WINDOWS\system32\atonfg.dll Win32/PSW.Papras.BO trojan (cleaned by deleting - quarantined) 00000000000000000000000000000000 C


----------



## Byteman (Jan 24, 2002)

Hi,

Apparently you took care of the bad files that were found in the first ESET online scan that were in the mailbox (Message Store)? I see the second scan found and deleted the last 2 files....good.

Now, you have to take care of old System Restore points to finish up.

Make sure you do the finishing up part, that is, creating a new first Restore Point, after you turn Restore off.

There is a restart in between, just after you turn System Restore OFF- that deletes the old points which are infected.

Turning Restore back on also requires you to create the *first new restore point* and after that, Windows will handle things / and you can make a restore point any time you need to.

Here are the steps:

*Note: Turning off System Restore deletes all previous restore points. You must create new restore points once you turn System Restore back on.*

1.Log on to an admin level user account
2.Close all open programs.
3.Right-click My Computer on Windows desktop.
4.Select Properties.
5.Click System Restore.
6.Check Turn off System Restore checkbox.

7.Click Apply and then Yes to delete all existing restore points.Wait till you see "Turned Off" replace "Monitoring".

8.Click OK and restart the computer.

*To reactivate System Restore option *

1.Follow the steps above, but in the step 4, uncheck "Turn off System Restore" checkbox.
2.Click Apply and then OK. You will see "Monitoring" back in the space....
3.Click Yes, when you are prompted to restart Windows.


----------



## Bozica (Feb 20, 2011)

Hi, I have taken these steps now all is good. I thought I would check just in case and I have no other restore points now. Only today&#8217;s one.


----------



## Byteman (Jan 24, 2002)

You will need an antivirus program if in fact, AVG has been damaged, is not working right, etc. 

See if you can determine what version of either Free or the pay-for version you were using.

Find a file from AVG perhaps in Program Files>Grisoft>AVG Free edition.....that might indicate the version you had.

We tried the avg remover tool which apparently did not remove all of the program....

Maybe you could run that AVG removal utility once more and tell us what happens?


If the computer will accept a new antivirus, I suggest either Microsoft Security Essentials or something like Avast , both of which are free though Avast does have a premium version.

Does your Windows Update work correctly? Can you try it and see if you are scheduled to get some Updates?


----------



## Bozica (Feb 20, 2011)

Hi, I just don&#8217;t get it. I downloaded a new version of AVG removal tool and it seemed to do more than it did last time. However when I check the computer via search files and programs AVG9 is still there. The removal tool saved a log on the desktop, would you like me to post the results for you? I have no clue why its still there.


----------



## Bozica (Feb 20, 2011)

I managed to to download and install Avast Free version. Also ran a quick scan and all is clear!


----------



## Byteman (Jan 24, 2002)

I had one job last week where I had to remove AVG manually after it became like yours. You do this by deleting Registry entries and it took me about 20 minutes of steady Reg key deleting. After that I could install a new antivirus. 

Anyway yes please post that log and if it says it's too large just attach the file to your reply


----------



## Bozica (Feb 20, 2011)

2011-04-03 22:57:15,437 DEBUG Avg9Uninstall\Directories key failed to open (error: e0010013)
2011-04-03 22:57:15,453 DEBUG Avg8Uninstall\Directories key failed to open (error: e0010013)
2011-04-03 22:57:15,453 DEBUG Reading HKLM\SOFTWARE\Microsoft\Windows\CurrentVersionrogramFilesDir (x86) value failed (error: e001003d)
2011-04-03 22:57:15,453 INFO Command line: "C:\Documents and Settings\Value Plus\Desktop\avg_remover_stf_x86_2011_1184.exe" 
2011-04-03 22:57:15,453 WARN AvgDir param empty.
2011-04-03 22:57:15,453 WARN AvgAdminDir param empty.
2011-04-03 22:57:15,453 WARN AvgDataDir param empty.
2011-04-03 22:57:36,703 INFO AvgRemover runs in attempt number 1
2011-04-03 22:57:36,703 INFO ***** Msi data *****
2011-04-03 22:57:36,718 DEBUG No product code found for our upgrade codes, nothing to do here
2011-04-03 22:57:36,718 INFO ***** Exchange&Outlook plugins data *****
2011-04-03 22:57:36,718 INFO Removing AvgOutlook addin
2011-04-03 22:57:36,718 INFO AvgOutlook Removing HKCR addin keys x86
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'avgoutlook.Addin': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'avgoutlook.Addin.1': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'CLSID\{9F39046C-801E-4E15-8CD9-ACF0ACF29048}': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'CLSID\{F083C5AB-08AD-4ABF-A2BE-8FA5C7D2F10A}': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'AppID\avgoutlook.DLL': 0xe001003d
2011-04-03 22:57:36,718 INFO AvgOutlook Removing HKCR addin keys x64
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'avgoutlook.Addin': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'avgoutlook.Addin.1': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'CLSID\{9F39046C-801E-4E15-8CD9-ACF0ACF29048}': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'CLSID\{F083C5AB-08AD-4ABF-A2BE-8FA5C7D2F10A}': 0xe001003d
2011-04-03 22:57:36,718 DEBUG Failed to delete key 'AppID\avgoutlook.DLL': 0xe001003d
2011-04-03 22:57:36,718 INFO Removing Sharepoint plugin if exists
2011-04-03 22:57:36,718 INFO Removing Antispam plugin for Exchange 2000/2003 if exists
2011-04-03 22:57:36,718 DEBUG Stopping service 'MSExchangeIS' to remove VSAPI plugin...
2011-04-03 22:57:36,734 DEBUG Service MSExchangeIS Stop failed (error: c0070424)
2011-04-03 22:57:36,734 DEBUG Exchange&Outlook plugins removal failed with error 0xc0070424
2011-04-03 22:57:36,734 INFO ***** Services *****
2011-04-03 22:57:36,734 INFO Processing service avg8emc, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service avg8wd, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service avg8emc is not installed
2011-04-03 22:57:36,734 INFO Processing service AvgWFPa, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service avg8wd is not installed
2011-04-03 22:57:36,734 INFO Processing service avgfws8, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Service avg8emc RegCleanup
2011-04-03 22:57:36,734 INFO Processing service AvgWFPx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AvgMfx86, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service avg9wd, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AvgLdx86, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Service avg8wd RegCleanup
2011-04-03 22:57:36,734 INFO Service AvgWFPa is not installed
2011-04-03 22:57:36,734 INFO Processing service AvgMfx64, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Registry keys for service avg8emc are not present
2011-04-03 22:57:36,734 INFO Processing service AvgTdiX, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service AvgWFPx is not installed
2011-04-03 22:57:36,734 INFO Service avgfws8 is not installed
2011-04-03 22:57:36,734 INFO Processing service avg9emc, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service AvgMfx86 is not installed
2011-04-03 22:57:36,734 DEBUG Registry keys for service avg8wd are not present
2011-04-03 22:57:36,734 INFO Processing service AvgRkx86, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service AvgLdx86 is not installed
2011-04-03 22:57:36,734 INFO Processing service avgfws, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Service AvgWFPa RegCleanup
2011-04-03 22:57:36,734 INFO Processing service AVGIDSShimxpx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service AvgMfx64 is not installed
2011-04-03 22:57:36,734 INFO Service AvgTdiX is not installed
2011-04-03 22:57:36,734 INFO Service avg9wd is not installed
2011-04-03 22:57:36,734 INFO Processing service AvgLdx64, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AvgTdiA, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AvgRkx64, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSDriverxpx, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Service AvgWFPx RegCleanup
2011-04-03 22:57:36,734 INFO Processing service AVGIDSFiltervtx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSAgent, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service avgfws9, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Service avgfws8 RegCleanup
2011-04-03 22:57:36,734 INFO Processing service AVGIDSFiltervta, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSDrivervtx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSShimvtx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSFilterxpx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSDrivervta, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service avg9emc is not installed
2011-04-03 22:57:36,734 DEBUG Service AvgMfx86 RegCleanup
2011-04-03 22:57:36,734 INFO Processing service AVGIDSFilterw7x, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service AvgRkx86 is not installed
2011-04-03 22:57:36,734 INFO Processing service AVGIDSShimw7x, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSDriverw7x, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSFilterw7a, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSDriverw7a, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSErHrw7a, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSErHrvta, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSErHrxpx, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Service AvgLdx86 RegCleanup
2011-04-03 22:57:36,734 INFO Processing service AVGIDSErHrvtx, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service avgwd, it can take several minutes...
2011-04-03 22:57:36,734 INFO Processing service AVGIDSErHrw7x, it can take several minutes...
2011-04-03 22:57:36,734 DEBUG Registry keys for service AvgWFPa are not present
2011-04-03 22:57:36,734 INFO Processing service AvgAdminServer, it can take several minutes...
2011-04-03 22:57:36,734 INFO Service avgfws is not installed
2011-04-03 22:57:36,734 INFO Service AVGIDSShimxpx is not installed
2011-04-03 22:57:36,734 DEBUG Service AvgTdiX RegCleanup
2011-04-03 22:57:36,734 DEBUG Service AvgMfx64 RegCleanup
2011-04-03 22:57:36,734 DEBUG Service avg9wd RegCleanup
2011-04-03 22:57:36,734 DEBUG Registry keys for service AvgWFPx are not present
2011-04-03 22:57:36,734 DEBUG Registry keys for service avgfws8 are not present
2011-04-03 22:57:36,734 INFO Service AvgLdx64 is not installed
2011-04-03 22:57:36,734 INFO Service AvgRkx64 is not installed
2011-04-03 22:57:36,734 INFO Service AvgTdiA is not installed
2011-04-03 22:57:36,734 INFO Service AVGIDSFiltervtx is not installed
2011-04-03 22:57:36,734 INFO Service AVGIDSDriverxpx is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSAgent is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSFilterxpx is not installed
2011-04-03 22:57:36,750 INFO Service avgfws9 is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSDrivervtx is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSShimvtx is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSFiltervta is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSDrivervta is not installed
2011-04-03 22:57:36,750 DEBUG Service avg9emc RegCleanup
2011-04-03 22:57:36,750 DEBUG Registry keys for service AvgMfx86 are not present
2011-04-03 22:57:36,750 DEBUG Service AvgRkx86 RegCleanup
2011-04-03 22:57:36,750 INFO Service AVGIDSFilterw7x is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSShimw7x is not installed
2011-04-03 22:57:36,750 DEBUG Registry keys for service AvgLdx86 are not present
2011-04-03 22:57:36,750 INFO Service AVGIDSDriverw7x is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSDriverw7a is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSFilterw7a is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSErHrxpx is not installed
2011-04-03 22:57:36,750 INFO Service avgwd is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSErHrw7x is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSErHrvtx is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSErHrvta is not installed
2011-04-03 22:57:36,750 INFO Service AvgAdminServer is not installed
2011-04-03 22:57:36,750 INFO Service AVGIDSErHrw7a is not installed
2011-04-03 22:57:36,750 DEBUG Service avgfws RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSShimxpx RegCleanup
2011-04-03 22:57:36,750 DEBUG Registry keys for service AvgTdiX are not present
2011-04-03 22:57:36,750 DEBUG Registry keys for service avg9wd are not present
2011-04-03 22:57:36,750 DEBUG Registry keys for service AvgMfx64 are not present
2011-04-03 22:57:36,750 DEBUG Service AvgLdx64 RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AvgRkx64 RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AvgTdiA RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSFiltervtx RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSDriverxpx RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSAgent RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSFilterxpx RegCleanup
2011-04-03 22:57:36,750 DEBUG Service avgfws9 RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSDrivervtx RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSShimvtx RegCleanup
2011-04-03 22:57:36,750 DEBUG Service AVGIDSFiltervta RegCleanup
2011-04-03 22:57:36,765 DEBUG Registry keys for service avg9emc are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AvgRkx86 are not present
2011-04-03 22:57:36,765 DEBUG Service AVGIDSFilterw7x RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSDrivervta RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSShimw7x RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSDriverw7x RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSDriverw7a RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSFilterw7a RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSErHrxpx RegCleanup
2011-04-03 22:57:36,765 DEBUG Service avgwd RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSErHrw7x RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSErHrvtx RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSErHrvta RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AvgAdminServer RegCleanup
2011-04-03 22:57:36,765 DEBUG Service AVGIDSErHrw7a RegCleanup
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSDriverxpx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AvgAdminServer are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSErHrw7a are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service avgfws9 are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSErHrw7x are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSErHrvta are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service avgwd are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSErHrxpx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSDriverw7x are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSFilterw7a are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSDriverw7a are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSDrivervta are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSShimxpx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSFilterw7x are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSAgent are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSFilterxpx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSDrivervtx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSErHrvtx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSShimw7x are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSShimvtx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSFiltervta are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AvgLdx64 are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AvgRkx64 are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AVGIDSFiltervtx are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service AvgTdiA are not present
2011-04-03 22:57:36,765 DEBUG Registry keys for service avgfws are not present
2011-04-03 22:57:36,765 INFO ***** Avg Fw NDIS driver(separate process) *****
2011-04-03 22:57:36,796 DEBUG Avg9Uninstall\Directories key failed to open (error: e0010013)
2011-04-03 22:57:36,796 DEBUG Avg8Uninstall\Directories key failed to open (error: e0010013)
2011-04-03 22:57:36,796 DEBUG Reading HKLM\SOFTWARE\Microsoft\Windows\CurrentVersionrogramFilesDir (x86) value failed (error: e001003d)
2011-04-03 22:57:36,796 INFO Command line: "C:\Documents and Settings\Value Plus\Desktop\avg_remover_stf_x86_2011_1184.exe" /ndisonly /skipask
2011-04-03 22:57:36,796 WARN AvgDir param empty.
2011-04-03 22:57:36,796 WARN AvgAdminDir param empty.
2011-04-03 22:57:36,796 WARN AvgDataDir param empty.
2011-04-03 22:57:36,796 INFO AvgRemover runs in attempt number 1
2011-04-03 22:57:36,796 INFO ***** Avg Fw NDIS driver *****
2011-04-03 22:57:36,796 INFO ...this operation can take several minutes...
2011-04-03 22:57:36,796 INFO FW removing policy
2011-04-03 22:57:36,859 INFO FW NDIS driver not present
2011-04-03 22:57:36,859 DEBUG Remove NDIS driver pass, next uninstalation step is 10, old was 1
2011-04-03 22:57:36,859 INFO ***** end of Fw NDIS separated process *****
2011-04-03 22:57:36,859 INFO ***** Drivers *****
2011-04-03 22:57:36,859 INFO ***** Running AVG process *****
2011-04-03 22:57:36,968 INFO ***** Registry keys and values *****
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Mozilla\Firefox\Extensions
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Mozilla\Firefox\Extensions:{3f963a5b-e555-4543-90e2-c3908898db71} Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Mozilla\Firefox\Extensions:{3f963a5b-e555-4543-90e2-c3908898db71} is not present
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Mozilla\Firefox\Extensions
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Mozilla\Firefox\Extensions:{1d5287d1-8a92-0001-1f31-1cec198018d8} Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Mozilla\Firefox\Extensions:{1d5287d1-8a92-0001-1f31-1cec198018d8} is not present
2011-04-03 22:57:36,984 INFO Processing registry SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avg8Alrt
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avg8Alrt ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avg8Alrt not found
2011-04-03 22:57:36,984 INFO Processing registry SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avg9Alrt
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avg9Alrt ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Eventlog\Application\Avg9Alrt not found
2011-04-03 22:57:36,984 INFO Processing registry SYSTEM\CurrentControlSet\Services\Eventlog\Application\AvgEms
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Eventlog\Application\AvgEms ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Eventlog\Application\AvgEms not found
2011-04-03 22:57:36,984 INFO Processing registry SYSTEM\CurrentControlSet\Services\Avg
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Avg ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Avg not found
2011-04-03 22:57:36,984 INFO Processing registry SYSTEM\CurrentControlSet\Services\Avg
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Avg ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SYSTEM\CurrentControlSet\Services\Avg not found
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2AF1721-312E-4B07-8B17-CEB780DCD054}
2011-04-03 22:57:36,984 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2AF1721-312E-4B07-8B17-CEB780DCD054} ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{B2AF1721-312E-4B07-8B17-CEB780DCD054} not found
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
2011-04-03 22:57:36,984 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\Toolbar
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Internet Explorer\Toolbar:{CCC7A320-B3CA-4199-B1A6-9F516DD69829} Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Microsoft\Internet Explorer\Toolbar:{CCC7A320-B3CA-4199-B1A6-9F516DD69829} is not present
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
2011-04-03 22:57:36,984 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} ForceRemove
2011-04-03 22:57:36,984 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Exchange\Client\Extensions
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Exchange\Client\Extensions:Outlook Setup Extension Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Microsoft\Exchange\Client\Extensions:Outlook Setup Extension is not present
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Exchange\Client\Extensions
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Exchange\Client\Extensions:AVG Exchange Extension Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Microsoft\Exchange\Client\Extensions:AVG Exchange Extension is not present
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:AppInit_DLLs Modify
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows:AppInit_DLLs doesn't need to be modified
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} is not present
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
2011-04-03 22:57:36,984 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} Remove
2011-04-03 22:57:36,984 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-460A-42C5-AE0C-81C61FFAEBC3} is not present
2011-04-03 22:57:36,984 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
2011-04-03 22:57:37,000 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} Remove
2011-04-03 22:57:37,000 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} is not present
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved
2011-04-03 22:57:37,000 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} Remove
2011-04-03 22:57:37,000 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved:{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} is not present
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2011-04-03 22:57:37,000 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG8_TRAY Remove
2011-04-03 22:57:37,000 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG8_TRAY is not present
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2011-04-03 22:57:37,000 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG9_TRAY Remove
2011-04-03 22:57:37,000 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG9_TRAY is not present
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG8Uninstall
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG8Uninstall ForceRemove
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG8Uninstall not found
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall ForceRemove
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG7Uninstall not found
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG9Uninstall
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG9Uninstall ForceRemove
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG9Uninstall not found
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C} ForceRemove
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} ForceRemove
2011-04-03 22:57:37,000 DEBUG Key SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} not found
2011-04-03 22:57:37,000 INFO Processing registry SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82}
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82} ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82} not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82}
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82} ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82} not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\AvgDiagFile
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\AvgDiagFile ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\AvgDiagFile not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\AvgDiagFile
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\AvgDiagFile ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\AvgDiagFile not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\.avgdi
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdi ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdi not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\.avgdx
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\.avgdx
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\.avgdx
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\.avgdx
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\.avgdx not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG8 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG8 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG8 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG8 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG8 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\AVG8 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG8 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG8 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG8 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG9 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG9 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG9 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG9 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG9 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG9 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\AVG9 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\AVG9 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\AVG9 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\AVG9 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\AVG9 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\AVG9 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG9 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG9 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG9 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG9 Shell Extension
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG9 Shell Extension ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\piffile\shellex\ContextMenuHandlers\AVG9 Shell Extension not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\PROTOCOLS\Handler\linkscanner not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\avgsbg.state
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\avgsbg.state
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\avgsbg.state.1
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state.1 ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state.1 not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\avgsbg.state.1
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state.1 ForceRemove
2011-04-03 22:57:37,015 DEBUG Key SOFTWARE\Classes\avgsbg.state.1 not found
2011-04-03 22:57:37,015 INFO Processing registry SOFTWARE\Classes\LinkScannerIE.NavFilter
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\LinkScannerIE.NavFilter
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\LinkScannerIE.NavFilter.1
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter.1 ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter.1 not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\LinkScannerIE.NavFilter.1
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter.1 ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\LinkScannerIE.NavFilter.1 not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\MicroScanner.MicroScanner
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\MicroScanner.MicroScanner ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\MicroScanner.MicroScanner not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\MicroScanner.MicroScanner
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\MicroScanner.MicroScanner ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\MicroScanner.MicroScanner not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AVGSE.DLL not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2011-04-03 22:57:37,031 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG_TRAY Remove
2011-04-03 22:57:37,031 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG_TRAY is not present
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Run
2011-04-03 22:57:37,031 DEBUG Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG_TRAY Remove
2011-04-03 22:57:37,031 INFO Value SOFTWARE\Microsoft\Windows\CurrentVersion\Run:AVG_TRAY is not present
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\AppID\avgsbg.DLL
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\AppID\avgsbg.DLL ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\AppID\avgsbg.DLL not found
2011-04-03 22:57:37,031 INFO Processing registry SOFTWARE\Classes\AppID\avgsbg.DLL
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\AppID\avgsbg.DLL ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SOFTWARE\Classes\AppID\avgsbg.DLL not found
2011-04-03 22:57:37,031 INFO Processing registry SYSTEM\ControlSet001\Control\GroupOrderList
2011-04-03 22:57:37,031 DEBUG Value SYSTEM\ControlSet001\Control\GroupOrderList:AVG Remove
2011-04-03 22:57:37,031 INFO Value SYSTEM\ControlSet001\Control\GroupOrderList:AVG is not present
2011-04-03 22:57:37,031 INFO Processing registry SYSTEM\ControlSet001\services\Avg
2011-04-03 22:57:37,031 DEBUG Key SYSTEM\ControlSet001\services\Avg ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SYSTEM\ControlSet001\services\Avg not found
2011-04-03 22:57:37,031 INFO Processing registry SYSTEM\ControlSet001\services\Avgfwfd
2011-04-03 22:57:37,031 DEBUG Key SYSTEM\ControlSet001\services\Avgfwfd ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SYSTEM\ControlSet001\services\Avgfwfd not found
2011-04-03 22:57:37,031 INFO Processing registry SYSTEM\ControlSet001\services\AVG Security Toolbar Service
2011-04-03 22:57:37,031 DEBUG Key SYSTEM\ControlSet001\services\AVG Security Toolbar Service ForceRemove
2011-04-03 22:57:37,031 DEBUG Key SYSTEM\ControlSet001\services\AVG Security Toolbar Service not found
2011-04-03 22:57:37,031 INFO Processing registry SYSTEM\ControlSet001\services\Avgfws
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\Avgfws ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\Avgfws not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\AVGIDSAgent
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSAgent ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSAgent not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\AVGIDSDriver
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSDriver ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSDriver not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\AVGIDSEH
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSEH ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSEH not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\AVGIDSFilter
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSFilter ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\AVGIDSFilter not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgldx64
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgldx64 ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgldx64 not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgldx86
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgldx86 ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgldx86 not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgmfx64
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgmfx64 ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgmfx64 not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgmfx86
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgmfx86 ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgmfx86 not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgrkx64
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgrkx64 ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgrkx64 not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgrkx86
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgrkx86 ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgrkx86 not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgtdia
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgtdia ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgtdia not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgtdix
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgtdix ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgtdix not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgwd
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgwd ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgwd not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgfwdx
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgfwdx ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgfwdx not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet001\services\avgfwda
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgfwda ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet001\services\avgfwda not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet002\services\Avg
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet002\services\Avg ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet002\services\Avg not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet002\services\Avgfwfd
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet002\services\Avgfwfd ForceRemove
2011-04-03 22:57:37,046 DEBUG Key SYSTEM\ControlSet002\services\Avgfwfd not found
2011-04-03 22:57:37,046 INFO Processing registry SYSTEM\ControlSet002\services\AVG Security Toolbar Service
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVG Security Toolbar Service ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVG Security Toolbar Service not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\Avgfws
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\Avgfws ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\Avgfws not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSAgent
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSAgent ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSAgent not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSDriver
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSDriver ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSDriver not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSEH
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSEH ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSEH not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSFilter
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSFilter ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSFilter not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgldx64
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgldx64 ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgldx64 not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgldx86
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgldx86 ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgldx86 not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgmfx64
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgmfx64 ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgmfx64 not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgmfx86
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgmfx86 ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgmfx86 not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgrkx64
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgrkx64 ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgrkx64 not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgrkx86
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgrkx86 ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgrkx86 not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgtdia
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgtdia ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgtdia not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgtdix
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgtdix ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgtdix not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgwd
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgwd ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgwd not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgfwdx
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgfwdx ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgfwdx not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\avgfwda
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgfwda ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\avgfwda not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\Avg
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\Avg ForceRemove
2011-04-03 22:57:37,062 DEBUG Key SYSTEM\ControlSet002\services\Avg not found
2011-04-03 22:57:37,062 INFO Processing registry SYSTEM\ControlSet002\services\Avgfwfd
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\Avgfwfd ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\Avgfwfd not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\AVG Security Toolbar Service
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVG Security Toolbar Service ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVG Security Toolbar Service not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\Avgfws
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\Avgfws ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\Avgfws not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSAgent
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSAgent ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSAgent not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSDriver
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSDriver ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSDriver not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSEH
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSEH ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSEH not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\AVGIDSFilter
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSFilter ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\AVGIDSFilter not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgldx64
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgldx64 ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgldx64 not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgldx86
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgldx86 ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgldx86 not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgmfx64
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgmfx64 ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgmfx64 not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgmfx86
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgmfx86 ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgmfx86 not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgrkx64
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgrkx64 ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgrkx64 not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgrkx86
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgrkx86 ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgrkx86 not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgtdia
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgtdia ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgtdia not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgtdix
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgtdix ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgtdix not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\ControlSet002\services\avgwd
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgwd ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\ControlSet002\services\avgwd not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGFWS
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGFWS ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGFWS not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSAGENT
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSAGENT ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSAGENT not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVER not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSEH
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSEH ForceRemove
2011-04-03 22:57:37,078 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSEH not found
2011-04-03 22:57:37,078 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSFILTER
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSFILTER ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSFILTER not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSSHIM
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSSHIM ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSSHIM not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX86
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX86 ForceRemove
2011-04-03 22:57:37,093 WARN Deleting key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX86 failed (error e0010058)
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX86
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX86 ForceRemove
2011-04-03 22:57:37,093 WARN Deleting key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX86 failed (error e0010058)
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX86
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX86 ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX86 not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64 ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGLDX64 not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64 ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGMFX64 not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64 ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGRKX64 not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIX
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIX ForceRemove
2011-04-03 22:57:37,093 WARN Deleting key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIX failed (error e0010058)
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGTDIA not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGWD
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGWD ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGWD not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVG9WD
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVG9WD ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVG9WD not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVERXPX
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVERXPX ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSDRIVERXPX not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSERHRXPX
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSERHRXPX ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSERHRXPX not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSSHIMXPX
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSSHIMXPX ForceRemove
2011-04-03 22:57:37,093 DEBUG Key SYSTEM\CurrentControlSet\Enum\Root\LEGACY_AVGIDSSHIMXPX not found
2011-04-03 22:57:37,093 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGFWS
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGFWS ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGFWS not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSAGENT
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSAGENT ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSAGENT not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVER not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSEH
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSEH ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSEH not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSFILTER
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSFILTER ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSFILTER not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSSHIM
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSSHIM ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSSHIM not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX86
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX86 ForceRemove
2011-04-03 22:57:37,109 WARN Deleting key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX86 failed (error e0010058)
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX86
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX86 ForceRemove
2011-04-03 22:57:37,109 WARN Deleting key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX86 failed (error e0010058)
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX86
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX86 ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX86 not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64 ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGLDX64 not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64 ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGMFX64 not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64 ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGRKX64 not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIX
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIX ForceRemove
2011-04-03 22:57:37,109 WARN Deleting key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIX failed (error e0010058)
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGTDIA not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGWD
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGWD ForceRemove
2011-04-03 22:57:37,109 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGWD not found
2011-04-03 22:57:37,109 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVG9WD
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVG9WD ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVG9WD not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVERXPX
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVERXPX ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSDRIVERXPX not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSERHRXPX
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSERHRXPX ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSERHRXPX not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSSHIMXPX
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSSHIMXPX ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet001\Enum\Root\LEGACY_AVGIDSSHIMXPX not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGFWS
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGFWS ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGFWS not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSAGENT
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSAGENT ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSAGENT not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVER
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVER ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVER not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSEH
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSEH ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSEH not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSFILTER
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSFILTER ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSFILTER not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSSHIM
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSSHIM ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSSHIM not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX86
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX86 ForceRemove
2011-04-03 22:57:37,125 WARN Deleting key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX86 failed (error e0010058)
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX86
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX86 ForceRemove
2011-04-03 22:57:37,125 WARN Deleting key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX86 failed (error e0010058)
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX86
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX86 ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX86 not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX64
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX64 ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGLDX64 not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX64
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX64 ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGMFX64 not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX64
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX64 ForceRemove
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGRKX64 not found
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIX
2011-04-03 22:57:37,125 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIX ForceRemove
2011-04-03 22:57:37,125 WARN Deleting key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIX failed (error e0010058)
2011-04-03 22:57:37,125 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIA
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIA ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGTDIA not found
2011-04-03 22:57:37,140 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGWD
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGWD ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGWD not found
2011-04-03 22:57:37,140 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVG9WD
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVG9WD ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVG9WD not found
2011-04-03 22:57:37,140 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVERXPX
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVERXPX ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSDRIVERXPX not found
2011-04-03 22:57:37,140 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSERHRXPX
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSERHRXPX ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSERHRXPX not found
2011-04-03 22:57:37,140 INFO Processing registry SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSSHIMXPX
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSSHIMXPX ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SYSTEM\ControlSet002\Enum\Root\LEGACY_AVGIDSSHIMXPX not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\Clients
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\Clients ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\Clients not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG8
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG8 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG8 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG9
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG9 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG9 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG10
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG10
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG IDS
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG IDS ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG IDS not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG IDS
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG IDS ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG IDS not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG
2011-04-03 22:57:37,140 DEBUG Value SOFTWARE\AVGumpType Remove
2011-04-03 22:57:37,140 DEBUG Value SOFTWARE\AVGumpType not present - Key not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AvgAdmin10
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AvgAdmin10 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AvgAdmin10 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AvgAdmin10
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AvgAdmin10 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AvgAdmin10 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG Security Toolbar
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG Security Toolbar
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AVG not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG8
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG8 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG8 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG9
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG9 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG9 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG10
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG\AVG10
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG\AVG10 not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG Security Toolbar
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\AVG Security Toolbar
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar ForceRemove
2011-04-03 22:57:37,140 DEBUG Key SOFTWARE\AVG Security Toolbar not found
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks
2011-04-03 22:57:37,140 DEBUG Value SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks:{A3BC75A2-1F87-4686-AA43-5347D756017C} Remove
2011-04-03 22:57:37,140 INFO Value SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks:{A3BC75A2-1F87-4686-AA43-5347D756017C} is not present
2011-04-03 22:57:37,140 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found
2011-04-03 22:57:37,156 INFO Processing registry SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser
2011-04-03 22:57:37,156 DEBUG Value SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser:{CCC7A320-B3CA-4199-B1A6-9F516DD69829} Remove
2011-04-03 22:57:37,156 INFO Value SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser:{CCC7A320-B3CA-4199-B1A6-9F516DD69829} is not present
2011-04-03 22:57:37,156 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found
2011-04-03 22:57:37,156 INFO Processing registry SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3BC75A2-1F87-4686-AA43-5347D756017C}
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3BC75A2-1F87-4686-AA43-5347D756017C} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found
2011-04-03 22:57:37,156 INFO Processing registry SOFTWARE\AppDataLow\Avg
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\AppDataLow\Avg ForceRemove
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\AppDataLow\Avg not found
2011-04-03 22:57:37,156 INFO Processing registry SOFTWARE\AppDataLow\Software\AVG Security Toolbar
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\AppDataLow\Software\AVG Security Toolbar ForceRemove
2011-04-03 22:57:37,156 DEBUG Key SOFTWARE\AppDataLow\Software\AVG Security Toolbar not found
2011-04-03 22:57:37,156 INFO Processing registry .avgdxa
2011-04-03 22:57:37,156 DEBUG Key .avgdxa ForceRemove
2011-04-03 22:57:37,156 DEBUG Key .avgdxa not found
2011-04-03 22:57:37,156 INFO Processing registry aAvgAPI.AvgBro
2011-04-03 22:57:37,156 DEBUG Key aAvgAPI.AvgBro ForceRemove
2011-04-03 22:57:37,156 DEBUG Key aAvgAPI.AvgBro not found
2011-04-03 22:57:37,156 INFO Processing registry AVG.Office
2011-04-03 22:57:37,156 DEBUG Key AVG.Office ForceRemove
2011-04-03 22:57:37,156 DEBUG Key AVG.Office not found
2011-04-03 22:57:37,156 INFO Processing registry AVG.Office.8
2011-04-03 22:57:37,156 DEBUG Key AVG.Office.8 ForceRemove
2011-04-03 22:57:37,156 DEBUG Key AVG.Office.8 not found
2011-04-03 22:57:37,156 INFO Processing registry AvgDiagFile
2011-04-03 22:57:37,156 DEBUG Key AvgDiagFile ForceRemove
2011-04-03 22:57:37,156 DEBUG Key AvgDiagFile not found
2011-04-03 22:57:37,156 INFO Processing registry AvgDiagExFile
2011-04-03 22:57:37,156 DEBUG Key AvgDiagExFile ForceRemove
2011-04-03 22:57:37,156 DEBUG Key AvgDiagExFile not found
2011-04-03 22:57:37,156 INFO Processing registry avgtoolbar.AVGTOOLBAR
2011-04-03 22:57:37,156 DEBUG Key avgtoolbar.AVGTOOLBAR ForceRemove
2011-04-03 22:57:37,156 DEBUG Key avgtoolbar.AVGTOOLBAR not found
2011-04-03 22:57:37,156 INFO Processing registry avgtoolbar.AVGTOOLBARMenu Button
2011-04-03 22:57:37,156 DEBUG Key avgtoolbar.AVGTOOLBARMenu Button ForceRemove
2011-04-03 22:57:37,156 DEBUG Key avgtoolbar.AVGTOOLBARMenu Button not found
2011-04-03 22:57:37,156 INFO Processing registry avgtoolbar.AVGTOOLBARToggle Button
2011-04-03 22:57:37,156 DEBUG Key avgtoolbar.AVGTOOLBARToggle Button ForceRemove
2011-04-03 22:57:37,156 DEBUG Key avgtoolbar.AVGTOOLBARToggle Button not found
2011-04-03 22:57:37,156 INFO Processing registry LinkScannerIE.NavFilter
2011-04-03 22:57:37,156 DEBUG Key LinkScannerIE.NavFilter ForceRemove
2011-04-03 22:57:37,156 DEBUG Key LinkScannerIE.NavFilter not found
2011-04-03 22:57:37,156 INFO Processing registry LinkScannerIE.NavFilter.1
2011-04-03 22:57:37,156 DEBUG Key LinkScannerIE.NavFilter.1 ForceRemove
2011-04-03 22:57:37,156 DEBUG Key LinkScannerIE.NavFilter.1 not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{04373D9C-5ED8-44f2-BA00-7895D6A5A2DA} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{18B30EBF-6B58-425E-AC54-831C05D91B5A}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{18B30EBF-6B58-425E-AC54-831C05D91B5A} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{18B30EBF-6B58-425E-AC54-831C05D91B5A} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{9F97547E-4609-42C5-AE0C-81C61FFAEBC3} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{A057A204-BACC-4D26-9990-79A187E2698E} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{A057A204-BACC-4D26-9990-79A187E2698E} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{A057A204-BACC-4D26-9990-79A187E2698F}
2011-04-03 22:57:37,156 DEBUG Key CLSID\{A057A204-BACC-4D26-9990-79A187E2698F} ForceRemove
2011-04-03 22:57:37,156 DEBUG Key CLSID\{A057A204-BACC-4D26-9990-79A187E2698F} not found
2011-04-03 22:57:37,156 INFO Processing registry CLSID\{A057A204-BACC-4D26-9990-79A187E26990}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{A057A204-BACC-4D26-9990-79A187E26990} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{A057A204-BACC-4D26-9990-79A187E26990} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{F274614C-63F8-47D5-A4D1-FBDDE494F8D1} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{9781B2D1-AF27-474F-A3A5-C0763FBDF3B7}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{9781B2D1-AF27-474F-A3A5-C0763FBDF3B7} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{9781B2D1-AF27-474F-A3A5-C0763FBDF3B7} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{A3BC75A2-1F87-4686-AA43-5347D756017C} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found
2011-04-03 22:57:37,171 INFO Processing registry Interface\{52261B0E-CA1A-4FA9-9805-4D01202DF09D}
2011-04-03 22:57:37,171 DEBUG Key Interface\{52261B0E-CA1A-4FA9-9805-4D01202DF09D} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key Interface\{52261B0E-CA1A-4FA9-9805-4D01202DF09D} not found
2011-04-03 22:57:37,171 INFO Processing registry Interface\{8EA1F9F2-997A-4832-8E09-815E3D0C0A0C}
2011-04-03 22:57:37,171 DEBUG Key Interface\{8EA1F9F2-997A-4832-8E09-815E3D0C0A0C} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key Interface\{8EA1F9F2-997A-4832-8E09-815E3D0C0A0C} not found
2011-04-03 22:57:37,171 INFO Processing registry Interface\{7F24AABF-C822-4C18-9432-21433208F4DC}
2011-04-03 22:57:37,171 DEBUG Key Interface\{7F24AABF-C822-4C18-9432-21433208F4DC} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key Interface\{7F24AABF-C822-4C18-9432-21433208F4DC} not found
2011-04-03 22:57:37,171 INFO Processing registry TypeLib\{3E536428-8E1A-4A2C-8463-4A8F74763C30}
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{3E536428-8E1A-4A2C-8463-4A8F74763C30} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{3E536428-8E1A-4A2C-8463-4A8F74763C30} not found
2011-04-03 22:57:37,171 INFO Processing registry TypeLib\{5DAB1D4C-D020-41CD-936F-D63FF662E9F7}
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{5DAB1D4C-D020-41CD-936F-D63FF662E9F7} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{5DAB1D4C-D020-41CD-936F-D63FF662E9F7} not found
2011-04-03 22:57:37,171 INFO Processing registry TypeLib\{A0C8F0F1-DE25-4ADB-8F0B-508F6CA43DE9}
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{A0C8F0F1-DE25-4ADB-8F0B-508F6CA43DE9} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{A0C8F0F1-DE25-4ADB-8F0B-508F6CA43DE9} not found
2011-04-03 22:57:37,171 INFO Processing registry TypeLib\{CCC7A320-B3CA-4199-B1A6-9F516DD69829}
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key TypeLib\{CCC7A320-B3CA-4199-B1A6-9F516DD69829} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{8B39AD4E-1AB3-4AE1-B533-706F1CACED83}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{8B39AD4E-1AB3-4AE1-B533-706F1CACED83} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{8B39AD4E-1AB3-4AE1-B533-706F1CACED83} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{6E801D47-45B7-4D10-8268-DBBD5C233F82} not found
2011-04-03 22:57:37,171 INFO Processing registry CLSID\{DC182551-99C7-4e28-A8F3-8DCFC4745C4C}
2011-04-03 22:57:37,171 DEBUG Key CLSID\{DC182551-99C7-4e28-A8F3-8DCFC4745C4C} ForceRemove
2011-04-03 22:57:37,171 DEBUG Key CLSID\{DC182551-99C7-4e28-A8F3-8DCFC4745C4C} not found
2011-04-03 22:57:37,171 DEBUG Removing Session Manager values
2011-04-03 22:57:37,171 DEBUG Registry remover failed for some registry item(s)
2011-04-03 22:57:37,171 INFO ***** Files and folders *****
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 0
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 1
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 2
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 3
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 4
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 5
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 6
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 7
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 8
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 9
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 10
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 11
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 12
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 13
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 14
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 15
2011-04-03 22:57:37,171 DEBUG Missing ParentDir path for fileItem number 16
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\Value Plus\Application Data\AVGTOOLBAR'
2011-04-03 22:57:37,171 INFO Directory 'C:\Documents and Settings\Value Plus\Application Data\AVGTOOLBAR' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Start Menu\Programs\avg 8.0'
2011-04-03 22:57:37,171 INFO Directory 'C:\Documents and Settings\All Users\Start Menu\Programs\avg 8.0' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Start Menu\Programs\avg free 8.0'
2011-04-03 22:57:37,171 INFO Directory 'C:\Documents and Settings\All Users\Start Menu\Programs\avg free 8.0' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Start Menu\Programs\avg 8.5'
2011-04-03 22:57:37,171 INFO Directory 'C:\Documents and Settings\All Users\Start Menu\Programs\avg 8.5' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Start Menu\Programs\avg free 8.5'
2011-04-03 22:57:37,171 INFO Directory 'C:\Documents and Settings\All Users\Start Menu\Programs\avg free 8.5' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\avg 8.0.lnk'
2011-04-03 22:57:37,171 INFO File 'C:\Documents and Settings\All Users\Desktop\avg 8.0.lnk' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\avg free 8.0.lnk'
2011-04-03 22:57:37,171 INFO File 'C:\Documents and Settings\All Users\Desktop\avg free 8.0.lnk' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\avg 8.5.lnk'
2011-04-03 22:57:37,171 INFO File 'C:\Documents and Settings\All Users\Desktop\avg 8.5.lnk' not found
2011-04-03 22:57:37,171 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\avg free 8.5.lnk'
2011-04-03 22:57:37,171 INFO File 'C:\Documents and Settings\All Users\Desktop\avg free 8.5.lnk' not found
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 27
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 28
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 29
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 30
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 31
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 32
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 33
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 34
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 35
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 36
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 37
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 38
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 39
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 40
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 41
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 42
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 43
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 44
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 45
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 46
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 47
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 48
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar\Languages'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar\Languages' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar\Update'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar\Update' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar'
2011-04-03 22:57:37,203 DEBUG Directory C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar not deleted (error c0070091)
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\avg 9.0.lnk'
2011-04-03 22:57:37,203 INFO File 'C:\Documents and Settings\All Users\Desktop\avg 9.0.lnk' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\avg free 9.0.lnk'
2011-04-03 22:57:37,203 INFO File 'C:\Documents and Settings\All Users\Desktop\avg free 9.0.lnk' not found
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 55
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 56
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 57
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 58
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 59
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 60
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 61
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 62
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 63
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 64
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 65
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 66
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 67
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 68
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 69
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 70
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 71
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 72
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 73
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 74
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 75
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 76
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 77
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 78
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 79
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 80
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 81
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 82
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 83
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 84
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 85
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 86
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 87
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 88
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 89
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 90
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 91
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 92
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 93
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 94
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 95
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 96
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 97
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 98
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 99
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 100
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 101
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 102
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 103
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 104
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 105
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 106
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 107
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 108
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 109
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 110
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 111
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 112
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 113
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 114
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 115
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 116
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 117
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 118
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 119
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 120
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 121
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 122
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 123
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 124
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 125
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 126
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 127
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 128
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 129
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 130
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 131
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 132
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 133
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 134
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 135
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 136
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 137
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 138
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 139
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 140
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 141
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 142
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 143
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 144
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 145
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 146
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 147
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 148
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 149
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 150
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 151
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 152
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 153
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 154
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 155
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 156
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 157
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 158
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 159
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 160
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 161
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 162
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 163
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 164
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 165
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 166
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 167
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 168
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 169
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 170
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 171
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 172
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 173
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 174
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 175
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 176
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 177
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 178
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 179
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 180
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 181
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 182
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 183
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 184
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 185
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 186
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 187
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 188
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 189
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 190
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 191
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 192
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 193
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 194
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 195
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 196
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 197
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 198
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 199
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 200
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 201
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 202
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 203
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 204
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 205
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32\Drivers\AVG'
2011-04-03 22:57:37,203 INFO Directory 'C:\WINDOWS\System32\Drivers\AVG' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\System32'
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Program Files\Windows Sidebar\Shared Gadgets\AVG.Gadget'
2011-04-03 22:57:37,203 INFO Directory 'C:\Program Files\Windows Sidebar\Shared Gadgets\AVG.Gadget' not found
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 215
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG10\SetupCoreBackup'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Application Data\AVG10\SetupCoreBackup' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG10\SetupBackup'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Application Data\AVG10\SetupBackup' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG10\Chjw'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Application Data\AVG10\Chjw' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG10\Antispam'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Application Data\AVG10\Antispam' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Application Data\AVG10'
2011-04-03 22:57:37,203 DEBUG Directory C:\Documents and Settings\All Users\Application Data\AVG10 not deleted (error c0070091)
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Start Menu\Programs\AVG FREE 2011'
2011-04-03 22:57:37,203 INFO Directory 'C:\Documents and Settings\All Users\Start Menu\Programs\AVG FREE 2011' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk'
2011-04-03 22:57:37,203 INFO File 'C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\Documents and Settings\All Users\Desktop\AVG FREE 2011.lnk'
2011-04-03 22:57:37,203 INFO File 'C:\Documents and Settings\All Users\Desktop\AVG FREE 2011.lnk' not found
2011-04-03 22:57:37,203 DEBUG Processing item 'C:\WINDOWS\SysWOW64\Drivers\AVG'
2011-04-03 22:57:37,203 INFO Directory 'C:\WINDOWS\SysWOW64\Drivers\AVG' not found
2011-04-03 22:57:37,203 DEBUG Missing ParentDir path for fileItem number 226


----------



## Byteman (Jan 24, 2002)

Hi,

Be sure you have settings made so you can see hidden, system and all files.....

If you open Windows Explorer while logged into an admin level user account (and you can try this in Safe Mode, and you can try using the "Administrator" special XP account also, and try to delete any C:\Program Files\Grisoft\AVG folders or the files in them.....you may find they will not go. That was what I ran into on a customer's machine.

If you would like to try editing the Registry > You should make a Restore Point again, before trying anything, just so you have 2 of them.

Start>Run>type in the run space> regedit (and press enter key once)

Registry editor opens.......hit the EDIT tab at the top of that window, then "Find"

type in AVG

Over on the right side, right click and "Delete" the things there for each "Find Next"

(*EXCEPT * AVGeneralNotification.AVGeneralNotifcation entries, there are about six or so......these are not part of the AVG Antivirus program.

Or, anything you are not sure belonged to AVG antivirus. There were very many items, I removed them all even tiny settings bits....

Hit "Find Next" and delete the values on the right side of the editor for each AVG or Grisoft item.

When all that is left is AVG folders delete those in the Registry. Close Registry Editor.

Open Windows Explorer and look for any AVG folders and delete them and files in them.

Then try the installer for a new antivirus program.....like Avast.

Even if you do decide to NOT edit Registry, try installing a new antivirus product. If it fails, you can try the regediting.

Mine went well.

You could try AVG again, I didn't here so I do not know if it would work but I am leaning toward not since it seems to me the
malware damages the system enough to prevent removal of AVG, or the install of other products in an effort to slow down the malware cleaning etc.


----------



## Bozica (Feb 20, 2011)

Hi, I cant use safe mode just boots straight to windows.

I used the regedit option and finally removed it all. Difficult to remove everything so the rest was deleted via files and folder search. It looks like its all gone now. 
I have already downloaded Avast free version ran another scan and all seems ok.


----------



## Byteman (Jan 24, 2002)

OK, you should be fine. Thank you for being patient and great to work with! If and when you feel your problem is soved you can use the "Mark Solved" button at the top to do so. You can still reply here if you need to.


----------



## Bozica (Feb 20, 2011)

Thank you so much for all your help I truly appreciate all your efforts . 
I understand this forum is very busy and I am confident that the Melware is all gone. I can try to sort out other issues and if I get stuck I can post on the XP forum to see if someone can assist over there. If that is ok! Or did you have something else you wanted to check? I just don&#8217;t want to take up too much of your time.
Thank you for your patience it has been great working with you too!


----------



## Byteman (Jan 24, 2002)

OK, I think we are done working on malware. You can start a new thread or let me know right here what the problems are. They may relate to malware...

Here is a bit about fixing the XP Safe Mode booting option:

http://www.d-a-l.com/help/windows-xp-help/39136-i-cant-boot-safe-mode.html

Some OEM systems are not able to do a Repair Install.

EDIT: Also, in the Recovery Console, a few chkdsk /p checkups can go a long way to fixing things like that.....


----------



## Bozica (Feb 20, 2011)

Hi, sorry I&#8217;ve been so busy the last couple of days. I did get a chance to try both options but had no luck at all. Today just before posting here I thought I would give it a try again so stared with the F8 option and low and behold it works, I don&#8217;t get it. The only other thing I did was run a full scan with Avast and it didn&#8217;t find anything so I switch it off until today.
Is there anything else I should check or am I right to start using the computer?


----------



## Byteman (Jan 24, 2002)

Hi, Yes it should be OK to use the computer. Keep your eye on things esepecially accounts, even though you changed the passwords..... you never know. If you changed everything using a clean computer, the phone, etc then all should be OK> but, people do forget things and I know some who used the infected computer to change passwords which failed. 

Sounds like you will be fine!


----------



## Bozica (Feb 20, 2011)

Thanks for that, all is good with the passwords. Thank you again for taking the time to help me out. Much appreciated!


----------



## Bozica (Feb 20, 2011)

Hi, sorry I'm back again.

I don't know what has happened but I couldn't get on the net, all programs were still running however when I tried to connect nothing would happen. I searched for iexplore.exe but nothing came up… So I decide to do an XP system repair. Ok now I have connection but I cant activate XP I am receiving the *Error message when you try to activate Windows XP: "local scripting has been disabled on this computer"
*Activate Windows cannot run because local scripting has been disabled on this computer. Scripting may have been disabled for virus prevention or as a security measure. Once local scripting has been enabled, run Activate Windows again.
Are you able to help please?

Also Adobe Reader 9 wouldnt print PDF's , I was getting the DEP message I noticed this first prior to the IE issue.
That was on XP SP3. ( Now the computer is SP2 due to the repair.)


----------



## Byteman (Jan 24, 2002)

Hi,

This is very common to have happen after malware removal-

try this: http://windowsxp.mvps.org/activescripting.htm


----------



## Bozica (Feb 20, 2011)

I have just tried it again, settings are set. 

I found that option prior to posting back here. I am sorry I should have mentioned that. No luck with it I&#8217;m still getting the same message.


----------



## Byteman (Jan 24, 2002)

Hi, Put the XP installation CD in the drive tray

Use the Start button> clic on the "Run"

In the space type this: cmd (and press the Enter key)

at the command prompt, type: sfc /scannow (there IS one space after sfc just before the /)

let it run, should help fix any files that are not of correct version, missing, etc. Remove XP CD when it finishes.....

Note: System File Checker may or may not prompt you to restart but even if it doesn't, you should restart anyway.

Here is some info about the sfc /scannow feature>>>>

http://www.bleepingcomputer.com/forums/topic43051.html


----------



## Bozica (Feb 20, 2011)

Hi, I have tried that now and I had no luck with it. 
It did do its thing, then I rebooted but the result is still the same. 
During the process the windows repair window popped up prompting for me to do another repair on the system. ( The same window you get when you start the repair, the other process was still running behind it so I closed the repair).
Is there something else I could try or do you think its time to do a clean install? Not that I really wanted to but I cant see any other way to get past this.


----------



## Byteman (Jan 24, 2002)

I have no other things to try so I definitely would do a clean install.


----------



## Bozica (Feb 20, 2011)

Thank you, I too think its time for a clean install. I appreciate all your efforts!
Have a Happy & Safe Easter!


----------

