[RESOLVED] Hijacked browser

Yes! Also I'm getting pop ups now when I visit certain sites. Myspace being a big one!

By the way, I got a few things you need to know. I meant to mention earlier, I do have a Microsoft Visual C++ runtime error problem. Pops up randomly when I browse my folders. It's very random, it could happen today, or maybe a month from now. I've had it for over a year, so I thought I'd let you know in case you're tracing down the wrong file. Sorry for not mentioning it before, I had my focus all on this virus.

Also, before my browsers became hijacked, the virus I had on it previously was AntiVirus Soft aka AntiVirus live, I read that both are the same, just different icon or something. I deleted only the .exe to it, but from all these scans nothing else came up.

Just wanted to let you know that.

OK....one refreshing question, since this thread is pretty long...
Both browsers are getting redirected?
Any particular site(s), they go to?


Please download Sophos Anti-rootkit & save it to your desktop.

IMPORTANT!

• Disconnect from the Internet or physically unplug you Internet cable connection.
• Clean out your temporary files.
• Close all open programs, scheduling/updating tasks and background processes that might activate during the scan including the screensaver.
• Temporarily disable your anti-virus and real-time anti-spyware protection.
• After starting the scan, do not use the computer until the scan has completed.
• When finished, re-enable your anti-virus/anti-malware (or reboot) and then you can reconnect to the Internet.

• Double-click sar_15_sfx.exe to begin the installation, read the license agreement and click Accept.
• Allow the default location of C:\Program Files\Sophos\Sophos Anti-Rootkit and click Install.
• A message will appear "Sophos Anti-Rootkit was successfully installed. Click 'yes' to start it now". Click Yes.
• Make sure the following are checked:
  
  
  • Running processes
  • Windows Registry
  • Local Hard Drives
  
  
  
• Click Start scan.
• Sophos Anti-Rootkit will scan the selected areas and display any suspicious files in the upper panel.
• When the scan is complete, a pop-up screen will appear with "Rootkit Scan Results". Click OK to continue.
• Click on the suspicious file to display more information about it in the lower panel which also includes whether the item is recommended for removal.
  
  
  • Files tagged as Removable: No are not marked for removal and cannot be removed.
  • Files tagged as Removable: Yes (clean up recommended) are marked for removal by default.
  • Files tagged as Removable: Yes (but clean up not recommended) are not marked for removal because Sophos did not recognize them. These files will require further investigation.
  
  
  
• Select only items recommended for removal, then click "Clean up checked items". You will be asked to confirm, click Yes.
• A pop up window will appear advising the cleanup will finish when you restart your computer. Click Restart Now.
• After reboot, a dialog box displays the files you selected for removal and the action taken.
• Click Empty list and then click Continue to re-scan your computer a second time to ensure everything was cleaned.
• When done, go to Start > Run and type or copy/paste: %temp%\sarscan.log
• This should open the log from the rootkit scan. Please post this log in your next reply. If you have a problem, you can find sarscan.log in C:\Documents and Settings\<username>\Local Settings\Temp\

Actually, all 3 of my browsers, including Safari. And no, just random sites still. Sometimes it'll put me in a popular site, sometimes a random I guess spam site?

And ok, I'll post log after this reply.

OK :)

Scan came out clean:( So I'm assuming no log to post.

Hmmm, I hope this problem is fixable!

Download OTL to your Desktop.

* Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
* Under the Custom Scan box paste this in:


netsvcs
&#37;SYSTEMDRIVE%\*.exe
/md5start
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
sceclt.dll
ntelogon.dll
logevent.dll
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
/md5stop
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
%systemroot%\Tasks\*.job /lockedfiles
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
CREATERESTOREPOINT


* Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.

• When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
• Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

Ok, will do this in the morning.

No problem, I'll have more fresh brain too :)

There was no "Extras" log.


OTL logfile created on: 2/13/2010 9:46:17 AM - Run 4
OTL by OldTimer - Version 3.1.28.0 Folder = C:\Users\User\Desktop
Windows Vista Home Premium Edition (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6000.16916)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 55.00&#37; Memory free
4.00 Gb Paging File | 3.00 Gb Available in Paging File | 81.00% Paging File free
Paging file location(s): ?:\pagefile.sys

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 103.54 Gb Total Space | 23.80 Gb Free Space | 22.99% Space Free | Partition Type: NTFS
Drive D: | 8.25 Gb Total Space | 1.50 Gb Free Space | 18.18% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ASK
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Company Name Whitelist: On
Skip Microsoft Files: On
File Age = 14 Days
Output = Standard
Quick Scan

========== Processes (SafeList) ==========

PRC - [2010/02/08 13:23:54 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
PRC - [2009/11/24 18:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009/11/24 18:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009/11/24 18:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009/11/24 18:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009/11/24 18:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009/11/19 10:38:49 | 000,135,664 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe
PRC - [2009/06/04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
PRC - [2009/05/29 12:41:26 | 000,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2008/12/12 11:17:38 | 000,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008/10/29 01:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008/01/02 17:07:08 | 000,141,848 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxtray.exe
PRC - [2008/01/02 17:07:04 | 000,256,536 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxsrvc.exe
PRC - [2008/01/02 17:07:02 | 000,133,656 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxpers.exe
PRC - [2008/01/02 17:06:52 | 000,166,424 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\hkcmd.exe
PRC - [2007/12/10 18:55:26 | 000,323,584 | ---- | M] (PixArt Imaging Incorporation) -- C:\WINDOWS\PixArt\Pac207\Monitor.exe
PRC - [2007/05/16 12:43:04 | 000,677,432 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
PRC - [2007/04/19 15:35:46 | 000,075,304 | ---- | M] (Hewlett-Packard Company) -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe
PRC - [2007/03/01 15:18:36 | 000,472,776 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
PRC - [2007/02/10 04:29:56 | 000,089,968 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
PRC - [2007/01/29 17:23:52 | 000,386,560 | ---- | M] (Conexant Systems, Inc.) -- C:\WINDOWS\System32\drivers\XAudio.exe
PRC - [2007/01/10 18:12:08 | 000,317,128 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
PRC - [2007/01/04 16:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe
PRC - [2006/11/07 15:57:58 | 000,159,744 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\Apoint.exe
PRC - [2006/09/08 10:06:08 | 000,040,960 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApntEx.exe
PRC - [2006/09/08 09:54:30 | 000,042,544 | ---- | M] (Alps Electric Co., Ltd.) -- C:\Program Files\Apoint2K\ApMsgFwd.exe
PRC - [2006/05/02 17:41:28 | 000,135,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe


========== Modules (SafeList) ==========

MOD - [2010/02/08 13:23:54 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
MOD - [2006/11/02 04:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - [2009/11/24 18:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009/11/24 18:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009/11/24 18:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009/11/24 18:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009/11/19 10:38:49 | 000,135,664 | ---- | M] (Google Inc.) [Disabled | Stopped] -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate) Google Update Service (gupdate)
SRV - [2009/10/28 20:21:14 | 000,545,568 | ---- | M] (Apple Inc.) [On_Demand | Stopped] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
SRV - [2009/06/04 19:03:06 | 000,354,840 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009/05/29 12:41:26 | 000,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
SRV - [2008/12/12 11:17:38 | 000,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
SRV - [2008/11/30 15:43:06 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2007/07/02 13:15:45 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2007/04/19 15:35:46 | 000,075,304 | ---- | M] (Hewlett-Packard Company) [Auto | Running] -- C:\Program Files\Common Files\LightScribe\LSSrvc.exe -- (LightScribeService)
SRV - [2007/03/20 16:41:24 | 000,153,792 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe -- (Adobe Version Cue CS3)
SRV - [2007/03/14 14:07:30 | 000,062,984 | ---- | M] (Hewlett-Packard) [Disabled | Stopped] -- C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe -- (HP Health Check Service)
SRV - [2007/03/05 12:30:06 | 000,110,592 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Stopped] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe -- (Com4Qlb)
SRV - [2007/02/17 09:31:12 | 000,074,656 | R--- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr)
SRV - [2007/02/12 11:36:58 | 000,880,640 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe -- (RoxMediaDB9)
SRV - [2007/02/10 04:29:56 | 000,089,968 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2007/02/10 04:29:54 | 029,178,224 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$SONY_MEDIAMGR2) SQL Server (SONY_MEDIAMGR2)
SRV - [2007/02/10 04:29:48 | 000,242,544 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2007/01/29 17:23:52 | 000,386,560 | ---- | M] (Conexant Systems, Inc.) [Auto | Running] -- C:\WINDOWS\System32\drivers\XAudio.exe -- (XAudioService)
SRV - [2007/01/04 16:38:08 | 000,024,652 | ---- | M] (Viewpoint Corporation) [Auto | Running] -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service)
SRV - [2006/11/02 07:36:24 | 000,010,752 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\System32\inetsrv\WMSvc.exe -- (WMSvc)
SRV - [2006/11/02 07:36:19 | 000,322,560 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\WINDOWS\System32\inetsrv\iisw3adm.dll -- (WAS)
SRV - [2006/11/02 07:36:19 | 000,322,560 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\WINDOWS\System32\inetsrv\iisw3adm.dll -- (W3SVC)
SRV - [2006/11/02 07:35:29 | 000,013,312 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\ehome\ehstart.dll -- (ehstart)
SRV - [2006/10/27 00:47:54 | 000,065,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe -- (Microsoft Office Groove Audit Service)
SRV - [2006/10/26 21:49:34 | 000,441,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2006/10/26 16:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
SRV - [2006/05/02 17:41:28 | 000,135,168 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe -- (hpqwmiex)
SRV - [2005/10/14 01:50:20 | 000,045,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper)
SRV - [2005/04/04 00:41:10 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...ARIO&pf=laptop
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ARIO&pf=laptop

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TY...ARIO&pf=laptop
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/02/09 21:40:25 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/02/07 11:01:17 | 000,000,000 | ---D | M]

[2009/06/15 07:59:50 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\mozilla\Extensions
[2009/06/15 07:59:50 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\mozilla\Extensions\[email protected]
[2010/02/12 21:45:35 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\bv5h7rsw.SPEED\extensions
[2009/11/08 12:13:00 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\User\AppData\Roaming\mozilla\Firefox\Profiles\bv5h7rsw.SPEED\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/02/01 20:45:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2007/12/04 20:05:02 | 000,086,016 | ---- | M] (SpiralFrog Inc.) -- C:\Program Files\Mozilla Firefox\plugins\NPSFDMGR.dll

O1 HOSTS File: ([2010/02/11 09:02:07 | 000,000,022 | ---- | M]) - C:\WINDOWS\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Contribute Toolbar) - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe (Alps Electric Co., Ltd.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [PAC207_Monitor] C:\WINDOWS\PixArt\Pac207\Monitor.exe (PixArt Imaging Incorporation)
O4 - HKLM..\Run: [Persistence] C:\WINDOWS\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe (Hewlett-Packard Development Company, L.P.)
O4 - HKLM..\RunOnce: [Launcher] C:\WINDOWS\SMINST\Launcher.exe (soft thinks)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (Sun Microsystems, Inc.)
O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get.../ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jin...ndows-i586.cab (Java Plug-in 1.6.0)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 209.18.47.61 209.18.47.62
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2007/07/02 14:22:45 | 000,000,074 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2005/09/11 10:18:54 | 000,000,340 | -HS- | M] () - D:\AUTOMODE -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\WINDOWS\System32\ias [2006/11/02 06:18:47 | 000,000,000 | ---D | M]
NetSvcs: Irmon - C:\WINDOWS\System32\irmon.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: Wmi - C:\WINDOWS\System32\wmi.dll (Microsoft Corporation)
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
OTL cannot create restorepoints on Vista OSs!

========== Files/Folders - Created Within 14 Days ==========

[2010/02/12 22:53:43 | 000,000,000 | ---D | C] -- C:\Program Files\Sophos
[2010/02/11 14:29:31 | 000,000,000 | ---D | C] -- C:\Users\User\Documents\Documents\Bookmarks
[2010/02/11 13:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Spybot - Search & Destroy
[2010/02/11 13:28:04 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy
[2010/02/11 12:07:02 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\Users\User\Desktop\spybotsd162.exe
[2010/02/11 09:01:14 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2010/02/11 08:59:15 | 000,502,168 | ---- | C] (Enigma Software Group USA, LLC.) -- C:\Users\User\Desktop\SpyHunter-Installer.exe
[2010/02/09 16:28:27 | 000,000,000 | ---D | C] -- C:\Program Files\Intel
[2010/02/09 15:53:57 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\avz4
[2010/02/09 15:40:00 | 000,000,000 | ---D | C] -- C:\Users\User\Desktop\GooredFix Backups
[2010/02/09 15:39:44 | 000,070,858 | ---- | C] (jpshortstuff) -- C:\Users\User\Desktop\GooredFix.exe
[2010/02/09 14:19:50 | 000,000,000 | ---D | C] -- C:\Users\User\AppData\Local\temp
[2010/02/09 14:18:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2010/02/09 14:06:39 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2010/02/09 13:44:42 | 000,000,000 | ---D | C] -- C:\32788R22FWJFW
[2010/02/08 20:09:10 | 000,000,000 | ---D | C] -- C:\_OTM
[2010/02/08 20:07:52 | 000,504,832 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTM.exe
[2010/02/08 13:24:05 | 000,549,376 | ---- | C] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
[2010/02/08 13:01:27 | 000,472,064 | ---- | C] ( ) -- C:\Users\User\Desktop\RootRepeal.exe
[2010/02/08 12:27:39 | 000,044,567 | ---- | C] (jpshortstuff) -- C:\Users\User\Desktop\Kenco.exe
[2010/02/08 12:15:05 | 000,000,000 | ---D | C] -- C:\Program Files\Safari
[2010/02/08 08:47:45 | 000,000,000 | ---D | C] -- C:\Avenger
[2010/02/07 18:56:28 | 000,212,480 | ---- | C] (SteelWerX) -- C:\Windows\SWXCACLS.exe
[2010/02/07 18:56:28 | 000,161,792 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2010/02/07 18:56:28 | 000,136,704 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2010/02/07 18:56:28 | 000,031,232 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2010/02/07 18:56:18 | 000,000,000 | ---D | C] -- C:\Windows\ERDNT
[2010/02/07 18:55:42 | 000,000,000 | ---D | C] -- C:\Qoobox
[2010/02/04 22:22:11 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2010/02/04 12:49:19 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files - Modified Within 14 Days ==========

[2010/02/13 09:45:55 | 005,242,880 | -HS- | M] () -- C:\Users\User\NTUSER.DAT
[2010/02/13 09:44:00 | 000,000,882 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2010/02/13 08:58:13 | 000,738,334 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2010/02/13 08:58:13 | 000,147,444 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2010/02/13 08:58:12 | 000,884,640 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI
[2010/02/13 08:53:24 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010/02/13 08:53:23 | 000,003,072 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010/02/13 08:53:23 | 000,000,878 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2010/02/13 08:53:21 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010/02/13 08:53:06 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010/02/13 08:53:04 | 000,024,576 | ---- | M] () -- C:\Windows\System32\umstartup.etl
[2010/02/13 08:53:02 | 2137,022,464 | -HS- | M] () -- C:\hiberfil.sys
[2010/02/13 00:47:25 | 000,043,008 | ---- | M] () -- C:\Windows\System32\umstartup000.etl
[2010/02/13 00:47:06 | 004,292,402 | -H-- | M] () -- C:\Users\User\AppData\Local\IconCache.db
[2010/02/12 22:39:45 | 001,339,288 | ---- | M] () -- C:\Users\User\Desktop\sar_15_sfx.exe
[2010/02/12 21:54:06 | 000,000,318 | ---- | M] () -- C:\Windows\tasks\HPCeeScheduleForUser.job
[2010/02/12 13:44:27 | 000,002,231 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/02/11 21:55:39 | 000,524,288 | ---- | M] () -- C:\Users\User\Desktop\dds.scr
[2010/02/11 18:26:25 | 000,000,020 | -H-- | M] () -- C:\ProgramData\PKP_DLdu.DAT
[2010/02/11 12:12:43 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\Users\User\Desktop\spybotsd162.exe
[2010/02/11 09:02:07 | 000,000,022 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts
[2010/02/11 08:59:08 | 000,502,168 | ---- | M] (Enigma Software Group USA, LLC.) -- C:\Users\User\Desktop\SpyHunter-Installer.exe
[2010/02/09 15:53:42 | 005,125,238 | ---- | M] () -- C:\Users\User\Desktop\avz4.zip
[2010/02/09 15:39:41 | 000,070,858 | ---- | M] (jpshortstuff) -- C:\Users\User\Desktop\GooredFix.exe
[2010/02/09 14:36:36 | 000,077,312 | ---- | M] () -- C:\Users\User\Desktop\mbr.exe
[2010/02/09 14:08:41 | 000,000,215 | ---- | M] () -- C:\Windows\system.ini
[2010/02/09 13:14:34 | 003,852,379 | R--- | M] () -- C:\Users\User\Desktop\ComboFix.exe
[2010/02/08 23:10:18 | 000,002,281 | ---- | M] () -- C:\Users\Public\Desktop\Safari.lnk
[2010/02/08 20:07:46 | 000,504,832 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTM.exe
[2010/02/08 15:13:11 | 000,001,066 | ---- | M] () -- C:\Users\User\Desktop\GMERlog.zip
[2010/02/08 14:27:24 | 000,293,376 | ---- | M] () -- C:\Users\User\Desktop\6xe97uek.exe
[2010/02/08 13:23:54 | 000,549,376 | ---- | M] (OldTimer Tools) -- C:\Users\User\Desktop\OTL.exe
[2010/02/08 13:01:39 | 000,000,000 | ---- | M] () -- C:\Users\User\Desktop\settings.dat
[2010/02/08 13:00:55 | 000,464,491 | ---- | M] () -- C:\Users\User\Desktop\RootRepeal.zip
[2010/02/08 12:27:27 | 000,044,567 | ---- | M] (jpshortstuff) -- C:\Users\User\Desktop\Kenco.exe
[2010/02/08 08:39:51 | 000,724,952 | ---- | M] () -- C:\Users\User\Desktop\avenger.zip
[2010/02/07 12:13:47 | 000,001,874 | ---- | M] () -- C:\Users\User\Desktop\HijackThis.lnk
[2010/02/07 00:17:09 | 000,241,152 | ---- | M] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010/02/04 08:40:46 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Mbam.lnk
[1 C:\Windows\System32\drivers\*.tmp files -> C:\Windows\System32\drivers\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/02/12 22:39:53 | 001,339,288 | ---- | C] () -- C:\Users\User\Desktop\sar_15_sfx.exe
[2010/02/11 21:56:13 | 000,524,288 | ---- | C] () -- C:\Users\User\Desktop\dds.scr
[2010/02/09 15:53:11 | 005,125,238 | ---- | C] () -- C:\Users\User\Desktop\avz4.zip
[2010/02/08 15:13:11 | 000,001,066 | ---- | C] () -- C:\Users\User\Desktop\GMERlog.zip
[2010/02/08 14:27:26 | 000,293,376 | ---- | C] () -- C:\Users\User\Desktop\6xe97uek.exe
[2010/02/08 13:01:39 | 000,000,000 | ---- | C] () -- C:\Users\User\Desktop\settings.dat
[2010/02/08 13:01:05 | 000,464,491 | ---- | C] () -- C:\Users\User\Desktop\RootRepeal.zip
[2010/02/08 12:15:34 | 000,002,281 | ---- | C] () -- C:\Users\Public\Desktop\Safari.lnk
[2010/02/08 11:52:35 | 000,077,312 | ---- | C] () -- C:\Users\User\Desktop\mbr.exe
[2010/02/08 08:40:50 | 000,731,136 | ---- | C] () -- C:\Users\User\Desktop\avenger.exe
[2010/02/08 08:40:03 | 000,724,952 | ---- | C] () -- C:\Users\User\Desktop\avenger.zip
[2010/02/07 18:56:28 | 000,261,632 | ---- | C] () -- C:\Windows\PEV.exe
[2010/02/07 18:56:28 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2010/02/07 18:56:28 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2010/02/07 18:56:28 | 000,077,312 | ---- | C] () -- C:\Windows\MBR.exe
[2010/02/07 18:56:28 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2010/02/07 18:41:19 | 003,852,379 | R--- | C] () -- C:\Users\User\Desktop\ComboFix.exe
[2010/02/07 12:13:47 | 000,001,874 | ---- | C] () -- C:\Users\User\Desktop\HijackThis.lnk
[2010/02/04 22:24:23 | 000,002,231 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2010/02/04 21:01:07 | 2137,022,464 | -HS- | C] () -- C:\hiberfil.sys
[2010/01/19 13:30:38 | 000,073,728 | ---- | C] () -- C:\Windows\System32\VistaInfo32.dll
[2010/01/13 11:27:15 | 000,000,000 | ---- | C] () -- C:\ProgramData\Project Templates
[2009/08/01 11:25:48 | 000,162,304 | ---- | C] () -- C:\Windows\System32\ztvunrar36.dll
[2009/08/01 11:25:48 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNRAR3.dll
[2009/08/01 11:25:48 | 000,077,312 | ---- | C] () -- C:\Windows\System32\ztvunace26.dll
[2009/08/01 11:25:48 | 000,075,264 | ---- | C] () -- C:\Windows\System32\unacev2.dll
[2009/04/07 19:43:36 | 000,000,268 | RH-- | C] () -- C:\ProgramData\vhosts
[2009/04/07 19:43:36 | 000,000,268 | RH-- | C] () -- C:\Users\User\AppData\Roaming\laserjet
[2009/04/07 19:43:36 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLck.DAT
[2009/04/07 19:43:34 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Roaming\libiconv
[2009/04/07 18:57:49 | 000,000,000 | -H-- | C] () -- C:\ProgramData\PKP_DLbx.DAT
[2009/03/12 18:36:34 | 000,782,336 | ---- | C] () -- C:\Windows\System32\IlmImf.dll
[2009/03/12 18:36:34 | 000,353,280 | ---- | C] () -- C:\Windows\System32\pmtf2.dll
[2009/03/12 18:36:34 | 000,205,824 | ---- | C] () -- C:\Windows\System32\pmtf1.dll
[2009/03/12 18:36:34 | 000,204,288 | ---- | C] () -- C:\Windows\System32\pmtf3.dll
[2009/03/12 18:36:34 | 000,053,248 | ---- | C] () -- C:\Windows\System32\pmexr.dll
[2009/03/12 18:36:34 | 000,011,776 | ---- | C] () -- C:\Windows\System32\pmbm.dll
[2009/03/12 18:36:33 | 000,446,464 | ---- | C] () -- C:\Windows\System32\Photomatix_jpg.dll
[2009/03/12 18:36:33 | 000,266,240 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib.dll
[2009/03/12 18:36:33 | 000,249,856 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib2.dll
[2009/03/12 18:36:33 | 000,167,936 | ---- | C] () -- C:\Windows\System32\Photomatix25Lib3.dll
[2009/02/28 13:49:19 | 000,000,216 | ---- | C] () -- C:\Windows\ViewNX.INI
[2009/02/28 13:42:57 | 000,000,000 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT
[2009/02/28 13:42:57 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Roaming\Rock Kit
[2009/02/28 13:40:47 | 000,000,268 | RH-- | C] () -- C:\ProgramData\Sample Delay
[2009/02/28 13:40:47 | 000,000,268 | RH-- | C] () -- C:\Users\User\AppData\Roaming\Robot
[2009/02/28 13:40:47 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT
[2009/02/28 13:40:47 | 000,000,012 | RH-- | C] () -- C:\ProgramData\Screen Savers
[2009/02/13 22:38:39 | 000,000,097 | ---- | C] () -- C:\Windows\System32\PICSDK.ini
[2009/02/13 22:35:25 | 000,000,044 | ---- | C] () -- C:\Windows\EPSNX400.ini
[2008/11/16 19:04:55 | 000,049,959 | ---- | C] () -- C:\Windows\php.ini
[2008/08/10 09:26:44 | 000,000,324 | ---- | C] () -- C:\Windows\game.ini
[2008/01/13 12:41:37 | 000,000,092 | ---- | C] () -- C:\Users\User\AppData\Local\fusioncache.dat
[2008/01/02 16:57:36 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1409.dll
[2008/01/02 16:47:22 | 001,953,696 | ---- | C] () -- C:\Windows\System32\igklg400.dll
[2008/01/02 16:47:22 | 001,533,360 | ---- | C] () -- C:\Windows\System32\igklg450.dll
[2008/01/02 16:47:22 | 000,104,636 | ---- | C] () -- C:\Windows\System32\igmedcompkrn.dll
[2007/12/29 21:47:52 | 002,463,976 | ---- | C] () -- C:\Windows\System32\NPSWF32.dll
[2007/12/03 20:02:27 | 000,002,106 | ---- | C] () -- C:\Users\User\AppData\Roaming\wklnhst.dat
[2007/12/03 16:11:30 | 000,241,152 | ---- | C] () -- C:\Users\User\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2007/12/02 20:03:39 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Local\QSwitch.txt
[2007/12/02 20:03:39 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Local\DSwitch.txt
[2007/12/02 20:03:39 | 000,000,000 | ---- | C] () -- C:\Users\User\AppData\Local\AtStart.txt
[2007/10/25 22:02:54 | 000,000,566 | ---- | C] () -- C:\Windows\System32\SP207.INI
[2007/08/23 19:30:00 | 000,007,680 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2007/07/02 14:08:26 | 000,001,321 | ---- | C] () -- C:\ProgramData\hpzinstall.log
[2007/05/31 06:14:00 | 000,204,800 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1283.dll
[2007/05/31 05:49:06 | 000,910,464 | ---- | C] () -- C:\Windows\System32\igmedkrn.dll
[2007/03/21 19:58:56 | 000,304,920 | ---- | C] () -- C:\Windows\System32\drivers\iaStor.sys
[2007/02/27 15:43:02 | 000,000,000 | ---- | C] () -- C:\Windows\System32\px.ini
[2006/12/14 01:01:36 | 000,520,192 | ---- | C] () -- C:\Windows\System32\CddbPlaylist2Roxio.dll
[2006/12/14 01:01:36 | 000,204,800 | ---- | C] () -- C:\Windows\System32\CddbFileTaggerRoxio.dll
[2006/11/02 07:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006/11/02 02:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2005/02/28 13:33:00 | 000,343,040 | R--- | C] () -- C:\Windows\System32\lffpx7.dll
[2005/02/28 13:33:00 | 000,116,736 | R--- | C] () -- C:\Windows\System32\lfkodak.dll
[2004/03/26 08:56:40 | 000,017,191 | ---- | C] () -- C:\Windows\System32\lvcoinst.ini
[2004/01/08 09:30:22 | 000,011,170 | ---- | C] () -- C:\Windows\System32\PA207USD.DLL
[1996/04/03 14:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys

========== LOP Check ==========

[2008/12/19 08:57:36 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\BonkEnc
[2008/10/20 12:39:22 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\cmw
[2009/10/01 10:59:59 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2008/01/01 17:25:12 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\COWON
[2008/11/30 13:30:00 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\DAEMON Tools
[2009/03/09 08:16:25 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\ExpressDigital
[2009/07/09 17:04:15 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\gtk-2.0
[2009/04/10 09:47:04 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\IrfanView
[2009/02/13 22:43:18 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Leadertech
[2009/09/04 07:57:46 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\MSNInstaller
[2009/04/07 19:43:41 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Nikon
[2009/07/09 17:02:16 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Participatory Culture Foundation
[2009/07/09 17:04:17 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\PCF-VLC
[2008/10/28 20:25:15 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Publish Providers
[2010/01/11 21:20:36 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Red Kawa
[2008/02/16 11:43:01 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\RTPlayer
[2007/12/03 20:02:31 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\Template
[2010/02/05 15:18:26 | 000,000,000 | ---D | M] -- C:\Users\User\AppData\Roaming\uTorrent
[2010/02/13 00:47:14 | 000,032,642 | ---- | M] () -- C:\WINDOWS\Tasks\SCHEDLGU.TXT

========== Purity Check ==========



========== Custom Scans ==========

< &#37;SYSTEMDRIVE%\*.exe >


< MD5 for: AGP440.SYS >
[2008/01/19 02:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\WINDOWS\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2007/07/02 14:31:31 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=313FF294978EA6AF715722D708FB249F -- C:\WINDOWS\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.20494_none_b858f78adaed51b3\AGP440.sys
[2007/07/02 14:31:31 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=CE71AFD6738AA025D742CDBCFBDC8B9C -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_f2490cb0\AGP440.sys
[2007/07/02 14:31:31 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=CE71AFD6738AA025D742CDBCFBDC8B9C -- C:\WINDOWS\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6000.16399_none_b7d45c31c1cb309c\AGP440.sys
[2006/11/02 04:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\ERDNT\cache\AGP440.sys
[2006/11/02 04:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\System32\drivers\AGP440.sys
[2006/11/02 04:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\WINDOWS\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys

< MD5 for: ATAPI.SYS >
[2008/01/19 02:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\WINDOWS\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006/11/02 04:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2008/02/14 19:53:56 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\ERDNT\cache\atapi.sys
[2008/02/14 19:53:56 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\System32\drivers\atapi.sys
[2008/02/14 19:53:56 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2008/02/14 19:53:56 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2008/02/14 19:53:22 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\WINDOWS\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys

< MD5 for: CNGAUDIT.DLL >
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\ERDNT\cache\cngaudit.dll
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\System32\cngaudit.dll
[2006/11/02 04:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\WINDOWS\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll

< MD5 for: IASTOR.SYS >
[2009/06/04 18:54:36 | 000,408,600 | ---- | M] (Intel Corporation) MD5=1D004CB1DA6323B1F55CAEF7F94B61D9 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver64\IaStor.sys
[2007/03/21 19:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\SwSetup\HDD\iastor.sys
[2007/03/21 19:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\System32\DriverStore\FileRepository\iaahci.inf_3a63e5a6\iaStor.sys
[2007/03/21 19:58:56 | 000,304,920 | ---- | M] (Intel Corporation) MD5=997E8F5939F2D12CD9F2E6B395724C16 -- C:\WINDOWS\System32\DriverStore\FileRepository\iastor.inf_5f6e7be5\iaStor.sys
[2009/06/04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\driver\IaStor.sys
[2009/06/04 18:43:16 | 000,330,264 | ---- | M] (Intel Corporation) MD5=D483687EACE0C065EE772481A96E05F5 -- C:\WINDOWS\System32\DriverStore\FileRepository\iaahci.inf_0813ee45\iaStor.sys
[2007/03/21 19:58:56 | 000,304,920 | ---- | M] () Unable to obtain MD5 -- C:\WINDOWS\System32\drivers\iaStor.sys

< MD5 for: IASTORV.SYS >
[2008/01/19 02:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\WINDOWS\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\WINDOWS\System32\drivers\iaStorV.sys
[2006/11/02 04:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\WINDOWS\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys

< MD5 for: NETLOGON.DLL >
[2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\WINDOWS\ERDNT\cache\netlogon.dll
[2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\WINDOWS\System32\netlogon.dll
[2006/11/02 04:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\WINDOWS\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2008/01/19 02:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\WINDOWS\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll

< MD5 for: NVSTOR.SYS >
[2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\WINDOWS\System32\drivers\nvstor.sys
[2006/11/02 04:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\WINDOWS\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008/01/19 02:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\WINDOWS\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys

< MD5 for: SCECLI.DLL >
[2008/01/19 02:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\WINDOWS\SoftwareDistribution\Download\a58fa8f1a78b89e6c2a670e288053b8b\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\WINDOWS\ERDNT\cache\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\WINDOWS\System32\scecli.dll
[2006/11/02 04:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\WINDOWS\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll

< %systemroot%\*. /mp /s >

< %systemroot%\system32\*.dll /lockedfiles >
[2006/11/02 04:47:18 | 000,228,968 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\rsaenh.dll
[2007/12/04 08:42:23 | 000,223,232 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\SLC.dll

< %systemroot%\Tasks\*.job /lockedfiles >

< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2007/03/21 19:58:56 | 000,304,920 | ---- | M] (Intel Corporation) Unable to obtain MD5 -- C:\WINDOWS\System32\drivers\iaStor.sys
[1 C:\Windows\system32\drivers\*.tmp files -> C:\Windows\system32\drivers\*.tmp -> ]

< %systemroot%\System32\config\*.sav >
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\config\COMPONENTS.SAV
[2006/11/02 05:34:05 | 000,020,480 | ---- | M] () -- C:\WINDOWS\System32\config\DEFAULT.SAV
[2006/11/02 05:34:05 | 000,008,192 | ---- | M] () -- C:\WINDOWS\System32\config\SECURITY.SAV
[2006/11/02 05:34:08 | 010,133,504 | ---- | M] () -- C:\WINDOWS\System32\config\SOFTWARE.SAV
[2006/11/02 05:34:08 | 001,826,816 | ---- | M] () -- C:\WINDOWS\System32\config\SYSTEM.SAV

========== Alternate Data Streams ==========

@Alternate Data Stream - 134 bytes -> C:\ProgramData\TEMP:CB0AACC9
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:888AFB86
< End of report >

I still need Extras.txt log.

Unless you installed Viewpoint Manager knowledgeably...
Go Start>Control Panel>Add\Remove (Programs and Features in Vista), and...
Uninstall any of the following programs associated with Viewpoint:
* Viewpoint Manager
* Viewpoint Media Player
* Viewpoint Toolbar
This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware ("drive-by-install") as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.

Please download ComboFix from Here or Here to your Desktop.


**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

• Please, never rename Combofix unless instructed.
• Close any open browsers.
• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
• Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

NOTE 1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

• Close any open browsers.
• WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
• Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
• If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
• Double click on combofix.exe & follow the prompts.
• When finished, it will produce a report for you.
• Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

Make sure, you re-enable your security programs, when you're done with Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Did it generate an Extras log? I can't find one.

That viewpoint manager, I uninstalled it a couple days ago, is it still showing on my computer?

And about the Combofix, should I uninstall the one I have now? then re-install that one? if so, how do I uninstall it?

Uninstall Combofix:
Go Start > Run [Vista users, go Start>"Start search"]
Type in:
Combofix /Uninstall
Note the space between the "Combofix" and the "/Uninstall"
Click OK (Vista users - press Enter).
Restart computer.

ComboFix 10-02-12.01 - User 02/13/2010 13:19:19.5.2 - x86
Microsoft&#174; Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2037.1227 [GMT -5:00]
Running from: c:\users\User\Desktop\ComboFix.exe
AV: avast! antivirus 4.8.1368 [VPS 100213-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1368 [VPS 100213-1] *disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.

2010-02-13 18:31 . 2010-02-13 18:31 -------- d-----w- c:\users\User\AppData\Local\temp
2010-02-13 18:31 . 2010-02-13 18:31 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-02-13 18:31 . 2010-02-13 18:31 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-02-13 18:31 . 2010-02-13 18:31 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-02-13 18:31 . 2010-02-13 18:31 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-13 18:11 . 2010-02-13 18:17 -------- d-----w- C:\32788R22FWJFW
2010-02-13 03:53 . 2010-02-13 03:53 -------- d-----w- c:\program files\Sophos
2010-02-11 18:28 . 2010-02-12 18:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-11 18:28 . 2010-02-12 18:46 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-11 14:01 . 2010-02-12 18:46 -------- d-----w- c:\program files\Enigma Software Group
2010-02-09 21:28 . 2010-02-09 21:34 -------- d-----w- c:\program files\Intel
2010-02-09 01:09 . 2010-02-09 01:09 -------- d-----w- C:\_OTM
2010-02-08 17:15 . 2010-02-08 17:15 -------- d-----w- c:\program files\Safari
2010-02-07 04:55 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2010-02-07 04:55 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2010-02-07 04:55 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2010-02-07 04:55 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2010-02-07 04:55 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2010-02-07 04:55 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2010-02-07 04:55 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2010-02-07 04:54 . 2009-08-07 00:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2010-02-07 04:54 . 2009-08-06 23:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2010-02-05 03:22 . 2010-02-05 03:24 -------- d-----w- c:\program files\iTunes
2010-02-04 17:49 . 2010-02-04 17:49 -------- d-----w- c:\program files\Trend Micro
2010-01-20 18:14 . 2010-01-20 18:14 -------- d-----w- c:\program files\RFA
2010-01-20 17:23 . 2010-02-11 19:26 -------- d-----w- c:\programdata\RFA_Backups
2010-01-19 18:30 . 2010-01-19 18:30 8704 ----a-w- c:\windows\system32\SpOrder.dll
2010-01-19 18:30 . 2010-01-19 18:30 73728 ----a-w- c:\windows\system32\VistaInfo32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-11 23:26 . 2009-02-28 18:40 20 ---h--w- c:\programdata\PKP_DLdu.DAT
2010-02-09 21:28 . 2007-07-02 17:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-08 15:57 . 2009-04-17 13:50 117760 ----a-w- c:\users\User\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-07 17:12 . 2007-07-02 18:53 -------- d-----w- c:\programdata\Microsoft Help
2010-02-05 20:18 . 2008-10-29 00:15 -------- d-----w- c:\users\User\AppData\Roaming\uTorrent
2010-02-05 03:22 . 2007-12-05 23:45 -------- d-----w- c:\program files\iPod
2010-02-05 03:22 . 2007-12-06 00:04 -------- d-----w- c:\program files\Common Files\Apple
2010-02-04 19:41 . 2007-12-05 21:41 -------- d-----w- c:\program files\Viewpoint
2010-02-04 13:40 . 2009-04-19 14:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-03 17:02 . 2008-11-26 15:20 -------- d-----w- c:\program files\QuickTime
2010-02-01 20:30 . 2010-01-04 14:25 52224 ----a-w- c:\users\User\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-26 00:07 . 2009-07-23 12:34 335872 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-01-26 00:06 . 2009-02-28 18:41 -------- d-----w- c:\program files\Common Files\Nikon
2010-01-26 00:05 . 2003-03-19 02:05 106496 ----a-w- c:\windows\system32\ATL71.DLL
2010-01-22 00:12 . 2009-06-26 13:07 -------- d-----w- c:\program files\DivX
2010-01-21 16:21 . 2008-01-13 00:58 210928 ---ha-w- c:\windows\system32\mlfcache.dat
2010-01-20 17:21 . 2010-01-06 15:13 -------- d-----w- c:\program files\MyDefrag v4.2.7
2010-01-14 16:12 . 2009-10-24 06:25 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 16:27 . 2009-04-07 23:57 0 ---h--w- c:\programdata\PKP_DLbx.DAT
2010-01-13 16:19 . 2007-12-03 01:03 128952 ----a-w- c:\users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-13 14:25 . 2007-12-10 22:29 -------- d-----w- c:\program files\Intuit
2010-01-13 14:22 . 2007-12-10 22:29 -------- d-----w- c:\program files\Common Files\Intuit
2010-01-13 14:12 . 2010-01-13 14:12 38878288 ----a-w- c:\users\User\AppData\Roaming\Nikon\Message Center\DOWNLOAD_LOG\14716\S-CNX2__-222WU-___EN.exe
2010-01-13 14:08 . 2010-01-13 14:08 38986384 ----a-w- c:\users\User\AppData\Roaming\Nikon\Message Center\DOWNLOAD_LOG\14919\S-CNX2__-223WU-___EN.exe
2010-01-13 00:58 . 2008-12-20 16:42 -------- d-----w- c:\program files\Google
2010-01-12 02:20 . 2009-06-26 12:35 -------- d-----w- c:\users\User\AppData\Roaming\Red Kawa
2010-01-07 21:07 . 2009-04-19 14:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-04-19 14:59 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 19:29 . 2008-11-02 14:20 -------- d-----w- c:\program files\CCleaner
2010-01-06 16:56 . 2009-04-19 02:46 -------- d-----w- c:\program files\SpeedFan
2010-01-06 02:24 . 2007-07-02 18:32 -------- d-----w- c:\programdata\Roxio
2010-01-04 14:26 . 2009-05-31 14:38 5061520 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-26 16:08 . 2009-12-26 16:08 658184 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-25 16:57 . 2007-12-10 01:15 -------- d-----w- c:\users\User\AppData\Roaming\Roxio
2009-11-24 23:54 . 2009-10-12 15:09 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:49 . 2009-10-12 15:09 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-10-12 15:09 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-10-12 15:09 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-04-18 16:52 . 2009-04-18 16:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( SnapShot@2010-02-08_00.11.05 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-04-17 14:41 . 2008-01-19 07:33 72704 c:\windows\winsxs\x86_microsoft-windows-ie-adminkitmostfiles_31bf3856ad364e35_6.0.6001.18385_none_ade0a99107023f3c\admparse.dll
+ 2009-08-06 01:55 . 2009-04-11 06:28 64512 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18167_none_03958f7b9f23b4ad\WininetPlugin.dll
+ 2009-08-06 01:55 . 2009-04-11 06:28 27648 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6002.18167_none_03958f7b9f23b4ad\jsproxy.dll
+ 2008-04-09 13:58 . 2008-02-22 05:01 64512 c:\windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_6.0.6001.18385_none_01977b41a20f6796\WininetPlugin.dll
+ 2009-08-06 01:55 . 2009-06-15 14:52 23552 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18124_none_aba7f34857b9444a\lpk.dll
+ 2009-08-06 01:55 . 2009-06-15 14:51 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18124_none_aba7f34857b9444a\dciman32.dll
+ 2009-08-06 01:55 . 2009-04-11 06:28 34304 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18124_none_aba7f34857b9444a\atmlib.dll
+ 2009-08-06 01:55 . 2008-01-19 07:34 23552 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18344_none_a9abdfa25aa329e1\lpk.dll
+ 2009-08-06 01:55 . 2009-06-15 15:20 10240 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18344_none_a9abdfa25aa329e1\dciman32.dll
+ 2007-07-02 18:07 . 2010-02-13 18:05 68762 c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2006-11-02 13:05 . 2010-02-13 18:05 70218 c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2007-12-03 00:58 . 2010-02-13 18:05 12724 c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3095095602-4275134223-639891559-1000_UserData.bin
+ 2007-12-03 00:54 . 2010-02-13 18:03 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2007-12-03 00:54 . 2010-02-07 23:50 16384 c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-02-09 04:16 . 2010-02-13 18:03 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-03 00:54 . 2010-02-07 23:50 32768 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2007-12-03 00:54 . 2010-02-07 23:50 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2007-12-03 00:54 . 2010-02-13 18:03 16384 c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-02-13 18:03 . 2010-02-13 18:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2010-02-07 23:26 . 2010-02-07 23:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-02-13 18:03 . 2010-02-13 18:03 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-02-07 23:26 . 2010-02-07 23:48 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-08-14 13:48 . 2008-01-19 07:34 180736 c:\windows\winsxs\x86_microsoft-windows-ieframe_31bf3856ad364e35_6.0.6001.18385_none_6450f463ae5b5ef9\ieui.dll
+ 2008-10-15 12:40 . 2008-01-19 07:36 129536 c:\windows\winsxs\x86_microsoft-windows-ie-runtimeutilities_31bf3856ad364e35_6.0.6001.18385_none_4752321d8cc085f3\sqmapi.dll
+ 2009-08-06 01:55 . 2009-06-15 12:42 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6002.18124_none_aba7f34857b9444a\atmfd.dll
+ 2009-08-06 01:55 . 2009-06-15 12:52 289792 c:\windows\winsxs\x86_microsoft-windows-gdi_31bf3856ad364e35_6.0.6001.18344_none_a9abdfa25aa329e1\atmfd.dll
+ 2010-02-09 21:28 . 2009-06-04 23:43 330264 c:\windows\System32\DriverStore\FileRepository\iaahci.inf_0813ee45\iaStor.sys
- 2007-07-02 17:48 . 2006-11-10 21:25 319456 c:\windows\System32\difxapi.dll
+ 2007-07-02 17:48 . 2006-11-10 14:25 319456 c:\windows\System32\difxapi.dll
+ 2007-12-04 13:53 . 2010-02-08 16:03 262144 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2007-12-04 13:53 . 2010-02-07 05:15 262144 c:\windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2007-12-04 13:52 . 2010-02-08 16:02 262144 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
- 2007-12-04 13:52 . 2010-02-07 05:15 262144 c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\usrclass.dat
+ 2010-02-08 17:15 . 2010-02-08 17:15 307200 c:\windows\Installer\{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}\SafariIco.exe
+ 2009-08-06 01:55 . 2009-06-18 06:56 2452872 c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6002.22290_none_fda0dd56824b713c\ieapfltr.dat
+ 2009-08-06 01:55 . 2009-06-18 06:56 2452872 c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6002.18167_none_fd3eb255690f2f00\ieapfltr.dat
+ 2009-08-06 01:55 . 2009-06-18 06:56 2452872 c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6001.22585_none_fbca3ccc85187eda\ieapfltr.dat
+ 2009-08-06 01:55 . 2009-06-18 06:56 2452872 c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6001.18385_none_fb409e1b6bfae1e9\ieapfltr.dat
+ 2009-08-06 01:55 . 2009-06-18 06:56 2452872 c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.21184_none_f9e2d41887f30aad\ieapfltr.dat
+ 2009-08-06 01:55 . 2009-06-18 06:56 2452872 c:\windows\winsxs\x86_microsoft-windows-ie-antiphishfilter_31bf3856ad364e35_6.0.6000.16982_none_f9575e976ed704f3\ieapfltr.dat
+ 2010-02-08 17:15 . 2010-02-08 17:15 2449408 c:\windows\Installer\bdd0eb.msi
+ 2008-02-16 13:45 . 2010-02-09 22:37 250922870 c:\windows\winsxs\ManifestCache\6.0.6001.18000_001c50b5_blobs.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
backup=c:\windows\pss\Nikon Monitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 02:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-19 15:38 135664 ----atw- c:\program files\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 05:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 18:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-05 00:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 01:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2009-05-29 21:58 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-06-11 15:57 184320 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-03-29 00:45 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r***ent]
2009-10-21 17:58 916304 ----a-w- c:\program files\RFA\r***ent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2007-03-23 21:23 86016 ----a-w- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-09 13:12 1232896 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-02 19:45 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-03-23 18:07 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2007-07-02 18:15 1006264 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [10/12/2009 10:09 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [3/23/2009 1:07 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [3/23/2009 1:07 PM 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [10/12/2009 10:09 AM 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [10/12/2009 10:09 AM 53328]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [12/5/2007 4:43 PM 24652]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [11/30/2008 1:30 PM 717296]
S3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\System32\drivers\lmvac.sys [12/18/2008 7:13 PM 18912]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/10/2007 4:29 AM 29178224]
S3 PAC207;PC Camer@;c:\windows\System32\drivers\PFC027.SYS [2/13/2008 4:17 PM 618112]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [3/23/2009 1:07 PM 7408]
S3 WMSvc;Web Management Service;c:\windows\System32\inetsrv\WMSvc.exe [11/2/2006 7:36 AM 10752]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/19/2009 10:38 AM 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 15:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-19 15:38]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-19 15:38]

2010-02-13 c:\windows\Tasks\HPCeeScheduleForUser.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-07-02 21:23]
.
.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
uInternet Settings,ProxyOverride = <local>
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bv5h7rsw.SPEED\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 13:31
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys >>UNKNOWN [0x8635B8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87faed1f
\Driver\ACPI -> acpi.sys @ 0x804439d6
\Driver\atapi -> ataport.SYS @ 0x806619c6
\Driver\iaStor -> iaStor.sys @ 0x87b7d6c8
IoDeviceObjectType -> SecurityProcedure -> ntkrnlpa.exe @ 0x81d95467
\Device\Harddisk0\DR0 -> SecurityProcedure -> ntkrnlpa.exe @ 0x81d95467
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\9240.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(3508)
c:\program files\HP\QuickPlay\Kernel\Movie\CLDemuxer.ax
c:\program files\PixiePack Codec Pack\MP4Splitter.ax
c:\windows\system32\RealMediaSplitter.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2dsh264.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2h264dec.dll
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2h264dec.004
c:\program files\PixiePack Codec Pack\FLVSplitter.ax
c:\program files\Common Files\Roxio Shared\9.0\MPEG\RoxioMPEGDemuxer.dll
c:\program files\HP\QuickPlay\Kernel\DMP\CLWMFDemux.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mcdsmpeg.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mcmpgdec.dll
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mcspmpeg.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mpegin.dll
c:\program files\Common Files\Nikon\MPEG\nikondsmpeg.ax
c:\program files\Common Files\Nikon\MPEG\nikonmpgdec.dll
.
Completion time: 2010-02-13 13:37:20
ComboFix-quarantined-files.txt 2010-02-13 18:37
ComboFix2.txt 2010-02-09 19:19
ComboFix3.txt 2010-02-09 17:41
ComboFix4.txt 2010-02-08 04:27
ComboFix5.txt 2010-02-13 18:17

Pre-Run: 25,433,657,344 bytes free
Post-Run: 25,311,981,568 bytes free

- - End Of File - - CA0E1CDAE3ECF849715F8383F4A4E6CF

1. Please open Notepad

• Click Start , then Run
• Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Code:

---

KillAll::

File::

Folder::
c:\program files\Viewpoint

Driver::
"Viewpoint Manager Service"

Registry::

RegLockDel::

MBR::

---

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

https://discussions.virtualdr.com/im.../2016/03/2.gif


5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

• Combofix.txt
• A new HijackThis log.

ComboFix 10-02-12.01 - User 02/13/2010 14:40:25.6.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2037.1210 [GMT -5:00]
Running from: c:\users\User\Desktop\ComboFix.exe
Command switches used :: c:\users\User\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1368 [VPS 100213-1] *On-access scanning disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: avast! antivirus 4.8.1368 [VPS 100213-1] *disabled* (Updated) {7591DB91-41F0-48A3-B128-1A293FD8233D}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Viewpoint
c:\program files\Viewpoint\Common\ViewpointService.exe
c:\program files\Viewpoint\Common\VistaBoot.sdll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Viewpoint Manager Service


((((((((((((((((((((((((( Files Created from 2010-01-13 to 2010-02-13 )))))))))))))))))))))))))))))))
.

2010-02-13 19:53 . 2010-02-13 19:55 -------- d-----w- c:\users\User\AppData\Local\temp
2010-02-13 19:53 . 2010-02-13 19:53 -------- d-----w- c:\users\Public\AppData\Local\temp
2010-02-13 19:53 . 2010-02-13 19:53 -------- d-----w- c:\users\Mcx2\AppData\Local\temp
2010-02-13 19:53 . 2010-02-13 19:53 -------- d-----w- c:\users\Mcx1\AppData\Local\temp
2010-02-13 19:53 . 2010-02-13 19:53 -------- d-----w- c:\users\Default\AppData\Local\temp
2010-02-13 19:30 . 2010-02-13 19:35 -------- d-----w- C:\32788R22FWJFW
2010-02-13 03:53 . 2010-02-13 03:53 -------- d-----w- c:\program files\Sophos
2010-02-11 18:28 . 2010-02-12 18:46 -------- d-----w- c:\program files\Spybot - Search & Destroy
2010-02-11 18:28 . 2010-02-12 18:46 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-02-11 14:01 . 2010-02-12 18:46 -------- d-----w- c:\program files\Enigma Software Group
2010-02-09 21:28 . 2010-02-09 21:34 -------- d-----w- c:\program files\Intel
2010-02-09 01:09 . 2010-02-09 01:09 -------- d-----w- C:\_OTM
2010-02-08 17:15 . 2010-02-08 17:15 -------- d-----w- c:\program files\Safari
2010-02-07 04:55 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2010-02-07 04:55 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2010-02-07 04:55 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2010-02-07 04:55 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2010-02-07 04:55 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2010-02-07 04:55 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2010-02-07 04:55 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2010-02-07 04:54 . 2009-08-07 00:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2010-02-07 04:54 . 2009-08-06 23:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2010-02-05 03:22 . 2010-02-05 03:24 -------- d-----w- c:\program files\iTunes
2010-02-04 17:49 . 2010-02-04 17:49 -------- d-----w- c:\program files\Trend Micro
2010-01-20 18:14 . 2010-01-20 18:14 -------- d-----w- c:\program files\RFA
2010-01-20 17:23 . 2010-02-11 19:26 -------- d-----w- c:\programdata\RFA_Backups
2010-01-19 18:30 . 2010-01-19 18:30 8704 ----a-w- c:\windows\system32\SpOrder.dll
2010-01-19 18:30 . 2010-01-19 18:30 73728 ----a-w- c:\windows\system32\VistaInfo32.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-02-13 18:56 . 2009-04-17 13:50 117760 ----a-w- c:\users\User\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2010-02-11 23:26 . 2009-02-28 18:40 20 ---h--w- c:\programdata\PKP_DLdu.DAT
2010-02-09 21:28 . 2007-07-02 17:53 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-02-07 17:12 . 2007-07-02 18:53 -------- d-----w- c:\programdata\Microsoft Help
2010-02-05 20:18 . 2008-10-29 00:15 -------- d-----w- c:\users\User\AppData\Roaming\uTorrent
2010-02-05 03:22 . 2007-12-05 23:45 -------- d-----w- c:\program files\iPod
2010-02-05 03:22 . 2007-12-06 00:04 -------- d-----w- c:\program files\Common Files\Apple
2010-02-04 13:40 . 2009-04-19 14:59 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-02-03 17:02 . 2008-11-26 15:20 -------- d-----w- c:\program files\QuickTime
2010-02-01 20:30 . 2010-01-04 14:25 52224 ----a-w- c:\users\User\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2010-01-26 00:07 . 2009-07-23 12:34 335872 ----a-r- c:\users\User\AppData\Roaming\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-01-26 00:06 . 2009-02-28 18:41 -------- d-----w- c:\program files\Common Files\Nikon
2010-01-26 00:05 . 2003-03-19 02:05 106496 ----a-w- c:\windows\system32\ATL71.DLL
2010-01-22 00:12 . 2009-06-26 13:07 -------- d-----w- c:\program files\DivX
2010-01-21 16:21 . 2008-01-13 00:58 210928 ---ha-w- c:\windows\system32\mlfcache.dat
2010-01-20 17:21 . 2010-01-06 15:13 -------- d-----w- c:\program files\MyDefrag v4.2.7
2010-01-14 16:12 . 2009-10-24 06:25 181120 ------w- c:\windows\system32\MpSigStub.exe
2010-01-13 16:27 . 2009-04-07 23:57 0 ---h--w- c:\programdata\PKP_DLbx.DAT
2010-01-13 16:19 . 2007-12-03 01:03 128952 ----a-w- c:\users\User\AppData\Local\GDIPFONTCACHEV1.DAT
2010-01-13 14:25 . 2007-12-10 22:29 -------- d-----w- c:\program files\Intuit
2010-01-13 14:22 . 2007-12-10 22:29 -------- d-----w- c:\program files\Common Files\Intuit
2010-01-13 14:12 . 2010-01-13 14:12 38878288 ----a-w- c:\users\User\AppData\Roaming\Nikon\Message Center\DOWNLOAD_LOG\14716\S-CNX2__-222WU-___EN.exe
2010-01-13 14:08 . 2010-01-13 14:08 38986384 ----a-w- c:\users\User\AppData\Roaming\Nikon\Message Center\DOWNLOAD_LOG\14919\S-CNX2__-223WU-___EN.exe
2010-01-13 00:58 . 2008-12-20 16:42 -------- d-----w- c:\program files\Google
2010-01-12 02:20 . 2009-06-26 12:35 -------- d-----w- c:\users\User\AppData\Roaming\Red Kawa
2010-01-07 21:07 . 2009-04-19 14:59 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-07 21:07 . 2009-04-19 14:59 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 19:29 . 2008-11-02 14:20 -------- d-----w- c:\program files\CCleaner
2010-01-06 16:56 . 2009-04-19 02:46 -------- d-----w- c:\program files\SpeedFan
2010-01-06 02:24 . 2007-07-02 18:32 -------- d-----w- c:\programdata\Roxio
2010-01-04 14:26 . 2009-05-31 14:38 5061520 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-12-26 16:08 . 2009-12-26 16:08 658184 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-25 16:57 . 2007-12-10 01:15 -------- d-----w- c:\users\User\AppData\Roaming\Roxio
2009-11-24 23:54 . 2009-10-12 15:09 1280480 ----a-w- c:\windows\system32\aswBoot.exe
2009-11-24 23:49 . 2009-10-12 15:09 48560 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-11-24 23:48 . 2009-10-12 15:09 23120 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-11-24 23:47 . 2009-10-12 15:09 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-04-18 16:52 . 2009-04-18 16:52 22 --sha-w- c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2006-11-07 159744]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-01-02 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-01-02 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-01-02 133656]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-11-24 81000]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 16:05 356352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^LaunchU3.exe.lnk]
backup=c:\windows\pss\LaunchU3.exe.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
backup=c:\windows\pss\QuickBooks Update Agent.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Nikon Monitor.lnk]
backup=c:\windows\pss\Nikon Monitor.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^User^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
2008-10-15 02:38 623992 ----a-w- c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2008-10-15 06:04 39792 ----a-w- c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe_ID0EYTHM]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2009-11-19 15:38 135664 ----atw- c:\program files\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
2006-10-27 05:47 31016 ----a-w- c:\program files\Microsoft Office\Office12\GrooveMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Health Check Scheduler]
2007-03-12 18:54 50696 ----a-w- c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
2005-02-17 06:11 49152 ----a-w- c:\program files\HP\HP Software Update\hpwuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
2009-06-05 00:03 186904 ----a-w- c:\program files\Intel\Intel Matrix Storage Manager\IAAnotif.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2009-10-29 01:21 141600 ----a-w- c:\program files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nikon Transfer Monitor]
2009-05-29 21:58 479232 ----a-w- c:\program files\Common Files\Nikon\Monitor\NkMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
2007-06-11 15:57 184320 ----a-w- c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
2007-03-29 00:45 176128 ----a-w- c:\program files\HP\QuickPlay\QPService.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-11 04:08 417792 ----a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\r***ent]
2009-10-21 17:58 916304 ----a-w- c:\program files\RFA\r***ent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RunSpySweeperScheduleAtStartup]
2007-03-23 21:23 86016 ----a-w- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2008-01-09 13:12 1232896 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-02 19:45 77824 ----a-w- c:\program files\Java\jre1.6.0\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2009-03-23 18:07 1830128 ----a-w- c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Windows Defender]
2007-07-02 18:15 1006264 ----a-w- c:\program files\Windows Defender\MSASCui.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [10/12/2009 10:09 AM 114768]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [3/23/2009 1:07 PM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [3/23/2009 1:07 PM 72944]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [10/12/2009 10:09 AM 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [10/12/2009 10:09 AM 53328]
S0 sptd;sptd;c:\windows\System32\drivers\sptd.sys [11/30/2008 1:30 PM 717296]
S3 LTXMD_VAC;Litex Media Virtual Audio Cable (WDM);c:\windows\System32\drivers\lmvac.sys [12/18/2008 7:13 PM 18912]
S3 MSSQL$SONY_MEDIAMGR2;SQL Server (SONY_MEDIAMGR2);c:\program files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2/10/2007 4:29 AM 29178224]
S3 PAC207;PC Camer@;c:\windows\System32\drivers\PFC027.SYS [2/13/2008 4:17 PM 618112]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [3/23/2009 1:07 PM 7408]
S3 WMSvc;Web Management Service;c:\windows\System32\inetsrv\WMSvc.exe [11/2/2006 7:36 AM 10752]
S4 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/19/2009 10:38 AM 135664]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-04-19 20:23 452136 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{621FCD24-4498-4324-A81E-07D331376EDF}]
2007-09-19 15:32 7680 ----a-w- c:\program files\PixiePack Codec Pack\InstallerHelper.exe
.
Contents of the 'Scheduled Tasks' folder

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-19 15:38]

2010-02-13 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-19 15:38]

2010-02-13 c:\windows\Tasks\HPCeeScheduleForUser.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2007-07-02 21:23]
.
.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=PRESARIO&pf=laptop
uInternet Settings,ProxyOverride = <local>
FF - ProfilePath - c:\users\User\AppData\Roaming\Mozilla\Firefox\Profiles\bv5h7rsw.SPEED\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/weather/local/28273?lswe=28273&lwsa=WeatherLocalUndeclared&from=searchbox_localwx
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Java\jre1.6.0\bin\npjpi160.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPSFDMGR.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-02-13 14:56
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll iaStor.sys >>UNKNOWN [0x8635B8C8]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0x87faed1f
\Driver\ACPI -> acpi.sys @ 0x804439d6
\Driver\atapi -> ataport.SYS @ 0x806619c6
\Driver\iaStor -> iaStor.sys @ 0x87b7d6c8
IoDeviceObjectType -> SecurityProcedure -> ntkrnlpa.exe @ 0x81d95467
\Device\Harddisk0\DR0 -> SecurityProcedure -> ntkrnlpa.exe @ 0x81d95467
user & kernel MBR OK

**************************************************************************

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\9240.tmp"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(1236)
c:\program files\HP\QuickPlay\Kernel\Movie\CLDemuxer.ax
c:\program files\PixiePack Codec Pack\MP4Splitter.ax
c:\windows\system32\RealMediaSplitter.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2dsh264.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2h264dec.dll
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2h264dec.004
c:\program files\PixiePack Codec Pack\FLVSplitter.ax
c:\program files\Common Files\Roxio Shared\9.0\MPEG\RoxioMPEGDemuxer.dll
c:\program files\HP\QuickPlay\Kernel\DMP\CLWMFDemux.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mcdsmpeg.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mcmpgdec.dll
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mcspmpeg.ax
c:\program files\Adobe\Adobe Premiere Pro CS3\ad2mpegin.dll
c:\program files\Common Files\Nikon\MPEG\nikondsmpeg.ax
c:\program files\Common Files\Nikon\MPEG\nikonmpgdec.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Alwil Software\Avast4\ashDisp.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft SQL Server\90\Shared\sqlwriter.exe
c:\windows\system32\DRIVERS\xaudio.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\program files\Alwil Software\Avast4\ashMaiSv.exe
c:\program files\Alwil Software\Avast4\ashWebSv.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
.
**************************************************************************
.
Completion time: 2010-02-13 15:05:59 - machine was rebooted
ComboFix-quarantined-files.txt 2010-02-13 20:05
ComboFix2.txt 2010-02-13 18:37
ComboFix3.txt 2010-02-09 19:19
ComboFix4.txt 2010-02-09 17:41
ComboFix5.txt 2010-02-13 19:35

Pre-Run: 25,256,517,632 bytes free
Post-Run: 24,995,745,792 bytes free

- - End Of File - - 46EEDBB1A7DE86DEB36D4A196BB83308

Hijackthis;

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:20:58 PM, on 2/13/2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16916)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\PixArt\Pac207\Monitor.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ARIO&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [WAWifiMessage] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Launcher] &#37;WINDIR%\SMINST\launcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6060 bytes

I assume, redirection is still on?

Yes, I'm still getting redirected!:(

Download TDSSKiller and save it to your Desktop.
Extract its contents to your desktop and make sure TDSSKiller.exe (the contents of the zipped file) is on the Desktop itself, not within a folder on the desktop.
Go to Start > Run (Or you can hold down your Windows key and press R) and copy and paste the following into the text field. (make sure you include the quote marks) Then press OK.

"&#37;userprofile%\Desktop\TDSSKiller.exe" -l C:\TDSSKiller.txt -v

If it says "Hidden service detected" DO NOT type anything in. Just press Enter on your keyboard to not do anything to the file.
When it is done, a log file should be created on your C: drive called TDSSKiller.txt please copy and paste the contents of that file here.

15:37:30:959 1884 TDSS rootkit removing tool 2.2.3 Feb 4 2010 14:34:00
15:37:30:959 1884 ================================================================================
15:37:30:959 1884 SystemInfo:

15:37:30:959 1884 OS Version: 6.0.6000 ServicePack: 0.0
15:37:30:959 1884 Product type: Workstation
15:37:30:959 1884 ComputerName: ASK
15:37:30:960 1884 UserName: User
15:37:30:960 1884 Windows directory: C:\Windows
15:37:30:960 1884 Processor architecture: Intel x86
15:37:30:960 1884 Number of processors: 2
15:37:30:960 1884 Page size: 0x1000
15:37:30:960 1884 Boot type: Normal boot
15:37:30:960 1884 ================================================================================
15:37:30:965 1884 UnloadDriverW: NtUnloadDriver error 2
15:37:30:965 1884 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
15:37:30:966 1884 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmd.sys) returned status 00000000
15:37:31:068 1884 UtilityInit: KLMD drop and load success
15:37:31:068 1884 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201010)
15:37:31:068 1884 UtilityInit: KLMD open success
15:37:31:068 1884 UtilityInit: Initialize success
15:37:31:068 1884
15:37:31:068 1884 Scanning Services ...
15:37:31:068 1884 CreateRegParser: Registry parser init started
15:37:31:069 1884 CreateRegParser: DisableWow64Redirection error
15:37:31:069 1884 wfopen_ex: Trying to open file C:\Windows\system32\config\system
15:37:31:069 1884 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\config\system) returned status C0000043
15:37:31:069 1884 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
15:37:31:069 1884 wfopen_ex: Trying to KLMD file open
15:37:31:069 1884 KLMD_CreateFileW: Trying to open file C:\Windows\system32\config\system
15:37:31:069 1884 wfopen_ex: File opened ok (Flags 2)
15:37:31:090 1884 CreateRegParser: HIVE_ADAPTER(C:\Windows\system32\config\system) init success: 1316F70
15:37:31:090 1884 wfopen_ex: Trying to open file C:\Windows\system32\config\software
15:37:31:090 1884 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\config\software) returned status C0000043
15:37:31:091 1884 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
15:37:31:091 1884 wfopen_ex: Trying to KLMD file open
15:37:31:091 1884 KLMD_CreateFileW: Trying to open file C:\Windows\system32\config\software
15:37:31:091 1884 wfopen_ex: File opened ok (Flags 2)
15:37:31:091 1884 CreateRegParser: HIVE_ADAPTER(C:\Windows\system32\config\software) init success: 1316F98
15:37:31:091 1884 CreateRegParser: EnableWow64Redirection error
15:37:31:091 1884 CreateRegParser: RegParser init completed
15:37:31:506 1884 GetAdvancedServicesInfo: Raw services enum returned 462 services
15:37:31:513 1884 fclose_ex: Trying to close file C:\Windows\system32\config\system
15:37:31:514 1884 fclose_ex: Trying to close file C:\Windows\system32\config\software
15:37:31:514 1884
15:37:31:515 1884 Scanning Kernel memory ...
15:37:31:516 1884 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
15:37:31:516 1884 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 8522A568
15:37:31:516 1884 DetectCureTDL3: KLMD_GetDeviceObjectList returned 1 DevObjects
15:37:31:516 1884
15:37:31:516 1884 DetectCureTDL3: DEVICE_OBJECT: 85722958
15:37:31:516 1884 KLMD_GetLowerDeviceObject: Trying to get lower device object for 85722958
15:37:31:516 1884 DetectCureTDL3: DEVICE_OBJECT: 847FDF18
15:37:31:516 1884 KLMD_GetLowerDeviceObject: Trying to get lower device object for 847FDF18
15:37:31:516 1884 DetectCureTDL3: DEVICE_OBJECT: 847FE030
15:37:31:516 1884 KLMD_GetLowerDeviceObject: Trying to get lower device object for 847FE030
15:37:31:516 1884 KLMD_ReadMem: Trying to ReadMemory 0x847FE030[0x38]
15:37:31:516 1884 DetectCureTDL3: DRIVER_OBJECT: 847DBCE0
15:37:31:516 1884 KLMD_ReadMem: Trying to ReadMemory 0x847DBCE0[0xA8]
15:37:31:516 1884 KLMD_ReadMem: Trying to ReadMemory 0x83AA1410[0x1C]
15:37:31:516 1884 DetectCureTDL3: DRIVER_OBJECT name: \Driver\iaStor, Driver Name: iaStor
15:37:31:516 1884 DetectCureTDL3: IrpHandler (0) addr: 87B7D6C8
15:37:31:516 1884 DetectCureTDL3: IrpHandler (1) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (2) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (3) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (4) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (5) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (6) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (7) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (8) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (9) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (10) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (11) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (12) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (13) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (14) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (15) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (16) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (17) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (18) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (19) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (20) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (21) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (22) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (23) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (24) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (25) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: IrpHandler (26) addr: 87B7D6C8
15:37:31:517 1884 DetectCureTDL3: All IRP handlers pointed to one addr: 87B7D6C8
15:37:31:517 1884 KLMD_ReadMem: Trying to ReadMemory 0x87B7D6C8[0x400]
15:37:31:517 1884 TDL3_IrpHookDetect: TDL3 Stub signature found, trying to get hook true addr
15:37:31:517 1884 KLMD_ReadMem: Trying to ReadMemory 0xFFDF0308[0x4]
15:37:31:517 1884 KLMD_ReadMem: Trying to ReadMemory 0x847DB66C[0x4]
15:37:31:518 1884 TDL3_IrpHookDetect: New IrpHandler addr: 863168C8
15:37:31:518 1884 KLMD_ReadMem: Trying to ReadMemory 0x863168C8[0x400]
15:37:31:518 1884 TDL3_IrpHookDetect: CheckParameters: 10, FFDF0308, 510, 134, 3, 120
15:37:31:518 1884 Driver "iaStor" Irp handler infected by TDSS rootkit ... 15:37:31:518 1884 KLMD_WriteMem: Trying to WriteMemory 0x8631694E[0xD]
15:37:31:518 1884 cured
15:37:31:519 1884 TDL3_FileDetect: Processing driver: iaStor
15:37:31:519 1884 TDL3_FileDetect: Processing driver file: C:\Windows\system32\DRIVERS\iaStor.sys
15:37:31:519 1884 KLMD_CreateFileW: Trying to open file C:\Windows\system32\DRIVERS\iaStor.sys
15:37:31:550 1884 TDL3_FileDetect: C:\Windows\system32\DRIVERS\iaStor.sys - Verdict: Infected
15:37:31:550 1884 File C:\Windows\system32\DRIVERS\iaStor.sys infected by TDSS rootkit ... 15:37:31:551 1884 TDL3_FileCure: Processing driver file: C:\Windows\system32\DRIVERS\iaStor.sys
15:37:32:585 1884 FileCallback: Backup candidate found: C:\Windows\system32\DriverStore\FileRepository\iaahci.inf_3a63e5a6\iaStor.sys:304920, checking..
15:37:32:605 1884 ValidateDriverFile: Stage 1 passed
15:37:32:607 1884 ValidateDriverFile: Stage 2 passed
15:37:33:158 1884 DigitalSignVerifyByHandle: Embedded DS result: 00000000
15:37:33:158 1884 ValidateDriverFile: Stage 3 passed
15:37:33:158 1884 FileCallback: File validated successfully, restore information prepared
15:37:35:666 1884 FindDriverFileBackup: Backup copy found in DriverStore
15:37:35:666 1884 TDL3_FileCure: Backup copy found, using it..
15:37:35:667 1884 TDL3_FileCure: Dumping cured buffer to file C:\Windows\system32\drivers\tsk42DF.tmp
15:37:35:672 1884 TDL3_FileCure: New / Old Image paths: (system32\drivers\tsk42DF.tmp, system32\drivers\iaStor.sys)
15:37:35:672 1884 TDL3_FileCure: KLMD jobs schedule success
15:37:35:672 1884 will be cured on next reboot
15:37:35:673 1884 UtilityBootReinit: Reboot required for cure complete..
15:37:35:673 1884 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmdb.sys) returned status 00000000
15:37:35:677 1884 UtilityBootReinit: KLMD drop success
15:37:35:678 1884 KLMD_ApplyPendList: Pending buffer(1095_7E5B, 616) dropped successfully
15:37:35:678 1884 UtilityBootReinit: Cure on reboot scheduled successfully
15:37:35:678 1884
15:37:35:678 1884 Completed
15:37:35:679 1884
15:37:35:679 1884 Results:
15:37:35:679 1884 Memory objects infected / cured / cured on reboot: 1 / 1 / 0
15:37:35:680 1884 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
15:37:35:680 1884 File objects infected / cured / cured on reboot: 1 / 0 / 1
15:37:35:680 1884
15:37:35:681 1884 UnloadDriverW: NtUnloadDriver error 1
15:37:35:681 1884 KLMD_Unload: UnloadDriverW(klmd21) error 1
15:37:35:682 1884 MyNtCreateFileW: NtCreateFile(\??\C:\Windows\system32\drivers\klmd.sys) returned status 00000000
15:37:35:682 1884 UtilityDeinit: KLMD(ARK) unloaded successfully

...and redirection?

I think it's fixed!:D

I clicked about 20+ google search results, and I haven't got any redirecting!

OMG!
As you noticed, I knew, it was something wrong with istor.sys driver, but apparently I needed a good night sleep to recall the obvious tool to fix it.
Let's pray, it stays that way :)

Please, give me fresh HJT log.

Yes! Thank goodness for sleep too(: and thank you so much for helping me with this!

Btw, one more thing, I'm going to need help cleaning up my desktop, if you don't mind!:P

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:07:32 PM, on 2/13/2010
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16916)
Boot mode: Normal

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\PixArt\Pac207\Monitor.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Alwil Software\Avast4\ashDisp.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TY...ARIO&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint2K\Apoint.exe"
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe"
O4 - HKLM\..\Run: [WAWifiMessage] "C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 6060 bytes

You're very welcome :)

Quote:

---

I'm going to need help cleaning up my desktop, if you don't mind!

---

Not a problem. Just start new topic.


Please download JavaRa to your desktop and unzip it to its own folder

• Run JavaRa.exe (Vista users! Right click on JavaRa.exe, click Run As Administrator), pick the language of your choice and click Select. Then click Remove Older Versions.
• Accept any prompts.
• Open JavaRa.exe again and select Search For Updates.
• Select Update Using Sun Java's Website then click Search and click on the Open Webpage button. Download and install the latest Java Runtime Environment (JRE) version for your computer.

Note 1: UNCHECK any pre-checked toolbar and/or software offered with the Java update. The pre-checked toolbars/software are not part of the Java update.

Note 2: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications. If you don't want to run another extra service, go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter. Click OK and restart your computer.

==================================================================


Your computer is clean https://discussions.virtualdr.com/

1. Turn off System Restore:

- Windows XP:
1. Click Start.
2. Right-click the My Computer icon, and then click Properties.
3. Click the System Restore tab.
4. Check "Turn off System Restore".
5. Click Apply.
6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
7. Click OK.
- Windows Vista:
1. Click Start.
2. Right-click the Computer icon, and then click Properties.
3. Click on System Protection under the Tasks column on the left side
4. Click on Continue on the "User Account Control" window that pops up
5. Under the System Protection tab, find Available Disks
6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C:")
7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
8. Click OK

2. Restart computer.

3. Turn System Restore on.

4. Make sure, Windows Updates are current.

5. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run defrag at your convenience.

8. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

9. Please, let me know, how is your computer doing.

Wops, let me rephrase what I said, what I meant was, I'll need help taking all the scan programs you had me download off! Here's an SS to show what's on it right now. (I highlighted all of it).

http://i49.tinypic.com/f0dgkx.jpg

And I'll do all of that you mentioned and re-test everything and let you know how it's going then. After that I'll mark as resolved!

Also real quick, there's a process that runs at start up, hotkeycommand;

O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe

Can I disable this?

hkcmd.exe - Installed by the Intel 810 and 815 chipset graphic drivers. If you want the Ctrl+Alt+F12 or similar keypresses to access Intel's customised graphics properties, you need it, otherwise not. Can be disabled via the Display Properties in Control Panel

As for cleaning....

Please download OTC to your desktop. It'll remove most tools and logs we used so far. If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

• Double-click OTC.exe to run it. (Vista and 7 users, please right click on OTC and select "Run as an Administrator")
• Click on the CleanUp! button and follow the prompts.
• You will be asked to reboot the machine to finish the Cleanup process, choose Yes. If it doesn't ask you to reboot, restart computer manually.
• After the reboot all the tools we used should be gone.
• The tool will delete itself once it finishes.

Disabled at start up(: thank you for that. plus I never knew that short cut, so it was basically useless.

I did all that below just about, in the process of changing passwords right now. The scan programs are gone, I had to manually delete some, but they're gone.

Computer seems to be running normal again, if not a little better! I still have this Runtime error to figure out, which I'll probably wave off for another year:p

again, thank you for all your help! It both helped my computer out and aided me with more useful information to remember in the future.

I tested the redirecting issue once more just to double check. Looks like it's gone! Thank goodness. I will post some topics after this, got a registry full of left over program files that need to go bye bye(:

Well....good luck then :)