This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Resolved] Web search redirect

13 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Hi,

I seem to be running into the same problem that many folks on here have experienced: the redirect to findstuff.com when clicking on a search result.

Anytime I search in either IE7, FF (3.0.6) and click on one of the search results, I get redirected to findstuff. If I copy the link and then paste it, it works fine of course, but selecting any link sends me off on a wild goose chase.

I've attached my HijacK This! log below. Please let me know if more is needed.

thanks,

-matt



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:41:52 AM, on 2/27/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Creative\Shared Files\CTAudSvc.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
F:\WINDOWS\CTHELPER.EXE
F:\WINDOWS\system32\RUNDLL32.EXE
F:\WINDOWS\SYSTEM32\CTXFISPI.EXE
F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
F:\program files\powerstrip\pstrip.exe
F:\WINDOWS\system32\CTXFIHLP.EXE
F:\Program Files\Java\jre6\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\ATKKBService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\iTunes\iTunes.exe
F:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] F:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1224074379171
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - F:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 9161 bytes
Hi Snodherm and welcome to the forums here at WTT!

:welcome:

Yes, common problem these days. Getting harder to nail down too. Let's take a closer look.

  • Download OTListIt2 to your desktop.
  • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  • When the window appears, underneath Output at the top change it to Minimal Output.
  • Check the boxes beside LOP Check and Purity Check.
  • Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  • When the scan completes, it will open two notepad windows. OTListIt.Txt and Extras.Txt. These are saved in the same location as OTListIt2.
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.
Hi Indi,

Thanks for the help. Sorry for the delay, I was out of town for a few days. Attached are the logs, as requested.

I've noticed something else too, that whatever i've got on here is slowing my wireless connectivity down to 1.0 Mbps from a normal reading of 54 Mbps. Laptop is fine, desktop is super slow. That may be a problem for another day, though…



OTListIt logfile created on: 3/3/2009 10:47:53 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.3.2 Folder = F:\Documents and Settings\Matt\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.51 Gb Available Physical Memory | 75.72% Memory free
3.85 Gb Paging File | 3.43 Gb Available in Paging File | 89.22% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4092;

%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files
Drive C: | 76.32 Gb Total Space | 7.82 Gb Free Space | 10.25% Space Free | Partition Type: NTFS
Drive D: | 7.69 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
Drive F: | 232.88 Gb Total Space | 153.20 Gb Free Space | 65.79% Space Free | Partition Type: NTFS
Drive G: | 354.30 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Matt
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== Processes (SafeList) ==========

PRC - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
PRC - F:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
PRC - F:\WINDOWS\Explorer.EXE (Microsoft Corporation)
PRC - F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE (Creative Technology Ltd)
PRC - F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
PRC - F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe (Creative Technology Ltd)
PRC - F:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
PRC - F:\WINDOWS\SYSTEM32\CTXFISPI.EXE (Creative Technology Ltd)
PRC - F:\Program Files\ASUS\GamerOSD\GamerOSD.exe (ASUSTeK Computer Inc.)
PRC - F:\program files\powerstrip\pstrip.exe (EnTech Taiwan)
PRC - F:\WINDOWS\system32\CTXFIHLP.EXE (Creative Technology Ltd)
PRC - F:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
PRC - F:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
PRC - F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
PRC - F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd)
PRC - F:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
PRC - F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
PRC - C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe (ASUSTeK Inc.)
PRC - F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe (Creative Technology Ltd.)
PRC - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
PRC - F:\WINDOWS\ATKKBService.exe (ASUSTeK COMPUTER INC.)
PRC - F:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
PRC - F:\WINDOWS\system32\CTsvcCDA.EXE (Creative Technology Ltd)
PRC - F:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
PRC - F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
PRC - F:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
PRC - F:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
PRC - F:\WINDOWS\system32\PnkBstrA.exe ()
PRC - F:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
PRC - F:\WINDOWS\system32\wbem\unsecapp.exe (Microsoft Corporation)
PRC - F:\WINDOWS\system32\wbem\wmiprvse.exe (Microsoft Corporation)
PRC - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
PRC - F:\Documents and Settings\Matt\Desktop\OTListIt2.exe (OldTimer Tools)

========== Win32 Services (SafeList) ==========

SRV - (Apple Mobile Device [Auto | Running]) – F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe (Apple Inc.)
SRV - (aspnet_state [On_Demand | Stopped]) – F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (Microsoft Corporation)
SRV - (ATKKeyboardService [Auto | Running]) – F:\WINDOWS\ATKKBService.exe (ASUSTeK COMPUTER INC.)
SRV - (Bonjour Service [Auto | Running]) – F:\Program Files\Bonjour\mDNSResponder.exe (Apple Inc.)
SRV - (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) – F:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (Creative Audio Engine Licensing Service [On_Demand | Stopped]) – F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe (Creative Labs)
SRV - (Creative Service for CDROM Access [Auto | Running]) – F:\WINDOWS\system32\CTsvcCDA.EXE (Creative Technology Ltd)
SRV - (CTAudSvcService [Auto | Running]) – F:\Program Files\Creative\Shared Files\CTAudSvc.exe (Creative Technology Ltd)
SRV - (FontCache3.0.0.0 [On_Demand | Stopped]) – F:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe (Microsoft Corporation)
SRV - (gusvc [On_Demand | Running]) – F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (Google)
SRV - (helpsvc [Auto | Running]) – F:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll (Microsoft Corporation)
SRV - (IDriverT [On_Demand | Stopped]) – F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (Macrovision Corporation)
SRV - (idsvc [Unknown | Stopped]) – F:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe (Microsoft Corporation)
SRV - (iPod Service [On_Demand | Running]) – F:\Program Files\iPod\bin\iPodService.exe (Apple Inc.)
SRV - (JavaQuickStarterService [Auto | Running]) – F:\Program Files\Java\jre6\bin\jqs.exe (Sun Microsystems, Inc.)
SRV - (Lavasoft Ad-Aware Service [Auto | Running]) – F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
SRV - (MDM [Auto | Running]) – F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE (Microsoft Corporation)
SRV - (MSCamSvc [Auto | Running]) – F:\Program Files\Microsoft LifeCam\MSCamS32.exe (Microsoft Corporation)
SRV - (NetTcpPortSharing [Disabled | Stopped]) – F:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe (Microsoft Corporation)
SRV - (NVSvc [Auto | Running]) – F:\WINDOWS\system32\nvsvc32.exe (NVIDIA Corporation)
SRV - (ose [On_Demand | Stopped]) – F:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (PnkBstrA [Auto | Running]) – F:\WINDOWS\system32\PnkBstrA.exe ()
SRV - (WMPNetworkSvc [On_Demand | Stopped]) – F:\Program Files\Windows Media Player\WMPNetwk.exe (Microsoft Corporation)

========== Driver Services (SafeList) ==========

DRV - (AmdK8 [System | Running]) – F:\WINDOWS\system32\DRIVERS\AmdK8.sys (Advanced Micro Devices)
DRV - (asusgsb [On_Demand | Running]) – F:\WINDOWS\system32\drivers\asusgsb.sys (ASUSTeK Computer Inc.)
DRV - (asuskbnt [System | Running]) – F:\WINDOWS\system32\drivers\atkkbnt.sys (ASUSTeK COMPUTER INC.)
DRV - (ASUSVRC [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\AsusVRC.sys (ASUSTeK COMPUTER INC.)
DRV - (CT20XUT [On_Demand | Stopped]) – F:\WINDOWS\system32\drivers\CT20XUT.SYS (Creative Technology Ltd.)
DRV - (CT20XUT.SYS [On_Demand | Running]) – F:\WINDOWS\System32\drivers\CT20XUT.SYS (Creative Technology Ltd.)
DRV - (ctac32k [On_Demand | Running]) – F:\WINDOWS\system32\drivers\ctac32k.sys (Creative Technology Ltd)
DRV - (ctaud2k [On_Demand | Running]) – F:\WINDOWS\system32\drivers\ctaud2k.sys (Creative Technology Ltd)
DRV - (ctdvda2k [On_Demand | Stopped]) – F:\WINDOWS\system32\drivers\ctdvda2k.sys (Creative Technology Ltd)
DRV - (CTEXFIFX [On_Demand | Stopped]) – F:\WINDOWS\system32\drivers\CTEXFIFX.SYS (Creative Technology Ltd.)
DRV - (CTEXFIFX.SYS [On_Demand | Running]) – F:\WINDOWS\System32\drivers\CTEXFIFX.SYS (Creative Technology Ltd.)
DRV - (CTHWIUT [On_Demand | Stopped]) – F:\WINDOWS\system32\drivers\CTHWIUT.SYS (Creative Technology Ltd.)
DRV - (CTHWIUT.SYS [On_Demand | Stopped]) – F:\WINDOWS\System32\drivers\CTHWIUT.SYS (Creative Technology Ltd.)
DRV - (ctprxy2k [On_Demand | Running]) – F:\WINDOWS\system32\drivers\ctprxy2k.sys (Creative Technology Ltd)
DRV - (ctsfm2k [On_Demand | Running]) – F:\WINDOWS\system32\drivers\ctsfm2k.sys (Creative Technology Ltd)
DRV - (EIO_XP [System | Running]) – F:\WINDOWS\system32\drivers\EIO_XP.sys (ASUSTeK Computer Inc.)
DRV - (emupia [On_Demand | Running]) – F:\WINDOWS\system32\drivers\emupia2k.sys (Creative Technology Ltd)
DRV - (GEARAspiWDM [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys (GEAR Software Inc.)
DRV - (ha20x2k [On_Demand | Running]) – F:\WINDOWS\system32\drivers\ha20x2k.sys (Creative Technology Ltd)
DRV - (HDAudBus [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\HDAudBus.sys (Windows ® Server 2003 DDK provider)
DRV - (ISODrive [System | Running]) – F:\Program Files\UltraISO\drivers\ISODrive.sys (EZB Systems, Inc.)
DRV - (Lbd [Boot | Running]) – F:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (MDC8021X [Auto | Running]) – F:\WINDOWS\system32\DRIVERS\mdc8021x.sys (Meetinghouse Data Communications)
DRV - (MTsensor [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\ASACPI.sys ()
DRV - (nv [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\nv4_mini.sys (NVIDIA Corporation)
DRV - (nvata [Boot | Running]) – F:\WINDOWS\system32\DRIVERS\nvata.sys (NVIDIA Corporation)
DRV - (nvcap [Auto | Stopped]) – F:\WINDOWS\system32\DRIVERS\nvcap.sys (NVIDIA Corporation)
DRV - (NVENETFD [On_Demand | Stopped]) – F:\WINDOWS\system32\DRIVERS\NVENETFD.sys (NVIDIA Corporation)
DRV - (nvnetbus [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\nvnetbus.sys (NVIDIA Corporation)
DRV - (NVXBAR [Auto | Stopped]) – F:\WINDOWS\system32\DRIVERS\NVxbar.sys (NVIDIA Corporation)
DRV - (ossrv [On_Demand | Running]) – F:\WINDOWS\system32\drivers\ctoss2k.sys (Creative Technology Ltd.)
DRV - (PStrip [Auto | Running]) – F:\WINDOWS\system32\drivers\pstrip.sys (EnTech Taiwan)
DRV - (Ptilink [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\ptilink.sys (Parallel Technologies, Inc.)
DRV - (RT2500 [On_Demand | Running]) – F:\WINDOWS\system32\DRIVERS\RT2500.sys (Ralink Technology Inc.)
DRV - (SASDIFSV [System | Running]) – F:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASENUM [On_Demand | Running]) – F:\Program Files\SUPERAntiSpyware\SASENUM.SYS ( SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL [System | Running]) – F:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (Secdrv [On_Demand | Stopped]) – F:\WINDOWS\system32\DRIVERS\secdrv.sys (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.)
DRV - (SONYPVU1 [On_Demand | Stopped]) – F:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS (Sony Corporation)
DRV - (USBAAPL [On_Demand | Stopped]) – F:\WINDOWS\System32\Drivers\usbaapl.sys (Apple, Inc.)
DRV - (usbaudio [On_Demand | Stopped]) – F:\WINDOWS\system32\drivers\usbaudio.sys (Microsoft Corporation)
DRV - (Video3D [On_Demand | Running]) – F:\WINDOWS\System32\Drivers\Video3D32.sys (ASUSTeK COMPUTER INC.)
DRV - (VX6000 [On_Demand | Stopped]) – F:\WINDOWS\system32\DRIVERS\VX6000Xp.sys (Microsoft Corporation
)

========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = F:\WINDOWS\system32\blank.htm
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}:6.0.12
FF - prefs.js..extensions.enabledItems: [removed]:1.0
FF - prefs.js..extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.6
FF - HKLM\software\mozilla\Firefox\Extensions\\{20a82645-c095-46ed-80e3-08825760534b} -> %SystemRoot%\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [F:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION\] -> [2008/12/21 21:47:27 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\[removed] -> %ProgramFiles%\JAVA\JRE6\LIB\DEPLOY\JQS\FF [F:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF] -> [2009/02/16 22:04:59 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Components -> %ProgramFiles%\MOZILLA FIREFOX\COMPONENTS [F:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS] -> [2009/02/25 21:46:05 00,000,000 | —D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.6\extensions\\Plugins -> %ProgramFiles%\MOZILLA FIREFOX\PLUGINS [F:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS] -> [2009/02/25 21:46:05 00,000,000 | —D | M]
FF - F:\Documents and Settings\Matt\Application Data\mozilla\Extensions [2008/10/14 23:24:12 00,000,000 | —D | M]
FF - F:\Documents and Settings\Matt\Application Data\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2008/10/14 23:24:12 00,000,000 | —D | M]
FF - F:\Documents and Settings\Matt\Application Data\mozilla\Firefox\Profiles\o3w1sgg7.default\extensions [2008/10/14 23:24:12 00,000,000 | —D | M]
FF - F:\Program Files\mozilla firefox\extensions [2009/02/22 16:30:22 00,000,000 | —D | M]
FF - F:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009/02/25 21:46:01 00,000,000 | —D | M]
FF - F:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} [2009/02/16 22:05:10 00,000,000 | —D | M]

O1 HOSTS File: (27 bytes) - F:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (Spybot-S&D; IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll (Google Inc.)
O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll (Google Inc.)
O2 - BHO: (Java™ Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O3 - HKLM\..\Toolbar: (&Google; Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll ()
O4 - HKLM..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe (Lavasoft)
O4 - HKLM..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe (ASUSTeK Computer Inc.)
O4 - HKLM..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll" (Creative Technology Ltd.)
O4 - HKLM..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" (Creative Technology Ltd)
O4 - HKLM..\Run: [CTHelper] CTHELPER.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [CTxfiHlp] CTXFIHLP.EXE (Creative Technology Ltd)
O4 - HKLM..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found
O4 - HKLM..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe" File not found
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation)
O4 - HKLM..\Run: [NWEReboot] File not found
O4 - HKLM..\Run: [nwiz] nwiz.exe /install ()
O4 - HKLM..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe (EnTech Taiwan)
O4 - HKLM..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime (Apple Inc.)
O4 - HKLM..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup (Creative Technology Ltd.)
O4 - HKLM..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u File not found
O4 - HKLM..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r (Creative Technology Ltd)
O4 - HKCU..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start (ASUSTeK Inc.)
O4 - HKCU..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R (Creative Technology Ltd)
O4 - HKCU..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background (Microsoft Corporation)
O4 - HKCU..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - Startup: F:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - File not found
O9 - Extra 'Tools' menuitem : @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - F:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} https://support.microsoft.com/OAS/ActiveX/MSDcode.cab (Microsoft Data Collection Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab (System Requirements Lab Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftu…b?1224074379171 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flash…r/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-…indows-i586.cab (Java Plug-in 1.6.0_12)
O18 - Protocol\Handler\ipp Reg Error: Value error. - Reg Error: Key error. File not found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp Reg Error: Value error. - Reg Error: Key error. File not found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - F:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - F:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - F:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - F:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter: - text/xml - F:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - F:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - F:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - F:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop Components:0 (My Current Home Page) - About:Home
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - F:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - Autorun File - C:\AUTOEXEC.BAT () - [ NTFS ]
O32 - Autorun File - D:\AUTORUN.INF () - [ UDF ]

========== Files/Folders - Created Within 30 Days ==========

[4 F:\*.tmp files]
[4 F:\WINDOWS\*.tmp files]
[2009/03/02 22:27:01 | 01,324,940 | —- | C] () – F:\Documents and Settings\Matt\Desktop\netstumblerinstaller_0_4_0.exe
[2009/03/02 00:51:13 | 00,497,152 | —- | C] (OldTimer Tools) – F:\Documents and Settings\Matt\Desktop\OTListIt2.exe
[2009/02/27 00:09:37 | 00,001,734 | —- | C] () – F:\Documents and Settings\Matt\Desktop\HijackThis.lnk
[2009/02/27 00:09:37 | 00,000,000 | —D | C] – F:\Program Files\Trend Micro
[2009/02/26 23:57:36 | 00,515,388 | —- | C] () – F:\Documents and Settings\Matt\Desktop\LCOD1.mp3
[2009/02/26 23:33:32 | 00,616,698 | —- | C] () – F:\Documents and Settings\Matt\Desktop\audacity-manual-1.2.pdf
[2009/02/26 23:24:32 | 00,000,630 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Audacity.lnk
[2009/02/26 23:24:30 | 00,000,000 | —D | C] – F:\Program Files\Audacity
[2009/02/26 23:20:11 | 00,015,688 | —- | C] () – F:\WINDOWS\System32\lsdelete.exe
[2009/02/26 23:10:58 | 00,000,472 | —- | C] () – F:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/02/26 23:10:52 | 00,064,160 | —- | C] (Lavasoft AB) – F:\WINDOWS\System32\drivers\Lbd.sys
[2009/02/26 23:08:15 | 00,000,867 | —- | C] () – F:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/02/26 23:08:15 | 00,000,000 | -H-D | C] – F:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2009/02/26 23:08:12 | 00,000,000 | —D | C] – F:\Program Files\Lavasoft
[2009/02/26 23:08:12 | 00,000,000 | —D | C] – F:\Documents and Settings\All Users\Application Data\Lavasoft
[2009/02/26 22:58:40 | 00,000,000 | —- | C] () – F:\WINDOWS\System32\drivers\nfr.dll.gpref
[2009/02/25 23:22:39 | 00,014,848 | —- | C] () – F:\Documents and Settings\Matt\Desktop\dwarf.xls
[2009/02/25 21:36:23 | 00,000,000 | —D | C] – F:\Program Files\MSECache
[2009/02/25 21:03:33 | 00,015,657 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Alignment.docx
[2009/02/25 21:03:12 | 00,016,627 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Armour.xlsx
[2009/02/25 21:02:57 | 00,019,088 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Weapons.xlsx
[2009/02/25 21:02:25 | 00,637,100 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Class Abilities.docx
[2009/02/25 21:01:38 | 00,020,704 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Racial Abilities.docx
[2009/02/25 21:01:20 | 00,933,850 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Guild Hall Character Sheet.docx
[2009/02/25 21:01:04 | 00,017,058 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Training.docx
[2009/02/24 16:18:50 | 01,089,593 | —- | C] () – F:\WINDOWS\System32\dllcache\ntprint.cat
[2009/02/22 12:08:53 | 00,002,137 | —- | C] () – F:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/02/22 12:08:39 | 00,000,000 | —D | C] – F:\Program Files\iPod
[2009/02/22 12:08:37 | 00,000,000 | —D | C] – F:\Program Files\iTunes
[2009/02/22 12:08:37 | 00,000,000 | —D | C] – F:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2009/02/22 12:07:43 | 00,000,000 | —D | C] – F:\Program Files\QuickTime
[2009/02/22 11:57:13 | 00,000,000 | —D | C] – F:\Program Files\Bonjour
[2009/02/18 21:51:54 | 00,000,946 | —- | C] () – F:\Documents and Settings\Matt\Desktop\AVS4YOU Software Navigator.lnk
[2009/02/18 21:51:36 | 00,000,897 | —- | C] () – F:\Documents and Settings\Matt\Desktop\AVS Video Converter 6.lnk
[2009/02/18 21:51:27 | 00,000,000 | —D | C] – F:\Program Files\Common Files\AVSMedia
[2009/02/18 21:51:16 | 01,700,352 | —- | C] (Microsoft Corporation) – F:\WINDOWS\System32\GdiPlus.dll
[2009/02/18 21:51:16 | 00,487,424 | —- | C] (Microsoft Corporation) – F:\WINDOWS\System32\msvcp70.dll
[2009/02/18 21:51:16 | 00,024,576 | —- | C] (Microsoft Corporation) – F:\WINDOWS\System32\msxml3a.dll
[2009/02/18 21:51:16 | 00,000,000 | —D | C] – F:\Program Files\AVS4YOU
[2009/02/18 21:38:04 | 00,000,645 | —- | C] () – F:\Documents and Settings\Matt\Desktop\DIKO.lnk
[2009/02/18 21:38:03 | 00,719,872 | —- | C] (Abysmal Software) – F:\WINDOWS\System32\devil.dll
[2009/02/18 21:38:03 | 00,313,344 | —- | C] (The Public) – F:\WINDOWS\System32\avisynth.dll
[2009/02/18 21:37:58 | 00,000,000 | —D | C] – F:\Program Files\DIKO
[2009/02/16 22:16:54 | 00,000,000 | —D | C] – F:\Documents and Settings\Matt\Local Settings\Application Data\Google
[2009/02/16 22:16:54 | 00,000,000 | —D | C] – F:\Documents and Settings\Matt\Application Data\Google
[2009/02/16 22:16:19 | 00,000,000 | —D | C] – F:\Documents and Settings\All Users\Application Data\Google
[2009/02/16 22:16:17 | 00,000,000 | —D | C] – F:\Program Files\Google
[2009/02/16 22:14:40 | 08,961,680 | —- | C] () – F:\Documents and Settings\Matt\Desktop\CompConnect.zip
[2009/02/16 22:04:57 | 00,000,000 | —D | C] – F:\Program Files\Java
[2009/02/16 21:58:48 | 00,000,000 | —D | C] – F:\Program Files\RPGTools
[2009/02/16 21:55:50 | 09,139,447 | —- | C] () – F:\Documents and Settings\Matt\Desktop\chartool-0.1.b9.zip
[2009/02/16 21:55:21 | 16,176,135 | —- | C] () – F:\Documents and Settings\Matt\Desktop\maptool-1.3.b50.zip
[2009/02/16 21:54:19 | 01,436,268 | —- | C] () – F:\Documents and Settings\Matt\Desktop\dicetool-1.0.b34.zip
[2009/02/16 21:53:57 | 05,105,861 | —- | C] () – F:\Documents and Settings\Matt\Desktop\initiativetool-1.0.b23.zip
[2009/02/16 21:52:48 | 03,455,475 | —- | C] () – F:\Documents and Settings\Matt\Desktop\tokentool-1.0.b28.zip
[2009/02/16 20:25:12 | 00,036,864 | —- | C] () – F:\Documents and Settings\Matt\Desktop\Miranda Demorian.doc
[2009/02/15 23:55:10 | 00,001,534 | —- | C] () – F:\Documents and Settings\Matt\Desktop\OpenRPG.lnk
[2009/02/15 17:04:29 | 00,000,000 | —D | C] – F:\Documents and Settings\Matt\My Documents\Turbo Lister Backup
[2009/02/15 14:50:12 | 00,000,000 | —D | C] – F:\Documents and Settings\Matt\My Documents\Turbo Lister
[2009/02/11 22:48:03 | 00,000,000 | —D | C] – F:\Program Files\OpenRPG
[2009/02/11 22:47:22 | 00,000,000 | —D | C] – F:\Python25
[2009/02/04 19:23:23 | 00,000,000 | –SD | C] – F:\Documents and Settings\Matt\My Documents\My Web Sites
[2009/02/04 18:37:11 | 00,000,376 | —- | C] () – F:\WINDOWS\ODBC.INI
[2009/02/04 18:36:46 | 00,028,040 | —- | C] (Microsoft Corporation) – F:\WINDOWS\System32\mdimon.dll
[2009/02/04 18:35:34 | 00,000,000 | —D | C] – F:\Program Files\Common Files\L&H;
[2009/02/04 18:35:10 | 00,000,000 | —D | C] – F:\Program Files\Microsoft ActiveSync
[2009/02/04 18:34:26 | 00,000,000 | —D | C] – F:\Program Files\Common Files\DESIGNER
[2009/02/04 18:34:20 | 00,000,000 | —D | C] – F:\Program Files\Microsoft Works
[2009/02/04 18:34:11 | 00,000,000 | —D | C] – F:\Program Files\Microsoft Visual Studio
[2009/02/04 18:33:53 | 00,000,000 | —D | C] – F:\WINDOWS\SHELLNEW
[2009/02/04 18:33:40 | 00,000,000 | —D | C] – F:\Program Files\Microsoft.NET
[2009/02/04 18:33:39 | 00,000,000 | —D | C] – F:\Program Files\Microsoft Office
[2009/02/03 20:05:41 | 00,001,634 | —- | C] () – F:\Documents and Settings\Matt\Desktop\eBay Turbo Lister 2.lnk
[2009/02/03 20:05:26 | 00,000,000 | —D | C] – F:\Program Files\eBay

========== Files - Modified Within 30 Days ==========

[4 F:\*.tmp files]
[2 F:\WINDOWS\System32\*.tmp files]
[4 F:\WINDOWS\*.tmp files]
[2009/03/03 22:44:23 | 00,012,648 | —- | M] () – F:\WINDOWS\System32\wpa.dbl
[2009/03/03 22:44:17 | 00,193,876 | —- | M] () – F:\WINDOWS\System32\nvapps.xml
[2009/03/03 22:44:12 | 00,000,006 | -H– | M] () – F:\WINDOWS\tasks\SA.DAT
[2009/03/03 22:44:10 | 00,002,048 | –S- | M] () – F:\WINDOWS\bootstat.dat
[2009/03/02 22:51:03 | 00,055,468 | —- | M] () – F:\WINDOWS\System32\BMXStateBkp-{00000001-00000000-00000007-00001102-00000005-00211102}.rfx
[2009/03/02 22:51:03 | 00,055,468 | —- | M] () – F:\WINDOWS\System32\BMXState-{00000001-00000000-00000007-00001102-00000005-00211102}.rfx
[2009/03/02 22:51:03 | 00,000,788 | —- | M] () – F:\WINDOWS\System32\DVCState-{00000001-00000000-00000007-00001102-00000005-00211102}.rfx
[2009/03/02 22:27:09 | 01,324,940 | —- | M] () – F:\Documents and Settings\Matt\Desktop\netstumblerinstaller_0_4_0.exe
[2009/03/02 21:41:58 | 00,196,608 | —- | M] () – F:\WINDOWS\System32\drivers\nVivid.bin
[2009/03/02 00:51:13 | 00,497,152 | —- | M] (OldTimer Tools) – F:\Documents and Settings\Matt\Desktop\OTListIt2.exe
[2009/03/02 00:47:33 | 00,068,256 | —- | M] () – F:\Documents and Settings\Matt\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2009/02/27 08:54:28 | 00,515,388 | —- | M] () – F:\Documents and Settings\Matt\Desktop\LCOD1.mp3
[2009/02/27 00:09:37 | 00,001,734 | —- | M] () – F:\Documents and Settings\Matt\Desktop\HijackThis.lnk
[2009/02/26 23:33:38 | 00,616,698 | —- | M] () – F:\Documents and Settings\Matt\Desktop\audacity-manual-1.2.pdf
[2009/02/26 23:24:32 | 00,000,630 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Audacity.lnk
[2009/02/26 23:12:15 | 00,263,824 | —- | M] () – F:\WINDOWS\System32\FNTCACHE.DAT
[2009/02/26 23:10:58 | 00,000,472 | —- | M] () – F:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2009/02/26 23:10:48 | 00,015,688 | —- | M] () – F:\WINDOWS\System32\lsdelete.exe
[2009/02/26 23:10:23 | 00,064,160 | —- | M] (Lavasoft AB) – F:\WINDOWS\System32\drivers\Lbd.sys
[2009/02/26 23:08:15 | 00,000,867 | —- | M] () – F:\Documents and Settings\All Users\Desktop\Ad-Aware.lnk
[2009/02/26 22:58:40 | 00,000,000 | —- | M] () – F:\WINDOWS\System32\drivers\nfr.dll.gpref
[2009/02/26 09:05:07 | 00,014,848 | —- | M] () – F:\Documents and Settings\Matt\Desktop\dwarf.xls
[2009/02/25 21:03:33 | 00,015,657 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Alignment.docx
[2009/02/25 21:03:12 | 00,016,627 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Armour.xlsx
[2009/02/25 21:03:08 | 00,637,100 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Class Abilities.docx
[2009/02/25 21:02:57 | 00,019,088 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Weapons.xlsx
[2009/02/25 21:01:38 | 00,020,704 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Racial Abilities.docx
[2009/02/25 21:01:20 | 00,933,850 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Guild Hall Character Sheet.docx
[2009/02/25 21:01:05 | 00,017,058 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Training.docx
[2009/02/25 03:00:20 | 00,001,374 | —- | M] () – F:\WINDOWS\imsins.BAK
[2009/02/23 23:26:13 | 00,036,864 | —- | M] () – F:\Documents and Settings\Matt\Desktop\Miranda Demorian.doc
[2009/02/22 23:11:17 | 00,002,137 | —- | M] () – F:\Documents and Settings\All Users\Desktop\iTunes.lnk
[2009/02/18 21:51:54 | 00,000,946 | —- | M] () – F:\Documents and Settings\Matt\Desktop\AVS4YOU Software Navigator.lnk
[2009/02/18 21:51:36 | 00,000,897 | —- | M] () – F:\Documents and Settings\Matt\Desktop\AVS Video Converter 6.lnk
[2009/02/18 21:38:04 | 00,000,645 | —- | M] () – F:\Documents and Settings\Matt\Desktop\DIKO.lnk
[2009/02/16 22:14:55 | 08,961,680 | —- | M] () – F:\Documents and Settings\Matt\Desktop\CompConnect.zip
[2009/02/16 21:55:50 | 09,139,447 | —- | M] () – F:\Documents and Settings\Matt\Desktop\chartool-0.1.b9.zip
[2009/02/16 21:55:21 | 16,176,135 | —- | M] () – F:\Documents and Settings\Matt\Desktop\maptool-1.3.b50.zip
[2009/02/16 21:54:19 | 01,436,268 | —- | M] () – F:\Documents and Settings\Matt\Desktop\dicetool-1.0.b34.zip
[2009/02/16 21:53:57 | 05,105,861 | —- | M] () – F:\Documents and Settings\Matt\Desktop\initiativetool-1.0.b23.zip
[2009/02/16 21:52:48 | 03,455,475 | —- | M] () – F:\Documents and Settings\Matt\Desktop\tokentool-1.0.b28.zip
[2009/02/13 00:11:35 | 05,867,474 | -H– | M] () – F:\Documents and Settings\Matt\Local Settings\Application Data\IconCache.db
[2009/02/11 22:48:04 | 00,001,534 | —- | M] () – F:\Documents and Settings\Matt\Desktop\OpenRPG.lnk
[2009/02/11 10:19:42 | 00,038,496 | —- | M] (Malwarebytes Corporation) – F:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2009/02/11 10:19:34 | 00,015,504 | —- | M] (Malwarebytes Corporation) – F:\WINDOWS\System32\drivers\mbam.sys
[2009/02/08 03:03:40 | 00,000,603 | —- | M] () – F:\WINDOWS\win.ini
[2009/02/04 18:41:27 | 00,000,376 | —- | M] () – F:\WINDOWS\ODBC.INI
[2009/02/03 20:05:41 | 00,001,634 | —- | M] () – F:\Documents and Settings\Matt\Desktop\eBay Turbo Lister 2.lnk
[2009/02/03 18:21:12 | 21,244,864 | —- | M] (Microsoft Corporation) – F:\WINDOWS\System32\MRT.exe

========== LOP Check ==========

[2009/02/26 23:08:15 | 00,000,000 | RH-D | M] – F:\Documents and Settings\All Users\Application Data
[2009/02/22 12:08:51 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
[2009/02/26 23:08:16 | 00,000,000 | -H-D | M] – F:\Documents and Settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
[2008/10/15 11:14:46 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Adobe
[2008/10/16 19:17:48 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Apple
[2008/10/16 19:18:48 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Apple Computer
[2008/10/14 23:01:51 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Blizzard
[2009/01/05 00:20:39 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Creative
[2009/01/05 00:49:10 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\CyberLink
[2009/02/23 00:04:42 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Google
[2009/02/26 23:10:50 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Lavasoft
[2008/12/16 23:52:49 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Malwarebytes
[2009/02/04 18:37:13 | 00,000,000 | –SD | M] – F:\Documents and Settings\All Users\Application Data\Microsoft
[2008/10/16 22:31:35 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\nView_Profiles
[2008/12/16 23:40:31 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2008/12/16 01:07:20 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2008/10/14 23:30:25 | 00,000,000 | —D | M] – F:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
[2009/02/16 22:16:54 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data
[2008/10/17 01:10:30 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Adobe
[2008/11/06 01:47:32 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\AdobeUM
[2009/01/22 20:45:07 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Apple Computer
[2009/01/05 00:29:52 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Creative
[2009/01/05 00:49:58 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\CyberLink
[2009/02/16 22:16:54 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Google
[2008/12/14 12:55:48 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Help
[2008/10/14 13:17:57 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Identities
[2008/10/29 23:46:26 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\InstallShield
[2008/10/14 23:09:29 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Macromedia
[2008/12/16 23:52:53 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Malwarebytes
[2009/01/25 16:34:20 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Media Player Classic
[2009/02/25 20:23:44 | 00,000,000 | –SD | M] – F:\Documents and Settings\Matt\Application Data\Microsoft
[2008/10/14 23:24:11 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Mozilla
[2008/11/03 23:50:32 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Petroglyph
[2008/10/16 19:55:01 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\Sun
[2008/12/16 01:07:16 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\SUPERAntiSpyware.com
[2008/10/15 22:36:31 | 00,000,000 | —D | M] – F:\Documents and Settings\Matt\Application Data\WinRAR
[2009/02/26 23:10:58 | 00,000,472 | —- | M] () – F:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
[2004/08/04 07:00:00 | 00,000,065 | RH– | M] () – F:\WINDOWS\Tasks\desktop.ini
[2009/03/03 22:44:12 | 00,000,006 | -H– | M] () – F:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

< End of report >




OTListIt Extras logfile created on: 3/3/2009 10:47:53 PM - Run 1
OTListIt2 by OldTimer - Version 2.0.3.2 Folder = F:\Documents and Settings\Matt\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

2.00 Gb Total Physical Memory | 1.51 Gb Available Physical Memory | 75.72% Memory free
3.85 Gb Paging File | 3.43 Gb Available in Paging File | 89.22% Paging File free
Paging file location(s): F:\pagefile.sys 2046 4092;

%SystemDrive% = F: | %SystemRoot% = F:\WINDOWS | %ProgramFiles% = F:\Program Files
Drive C: | 76.32 Gb Total Space | 7.82 Gb Free Space | 10.25% Space Free | Partition Type: NTFS
Drive D: | 7.69 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
E: Drive not present or media not loaded
Drive F: | 232.88 Gb Total Space | 153.20 Gb Free Space | 65.79% Space Free | Partition Type: NTFS
Drive G: | 354.30 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: HOME
Current User Name: Matt
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Minimal
File Age = 30 Days
Company Name Whitelist: On

========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.html [@ = htmlfile] – F:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts]

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
C:\Program Files\Warcraft III\Warcraft III.exe:*:Enabled:Warcraft III (Blizzard Entertainment)
F:\Program Files\Messenger\Msmsgs.exe:*:Enabled:Windows Messenger (Microsoft Corporation)
%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 (Microsoft Corporation)
F:\Program Files\LucasArts\Star Wars Empire at War Forces of Corruption\swfoc.exe:*:Enabled:Star Wars™: Empire at War™: Forces of Corruption™ (Lucasfilm Entertainment Company, Ltd.)
F:\Program Files\LucasArts\Star Wars Empire at War\GameData\sweaw.exe:*:Enabled:Petroglyph (Lucasfilm Entertainment Company, Ltd.)
F:\Program Files\Microsoft LifeCam\LifeCam.exe:*:Enabled:LifeCam.exe (Microsoft Corporation)
F:\Program Files\Microsoft LifeCam\LifeExp.exe:*:Enabled:LifeExp.exe File not found
F:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager (Electronic Arts)
F:\Program Files\ASUS\GamerOSD\SBS.exe:*:Enabled:ASUS SBS Application (ASUSTeK Computer Inc.)
F:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA ()
F:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB ()
F:\Program Files\Activision\Call of Duty - World at War\CoDWaWmp.exe:*:Enabled:Call of Duty® - World at War™ (Activision Blizzard, Inc.)
F:\Program Files\Activision\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty® - World at War™ (Activision Blizzard, Inc.)
C:\Program Files\BitLord\BitLord.exe:*:Enabled:BitLord (www.BitLord.com)
F:\WINDOWS\system32\javaw.exe:*:Enabled:Java™ Platform SE binary (Sun Microsystems, Inc.)
F:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour (Apple Inc.)
F:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes (Apple Inc.)

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{07287123-B8AC-41CE-8346-3D777245C35B}" = Bonjour
"{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5
"{18F11181-EA1A-42AE-AF89-4867C7F7A6FA}" = Sound Blaster X-Fi
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java™ 6 Update 12
"{2DD388FF-6422-43C9-86A1-C7A99C83E946}" = ASUS nVidia Driver
"{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource
"{315ACD04-BCEB-478B-9B1D-5431D0E6CB11}" = ASUS Gamer OSD
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{43602F34-1AA3-44FB-AEB2-D08C2C73743F}" = Paint.NET v3.36
"{63AFACBC-4795-4A1B-8037-5085DC03FC54}" = Microsoft LifeCam
"{643B36F3-BED0-4FBB-8184-57D1C060DBDA}" = Wireless LAN Card
"{6592FDEC-2C1A-413A-9985-25FEC2F0848D}" = Star Wars Empire at War Forces of Corruption
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{75B869DA-C51D-4021-B8C8-5C23F46E078F}" = ASUS Smart Doctor
"{7A529246-912F-4C40-A82A-E608DB702FD7}" = ASUS VideoSecurity Online
"{90110409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{AC54E544-3E42-443C-A91D-A00A6974C592}" = NVIDIA PhysX v8.10.13
"{AC76BA86-7AD7-1033-7B44-A70000000000}" = Adobe Reader 7.0
"{B023185F-F1EF-4F97-B0BD-AE6D802226D1}" = NVIDIA WDM Drivers
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}" = SUPERAntiSpyware Free Edition
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D1E44702-21F5-4918-B8A3-6D126D5BD33C}" = Windows Messenger 5.1
"{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty® - World at War™
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{EC4455AB-F155-4CC1-A4C5-88F3777F9886}" = Apple Mobile Device Support
"{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}" = iTunes
"53F13DB4D9611FD63BE580F06F0729BF236ABE68" = Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Ad-Aware" = Ad-Aware
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Audacity_is1" = Audacity 1.2.6
"AudioCS" = Creative Audio Control Panel
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.3
"AVS4YOU Video Converter 6_is1" = AVS Video Converter 6
"CCleaner" = CCleaner (remove only)
"Combined Community Codec Pack_is1" = Combined Community Codec Pack 2008-09-21 16:18
"Creative Media Toolbox" = Creative Media Toolbox
"DIKO Free_is1" = DIKO 2.45
"HijackThis" = HijackThis 2.0.2
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"InstallShield_{69640730-B830-4C24-BB5C-222DA1260548}" = Turbo Lister 2
"InstallShield_{75B869DA-C51D-4021-B8C8-5C23F46E078F}" = ASUS Smart Doctor
"InstallShield_{7A529246-912F-4C40-A82A-E608DB702FD7}" = ASUS VideoSecurity Online
"InstallShield_{D80A6A73-E58A-4673-AFF5-F12D7110661F}" = Call of Duty® - World at War™
"InstallShield_{EF7E931D-DC84-471B-8DB6-A83358095474}" = EA Download Manager
"InterActual Player" = InterActual Player
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.0.6)" = Mozilla Firefox (3.0.6)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"OpenRPG" = OpenRPG (Remove Only)
"oZone3D.Net FurMark_is1" = oZone3D.Net FurMark v1.5.0
"PowerStrip 3 (remove only)" = PowerStrip 3 (remove only)
"PunkBusterSvc" = PunkBuster Services
"SysInfo" = Creative System Information
"SystemRequirementsLab" = System Requirements Lab
"UltraISO_is1" = UltraISO Premium V9.31
"Warhammer Online - Age of Reckoning" = Warhammer Online - Age of Reckoning
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR archiver
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"World of Warcraft" = World of Warcraft
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"wxPython2.8-unicode-py25_is1" = wxPython [removed] (unicode) for Python 2.5
"xvid" = XviD MPEG-4 Video Codec

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 2/23/2009 11:59:53 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x2665736c.

Error - 2/24/2009 8:37:25 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module sdhelper.dll, version 1.6.2.14, fault address 0x0000517c.

Error - 2/25/2009 10:45:39 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 7.0.6000.16791, faulting
module mshtml.dll, version 7.0.6000.16809, fault address 0x0004e170.

Error - 2/25/2009 11:43:35 PM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module unknown, version 0.0.0.0, fault address 0x6e6f6973.

Error - 2/27/2009 12:08:30 AM | Computer Name = HOME | Source = Lavasoft Ad-Aware Service | ID = 0
Description =

Error - 2/27/2009 12:36:16 AM | Computer Name = HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2/27/2009 12:38:07 AM | Computer Name = HOME | Source = Application Error | ID = 1000
Description = Faulting application svchost.exe, version 5.1.2600.5512, faulting
module nfr.dll, version 0.0.0.0, fault address 0x00001c4d.

Error - 2/27/2009 12:46:43 AM | Computer Name = HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 2/27/2009 1:56:09 AM | Computer Name = HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 3/2/2009 1:40:41 AM | Computer Name = HOME | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 7.0.6000.16791, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

[ System Events ]
Error - 1/10/2009 12:05:13 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM Video Capture (universal) service failed to start due
to the following error: %%1058

Error - 1/10/2009 12:05:13 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM A/V Crossbar service failed to start due to the following
error: %%1058

Error - 1/10/2009 12:30:35 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM Video Capture (universal) service failed to start due
to the following error: %%1058

Error - 1/10/2009 12:30:35 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM A/V Crossbar service failed to start due to the following
error: %%1058

Error - 1/10/2009 12:30:51 PM | Computer Name = HOME | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume C:.

Error - 1/10/2009 12:30:51 PM | Computer Name = HOME | Source = Ntfs | ID = 262199
Description = The file system structure on the disk is corrupt and unusable. Please
run the chkdsk utility on the volume C:.

Error - 1/10/2009 6:34:06 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM Video Capture (universal) service failed to start due
to the following error: %%1058

Error - 1/10/2009 6:34:06 PM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM A/V Crossbar service failed to start due to the following
error: %%1058

Error - 1/14/2009 4:07:56 AM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM Video Capture (universal) service failed to start due
to the following error: %%1058

Error - 1/14/2009 4:07:56 AM | Computer Name = HOME | Source = Service Control Manager | ID = 7000
Description = The nVidia WDM A/V Crossbar service failed to start due to the following
error: %%1058


< End of report >
I'd like for you to run this next online scan to check for anything that might be hidden.
The below scan can take up to an hour or longer, please be patient.

*Note
It is recommended to disable onboard antivirus program and antispyware programs while performing scans so no conflicts and to speed up scan time.
Please don't go surfing while your resident protection is disabled!
Once scan is finished remember to re-enable resident antivirus protection along with whatever antispyware app you use.


Please do a scan with Kaspersky Online Scanner or from here
http://www.kaspersky.com/virusscanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

  • Click on the Accept button and install any components it needs.
  • The program will install and then begin downloading the latest definition
    files.
  • After the files have been downloaded on the left side of the page in the Scan section select My Computer.
  • This will start the program and scan your system.
  • The scan will take a while, so be patient and let it run. (At times it may appear to stall)
    * Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    * Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    * Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
  • Once the scan is complete, click on View scan report To obtain the report:
Click on: Save Report As
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar In Save as type, click the drop arrow and select:
Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in
your reply.

Animated tutorial
http://i275.photobucket.com/albums/jj285/B…ng/KAS/KAS9.gif

(Note.. for Internet Explorer 7 users:
If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%
.)
Or use Firefox with IE-Tab plugin
https://addons.mozilla.org/en-US/firefox/addon/1419

In your next reply post:
Kaspersky log
New HJT log taken after the above scan has run
——————————————————————————–
KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, March 4, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, March 04, 2009 13:51:22
Records in database: 1868345
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 309944
Threat name: 1
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 03:05:03


File name / Threat name / Threats count
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\17\72460511-4902455e Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\6.0\20\57b210d4-4d4bf16d Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\OP.jar-3df4552-2c242387.zip Infected: Trojan-Downloader.Java.OpenStream.ac 1
C:\Documents and Settings\Matt\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\OP.jar-7bbdce6d-2d0eacb6.zip Infected: Trojan-Downloader.Java.OpenStream.ac 1

The selected area was scanned.





HJT Log


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:36:39 PM, on 3/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Creative\Shared Files\CTAudSvc.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
F:\WINDOWS\CTHELPER.EXE
F:\WINDOWS\SYSTEM32\CTXFISPI.EXE
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
F:\program files\powerstrip\pstrip.exe
F:\WINDOWS\system32\CTXFIHLP.EXE
F:\Program Files\Java\jre6\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\ATKKBService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Java\jre6\bin\java.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\WINDOWS\system32\NOTEPAD.EXE
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [LifeCam] "F:\Program Files\Microsoft LifeCam\LifeExp.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1224074379171
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - F:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 8937 bytes
Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop


  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : How to Disable your Security Programs

  • Double click on ComboFix.exe & follow the prompts.

  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.

  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


[external image: Posted Image]



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

[external image: Posted Image]


Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Please also post an updated HijackThis log and let me know how it's running.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.
3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you – please tell your helper.
4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.
Things seem to be running pretty smoothly right now. I haven't had that redirect occur as of late. NOt exactly sure in which iteration this occurred, though.

Here's the combofix log followed by the HJT.

ComboFix 09-03-03.01 - Matt 2009-03-04 22:46:04.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1475 [GMT -5:00]
Running from: f:\documents and settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_ISODRIVE
——-\Service_ISODrive


((((((((((((((((((((((((( Files Created from 2009-02-05 to 2009-03-05 )))))))))))))))))))))))))))))))
.

2009-02-27 00:09 . 2009-02-27 00:09 d——– f:\program files\Trend Micro
2009-02-26 23:24 . 2009-02-26 23:26 d——– f:\program files\Audacity
2009-02-26 23:20 . 2009-02-26 23:10 15,688 –a—— f:\windows\system32\lsdelete.exe
2009-02-26 23:10 . 2009-02-26 23:10 64,160 –a—— f:\windows\system32\drivers\Lbd.sys
2009-02-26 23:08 . 2009-02-26 23:08 d——– f:\program files\Lavasoft
2009-02-26 23:08 . 2009-02-26 23:10 d——– f:\documents and settings\All Users\Application Data\Lavasoft
2009-02-26 23:08 . 2009-02-26 23:08 d–h-c— f:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-02-26 22:58 . 2009-02-26 22:58 0 –a—— f:\windows\system32\drivers\nfr.dll.gpref
2009-02-25 21:36 . 2009-02-25 21:36 d——– f:\program files\MSECache
2009-02-24 16:18 . 2009-01-09 14:19 1,089,593 —–c— f:\windows\system32\dllcache\ntprint.cat
2009-02-22 12:08 . 2009-02-22 12:08 d——– f:\program files\iTunes
2009-02-22 12:08 . 2009-02-22 12:08 d——– f:\program files\iPod
2009-02-22 12:08 . 2009-02-22 12:08 d——– f:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2009-02-22 12:07 . 2009-02-22 12:08 d——– f:\program files\QuickTime
2009-02-22 11:57 . 2009-02-22 11:57 d——– f:\program files\Bonjour
2009-02-18 21:51 . 2009-02-18 21:51 d——– f:\program files\Common Files\AVSMedia
2009-02-18 21:51 . 2009-02-18 21:51 d——– f:\program files\AVS4YOU
2009-02-18 21:51 . 2008-08-13 10:22 1,700,352 –a—— f:\windows\system32\GdiPlus.dll
2009-02-18 21:51 . 2008-08-13 10:22 487,424 –a—— f:\windows\system32\msvcp70.dll
2009-02-18 21:51 . 2008-08-13 10:22 24,576 –a—— f:\windows\system32\msxml3a.dll
2009-02-18 21:38 . 2004-05-26 09:37 719,872 –a—— f:\windows\system32\devil.dll
2009-02-18 21:38 . 2006-12-30 23:16 313,344 –a—— f:\windows\system32\avisynth.dll
2009-02-18 21:37 . 2009-02-18 21:38 d——– f:\program files\DIKO
2009-02-16 22:16 . 2009-02-23 09:28 d——– f:\program files\Google
2009-02-16 22:05 . 2009-02-25 20:11 d——– f:\documents and settings\Matt\.maptool
2009-02-16 22:05 . 2009-02-16 22:04 410,984 –a—— f:\windows\system32\deploytk.dll
2009-02-16 22:05 . 2009-02-16 22:04 73,728 –a—— f:\windows\system32\javacpl.cpl
2009-02-16 22:04 . 2009-02-16 22:04 d——– f:\program files\Java
2009-02-16 21:58 . 2009-02-16 22:01 d——– f:\program files\RPGTools
2009-02-11 22:48 . 2009-02-12 23:56 d——– f:\program files\OpenRPG
2009-02-11 22:47 . 2009-02-11 22:47 d——– F:\Python25

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-05 02:55 196,608 —-a-w f:\windows\system32\drivers\nVivid.bin
2009-03-04 04:33 138,464 —-a-w f:\windows\system32\drivers\PnkBstrK.sys
2009-03-02 05:15 ——— d—–w f:\program files\Microsoft LifeCam
2009-02-27 04:49 ——— d—–w f:\program files\Malwarebytes' Anti-Malware
2009-02-22 17:08 ——— d—–w f:\program files\Common Files\Apple
2009-02-11 15:19 38,496 —-a-w f:\windows\system32\drivers\mbamswissarmy.sys
2009-02-11 15:19 15,504 —-a-w f:\windows\system32\drivers\mbam.sys
2009-02-06 08:09 ——— d—–w f:\program files\SUPERAntiSpyware
2009-02-06 08:01 ——— d—–w f:\program files\Microsoft Works
2009-02-05 05:10 ——— d—–w f:\program files\World of Warcraft
2009-02-04 23:35 ——— d—–w f:\program files\Microsoft ActiveSync
2009-02-04 23:35 ——— d—–w f:\program files\Common Files\L&H
2009-02-04 23:33 ——— d—–w f:\program files\Microsoft.NET
2009-02-04 01:05 ——— d–h–w f:\program files\InstallShield Installation Information
2009-02-04 01:05 ——— d—–w f:\program files\eBay
2009-01-25 21:34 ——— d—–w f:\documents and settings\Matt\Application Data\Media Player Classic
2009-01-25 21:22 ——— d—–w f:\program files\Combined Community Codec Pack
2009-01-23 01:45 ——— d—–w f:\documents and settings\Matt\Application Data\Apple Computer
2009-01-05 05:49 ——— d—–w f:\documents and settings\Matt\Application Data\CyberLink
2009-01-05 05:49 ——— d—–w f:\documents and settings\All Users\Application Data\CyberLink
2009-01-05 05:48 ——— d—–w f:\program files\CyberLink
2009-01-05 05:46 ——— d—–w f:\program files\InterActual
2009-01-05 05:29 ——— d—–w f:\documents and settings\Matt\Application Data\Creative
2009-01-05 05:20 ——— d—–w f:\documents and settings\All Users\Application Data\Creative
2009-01-05 05:18 ——— d—–w f:\program files\Common Files\Creative Labs Shared
2009-01-05 05:08 196,608 —-a-w f:\windows\system32\drivers\nStandard.bin
2009-01-04 18:19 22,328 —-a-w f:\documents and settings\Matt\Application Data\PnkBstrK.sys
2008-12-17 05:23 53,983 —-a-w F:\MGlogs.zip
2008-12-17 05:13 1,312,755 —-a-w F:\MGtools.exe
2008-10-17 00:04 32,768 –sha-w f:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008101620081017\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Creative Detector"="f:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400]
"MSMSGS"="f:\program files\Messenger\msmsgs.exe" [2008-06-02 1660952]
"ctfmon.exe"="f:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"SUPERAntiSpyware"="f:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2009-02-06 1830128]
"ASUS SmartDoctor"="c:\program files\ASUS\SmartDoctor\SmartDoctor.exe" [2008-07-09 1150976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="f:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2008-11-12 13672448]
"CTDVDDET"="f:\program files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE" [2003-06-18 45056]
"RCSystem"="f:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]
"AudioDrvEmulator"="f:\program files\Creative\Shared Files\Module Loader\DLLML.exe" [2005-06-16 49152]
"VolPanel"="f:\program files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" [2005-07-11 122880]
"UpdReg"="f:\windows\UpdReg.EXE" [2000-05-11 90112]
"NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2008-11-12 86016]
"ASUSGamerOSD"="f:\program files\ASUS\GamerOSD\GamerOSD.exe" [2008-05-28 380928]
"PowerStrip"="f:\program files\powerstrip\pstrip.exe" [2008-11-19 737312]
"SunJavaUpdateSched"="f:\program files\Java\jre6\bin\jusched.exe" [2009-02-16 148888]
"QuickTime Task"="f:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="f:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="f:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-26 509784]
"nwiz"="nwiz.exe" [2008-11-12 f:\windows\system32\nwiz.exe]
"CTHelper"="CTHELPER.EXE" [2005-08-07 f:\windows\CTHELPER.EXE]
"CTxfiHlp"="CTXFIHLP.EXE" [2008-10-07 f:\windows\system32\Ctxfihlp.exe]

f:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - f:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "f:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-02-06 03:09 356352 f:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.asv2"= asusasv2.dll
"vidc.ffds"= f:\progra~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"f:\\Program Files\\Messenger\\Msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"f:\\Program Files\\LucasArts\\Star Wars Empire at War Forces of Corruption\\swfoc.exe"=
"f:\\Program Files\\LucasArts\\Star Wars Empire at War\\GameData\\sweaw.exe"=
"f:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"f:\\Program Files\\Electronic Arts\\EADM\\Core.exe"=
"f:\\Program Files\\ASUS\\GamerOSD\\SBS.exe"=
"f:\\WINDOWS\\system32\\PnkBstrA.exe"=
"f:\\WINDOWS\\system32\\PnkBstrB.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaWmp.exe"=
"f:\\Program Files\\Activision\\Call of Duty - World at War\\CoDWaW.exe"=
"c:\\Program Files\\BitLord\\BitLord.exe"=
"f:\\WINDOWS\\system32\\javaw.exe"=
"f:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"f:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:nfr
"7070:TCP"= 7070:TCP:nfr

R0 Lbd;Lbd;f:\windows\system32\drivers\Lbd.sys [2009-02-26 64160]
R1 SASDIFSV;SASDIFSV;f:\program files\SUPERAntiSpyware\sasdifsv.sys [2008-12-04 8944]
R1 SASKUTIL;SASKUTIL;f:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2008-12-04 55024]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;f:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R2 PStrip;PStrip;f:\windows\system32\drivers\pstrip.sys [2007-07-14 27992]
R3 CT20XUT.SYS;CT20XUT.SYS;f:\windows\system32\drivers\CT20XUT.sys [2008-10-08 171032]
R3 CTEXFIFX.SYS;CTEXFIFX.SYS;f:\windows\system32\drivers\CTEXFIFX.sys [2008-10-08 1324056]
R3 SASENUM;SASENUM;f:\program files\SUPERAntiSpyware\SASENUM.SYS [2008-12-04 7408]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;f:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2009-01-05 79360]
S3 CT20XUT;CT20XUT;f:\windows\system32\drivers\CT20XUT.sys [2008-10-08 171032]
S3 CTEXFIFX;CTEXFIFX;f:\windows\system32\drivers\CTEXFIFX.sys [2008-10-08 1324056]
S3 CTHWIUT.SYS;CTHWIUT.SYS;f:\windows\system32\drivers\CTHWIUT.sys [2008-10-08 72728]
S3 CTHWIUT;CTHWIUT;f:\windows\system32\drivers\CTHWIUT.sys [2008-10-08 72728]
S3 VX6000;Microsoft LifeCam VX-6000;f:\windows\system32\drivers\VX6000Xp.sys [2008-11-12 2385896]
.
Contents of the 'Scheduled Tasks' folder

2009-02-27 f:\windows\Tasks\Ad-Aware Update (Weekly).job
- f:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-26 23:10]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-LifeCam - f:\program files\Microsoft LifeCam\LifeExp.exe
HKLM-Run-NWEReboot - (no file)


.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.yahoo.com/
IE: E&xport to Microsoft Excel - f:\progra~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - f:\documents and settings\Matt\Application Data\Mozilla\Firefox\Profiles\o3w1sgg7.default\
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-03-04 22:49:35
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CTxfiHlp = CTXFIHLP.EXE?

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(528)
f:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
———————— Other Running Processes ————————
.
f:\program files\Creative\Shared Files\CTAudSvc.exe
f:\windows\system32\rundll32.exe
f:\windows\system32\CTxfispi.exe
f:\program files\Creative\ShareDLL\CADI\NotiMan.exe
f:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
f:\windows\ATKKBService.exe
f:\program files\Bonjour\mDNSResponder.exe
f:\windows\system32\CTSVCCDA.EXE
f:\program files\Java\jre6\bin\jqs.exe
f:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
f:\program files\Microsoft LifeCam\MSCamS32.exe
f:\windows\system32\nvsvc32.exe
f:\windows\system32\PnkBstrA.exe
f:\program files\iPod\bin\iPodService.exe
f:\windows\system32\wbem\unsecapp.exe
.
**************************************************************************
.
Completion time: 2009-03-04 22:52:11 - machine was rebooted
ComboFix-quarantined-files.txt 2009-03-05 03:52:08
ComboFix2.txt 2008-12-17 05:07:22

Pre-Run: 164,506,456,064 bytes free
Post-Run: 164,866,387,968 bytes free

214 — E O F — 2009-02-27 08:01:03







Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:55:15 PM, on 3/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Creative\Shared Files\CTAudSvc.exe
F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
F:\program files\powerstrip\pstrip.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\WINDOWS\SYSTEM32\CTXFISPI.EXE
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\ATKKBService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\WINDOWS\system32\wuauclt.exe
F:\WINDOWS\system32\notepad.exe
F:\WINDOWS\explorer.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1224074379171
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - F:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 9050 bytes
Hi,

I see you have MalwareBytes' installed. I would like you to run it and do some cleanup.

First, use Use ATF Cleaner to remove temp files,
cookies, cache, ect…

Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.
For Technical Support, double-click the e-mail address located at the bottom of each menu.

  • Run MalwareBytes' and run an update.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy and Paste the entire report in your next reply along with a Hijackthis log.
Let me know how it's running too please.
Howdy,

Things seem to be running well, I haven't had the redirect in a while, so that's good. I feel like something in here's slowing down my connectivity, however, as internet connections are taking longer than they were prior to this.

MWB and HJT logs below.

Thanks for all the help, thus far!!



Malwarebytes' Anti-Malware 1.34
Database version: 1822
Windows 5.1.2600 Service Pack 3

3/5/2009 9:56:04 PM
mbam-log-2009-03-05 (21-56-04).txt

Scan type: Quick Scan
Objects scanned: 68909
Time elapsed: 2 minute(s), 0 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:57:43 PM, on 3/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Creative\Shared Files\CTAudSvc.exe
F:\WINDOWS\Explorer.EXE
F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
F:\WINDOWS\CTHELPER.EXE
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
F:\WINDOWS\SYSTEM32\CTXFISPI.EXE
F:\program files\powerstrip\pstrip.exe
F:\WINDOWS\system32\CTXFIHLP.EXE
F:\Program Files\Java\jre6\bin\jusched.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\ctfmon.exe
F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\WINDOWS\ATKKBService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1224074379171
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - F:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 9110 bytes
Is it just your internet that is slow? Or the PC in general?

One of the other things I've noticed is you have 2 Anti-Spyware programs running real time, SuperAntiSpyware and Ad-Aware. And you have no Antivirus, which is critical.

I would advise stopping the real time protection on one of the Anti-Spyware programs, and see if that helps with the speed. Then you need to install an Antivirus as that is critical. Here are a few free for home use ones:

AVG AntiVirus
Avast Antivirus Home Version–Free
Antivir Personal - Free

Install, update, and run a full system scan with one of these. Report back with a new HJT log and let me know how it's running.
The computer seems to be running well, I'm not noticing any general slowdowns, but the Internet is really just creeping along. I've got a laptop hooked up to the same router and it's working fine. must be something on this desktop… the good news is that the redirect issue seems to be resolved!

Aside from the slowness, upon my last reboot, I'm now getting an error on startup telling me that "Data Execution Prevention" (DEP) has prevented a program from starting that could possibly contain malicious code. "Generic Host
Process for Win32 Services" is the culprit. No idea why that's starting.


i ran Avast and it caught 4 files. i cleaned them and ran it twice more - no infections. HJT log is below.

Thanks again!


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:31:35 PM, on 3/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
F:\WINDOWS\System32\smss.exe
F:\WINDOWS\system32\winlogon.exe
F:\WINDOWS\system32\services.exe
F:\WINDOWS\system32\lsass.exe
F:\WINDOWS\system32\svchost.exe
F:\WINDOWS\System32\svchost.exe
F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
F:\Program Files\Alwil Software\Avast4\ashServ.exe
F:\WINDOWS\Explorer.EXE
F:\WINDOWS\system32\spoolsv.exe
F:\Program Files\Creative\Shared Files\CTAudSvc.exe
F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE
F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
F:\WINDOWS\CTHELPER.EXE
F:\WINDOWS\system32\RUNDLL32.EXE
F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
F:\WINDOWS\SYSTEM32\CTXFISPI.EXE
F:\program files\powerstrip\pstrip.exe
F:\WINDOWS\system32\CTXFIHLP.EXE
F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
F:\Program Files\Java\jre6\bin\jusched.exe
F:\WINDOWS\ATKKBService.exe
F:\Program Files\Bonjour\mDNSResponder.exe
F:\WINDOWS\system32\CTsvcCDA.EXE
F:\Program Files\Java\jre6\bin\jqs.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
F:\Program Files\Microsoft LifeCam\MSCamS32.exe
F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
F:\Program Files\Messenger\msmsgs.exe
F:\WINDOWS\system32\ctfmon.exe
C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe
F:\Program Files\Creative\ShareDLL\CADI\NotiMan.exe
F:\WINDOWS\system32\nvsvc32.exe
F:\WINDOWS\system32\PnkBstrA.exe
F:\WINDOWS\system32\svchost.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Program Files\Alwil Software\Avast4\ashSimpl.exe
F:\Program Files\Internet Explorer\iexplore.exe
F:\Program Files\iTunes\iTunes.exe
F:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - F:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - F:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - F:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - F:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - F:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [CTDVDDET] "F:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE"
O4 - HKLM\..\Run: [RCSystem] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" RCSystem * -Startup
O4 - HKLM\..\Run: [AudioDrvEmulator] "F:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe" -1 AudioDrvEmulator "F:\Program Files\Creative\Shared Files\Module Loader\Audio Emulator\AudDrvEm.dll"
O4 - HKLM\..\Run: [VolPanel] "F:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe" /r
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [UpdReg] F:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [ASUSGamerOSD] F:\Program Files\ASUS\GamerOSD\GamerOSD.exe
O4 - HKLM\..\Run: [PowerStrip] f:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] F:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avast!] F:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Creative Detector] "F:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
O4 - HKCU\..\Run: [MSMSGS] "F:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] F:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - F:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: @F:\Program Files\Messenger\Msgslang.dll,-61144 - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/MSDcode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownlo…/sysreqlab3.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1224074379171
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://dl8-cdn-01.sun.com/s/ESD7/JSCDL/jdk…ows-i586-jc.cab
O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - F:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - F:\WINDOWS\ATKKBService.exe
O23 - Service: avast! Antivirus - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - F:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - F:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - F:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - F:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - F:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - F:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - F:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - F:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - F:\WINDOWS\system32\PnkBstrA.exe

–
End of file - 9701 bytes

Aside from the slowness, upon my last reboot, I'm now getting an error on startup telling me that "Data Execution Prevention" (DEP) has prevented a program from starting that could possibly contain malicious code. "Generic Host
Process for Win32 Services" is the culprit. No idea why that's starting.

Hmm….okay. I'll look into that some more. In the meantime let's run another scan. Also, do you have any info. on what Avast found? Like file name, location, ect…?

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
  • Doubleclick the drweb-cureit.exe file and Allow to run the express scan
  • This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
  • Once the short scan has finished, mark the drives that you want to scan.
  • Select all drives. A red dot shows which drives have been chosen.
  • Click the green arrow at the right, and the scan will start.
  • Click 'Yes to all' if it asks if you want to cure/move the file.
  • When the scan has finished, in the menu, click file and choose save report list
  • Save the report to your desktop. The report will be called DrWeb.csv
  • Close Dr.Web Cureit.
Post the report in your next reply.
Unfortunately, I don't remember what any of the virus catches were and I deleted all the log files. Probably not the best move on my part. I'm kicking myself for it now. Here's the Dr. Web log. ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;F:\Documents and Settings\Matt\Desktop\ComboFix.exe/data002;Program.PsExec.171;; data002;F:\Documents and Settings\Matt\Desktop;Archive contains infected objects;; ComboFix.exe;F:\Documents and Settings\Matt\Desktop;Container contains infected objects;Moved.; Process.exe;F:\MGtools;Tool.Prockill;; A0018946.EXE;F:\System Volume Information\_restore{C2B7C6DE-A44B-415F-8958-0C4E788EB191}\RP109;Program.PsExec.170;; A0019013.exe;F:\System Volume Information\_restore{C2B7C6DE-A44B-415F-8958-0C4E788EB191}\RP110;Tool.Prockill;; A0027382.bat;F:\System Volume Information\_restore{C2B7C6DE-A44B-415F-8958-0C4E788EB191}\RP186;Probably BATCH.Virus;; A0027399.EXE;F:\System Volume Information\_restore{C2B7C6DE-A44B-415F-8958-0C4E788EB191}\RP186;Program.PsExec.170;; A0027987.bat;F:\System Volume Information\_restore{C2B7C6DE-A44B-415F-8958-0C4E788EB191}\RP189;Probably BATCH.Virus;;

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI