[Closed] Google redirect, dvd burner disabled, and sys restore

Ok, I realize a lot of people have this problem, but your advice seems to differ person to person. I have tried to fix it myself, but I had no success. I figured I would get some real help before I messed things up worse than I may have already.

Basically, I have the google redirect virus which attacks Firefox, IE, and Chrome. Also, I have lost the ability to burn data DVDs which means I don't have a good way to back up my data. Also my system restore isn't working. I thought these were unrelated, but I see other people have had the same set of problems. Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:42:48 AM, on 9/3/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\AskBarDis\bar\bin\AskService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\TODDSrv.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\ddwmon.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Documents and Settings\Bradtastic\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
C:\WINDOWS\system32\RAMASST.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Winamp\winamp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://my.msn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.msu.edu:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;
O1 - Hosts: 69.253.151.209 idenupdate.motorola.com
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {080A1D79-D842-49CD-B0E7-DAF06B0BAE21} - C:\WINDOWS\system32\pmkjg.dll (file missing)
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Viewpoint Toolbar BHO - {A7327C09-B521-4EDB-8509-7D2660C9EC98} - C:\Program Files\Viewpoint\Viewpoint Toolbar\3.8.0\ViewBarBHO.dll (file missing)
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.8.0\IEViewBar.dll (file missing)
O3 - Toolbar: ZoneAlarm Spy Blocker Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [DDWMon] C:\Program Files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
O4 - HKLM\..\Run: [RecoverFromReboot] C:\WINDOWS\Temp\RecoverFromReboot.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Bradtastic\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} (Java Plug-in 1.5.0_06) -
O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} (Java Plug-in 1.6.0_02) -
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} (Java Plug-in 1.6.0_13) -
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} (Java Plug-in 1.6.0_14) -
O16 - DPF: {FFBB3F3B-0A5A-4106-BE53-DFE1E2340CB1} (DownloadManager Control) - http://dlm.tools.akamai.com/dlmanager/vers…vex-2.2.1.6.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: ASKService - Unknown owner - C:\Program Files\AskBarDis\bar\bin\AskService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe (file missing)
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - TOSHIBA Corporation - C:\WINDOWS\system32\TODDSrv.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

–
End of file - 13113 bytes

Well, it appears that everything is fixed. Google is not being redirected anymore. I was able to create a restore point. I didn't have a blank DVD to fully test the DVD burner, but I did not get the usually error message when I started the data burning process. Thanks a lot, I thought I was in serious trouble, but it looks like everything is fixed.




ComboFix 09-09-10.03 - Bradtastic 09/11/2009 13:29.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1526.1035 [GMT -4:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bradtastic\Application Data\inst.exe
c:\documents and settings\Bradtastic\My Documents\ZbThumbnail.info
c:\program files\INSTALL.LOG
c:\program files\Protection System
c:\windows\Installer\1f6a3a85.msi
c:\windows\Installer\1f6a3a86.msp
c:\windows\Installer\1f6a3a87.msp
c:\windows\Installer\1f6a3a88.msp
c:\windows\Installer\1f6a3a89.msp
c:\windows\Installer\1f6a3a8a.msp
c:\windows\Installer\1f6a3a8b.msp
c:\windows\Installer\1f6a3a8c.msp
c:\windows\Installer\1f6a3a8d.msp
c:\windows\Installer\1f6a3a8e.msp
c:\windows\Installer\9d22cf7.msp
c:\windows\kb913800.exe
c:\windows\system32\ahvhbiep.ini
c:\windows\system32\aogokqnc.ini
c:\windows\system32\behgcwdj.ini
c:\windows\system32\cilbfcrw.ini
c:\windows\system32\ddyfjiap.ini
c:\windows\system32\drivers\SKYNETaoyupsxo.sys
c:\windows\system32\ehkmp.bak1
c:\windows\system32\ehkmp.bak2
c:\windows\system32\ehkmp.ini
c:\windows\system32\ffhkj.bak1
c:\windows\system32\ffhkj.bak2
c:\windows\system32\ggxtaopc.ini
c:\windows\system32\ghwulpng.ini
c:\windows\system32\gjkmp.bak1
c:\windows\system32\gjkmp.bak2
c:\windows\system32\gjkmp.ini
c:\windows\system32\hesqblcf.ini
c:\windows\system32\hfydeipf.ini
c:\windows\system32\ikqbldvs.ini
c:\windows\system32\jcgqgmtn.ini
c:\windows\system32\jcufbqvi.ini
c:\windows\system32\jqaxygjn.ini
c:\windows\system32\llnmp.bak1
c:\windows\system32\llnmp.bak2
c:\windows\system32\llnmp.ini
c:\windows\system32\mvokalnt.ini
c:\windows\system32\phhueenu.ini
c:\windows\system32\pyxwiiiv.ini
c:\windows\system32\qdrdiamv.ini
c:\windows\system32\rbbrxfnn.ini
c:\windows\system32\rinerrfs.ini
c:\windows\system32\SKYNETdohsaeje.dll
c:\windows\system32\SKYNETjgdlmnhc.dat
c:\windows\system32\SKYNETmirpwrxc.dat
c:\windows\system32\SKYNEToeppctqv.dll
c:\windows\system32\SKYNETywtkuuox.dll
c:\windows\system32\tasbocbf.ini
c:\windows\system32\tcrrrgip.ini
c:\windows\system32\UACdkrvismlqj.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UAClxiyeegskd.dat
c:\windows\system32\UACnutmhwwupo.dll
c:\windows\system32\urmppwar.ini
c:\windows\system32\uunlaowl.ini
c:\windows\system32\vuobmdpr.ini
c:\windows\system32\wdktfaqa.ini
c:\windows\system32\xrigysgi.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_SKYNETwyluoodh
——-\Legacy_SKYNETwyluoodh
——-\Legacy_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2009-08-11 to 2009-09-11 )))))))))))))))))))))))))))))))
.

2009-09-10 17:31 . 2009-09-10 17:31 ——– d-sh–w- c:\documents and settings\Administrator\PrivacIE
2009-09-10 17:31 . 2009-09-10 17:31 ——– d-sh–w- c:\documents and settings\Administrator\IETldCache
2009-09-07 04:37 . 2009-09-07 04:37 ——– d–h–w- c:\windows\PIF
2009-09-02 21:21 . 2009-09-02 21:21 ——– d—–w- c:\documents and settings\Bradtastic\Local Settings\Application Data\Installer3040
2009-09-02 21:13 . 2009-09-02 21:13 ——– d—–w- c:\documents and settings\Bradtastic\Local Settings\Application Data\Installer5500
2009-08-31 19:10 . 2009-08-31 19:15 ——– d—–w- c:\documents and settings\Bradtastic\.gimp-2.2
2009-08-26 19:35 . 1999-01-22 22:31 180276 —-a-w- c:\windows\system32\Mspdb50.dll
2009-08-26 19:34 . 2009-08-26 19:34 ——– d—–w- c:\program files\Avid
2009-08-26 19:34 . 2001-02-01 20:10 45056 —-a-w- c:\windows\system32\wnaspi32.dll
2009-08-26 02:30 . 2009-08-27 16:32 ——– d—–w- C:\Colorado
2009-08-16 03:55 . 2009-08-16 03:55 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\Vso
2009-08-14 20:05 . 2009-08-14 20:05 ——– d—–w- C:\Temp
2009-08-14 20:05 . 2005-01-19 04:18 323584 —-a-w- c:\windows\system32\FoxImager.dll
2009-08-14 20:05 . 2002-01-05 11:37 344064 —-a-w- c:\windows\system32\msvcr70.dll
2009-08-14 20:05 . 1998-06-18 04:00 89360 —-a-w- c:\windows\system32\VB5DB.DLL
2009-08-14 20:05 . 2009-08-14 20:05 ——– d—–w- c:\program files\Cheetah Burner
2009-08-14 15:14 . 2009-08-14 15:17 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\vlc
2009-08-14 14:54 . 2009-08-14 14:54 ——– d—–w- c:\program files\VideoLAN
2009-08-13 21:39 . 2009-03-19 20:32 23400 —-a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
2009-08-13 21:39 . 2008-04-17 16:12 107368 —-a-w- c:\windows\system32\GEARAspi.dll
2009-08-13 21:39 . 2009-08-13 21:39 ——– d—–w- c:\program files\iPod
2009-08-13 21:38 . 2009-08-13 21:39 ——– d—–w- c:\program files\iTunes
2009-08-13 21:38 . 2009-08-13 21:39 ——– d—–w- c:\documents and settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-08-13 21:37 . 2009-08-13 21:39 ——– d—–w- c:\program files\Common Files\Apple
2009-08-13 19:47 . 2009-08-13 19:47 ——– d—–w- C:\New Folder
2009-08-12 19:19 . 2009-08-12 19:19 ——– d—–w- c:\windows\ServicePackFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-11 03:20 . 2007-07-11 03:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-09-11 03:20 . 2007-07-11 03:22 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-09-11 03:17 . 2007-01-25 03:22 ——– d—–w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-09-11 03:15 . 2008-01-27 05:18 ——– d—–w- c:\program files\DivX
2009-09-11 03:14 . 2009-05-16 22:07 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\Any Video Converter
2009-09-11 03:14 . 2009-05-16 22:07 ——– d—–w- c:\program files\Any Video Converter
2009-09-11 03:13 . 2006-07-20 02:38 ——– d—–w- c:\program files\Common Files\AOL
2009-09-11 03:12 . 2006-07-19 22:54 ——– d–h–w- c:\program files\InstallShield Installation Information
2009-09-11 03:11 . 2006-07-20 00:57 ——– d—–w- c:\program files\Common Files\Adobe
2009-09-10 20:22 . 2009-04-28 03:09 ——– d—–w- c:\documents and settings\All Users\Application Data\avg8
2009-09-07 05:05 . 2009-08-05 01:10 8192 –sha-w- c:\program files\Thumbs.db
2009-09-06 16:13 . 2009-04-23 06:36 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\uTorrent
2009-09-06 16:08 . 2009-04-23 06:05 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\DNA
2009-09-04 23:51 . 2007-10-18 21:53 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\OpenOffice.org2
2009-09-02 15:35 . 2006-12-27 08:17 18110 —-a-w- c:\documents and settings\Bradtastic\Application Data\wklnhst.dat
2009-08-16 22:13 . 2009-04-28 03:09 11952 —-a-w- c:\windows\system32\avgrsstx.dll
2009-08-16 22:13 . 2009-04-28 03:09 335240 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2009-08-16 22:13 . 2009-04-28 03:09 27784 —-a-w- c:\windows\system32\drivers\avgmfx86.sys
2009-08-16 03:57 . 2008-07-31 16:37 ——– d—–w- c:\program files\Inkscape
2009-08-16 03:55 . 2008-07-31 16:42 ——– d—–w- c:\documents and settings\Bradtastic\Application Data\Inkscape
2009-08-16 03:55 . 2009-07-31 04:33 ——– d—–w- c:\program files\DVDFab 6
2009-08-16 03:55 . 2009-08-16 03:55 47360 —-a-w- c:\documents and settings\Bradtastic\Application Data\pcouffin.sys
2009-08-13 22:27 . 2006-07-19 22:18 48320 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-13 21:38 . 2007-01-13 21:11 ——– d—–w- c:\program files\Bonjour
2009-08-13 20:37 . 2008-03-23 05:20 ——– d—–w- c:\program files\QuickTime
2009-08-13 20:36 . 2007-01-03 21:15 ——– d—–w- c:\program files\Apple Software Update
2009-08-10 00:19 . 2009-06-30 21:34 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-08-10 00:19 . 2006-07-20 01:52 ——– d—–w- c:\program files\Java
2009-08-06 15:24 . 2009-08-06 15:24 ——– d—–w- c:\program files\MSBuild
2009-08-06 15:24 . 2009-08-06 15:24 ——– d—–w- c:\program files\Reference Assemblies
2009-08-06 15:12 . 2008-08-10 06:05 ——– d—–w- c:\program files\Microsoft Silverlight
2009-08-06 07:03 . 2009-08-06 07:03 ——– d—–w- c:\program files\MSXML 6.0
2009-08-05 09:11 . 2006-07-19 00:47 204800 —-a-w- c:\windows\system32\mswebdvd.dll
2009-08-05 06:17 . 2009-08-05 01:27 ——– d—–w- c:\program files\Media
2009-07-31 06:36 . 2006-12-28 05:32 ——– d—–w- c:\documents and settings\All Users\Application Data\DVD Shrink
2009-07-31 05:14 . 2009-07-31 05:14 ——– d—–w- c:\documents and settings\All Users\Application Data\vsosdk
2009-07-17 18:55 . 2006-07-19 00:46 58880 —-a-w- c:\windows\system32\atl.dll
2009-07-14 03:43 . 2006-07-19 00:48 286208 —-a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2006-07-19 00:48 915456 —-a-w- c:\windows\system32\wininet.dll
2009-06-30 04:44 . 2009-06-30 15:48 15688 —-a-w- c:\windows\system32\lsdelete.exe
2009-06-30 04:43 . 2009-06-30 04:44 64160 —-a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-29 17:55 . 2007-07-11 03:17 4212 —ha-w- c:\windows\system32\zllictbl.dat
2009-06-25 18:36 . 2006-07-19 00:47 95744 —-a-w- c:\windows\system32\mqsec.dll
2009-06-25 18:36 . 2006-07-19 00:47 517120 —-a-w- c:\windows\system32\mqsnap.dll
2009-06-25 18:36 . 2006-07-19 00:47 48640 —-a-w- c:\windows\system32\mqupgrd.dll
2009-06-25 18:36 . 2006-07-19 00:47 471552 —-a-w- c:\windows\system32\mqutil.dll
2009-06-25 18:36 . 2006-07-19 00:47 186880 —-a-w- c:\windows\system32\mqtrig.dll
2009-06-25 18:36 . 2006-07-19 00:47 123392 —-a-w- c:\windows\system32\mqrtdep.dll
2009-06-25 18:36 . 2006-07-19 00:47 661504 —-a-w- c:\windows\system32\mqqm.dll
2009-06-25 18:36 . 2006-07-19 00:47 47104 —-a-w- c:\windows\system32\mqdscli.dll
2009-06-25 18:36 . 2006-07-19 00:47 225280 —-a-w- c:\windows\system32\mqoa.dll
2009-06-25 18:36 . 2006-07-19 00:47 177152 —-a-w- c:\windows\system32\mqrt.dll
2009-06-25 18:36 . 2006-07-19 00:47 16896 —-a-w- c:\windows\system32\mqise.dll
2009-06-25 18:36 . 2006-07-19 00:47 138240 —-a-w- c:\windows\system32\mqad.dll
2009-06-25 08:17 . 2006-07-19 00:48 59392 —-a-w- c:\windows\system32\wdigest.dll
2009-06-25 08:17 . 2006-07-19 00:47 56320 —-a-w- c:\windows\system32\secur32.dll
2009-06-25 08:17 . 2006-07-19 00:47 168448 —-a-w- c:\windows\system32\schannel.dll
2009-06-25 08:17 . 2006-07-19 00:47 136192 —-a-w- c:\windows\system32\msv1_0.dll
2009-06-25 08:17 . 2006-07-19 00:47 729600 —-a-w- c:\windows\system32\lsasrv.dll
2009-06-25 08:17 . 2006-07-19 00:47 301568 —-a-w- c:\windows\system32\kerberos.dll
2009-06-22 11:49 . 2006-07-19 00:47 117248 —-a-w- c:\windows\system32\mqtgsvc.exe
2009-06-22 11:49 . 2006-07-19 00:47 19968 —-a-w- c:\windows\system32\mqbkup.exe
2009-06-22 11:49 . 2006-07-19 00:47 4608 —-a-w- c:\windows\system32\mqsvc.exe
2009-06-22 11:48 . 2006-07-19 00:47 91776 —-a-w- c:\windows\system32\drivers\mqac.sys
2009-06-22 11:35 . 2006-07-19 00:47 92544 —-a-w- c:\windows\system32\drivers\ksecdd.sys
2009-06-17 15:27 . 2009-07-01 05:26 38160 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 15:27 . 2009-07-01 05:26 19096 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 14:55 . 2006-07-19 00:47 119808 —-a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:55 . 2006-07-19 00:47 82432 —-a-w- c:\windows\system32\fontsub.dll
2009-01-08 19:50 . 2009-01-08 19:50 678790 —-a-w- c:\program files\green spartan.jpg
2007-10-19 23:47 . 2009-02-13 19:56 3753 —-a-w- c:\program files\msu-green-logo.gif
2007-10-19 22:52 . 2009-02-13 19:55 14044 —-a-w- c:\program files\gruff.jpg
2007-10-19 20:48 . 2009-02-13 19:55 25337 —-a-w- c:\program files\michigan_state_logo.jpg
2007-04-30 14:52 . 2007-04-30 14:52 3858786 —-a-w- c:\program files\blackice.flv
.

((((((((((((((((((((((((((((( SnapShot@2009-09-11_02.45.02 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-11 17:41 . 2009-09-11 17:41 16384 c:\windows\Temp\Perflib_Perfdata_1e8.dat
+ 2006-07-19 02:40 . 2009-09-11 17:31 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-07-19 02:40 . 2009-09-11 00:58 32768 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2006-07-19 02:40 . 2009-09-11 00:58 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2006-07-19 02:40 . 2009-09-11 17:31 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2006-07-19 02:40 . 2009-09-11 17:31 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-07-19 02:40 . 2009-09-11 00:58 16384 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-07-01 01:58 . 2009-09-11 17:01 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-07-01 01:58 . 2009-09-11 00:58 245760 c:\windows\system32\config\systemprofile\IETldCache\index.dat
- 2009-09-11 01:02 . 2009-05-05 20:34 2824424 c:\windows\SoftwareDistribution\Download\Install\office2003-kb969615-fullfile-x86-en-us.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2008-10-16 22:22 333192 —-a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{3041d03e-fd4b-44e0-b742-2d9b88305f98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{3041D03E-FD4B-44E0-B742-2D9B88305F98}"= "c:\program files\AskBarDis\bar\bin\askBar.dll" [2008-10-16 333192]

[HKEY_CLASSES_ROOT\clsid\{3041d03e-fd4b-44e0-b742-2d9b88305f98}]
[HKEY_CLASSES_ROOT\TypeLib\{4b1c1e16-6b34-430e-b074-5928eca4c150}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Bradtastic\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2008-09-20 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-10 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-08-02 364544]
"DDWMon"="c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\\ddwmon.exe" [2006-04-26 299008]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 118784]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-03-02 761948]
"PadTouch"="c:\program files\TOSHIBA\Touch and Launch\PadExe.exe" [2005-12-06 1077322]
"Tvs"="c:\program files\Toshiba\Tvs\TvsTray.exe" [2006-02-02 73728]
"SmoothView"="c:\program files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-18 151552]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-07-03 802816]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-07-03 700416]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-01-10 185896]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-08-16 2007832]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-06-30 520024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-08-10 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-08-23 16050688]
"AGRSMMSG"="AGRSMMSG.exe" - c:\windows\agrsmmsg.exe [2006-03-18 89541]
"TPSMain"="TPSMain.exe" - c:\windows\system32\TPSMain.exe [2005-06-01 282624]
"TFncKy"="TFncKy.exe" [BU]

c:\documents and settings\Bradtastic\Start Menu\Programs\Startup\
Microsoft Office OneNote 2003 Quick Launch.lnk - c:\program files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2007-4-19 64864]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
RAMASST.lnk - c:\windows\system32\RAMASST.exe [2006-7-19 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-16 22:13 11952 —-a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"c:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= c:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\windows\system32\rbueamci.exe"= c:\windows\system32\rbu
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/30/2009 12:44 AM 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [4/27/2009 11:09 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [4/27/2009 11:09 PM 108552]
R2 ASKService;ASKService;c:\program files\AskBarDis\bar\bin\AskService.exe [6/29/2009 1:55 PM 464264]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [4/27/2009 11:09 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [4/27/2009 11:09 PM 297752]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 3:06 PM 1029456]
R2 tdudf;TOSHIBA UDF File System Driver;c:\windows\system32\drivers\tdudf.sys [6/28/2006 2:50 PM 98816]
S3 IO_Memory;IO_Memory;\??\c:\sysprep\Drivers\ioport.sys –> c:\sysprep\Drivers\ioport.sys [?]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [12/19/2007 12:14 AM 42112]
S3 SVRPEDRV;SVRPEDRV;\??\c:\sysprep\PEDrv.sys –> c:\sysprep\PEDrv.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-07 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 04:43]

2009-08-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2009-09-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2813578326-4000400447-2965763523-1005Core.job
- c:\documents and settings\Bradtastic\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-20 03:49]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2813578326-4000400447-2965763523-1005UA.job
- c:\documents and settings\Bradtastic\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-20 03:49]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.toshibadirect.com/dpdstart
uInternet Settings,ProxyServer = proxy.msu.edu:80
uInternet Settings,ProxyOverride =
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - ProfilePath - c:\documents and settings\Bradtastic\Application Data\Mozilla\Firefox\Profiles\cc95jf6o.default\
FF - prefs.js: browser.startup.homepage - hxxp://my.msn.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\documents and settings\Bradtastic\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-11 13:42
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'explorer.exe'(2484)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\TPwrCfg.DLL
c:\windows\system32\TPwrReg.dll
c:\windows\system32\TPSTrace.DLL
.
———————— Other Running Processes ————————
.
c:\program files\Intel\Wireless\Bin\EvtEng.exe
c:\program files\Intel\Wireless\Bin\S24EvMon.exe
c:\windows\system32\ZoneLabs\vsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\TOSHIBA\ConfigFree\CFSvcs.exe
c:\windows\system32\DVDRAMSV.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\Intel\Wireless\Bin\RegSrvc.exe
c:\program files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
c:\windows\system32\TODDSrv.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\TOSHIBA\TOSHIBA Direct Disc Writer\DDWMon.exe
c:\program files\Synaptics\SynTP\Toshiba.exe
c:\windows\ehome\ehmsas.exe
c:\windows\system32\TPSBattM.exe
c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
c:\documents and settings\Bradtastic\Local Settings\Application Data\Google\Update\1.2.183.7\GoogleCrashHandler.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Real\RealPlayer\realplay.exe
.
**************************************************************************
.
Completion time: 2009-09-11 13:51 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-11 17:51
ComboFix2.txt 2009-09-11 02:50

Pre-Run: 49,961,025,536 bytes free
Post-Run: 49,716,830,208 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

383 — E O F — 2009-09-11 17:45