[Resolved] WinPatrol Website Popup

The Desktop Icons changed into white instead of trasnlucent. And I started getting pop ups about changing my homepage. I always said no. I tried running anti virus and spyware programs such as Malewarebytes. I will attach a picture of it if that helps. ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/10/14 12:56 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP3 ================================================== Drivers ——————- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xB657A000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xBADE2000 Size: 8192 File Visible: No Signed: - Status: - Name: giveio.sys Image Path: giveio.sys Address: 0xBAE71000 Size: 1664 File Visible: No Signed: - Status: - Name: PCI_PNP2228 Image Path: \Driver\PCI_PNP2228 Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xB4DA1000 Size: 49152 File Visible: No Signed: - Status: - Name: speedfan.sys Image Path: speedfan.sys Address: 0xBADAC000 Size: 5248 File Visible: No Signed: - Status: - Name: spln.sys Image Path: spln.sys Address: 0xBA6A7000 Size: 1048576 File Visible: No Signed: - Status: - Name: sptd Image Path: \Driver\sptd Address: 0x00000000 Size: 0 File Visible: No Signed: - Status: - SSDT ——————- #: 041 Function Name: NtCreateKey Status: Hooked by "spln.sys" at address 0xba6a80e0 #: 071 Function Name: NtEnumerateKey Status: Hooked by "spln.sys" at address 0xba6c6ca2 #: 073 Function Name: NtEnumerateValueKey Status: Hooked by "spln.sys" at address 0xba6c7030 #: 119 Function Name: NtOpenKey Status: Hooked by "spln.sys" at address 0xba6a80c0 #: 160 Function Name: NtQueryKey Status: Hooked by "spln.sys" at address 0xba6c7108 #: 177 Function Name: NtQueryValueKey Status: Hooked by "spln.sys" at address 0xba6c6f88 #: 247 Function Name: NtSetValueKey Status: Hooked by "spln.sys" at address 0xba6c719a ==EOF== DDS (Ver_09-10-13.01) - NTFSx86 Run by [removed] at 12:54:40.56 on Wed 10/14/2009 Internet Explorer: 6.0.2900.5512 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2708 [GMT -7:00] AV: McAfee VirusScan *On-access scanning enabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83} FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup svchost.exe C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\McAfee\SiteAdvisor\McSACore.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\Program Files\McAfee\MPF\MPFSrv.exe C:\Program Files\McAfee\MSK\MskSrver.exe E:\Other Applications\NVIDIA Corporation\nTune\nTuneService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\PnkBstrA.exe C:\WINDOWS\system32\PnkBstrB.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\Java\jre6\bin\jusched.exe E:\Other Applications\Microsoft Office\Office12\GrooveMonitor.exe E:\Other Applications\WinPatrol\winpatrol.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe E:\Other Applications\MultiScreen\MultiScreen.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe E:\Other Applications\Uniblue\RegistryBooster 2\RegistryBooster.exe E:\Other Applications\NaturalColour\NCProTray.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\ALCFDRTM.EXE C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Documents and Settings\John Baron\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = about:blank uInternet Settings,ProxyOverride = *.local BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: McAfee Phishing Filter: {27b4851a-3207-45a2-b947-be8afe6163ab} - c:\progra~1\mcafee\msk\mskapbho.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - e:\other applications\microsoft office\office12\GrooveShellExtensions.dll BHO: Java™ Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll uRun: [updateMgr] c:\program files\adobe\acrobat 7.0\reader\AdobeUpdateManager.exe AcRdB7_1_0 uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\ahead\lib\NMBgMonitor.exe" uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe uRun: [Uniblue RegistryBooster 2] e:\other applications\uniblue\registrybooster 2\RegistryBooster.exe /S uRun: [NVIDIA nTune] "e:\other applications\nvidia corporation\ntune\nTuneCmd.exe" clear mRun: [RTHDCPL] RTHDCPL.EXE mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe mRun: [InCD] c:\program files\nero\nero 7\incd\InCD.exe mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [GrooveMonitor] "e:\other applications\microsoft office\office12\GrooveMonitor.exe" mRun: [WinPatrol] e:\other applications\winpatrol\winpatrol.exe -expressboot mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey mRun: [McENUI] c:\progra~1\mcafee\mhn\McENUI.exe /hide mRun: [MultiScreen] e:\other applications\multiscreen\MultiScreen.exe StartupFolder: c:\docume~1\johnba~1\startm~1\programs\startup\onenot~1.lnk - e:\other applications\microsoft office\office12\ONENOTEM.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ncprotray.lnk - e:\other applications\naturalcolour\NCProTray.exe IE: E&xport to Microsoft Excel - e:\othera~1\micros~1\office12\EXCEL.EXE/3000 IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - e:\othera~1\micros~1\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - e:\othera~1\micros~1\office12\REFIEBAR.DLL Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - e:\other applications\microsoft office\office12\GrooveSystemServices.dll Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - e:\other applications\microsoft office\office12\GrooveShellExtensions.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\johnba~1\applic~1\mozilla\firefox\profiles\t3m951hr.default\ FF - plugin: c:\program files\google\update\1.2.183.7\npGoogleOneClick8.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin2.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin3.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin4.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin5.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin6.dll FF - plugin: e:\other applications\quicktime\plugins\npqtplugin7.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} ============= SERVICES / DRIVERS =============== R1 BIOS;BIOS;c:\windows\system32\drivers\BIOS.sys [2008-7-22 13696] R1 BS_I2cIo;BS_I2cIo;c:\windows\system32\drivers\BS_I2cIo.sys [2008-7-22 16768] R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2009-9-8 12672] R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\mcafee\siteadvisor\McSACore.exe [2008-9-29 210216] S2 gupdate1c9948ffb128b4;Google Update Service (gupdate1c9948ffb128b4);c:\program files\google\update\GoogleUpdate.exe [2009-2-21 133104] S3 BS_Flash;BS_Flash;c:\program files\tseries bios update\award\BS_Flash.sys [2008-7-22 3604] S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-6 34064] S4 0251031237344700mcinstcleanup;McAfee Application Installer Cleanup (0251031237344700);c:\windows\temp\025103~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service –> c:\windows\temp\025103~1.exe c:\progra~1\common~1\mcafee\instal~1\cleanup.ini -cleanup -nolog -service [?] =============== Created Last 30 ================ ==================== Find3M ==================== 2009-10-02 16:50 69,285 a——- c:\windows\War3Unin.dat 2009-09-08 23:11 139,584 a——- c:\windows\system32\drivers\PnkBstrK.sys 2009-09-08 23:11 189,104 a——- c:\windows\system32\PnkBstrB.exe 2009-09-07 21:33 75,064 a——- c:\windows\system32\PnkBstrA.exe 2009-09-02 21:29 22,328 a——- c:\docume~1\johnba~1\applic~1\PnkBstrK.sys 2009-08-07 19:51 15,308,424 a——- c:\windows\system32\xlive.dll 2009-08-07 19:51 13,642,888 a——- c:\windows\system32\xlivefnt.dll 2009-08-06 19:23 274,288 a——- c:\windows\system32\mucltui.dll 2009-08-06 19:23 215,920 a——- c:\windows\system32\muweb.dll 2009-08-05 02:01 204,800 a——- c:\windows\system32\mswebdvd.dll 2009-07-28 21:37 119,808 a——- c:\windows\system32\t2embed.dll 2009-07-28 21:37 81,920 a——- c:\windows\system32\fontsub.dll 2009-07-20 09:34 70,936 a——- c:\windows\system32\PhysXLoader.dll 2009-07-17 12:01 58,880 a——- c:\windows\system32\atl.dll 2008-08-05 09:28 47,360 a——- c:\docume~1\johnba~1\applic~1\pcouffin.sys ============= FINISH: 12:55:04.10 ===============