[Resolved] Firefox redirects to directrdr.com

Looking around the website I realise that I should have posted my RootAppeal and DDS log as requested, please see as follows: ROOTREPEAL © AD, 2007-2009 ================================================== Scan Start Time: 2009/12/20 19:27 Program Version: Version 1.3.5.0 Windows Version: Windows Vista SP2 ================================================== Drivers ——————- Name: dump_diskdump.sys Image Path: C:\Windows\System32\Drivers\dump_diskdump.sys Address: 0x8E514000 Size: 40960 File Visible: No Signed: - Status: - Name: dump_nvstor32.sys Image Path: C:\Windows\System32\Drivers\dump_nvstor32.sys Address: 0x8E51E000 Size: 155648 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\Windows\system32\drivers\rootrepeal.sys Address: 0xA05F1000 Size: 49152 File Visible: No Signed: - Status: - Processes ——————- Path: System PID: 4 Status: Locked to the Windows API! Path: C:\Windows\System32\audiodg.exe PID: 1312 Status: Locked to the Windows API! ==EOF== DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 19:24:52.17 on 20/12/2009 Internet Explorer: 8.0.6001.18865 BrowserJavaVersion: 1.6.0_17 Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2815.1294 [GMT 0:00] SP: Spybot - Search and Destroy *enabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9} SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46} ============== Running Processes =============== C:\Windows\system32\wininit.exe C:\Windows\system32\lsm.exe C:\Windows\system32\svchost.exe -k DcomLaunch C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k rpcss C:\Windows\System32\svchost.exe -k secsvcs C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted C:\Windows\system32\svchost.exe -k netsvcs C:\Windows\system32\svchost.exe -k GPSvcGroup C:\Windows\system32\SLsvc.exe C:\Windows\system32\nvvsvc.exe C:\Windows\system32\svchost.exe -k LocalService C:\Windows\system32\svchost.exe -k NetworkService C:\Windows\System32\spoolsv.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork C:\Windows\system32\Dwm.exe C:\Windows\system32\taskeng.exe C:\Windows\Explorer.EXE C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\RtHDVCpl.exe C:\Program Files\Microsoft IntelliPoint\ipoint.exe C:\Program Files\HP\HP Software Update\hpwuSchd2.exe C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\ESET\ESET Smart Security\egui.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Windows\ehome\ehtray.exe C:\Program Files\Windows Media Player\wmpnscfg.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Windows\ehome\ehmsas.exe C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe C:\Program Files\ESET\ESET Smart Security\ekrn.exe C:\Windows\system32\svchost.exe -k hpdevmgmt C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Windows\system32\IoctlSvc.exe C:\Windows\System32\svchost.exe -k HPZ12 C:\Program Files\O2\bin\sprtsvc.exe C:\Windows\system32\svchost.exe -k imgsvc C:\Windows\System32\svchost.exe -k WerSvcGroup C:\Windows\system32\SearchIndexer.exe C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe C:\Windows\system32\WUDFHost.exe C:\Windows\System32\mobsync.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe C:\Windows\system32\wbem\unsecapp.exe C:\Windows\system32\wbem\wmiprvse.exe C:\Windows\system32\wuauclt.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Windows\explorer.exe C:\Windows\system32\SearchProtocolHost.exe C:\Windows\system32\SearchFilterHost.exe C:\Windows\system32\taskeng.exe C:\Windows\system32\DllHost.exe C:\Windows\system32\DllHost.exe C:\Users\Mark\Desktop\dds.scr C:\Windows\system32\wbem\wmiprvse.exe ============== Pseudo HJT Report =============== uSearch Page = hxxp://www.google.com uStart Page = hxxp://www.google.co.uk/ uDefault_Page_URL = hxxp://go.packardbell.com/?id=9067 uSearch Bar = hxxp://www.google.com/ie uDefault_Search_URL = hxxp://www.google.com/ie uInternet Settings,ProxyOverride = *.local uSearchAssistant = hxxp://www.google.com/ie uSearchURL,(Default) = hxxp://www.google.com/search?q=%s BHO: {00000000-6C30-11D8-9363-000AE6309654} - No File BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll TB: {B4B3001E-0F56-4E51-8250-BDE11547EC55} - No File uRun: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide mRun: [RtHDVCpl] RtHDVCpl.exe mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe" mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe" mRun: [IntelliPoint] "c:\program files\microsoft intellipoint\ipoint.exe" mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe mRun: [Skytel] Skytel.exe mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe" mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [egui] "c:\program files\eset\eset smart security\egui.exe" /hide /waitservice StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hp digital imaging monitor.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0) mPolicies-system: EnableUIADesktopToggle = 0 (0x0) IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000 IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll Trusted Zone: o2.co.uk\*.broadband DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx1.hotmail.com/mail/w3/resources/VistaMSNPUplden-gb.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1226515186132 DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll Notify: !SABWinLogon - c:\program files\superadblocker.com\super ad blocker\SABWINLO.DLL SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll SEH: {5AE067D3-9AFB-48E0-853A-EBB7F4A000D7} - No File Hosts: 127.0.0.1 www.spywareinfo.com ================= FIREFOX =================== FF - ProfilePath - c:\users\mark\appdata\roaming\mozilla\firefox\profiles\3v7d1en1.default\ FF - prefs.js: browser.search.selectedEngine - MyStart Search FF - prefs.js: browser.startup.homepage - www.google.co.uk FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search= FF - plugin: c:\progra~1\meadco~1\npmeadax.dll FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll FF - plugin: c:\program files\google\picasa3\npPicasa3.dll FF - plugin: c:\program files\google\update\1.2.183.13\npGoogleOneClick8.dll FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-11-16 108792] R2 ekrn;ESET Service;c:\program files\eset\eset smart security\ekrn.exe [2009-11-16 735960] R2 epfwwfp;epfwwfp;c:\windows\system32\drivers\epfwwfp.sys [2009-11-16 38240] R2 SBSDWSCService;SBSD Security Center Service;c:\program files\spybot - search & destroy\SDWinSec.exe [2008-11-8 1153368] R2 sprtsvc_O2;SupportSoft Sprocket Service (O2);c:\program files\o2\bin\sprtsvc.exe [2007-6-7 202280] S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2009-10-27 133104] S3 FlashUSB;Flash Loader utility driver;c:\windows\system32\drivers\FlashUSB.sys [2009-5-7 15453] S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-21 21504] S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\sisoftware\sisoftware sandra professional business 2009.sp2\RpcAgentSrv.exe [2009-7-11 98488] =============== Created Last 30 ================ 2009-12-20 15:24:48 0 d—–w- c:\windows\F8BA8B13856D4DFBA28F7EC868142453.TMP 2009-12-20 14:55:11 0 d—a-w- c:\programdata\TEMP 2009-12-20 14:28:36 0 d—–w- c:\programdata\SUPERAntiSpyware.com 2009-12-20 14:18:05 0 d—–w- c:\users\mark\appdata\roaming\Malwarebytes 2009-12-20 14:18:01 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-12-20 14:17:59 0 d—–w- c:\programdata\Malwarebytes 2009-12-20 14:17:58 19160 —-a-w- c:\windows\system32\drivers\mbam.sys 2009-12-20 14:17:57 0 d—–w- c:\program files\Malwarebytes' Anti-Malware 2009-12-20 14:13:42 0 d—–w- c:\programdata\Windows Genuine Advantage 2009-12-20 14:00:22 2128 —ha-w- c:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 2009-12-20 14:00:22 2128 —ha-w- c:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 2009-12-19 12:33:54 34800 —-a-w- c:\programdata\nvModes.dat 2009-12-19 10:54:14 0 d—–w- c:\users\mark\appdata\roaming\SuperAdBlocker.com 2009-12-19 10:53:57 0 d—–w- c:\windows\system32\URTTemp 2009-12-19 10:53:56 0 d—–w- c:\program files\SuperAdBlocker.com 2009-12-19 10:53:27 0 d—–w- c:\program files\common files\Wise Installation Wizard 2009-12-12 03:00:25 24064 —-a-w- c:\windows\system32\nshhttp.dll 2009-12-12 03:00:22 411648 —-a-w- c:\windows\system32\drivers\http.sys 2009-12-12 03:00:22 30720 —-a-w- c:\windows\system32\httpapi.dll 2009-12-09 21:59:09 377344 —-a-w- c:\windows\system32\winhttp.dll 2009-12-09 21:57:57 243712 —-a-w- c:\windows\system32\rastls.dll 2009-12-06 14:45:52 0 d—–w- c:\users\mark\appdata\roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1 2009-12-06 14:45:49 0 d—–w- c:\program files\BBC iPlayer Desktop 2009-11-27 03:00:44 2048 —-a-w- c:\windows\system32\tzres.dll 2009-11-26 10:12:55 1401856 —-a-w- c:\windows\system32\msxml6.dll 2009-11-26 10:12:54 1248768 —-a-w- c:\windows\system32\msxml3.dll 2009-11-26 10:12:51 714240 —-a-w- c:\windows\system32\timedate.cpl ==================== Find3M ==================== 2009-12-19 12:32:43 51200 —-a-w- c:\windows\inf\infpub.dat 2009-12-19 12:32:43 143360 —-a-w- c:\windows\inf\infstrng.dat 2009-12-19 12:32:43 143360 —-a-w- c:\windows\inf\infstor.dat 2009-11-21 06:40:20 916480 —-a-w- c:\windows\system32\wininet.dll 2009-11-21 06:34:39 71680 —-a-w- c:\windows\system32\iesetup.dll 2009-11-21 06:34:39 109056 —-a-w- c:\windows\system32\iesysprep.dll 2009-11-21 04:59:58 133632 —-a-w- c:\windows\system32\ieUnatt.exe 2009-11-17 03:17:30 665600 —-a-w- c:\windows\inf\drvindex.dat 2009-11-17 03:17:26 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf 2009-11-17 03:17:10 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf 2009-11-16 09:06:50 38240 —-a-w- c:\windows\system32\drivers\epfwwfp.sys 2009-11-16 09:06:44 135048 —-a-w- c:\windows\system32\drivers\epfw.sys 2009-11-16 09:03:36 108792 —-a-w- c:\windows\system32\drivers\ehdrv.sys 2009-11-16 08:56:12 116520 —-a-w- c:\windows\system32\drivers\eamon.sys 2009-11-02 20:42:06 195456 ——w- c:\windows\system32\MpSigStub.exe 2009-10-11 04:17:27 411368 —-a-w- c:\windows\system32\deploytk.dll 2009-10-08 21:08:01 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll 2009-10-08 21:08:01 234496 —-a-w- c:\windows\system32\oleacc.dll 2009-10-08 21:07:59 4096 —-a-w- c:\windows\system32\oleaccrc.dll 2009-10-01 01:02:17 2537472 —-a-w- c:\windows\system32\wpdshext.dll 2009-10-01 01:02:05 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe 2009-10-01 01:02:04 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll 2009-10-01 01:02:02 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll 2009-10-01 01:02:00 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll 2009-10-01 01:01:59 546816 —-a-w- c:\windows\system32\wpd_ci.dll 2009-10-01 01:01:59 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll 2009-10-01 01:01:56 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll 2009-10-01 01:01:56 350208 —-a-w- c:\windows\system32\WPDSp.dll 2009-10-01 01:01:56 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll 2009-10-01 01:01:56 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll 2009-10-01 01:01:54 81920 —-a-w- c:\windows\system32\wpdbusenum.dll 2009-10-01 01:01:50 226816 —-a-w- c:\windows\system32\WpdMtp.dll 2009-10-01 01:01:49 61952 —-a-w- c:\windows\system32\WpdMtpUS.dll 2009-10-01 01:01:49 33280 —-a-w- c:\windows\system32\WpdConns.dll 2009-09-27 23:12:22 7614056 —-a-w- c:\windows\system32\nvd3dum.dll 2009-09-27 23:12:22 490088 —-a-w- c:\windows\system32\nvuninst.exe 2009-09-27 23:12:22 490088 —-a-w- c:\windows\system32\nvudisp.exe 2009-09-27 23:12:22 2169448 —-a-w- c:\windows\system32\nvcuvid.dll 2009-09-27 23:12:22 1997416 —-a-w- c:\windows\system32\nvcuda.dll 2009-09-27 23:12:22 1714792 —-a-w- c:\windows\system32\nvcuvenc.dll 2009-09-27 23:12:22 170600 —-a-w- c:\windows\system32\nvcod167.dll 2009-09-27 23:12:22 170600 —-a-w- c:\windows\system32\nvcod.dll 2009-09-27 23:12:22 11197032 —-a-w- c:\windows\system32\nvoglv32.dll 2009-09-27 23:12:22 1074280 —-a-w- c:\windows\system32\nvapi.dll 2009-09-27 17:47:30 2173544 —-a-w- c:\windows\system32\nvcplui.exe 2009-09-27 17:47:00 92776 —-a-w- c:\windows\system32\nvmctray.dll 2009-09-27 17:47:00 805480 —-a-w- c:\windows\system32\nvsvc.dll 2009-09-27 17:47:00 4033128 —-a-w- c:\windows\system32\nvvitvs.dll 2009-09-27 17:47:00 3553896 —-a-w- c:\windows\system32\nvgames.dll 2009-09-27 17:47:00 3172968 —-a-w- c:\windows\system32\nvwss.dll 2009-09-27 17:47:00 215656 —-a-w- c:\windows\system32\nvvsvc.exe 2009-09-27 17:47:00 195176 —-a-w- c:\windows\system32\nvmccss.dll 2009-09-27 17:47:00 150120 —-a-w- c:\windows\system32\nvshext.dll 2009-09-27 17:47:00 1309288 —-a-w- c:\windows\system32\nvsvs.dll 2009-09-27 17:47:00 1292904 —-a-w- c:\windows\system32\nvmobls.dll 2009-09-27 17:46:00 4942440 —-a-w- c:\windows\system32\nvdisps.dll 2009-09-27 17:46:00 13949544 —-a-w- c:\windows\system32\nvcpl.dll 2009-09-25 02:10:10 974848 —-a-w- c:\windows\system32\WindowsCodecs.dll 2009-09-25 02:07:08 189440 —-a-w- c:\windows\system32\WindowsCodecsExt.dll 2009-09-25 02:04:32 321024 —-a-w- c:\windows\system32\PhotoMetadataHandler.dll 2009-09-25 01:49:22 1554432 —-a-w- c:\windows\system32\xpsservices.dll 2009-09-25 01:48:08 351232 —-a-w- c:\windows\system32\XpsPrint.dll 2009-09-25 01:38:29 847360 —-a-w- c:\windows\system32\OpcServices.dll 2009-09-25 01:36:13 280064 —-a-w- c:\windows\system32\XpsGdiConverter.dll 2009-09-25 01:35:31 135680 —-a-w- c:\windows\system32\XpsRasterService.dll 2009-09-25 01:33:25 195584 —-a-w- c:\windows\system32\dxdiagn.dll 2009-09-25 01:33:15 829440 —-a-w- c:\windows\system32\d3d10warp.dll 2009-09-25 01:33:01 369664 —-a-w- c:\windows\system32\WMPhoto.dll 2009-09-25 01:32:59 252928 —-a-w- c:\windows\system32\dxdiag.exe 2009-09-25 01:31:53 519680 —-a-w- c:\windows\system32\d3d11.dll 2009-09-25 01:31:26 486912 —-a-w- c:\windows\system32\d3d10level9.dll 2009-09-25 01:31:21 161280 —-a-w- c:\windows\system32\d3d10_1.dll 2009-09-25 01:31:19 218112 —-a-w- c:\windows\system32\d3d10_1core.dll 2009-09-25 01:31:16 1030144 —-a-w- c:\windows\system32\d3d10.dll 2009-09-25 01:31:15 828928 —-a-w- c:\windows\system32\d2d1.dll 2009-09-25 01:30:23 481792 —-a-w- c:\windows\system32\dxgi.dll 2009-09-25 01:30:23 190464 —-a-w- c:\windows\system32\d3d10core.dll 2009-09-25 01:27:04 793088 —-a-w- c:\windows\system32\FntCache.dll 2009-09-25 01:27:04 37888 —-a-w- c:\windows\system32\cdd.dll 2009-09-25 01:27:04 1064448 —-a-w- c:\windows\system32\DWrite.dll 2009-09-24 22:54:55 258048 —-a-w- c:\windows\system32\winspool.drv 2009-09-24 22:54:53 667648 —-a-w- c:\windows\system32\printfilterpipelinesvc.exe 2009-09-24 22:54:52 26112 —-a-w- c:\windows\system32\printfilterpipelineprxy.dll 2009-09-24 05:41:51 37665 —-a-w- c:\windows\fonts\GlobalUserInterface.CompositeFont 2008-01-21 02:43:21 174 –sha-w- c:\program files\desktop.ini 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat 2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat 2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat 2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat 2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat 2008-11-14 16:22:25 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\history\history.ie5\index.dat 2008-11-14 16:22:25 32768 –sha-w- c:\windows\serviceprofiles\localservice\appdata\local\microsoft\windows\temporary internet files\content.ie5\index.dat 2008-11-14 16:22:25 16384 –sha-w- c:\windows\serviceprofiles\localservice\appdata\roaming\microsoft\windows\cookies\index.dat 2008-05-22 18:23:29 8192 –sha-w- c:\windows\users\default\NTUSER.DAT ============= FINISH: 19:25:52.39 ===============

Thank you for your swift reply LDTate.

Currently my Firefox browser seems to be opening several random tabs. The web addresses are as follows:

file:///C:/Program%20Files/Mozilla%20Firefox/
file:///C:/Program%20Files/Mozilla%20Firefox/
http://www.Î`f}³jù7–„]`gÓnd_,¤rÐ.com/
http://www.xn–2-oda.com/
http://%C2%BAY%1B%02y@xn–-tcam0rya8h1a3a7382e/
http://www.®wmy®îqºá%29¬`.com…\%0B%B2%9F

My Malwarebytes Anti Malware scan results are as follows:

Malwarebytes' Anti-Malware 1.42
Database version: 3415
Windows 6.0.6002 Service Pack 2
Internet Explorer 8.0.6001.18865

23/12/2009 16:38:44
mbam-log-2009-12-23 (16-38-44).txt

Scan type: Quick Scan
Objects scanned: 102494
Time elapsed: 3 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 1
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{19127ad2-394b-70f5-c650-b97867baa1f7} (Backdoor.Bot) -> Quarantined and deleted successfully.
HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\{43bf8cd1-c5d5-2230-7bb2-98f22c2b7dc6} (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\uid (Malware.Trace) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (C:\Windows\system32\userinit.exe,C:\Windows\system32\sdra64.exe,) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Folders Infected:
C:\Windows\System32\lowsec (Stolen.data) -> Quarantined and deleted successfully.

Files Infected:
C:\Windows\System32\lowsec\local.ds (Stolen.data) -> Quarantined and deleted successfully.
C:\Windows\System32\lowsec\user.ds (Stolen.data) -> Quarantined and deleted successfully.


My latest Hijackthis scan is as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:00:22, on 23/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Microsoft IntelliPoint\ipoint.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\ESET\ESET Smart Security\egui.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\TrendMicro\HiJackThis\HiJackThis.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.packardbell.com/?id=9067
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\RunOnce: [Uninstall Adobe Download Manager] "C:\Windows\system32\rundll32.exe" "C:\Users\Mark\AppData\Local\Temp\nos_uninstall_Adobe.dll",Uninstall /IE2883E8F-472F-4fb0-9522-AC9BF37916A7 /Get1noarp
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O15 - Trusted Zone: http://*.broadband.o2.co.uk
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/…NPUplden-gb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1226515186132
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - Winlogon Notify: !SABWinLogon - C:\Program Files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL (file missing)
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - Realtek Corporation - (no file)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (O2) (sprtsvc_O2) - SupportSoft, Inc. - C:\Program Files\O2\bin\sprtsvc.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe

–
End of file - 9623 bytes



Many thanks in advance for your time

Thank you very much for your assistance, it is very much appreciated. I have run ComboFix as suggested and here is my log:

ComboFix 09-12-23.02 - Mark 24/12/2009 13:17:39.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.44.1033.18.2815.2033 [GMT 0:00]
Running from: c:\users\[removed]\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-873140555-1699530256-399710265-500
c:\windows\CouponPrinter.ocx
c:\windows\system32\DeletedKey01.reg
c:\windows\system32\uninstall.exe

Infected copy of c:\windows\system32\drivers\nvstor32.sys was found and disinfected
Restored copy from - Kitty ate it
.
((((((((((((((((((((((((( Files Created from 2009-11-24 to 2009-12-24 )))))))))))))))))))))))))))))))
.

2009-12-23 19:00 . 2009-12-23 19:00 ——– d—–w- c:\program files\Trend Micro
2009-12-23 16:52 . 2009-12-23 16:52 388096 —-a-r- c:\users\Mark\AppData\Roaming\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2009-12-23 16:52 . 2009-12-23 16:52 ——– d—–w- c:\program files\TrendMicro
2009-12-22 21:39 . 2009-12-23 16:45 ——– d—–w- c:\programdata\NOS
2009-12-22 21:39 . 2009-12-23 16:45 ——– d—–w- c:\program files\NOS
2009-12-20 15:24 . 2009-12-20 15:42 ——– d—–w- c:\windows\F8BA8B13856D4DFBA28F7EC868142453.TMP
2009-12-20 14:28 . 2009-12-20 14:28 ——– d—–w- c:\programdata\SUPERAntiSpyware.com
2009-12-20 14:18 . 2009-12-20 14:18 ——– d—–w- c:\users\Mark\AppData\Roaming\Malwarebytes
2009-12-20 14:18 . 2009-12-03 16:14 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-20 14:17 . 2009-12-20 14:17 ——– d—–w- c:\programdata\Malwarebytes
2009-12-20 14:17 . 2009-12-03 16:13 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2009-12-20 14:17 . 2009-12-23 16:32 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2009-12-19 10:54 . 2009-12-19 10:54 ——– d—–w- c:\users\Mark\AppData\Roaming\SuperAdBlocker.com
2009-12-19 10:53 . 2009-12-19 10:53 ——– d—–w- c:\windows\system32\URTTemp
2009-12-19 10:53 . 2009-12-19 10:56 ——– d—–w- c:\program files\SuperAdBlocker.com
2009-12-19 10:53 . 2009-12-20 15:17 ——– d—–w- c:\program files\Common Files\Wise Installation Wizard
2009-12-12 03:00 . 2009-11-09 12:31 24064 —-a-w- c:\windows\system32\nshhttp.dll
2009-12-12 03:00 . 2009-11-09 12:30 30720 —-a-w- c:\windows\system32\httpapi.dll
2009-12-12 03:00 . 2009-11-09 10:36 411648 —-a-w- c:\windows\system32\drivers\http.sys
2009-12-09 21:59 . 2009-08-24 11:36 377344 —-a-w- c:\windows\system32\winhttp.dll
2009-12-09 21:57 . 2009-10-07 11:36 243712 —-a-w- c:\windows\system32\rastls.dll
2009-12-06 14:45 . 2009-12-06 14:45 ——– d—–w- c:\users\Mark\AppData\Roaming\BBCiPlayerDesktop.61DB7A798358575D6A969CCD73DDBBD723A6DA9D.1
2009-12-06 14:45 . 2009-12-06 14:40 38208 —-a-w- c:\users\Mark\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-06 14:45 . 2009-12-06 14:45 ——– d—–w- c:\program files\BBC iPlayer Desktop
2009-12-06 14:45 . 2009-12-06 14:40 38208 —-a-w- c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-12-06 14:45 . 2009-12-06 14:45 ——– d—–w- c:\program files\Common Files\Adobe AIR
2009-11-27 03:00 . 2009-10-29 09:17 2048 —-a-w- c:\windows\system32\tzres.dll
2009-11-26 10:12 . 2009-08-11 16:44 1401856 —-a-w- c:\windows\system32\msxml6.dll
2009-11-26 10:12 . 2009-08-11 16:44 1248768 —-a-w- c:\windows\system32\msxml3.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-24 13:26 . 2009-12-19 12:33 34800 —-a-w- c:\programdata\nvModes.dat
2009-12-21 21:36 . 2008-05-22 09:42 ——– d—–w- c:\program files\Google
2009-12-20 19:15 . 2008-11-08 19:43 ——– d—–w- c:\users\Mark\AppData\Roaming\uTorrent
2009-12-20 13:52 . 2008-05-22 09:32 ——– d—–w- c:\programdata\NVIDIA
2009-12-19 12:27 . 2009-08-17 13:54 ——– d—–w- c:\program files\QuickTime
2009-12-19 11:49 . 2009-03-28 13:45 ——– d—–w- c:\program files\WinCDG Pro 3.0
2009-12-19 11:49 . 2008-11-08 20:01 ——– d—–w- c:\program files\PowerISO
2009-12-18 16:18 . 2008-11-08 19:48 ——– d—–w- c:\program files\Spybot - Search & Destroy
2009-12-17 16:57 . 2008-11-08 19:48 ——– d—–w- c:\programdata\Spybot - Search & Destroy
2009-12-10 03:18 . 2006-11-02 11:18 ——– d—–w- c:\program files\Windows Mail
2009-12-10 03:03 . 2008-05-22 09:50 ——– d—–w- c:\programdata\Microsoft Help
2009-11-23 10:57 . 2009-11-23 10:57 ——– d—–w- c:\program files\Common Files\Apple
2009-11-23 10:56 . 2009-07-04 12:08 ——– d—–w- c:\programdata\Apple Computer
2009-11-21 11:11 . 2009-03-08 09:25 ——– d—–w- c:\program files\Java
2009-11-21 06:40 . 2009-12-09 21:58 916480 —-a-w- c:\windows\system32\wininet.dll
2009-11-21 06:34 . 2009-12-09 21:58 71680 —-a-w- c:\windows\system32\iesetup.dll
2009-11-21 06:34 . 2009-12-09 21:58 109056 —-a-w- c:\windows\system32\iesysprep.dll
2009-11-21 04:59 . 2009-12-09 21:58 133632 —-a-w- c:\windows\system32\ieUnatt.exe
2009-11-17 03:17 . 2009-11-17 03:17 ——– d—–w- c:\program files\Windows Portable Devices
2009-11-17 03:17 . 2006-11-02 10:25 665600 —-a-w- c:\windows\inf\drvindex.dat
2009-11-17 03:17 . 2009-11-17 03:17 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdMtpDr_01_07_00.Wdf
2009-11-17 03:17 . 2009-11-17 03:17 0 —ha-w- c:\windows\system32\drivers\Msft_User_WpdFs_01_07_00.Wdf
2009-11-16 09:06 . 2009-11-16 09:06 38240 —-a-w- c:\windows\system32\drivers\epfwwfp.sys
2009-11-16 09:06 . 2009-11-16 09:06 135048 —-a-w- c:\windows\system32\drivers\epfw.sys
2009-11-16 09:03 . 2009-11-16 09:03 108792 —-a-w- c:\windows\system32\drivers\ehdrv.sys
2009-11-16 08:56 . 2009-11-16 08:56 116520 —-a-w- c:\windows\system32\drivers\eamon.sys
2009-11-02 20:42 . 2009-10-02 22:38 195456 ——w- c:\windows\system32\MpSigStub.exe
2009-10-30 16:17 . 2009-04-05 07:26 ——– d—–w- c:\programdata\DriverScanner
2009-10-11 04:17 . 2008-12-25 17:35 411368 —-a-w- c:\windows\system32\deploytk.dll
2009-10-08 21:08 . 2009-11-17 03:00 555520 —-a-w- c:\windows\system32\UIAutomationCore.dll
2009-10-08 21:08 . 2009-11-17 03:00 234496 —-a-w- c:\windows\system32\oleacc.dll
2009-10-08 21:07 . 2009-11-17 03:00 4096 —-a-w- c:\windows\system32\oleaccrc.dll
2009-10-06 17:28 . 2008-11-08 14:48 103032 —-a-w- c:\users\Mark\AppData\Local\GDIPFONTCACHEV1.DAT
2009-10-06 17:03 . 2009-10-06 17:03 3584 —-a-r- c:\users\Mark\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
2009-10-01 01:02 . 2009-11-17 03:01 2537472 —-a-w- c:\windows\system32\wpdshext.dll
2009-10-01 01:02 . 2009-11-17 03:01 30208 —-a-w- c:\windows\system32\WPDShextAutoplay.exe
2009-10-01 01:02 . 2009-11-17 03:01 334848 —-a-w- c:\windows\system32\PortableDeviceApi.dll
2009-10-01 01:02 . 2009-11-17 03:01 87552 —-a-w- c:\windows\system32\WPDShServiceObj.dll
2009-10-01 01:02 . 2009-11-17 03:01 31232 —-a-w- c:\windows\system32\BthMtpContextHandler.dll
2009-10-01 01:01 . 2009-11-17 03:01 546816 —-a-w- c:\windows\system32\wpd_ci.dll
2009-10-01 01:01 . 2009-11-17 03:01 160256 —-a-w- c:\windows\system32\PortableDeviceTypes.dll
2009-10-01 01:01 . 2009-11-17 03:01 60928 —-a-w- c:\windows\system32\PortableDeviceConnectApi.dll
2009-10-01 01:01 . 2009-11-17 03:01 350208 —-a-w- c:\windows\system32\WPDSp.dll
2009-10-01 01:01 . 2009-11-17 03:01 196608 —-a-w- c:\windows\system32\PortableDeviceWMDRM.dll
2009-10-01 01:01 . 2009-11-17 03:01 100864 —-a-w- c:\windows\system32\PortableDeviceClassExtension.dll
2009-10-01 01:01 . 2009-11-17 03:01 81920 —-a-w- c:\windows\system32\wpdbusenum.dll
2009-10-01 01:01 . 2009-11-17 03:01 40448 —-a-w- c:\windows\system32\drivers\WpdUsb.sys
2009-10-01 01:01 . 2009-11-17 03:01 226816 —-a-w- c:\windows\system32\WpdMtp.dll
2009-10-01 01:01 . 2009-11-17 03:01 61952 —-a-w- c:\windows\system32\WpdMtpUS.dll
2009-10-01 01:01 . 2009-11-17 03:01 33280 —-a-w- c:\windows\system32\WpdConns.dll
2009-09-27 23:12 . 2009-09-27 23:12 9509832 —-a-w- c:\windows\system32\drivers\nvlddmkm.sys
2009-09-27 23:12 . 2009-09-27 23:12 490088 —-a-w- c:\windows\system32\nvudisp.exe
2009-09-27 23:12 . 2009-09-27 23:12 2169448 —-a-w- c:\windows\system32\nvcuvid.dll
2009-09-27 23:12 . 2009-09-27 23:12 1997416 —-a-w- c:\windows\system32\nvcuda.dll
2009-09-27 23:12 . 2009-09-27 23:12 1714792 —-a-w- c:\windows\system32\nvcuvenc.dll
2009-09-27 23:12 . 2009-09-27 23:12 170600 —-a-w- c:\windows\system32\nvcod167.dll
2009-09-27 23:12 . 2009-09-27 23:12 170600 —-a-w- c:\windows\system32\nvcod.dll
2009-09-27 23:12 . 2009-09-27 23:12 11197032 —-a-w- c:\windows\system32\nvoglv32.dll
2009-09-27 23:12 . 2009-04-13 12:32 1074280 —-a-w- c:\windows\system32\nvapi.dll
2009-09-27 23:12 . 2009-01-16 02:42 7614056 —-a-w- c:\windows\system32\nvd3dum.dll
2009-09-27 23:12 . 2007-10-04 17:14 490088 —-a-w- c:\windows\system32\nvuninst.exe
2009-09-27 17:47 . 2009-09-27 17:47 2173544 —-a-w- c:\windows\system32\nvcplui.exe
2009-09-27 17:47 . 2009-09-27 17:47 92776 —-a-w- c:\windows\system32\nvmctray.dll
2009-09-27 17:47 . 2009-09-27 17:47 805480 —-a-w- c:\windows\system32\nvsvc.dll
2009-09-27 17:47 . 2009-09-27 17:47 4033128 —-a-w- c:\windows\system32\nvvitvs.dll
2009-09-27 17:47 . 2009-09-27 17:47 3553896 —-a-w- c:\windows\system32\nvgames.dll
2009-09-27 17:47 . 2009-09-27 17:47 3172968 —-a-w- c:\windows\system32\nvwss.dll
2009-09-27 17:47 . 2009-09-27 17:47 215656 —-a-w- c:\windows\system32\nvvsvc.exe
2009-09-27 17:47 . 2009-09-27 17:47 195176 —-a-w- c:\windows\system32\nvmccss.dll
2009-09-27 17:47 . 2009-09-27 17:47 150120 —-a-w- c:\windows\system32\nvshext.dll
2009-09-27 17:47 . 2009-09-27 17:47 1309288 —-a-w- c:\windows\system32\nvsvs.dll
2009-09-27 17:47 . 2009-09-27 17:47 1292904 —-a-w- c:\windows\system32\nvmobls.dll
2009-09-27 17:46 . 2009-09-27 17:46 4942440 —-a-w- c:\windows\system32\nvdisps.dll
2009-09-27 17:46 . 2009-09-27 17:46 13949544 —-a-w- c:\windows\system32\nvcpl.dll
2008-05-22 18:23 . 2008-05-22 18:23 8192 –sha-w- c:\windows\Users\Default\NTUSER.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" [2008-06-24 1840424]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-21 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"RtHDVCpl"="RtHDVCpl.exe" [2008-05-07 6139904]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"NBKeyScan"="c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" [2008-06-08 2221352]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2008-06-10 1406024]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"Skytel"="Skytel.exe" [2007-11-20 1826816]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-10 417792]
"egui"="c:\program files\ESET\ESET Smart Security\egui.exe" [2009-11-16 2054360]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-12-03 1394000]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2008-3-25 214360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2009-11-10 23:08 417792 —-a-w- c:\program files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(:2b,ba,bf,54,de,3c,ca,01

R1 ehdrv;ehdrv;c:\windows\System32\drivers\ehdrv.sys [16/11/2009 09:03 108792]
R2 ekrn;ESET Service;c:\program files\ESET\ESET Smart Security\ekrn.exe [16/11/2009 09:04 735960]
R2 epfwwfp;epfwwfp;c:\windows\System32\drivers\epfwwfp.sys [16/11/2009 09:06 38240]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [08/11/2008 19:48 1153368]
R2 sprtsvc_O2;SupportSoft Sprocket Service (O2);c:\program files\O2\bin\sprtsvc.exe [07/06/2007 16:19 202280]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [27/10/2009 13:23 133104]
S3 FlashUSB;Flash Loader utility driver;c:\windows\System32\drivers\FlashUSB.sys [07/05/2009 20:33 15453]
S3 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [21/01/2008 02:23 21504]
S3 SandraAgentSrv;SiSoftware Deployment Agent Service;c:\program files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe [11/07/2009 07:43 98488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
.
——- Supplementary Scan ——-
.
uStart Page = hxxp://www.google.co.uk/
uDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
Trusted Zone: o2.co.uk\*.broadband
FF - ProfilePath - c:\users\Mark\AppData\Roaming\Mozilla\Firefox\Profiles\3v7d1en1.default\
FF - prefs.js: browser.search.selectedEngine - MyStart Search
FF - prefs.js: browser.startup.homepage - www.google.co.uk
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search;=
FF - plugin: c:\progra~1\MEADCO~1\npmeadax.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

—- FIREFOX POLICIES —-
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

ShellExecuteHooks-{5AE067D3-9AFB-48E0-853A-EBB7F4A000D7} - (no file)
Notify-!SABWinLogon - c:\program files\SuperAdBlocker.com\Super Ad Blocker\SABWINLO.DLL



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-24 13:26
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-1591383325-2579630227-2171385010-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.**û*T%\OpenWithList]
@Class="Shell"

[HKEY_USERS\S-1-5-21-1591383325-2579630227-2171385010-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*>*©*Q%\OpenWithList]
@Class="Shell"

[HKEY_USERS\S-1-5-21-1591383325-2579630227-2171385010-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.*f*£*“%\OpenWithList]
@Class="Shell"

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
———————— Other Running Processes ————————
.
c:\windows\system32\nvvsvc.exe
c:\windows\system32\nvvsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Diskeeper Corporation\Diskeeper\DkService.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\program files\Nero\Nero8\Nero BackItUp\NBService.exe
c:\windows\system32\IoctlSvc.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Internet Explorer\IELowutil.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2009-12-24 13:30:33 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-24 13:30

Pre-Run: 313,186,533,376 bytes free
Post-Run: 313,132,306,432 bytes free

- - End Of File - - 5B5A044FC3C3B70B8D01011F53953C8F


My latest HijackThis scan is as follows:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:46:32, on 24/12/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18865)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\Explorer.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\IncrediMail\bin\IncMail.exe
C:\Program Files\IncrediMail\bin\ImApp.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Mark\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SuperAdBlockerBHO Class - {00000000-6C30-11D8-9363-000AE6309654} - (no file)
O2 - BHO: Spybot-S&D; IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: (no name) - {B4B3001E-0F56-4E51-8250-BDE11547EC55} - (no file)
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET Smart Security\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end; to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O15 - Trusted Zone: http://*.broadband.o2.co.uk
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/resources/…NPUplden-gb.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1226515186132
O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET Smart Security\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - C:\Program Files\ESET\ESET Smart Security\ekrn.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Unknown owner - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe (file missing)
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Windows\system32\IoctlSvc.exe
O23 - Service: Super Ad Blocker Service (SABSVC) - Realtek Corporation - (no file)
O23 - Service: SiSoftware Deployment Agent Service (SandraAgentSrv) - SiSoftware - C:\Program Files\SiSoftware\SiSoftware Sandra Professional Business 2009.SP2\RpcAgentSrv.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: SupportSoft Sprocket Service (O2) (sprtsvc_O2) - SupportSoft, Inc. - C:\Program Files\O2\bin\sprtsvc.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\Supportsoft\bin\ssrc.exe

–
End of file - 7662 bytes

I am currently not showing any signs of infection, no tabs or re-directs have occured at the moment. Thank you again for your time and patience and expertise!