remove searchqu.com

Could someone please show me how to get rid of the lame searchqu.com? I would greatly appreciate it. Regards, DDS (Ver_09-06-26.01) - NTFSx86 Run by [removed] at 21:15:36.60 on Sat 12/25/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.2046.1171 [GMT -5:00] AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7} ============== Running Processes =============== I:\PROGRA~1\GbPlugin\GbpSv.exe I:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe I:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe I:\WINDOWS\system32\spoolsv.exe I:\Program Files\Avira\AntiVir Desktop\sched.exe svchost.exe I:\Program Files\Avira\AntiVir Desktop\avguard.exe I:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe I:\Program Files\Bonjour\mDNSResponder.exe I:\Program Files\Roxio\BackOnTrack\File Backup\FileBackupSVC.exe I:\Program Files\Flip Video\FlipShare\FlipShareService.exe I:\Program Files\Avira\AntiVir Desktop\avshadow.exe I:\WINDOWS\system32\svchost.exe -k hpdevmgmt I:\Program Files\Java\jre6\bin\jqs.exe I:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe I:\WINDOWS\System32\svchost.exe -k HPZ12 I:\WINDOWS\system32\nvsvc32.exe I:\WINDOWS\system32\PDFCreatorMessages.exe I:\WINDOWS\System32\svchost.exe -k HPZ12 I:\WINDOWS\system32\svchost.exe -k imgsvc I:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe I:\Program Files\Common Files\Pure Networks Shared\Platform\nmctxth.exe I:\Program Files\Linksys\Linksys Wireless Manager\LinksysWirelessManager.exe I:\WINDOWS\system32\RUNDLL32.EXE I:\WINDOWS\RTHDCPL.EXE I:\Program Files\Avira\AntiVir Desktop\avgnt.exe I:\Program Files\Logitech\Logitech WebCam Software\LWS.exe I:\Program Files\Microsoft IntelliType Pro\itype.exe I:\Program Files\Microsoft IntelliPoint\ipoint.exe I:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe I:\Program Files\4over Inc\PDF CMYK Print Engine\PDFCMYKPrintEngineClient.exe I:\Program Files\Brownie\BrstsWnd.exe I:\Program Files\iTunes\iTunesHelper.exe I:\Program Files\Multimedia Card Reader\shwicon2k.exe I:\Program Files\Common Files\Java\Java Update\jusched.exe I:\Program Files\HP\HP Software Update\HPWuSchd2.exe I:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe I:\Program Files\Logitech\Logitech Vid\vid.exe I:\Program Files\Skype\Phone\Skype.exe I:\Program Files\iPod\bin\iPodService.exe I:\Program Files\MultiScreen\MultiScreen.exe I:\Program Files\Skype\Plugin Manager\skypePM.exe I:\WINDOWS\system32\ctfmon.exe I:\WINDOWS\system32\wscntfy.exe I:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe I:\WINDOWS\explorer.exe I:\Program Files\Mozilla Firefox\firefox.exe I:\Program Files\Skype\Toolbars\Shared\SkypeNames2.exe I:\Program Files\Outlook Express\msimn.exe I:\Program Files\Mozilla Firefox\plugin-container.exe I:\Documents and Settings\Rodrigo\Desktop\dds.scr ============== Pseudo HJT Report =============== uStart Page = hxxp://www.google.com/ uInternet Settings,ProxyOverride = *.local BHO: SnagIt Toolbar Loader: {00c6482d-c502-44c8-8409-fce54ad9c208} - i:\program files\techsmith\snagit 9\SnagitBHO.dll BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - i:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File BHO: WsftpBrowserHelper Class: {601ed020-fb6c-11d3-87d8-0050da59922b} - i:\program files\ws_ftp pro\wsbho2k0.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - i:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - i:\program files\skype\toolbars\internet explorer\skypeieplugin.dll BHO: GbIehObj Class: {c41a1c0e-ea6c-11d4-b1b8-444553540000} - i:\program files\gbplugin\gbieh.dll BHO: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - i:\program files\ask.com\GenericAskToolbar.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - i:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - i:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - i:\program files\ask.com\GenericAskToolbar.dll TB: Snagit: {8ff5e183-abde-46eb-b09e-d2aab95cabe3} - i:\program files\techsmith\snagit 9\SnagitIEAddin.dll uRun: [SUPERAntiSpyware] i:\program files\superantispyware\SUPERAntiSpyware.exe uRun: [Logitech Vid] "i:\program files\logitech\logitech vid\vid.exe" -bootmode uRun: [Skype] "i:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [msnmsgr] "i:\program files\windows live\messenger\msnmsgr.exe" /background uRun: [MultiScreen] i:\program files\multiscreen\MultiScreen.exe mRun: [nmctxth] "i:\program files\common files\pure networks shared\platform\nmctxth.exe" mRun: [Linksys Wireless Manager] "i:\program files\linksys\linksys wireless manager\LinksysWirelessManager.exe" /cm /min /lcid 1033 mRun: [NvCplDaemon] RUNDLL32.EXE i:\windows\system32\NvCpl.dll,NvStartup mRun: [nwiz] nwiz.exe /install mRun: [NvMediaCenter] RUNDLL32.EXE i:\windows\system32\NvMcTray.dll,NvTaskbarInit mRun: [RTHDCPL] RTHDCPL.EXE mRun: [AdobeCS4ServiceManager] "i:\program files\common files\adobe\cs4servicemanager\CS4ServiceManager.exe" -launchedbylogin mRun: [avgnt] "i:\program files\avira\antivir desktop\avgnt.exe" /min mRun: [LogitechQuickCamRibbon] "i:\program files\logitech\logitech webcam software\LWS.exe" /hide mRun: [itype] "i:\program files\microsoft intellitype pro\itype.exe" mRun: [IntelliPoint] "i:\program files\microsoft intellipoint\ipoint.exe" mRun: [CorelDRAW Graphics Suite 11b] i:\program files\corel\corel graphics 12\languages\en\programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=010511 serial=DR12CED-4116385-yvk lang=EN mRun: [RoxioDragToDisc] "i:\program files\roxio\easy media creator 7\drag to disc\DrgToDsc.exe" mRun: [QuickTime Task] "i:\program files\quicktime\qttask.exe" -atboottime mRun: [PDF CMYK Print EngineClient] i:\program files\4over inc.\pdf cmyk print engine\PDFCMYKPrintEngineClient.exe mRun: [BrStsWnd] i:\program files\brownie\BrstsWnd.exe Autorun mRun: [AppleSyncNotifier] i:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe mRun: [iTunesHelper] "i:\program files\itunes\iTunesHelper.exe" mRun: [Sunkist2k] i:\program files\multimedia card reader\shwicon2k.exe mRun: [SunJavaUpdateSched] "i:\program files\common files\java\java update\jusched.exe" mRun: [HP Software Update] i:\program files\hp\hp software update\HPWuSchd2.exe mRun: [Adobe Reader Speed Launcher] "i:\program files\adobe\reader 9.0\reader\Reader_sl.exe" mRun: [Adobe ARM] "i:\program files\common files\adobe\arm\1.0\AdobeARM.exe" StartupFolder: i:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - i:\program files\hp\digital imaging\bin\hpqtra08.exe IE: E&xport to Microsoft Excel - i:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Google Sidewiki… - i:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_950DF09FAB501E03.dll/cmsidewiki.html IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - i:\program files\messenger\msmsgs.exe IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - i:\program files\skype\toolbars\internet explorer\skypeieplugin.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - i:\progra~1\micros~2\office11\REFIEBAR.DLL DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxps://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - i:\program files\common files\pure networks shared\platform\puresp4.dll Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - i:\program files\skype\toolbars\internet explorer\skypeieplugin.dll Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - i:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: GbPluginBb - i:\program files\gbplugin\gbieh.dll Notify: !SASWinLogon - i:\program files\superantispyware\SASWINLO.DLL SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - i:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - i:\program files\superantispyware\SASSEH.DLL SEH: GbPluginObj Class: {e37cb5f0-51f5-4395-a808-5fa49e399f83} - i:\program files\gbplugin\gbieh.dll ================= FIREFOX =================== FF - ProfilePath - i:\docume~1\rodrigo\applic~1\mozilla\firefox\profiles\4w3h730c.default\ FF - prefs.js: browser.search.selectedEngine - Web Search FF - prefs.js: browser.startup.homepage - hxxp://www.searchqu.com/ FF - prefs.js: keyword.URL - hxxp://www.searchqu.com/web?src=ffb&systemid=101&q= FF - component: i:\documents and settings\rodrigo\application data\mozilla\firefox\profiles\4w3h730c.default\extensions\{87f8774f-b485-47e2-a755-a40a8a5e886c}\components\GbMzhBb.dll FF - component: i:\documents and settings\rodrigo\application data\mozilla\firefox\profiles\4w3h730c.default\extensions\{a7c6cf7f-112c-4500-a7ea-39801a327e5f}\platform\winnt_x86-msvc\components\ipc_fireftp.dll FF - component: i:\program files\mozilla firefox\extensions\{ab2ce124-6272-4b12-94a9-7303c7397bd1}\components\SkypeFfComponent.dll FF - plugin: i:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll FF - plugin: i:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll FF - plugin: i:\program files\windows live\photo gallery\NPWLPG.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - i:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - i:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} —- FIREFOX POLICIES —- i:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true); i:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true); i:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); i:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200); i:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true); i:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true); i:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true); i:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); i:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); i:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); i:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32); i:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600); i:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbaam7a8h", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqz9s", true); // Traditional i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–fiqs8s", true); // Simplified i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–j6w193g", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgba3a4f16a", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgba3a4fra", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbayh7gpa", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–p1ai", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4ar", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgberp4a5d4a87g", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7c0a67fbc", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–mgbqly7cvafr", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kpry57d", true); // Traditional i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn–kprw13d", true); // Simplified i:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true); i:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false); i:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5); i:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.count", 24); i:\program files\mozilla firefox\greprefs\all.js - pref("network.buffer.cache.size", 4096); i:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1); i:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", "-1"); i:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); i:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 45); i:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false); i:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25); i:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5); i:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); i:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true); i:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true); i:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pr ef", true); i:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", ""); i:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false); i:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false); i:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); i:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); i:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600); i:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com"); i:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); i:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); // now unused i:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.delay", 50); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20); i:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20); ============= SERVICES / DRIVERS =============== R0 GbpKm;Gbp KernelMode;i:\windows\system32\drivers\gbpkm.sys [2010-10-7 47008] R0 xfilt;VIA SATA IDE Hot-plug Driver;i:\windows\system32\drivers\xfilt.sys [2010-6-6 17920] R1 avgio;avgio;i:\program files\avira\antivir desktop\avgio.sys [2010-6-7 11608] R1 SASDIFSV;SASDIFSV;i:\program files\superantispyware\SASDIFSV.SYS [2009-6-23 12872] R1 SASKUTIL;SASKUTIL;i:\program files\superantispyware\SASKUTIL.SYS [2009-6-23 67656] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;i:\program files\avira\antivir desktop\sched.exe [2010-6-7 135336] R2 AntiVirService;Avira AntiVir Guard;i:\program files\avira\antivir desktop\avguard.exe [2010-6-7 267944] R2 avgntflt;avgntflt;i:\windows\system32\drivers\avgntflt.sys [2010-6-7 61960] R2 CEEBC40A-FDED-4C59-B354-939132350B01;Roxio File Backup Service;i:\program files\roxio\backontrack\file backup\FileBackupSVC.exe [2009-3-4 96752] R2 FlipShare Service;FlipShare Service;i:\program files\flip video\flipshare\FlipShareService.exe [2010-5-14 455944] R2 GbpSv;Gbp Service;i:\progra~1\gbplugin\GbpSv.exe [2010-10-7 52824] R3 RT80x86;Linksys WPC600N/WMP600N Wireless-N Card Driver;i:\windows\system32\drivers\rt2860.sys [2010-6-6 1005312] S2 gupdate;Google Update Service (gupdate);i:\program files\google\update\GoogleUpdate.exe [2010-6-6 136176] S3 SASENUM;SASENUM;i:\program files\superantispyware\SASENUM.SYS [2009-6-23 12872] =============== Created Last 30 ================ 2010-12-25 18:51 a-dshr– I:\cmdcons 2010-12-25 18:46 256,512 a——- i:\windows\PEV.exe 2010-12-25 18:46 161,792 a——- i:\windows\SWREG.exe 2010-12-25 18:46 98,816 a——- i:\windows\sed.exe 2010-12-25 18:46 89,088 a——- i:\windows\MBR.exe 2010-12-25 18:46 –d—– I:\ComboFix 2010-12-19 18:24 –d—– i:\docume~1\rodrigo\applic~1\com.adobe.mauby.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1 2010-12-19 13:48 –d—– i:\docume~1\rodrigo\applic~1\Red Kawa 2010-12-07 18:18 –d—– i:\windows\system32\wbem\Repository 2010-12-07 18:08 –d—– i:\docume~1\alluse~1\applic~1\Bandoo 2010-12-07 18:07 –d—– i:\program files\Bandoo ==================== Find3M ==================== 2010-12-24 13:13 0 a——- i:\windows\system32\drivers\logiflt.iad 2010-12-12 16:11 1,005,312 a——- i:\windows\system32\drivers\rt2860.sys 2010-12-12 16:11 221,184 a——- i:\windows\system32\RaCoInst.dll 2010-12-12 16:11 13,650 a——- i:\windows\system32\RaCoInst.dat 2010-12-06 19:14 6,754,712 a——- i:\windows\system32\drivers\lvuvc.sys 2010-12-06 19:14 0 a——- i:\windows\system32\drivers\lvuvc.hs 2010-11-22 19:25 61,960 a——- i:\windows\system32\drivers\avgntflt.sys 2010-11-17 11:19 47,008 a——- i:\windows\system32\drivers\gbpkm.sys 2010-11-06 14:48 204 a——- i:\windows\system32\drivers\GbpKmAp.lst 2010-11-03 16:40 139,799 a——- i:\windows\hpoins15.dat 2010-10-18 03:00 108,032 a——- i:\windows\system32\ff_vfw.dll 2010-07-17 13:36 126,632 a——- i:\docume~1\rodrigo\applic~1\GDIPFONTCACHEV1.DAT ============= FINISH: 21:15:46.04 ===============