This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

search redirect problem

20 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

OTL Extras logfile created on: 1/14/2011 9:28:59 AM - Run 1
OTL by OldTimer - Version 3.2.20.2 Folder = C:\Users\zane\Documents
Windows Vista Home Basic Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18999)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1,013.00 Mb Total Physical Memory | 161.00 Mb Available Physical Memory | 16.00% Memory free
2.00 Gb Paging File | 1.00 Gb Available in Paging File | 25.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 32.51 Gb Total Space | 3.99 Gb Free Space | 12.28% Space Free | Partition Type: NTFS
Drive D: | 32.26 Gb Total Space | 32.16 Gb Free Space | 99.72% Space Free | Partition Type: NTFS

Computer Name: ZANE-PC | User Name: zane | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]
.hlp [@ = hlpfile] – C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\]
.html [@ = htmlfile] – Reg Error: Key error. File not found

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]
batfile [open] – "%1" %*
cmdfile [open] – "%1" %*
comfile [open] – "%1" %*
exefile [open] – "%1" %*
helpfile [open] – Reg Error: Key error.
hlpfile [open] – %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
piffile [open] – "%1" %*
regfile [merge] – Reg Error: Key error.
scrfile [config] – "%1"
scrfile [install] – rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] – "%1" /S
txtfile – Reg Error: Key error.
Unknown [openas] – %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] – cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [FinePix] – "C:\Program Files\FinePixViewer\FinePixViewer.exe" "%1" (FUJI PHOTO FILM CO.,LTD.)
Folder [open] – %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] – %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] – %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
"UacDisableNotify" = 1
"InternetSettingsDisableNotify" = 1
"AutoUpdateDisableNotify" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type – File not found
"VistaSp2" = Reg Error: Unknown registry data type – File not found

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]


========== Vista Active Open Ports Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{038A3A0B-1D0E-465E-944D-3C990A8A40A0}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{0E0B464A-B6E4-4F18-8DBD-7FFA7EEF3F00}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{1D32A569-B785-45BC-AD18-EC5DE44120D5}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1F987F45-8613-4998-A023-D09C86D24197}" = rport=138 | protocol=17 | dir=out | app=system |
"{24DE9A09-EAFC-4053-A30D-48DFDD04BF14}" = lport=139 | protocol=6 | dir=in | app=system |
"{2DF83102-1B36-4519-AC75-51C78D0346FD}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3266A743-8E6C-48A6-BFA8-4B0F3E35ACA0}" = rport=139 | protocol=6 | dir=out | app=system |
"{5102611C-2007-4472-A511-2C4C7B8B2C4F}" = rport=137 | protocol=17 | dir=out | app=system |
"{56E78214-3B54-438A-92EF-19EEC544018C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{61BDEA28-FC16-4A2A-A499-522E583C9DD8}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{6932E187-F0C8-48FD-960E-8295BBA0C43D}" = lport=138 | protocol=17 | dir=in | app=system |
"{73949FFD-E351-43C3-A487-39E1911F8ED2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{97CC62D7-CD36-438C-B16B-A32DFEEC434C}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D674CF20-CA8C-4F3E-BDCB-B528AED432B8}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{D681AE37-286D-43F9-A0BE-32782D3CFCA2}" = rport=445 | protocol=6 | dir=out | app=system |
"{E05A0EA1-ED8D-456D-841D-7F7CA213E1EE}" = lport=445 | protocol=6 | dir=in | app=system |
"{F602AEC4-E46C-42F5-A3C2-467204BDF34B}" = lport=137 | protocol=17 | dir=in | app=system |
"{FE6350F2-9335-494C-8F2E-8E09FA195B17}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |

========== Vista Active Application Exception List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0951FF80-95BE-48E9-A55F-FFE18943881F}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpiscnapp.exe |
"{0A2A031E-6161-46D6-8286-567665FCCA22}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqcopy2.exe |
"{0D6945D0-A5C4-43DD-AA3A-F5B2B57ABC6C}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpoews01.exe |
"{0F828659-4DAB-4822-9943-252CC29ADB5B}" = dir=in | app=c:\program files\acer\acer arcade\pcmservice.exe |
"{29ADAC27-34CB-4328-BEA5-174074B1BF2D}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpfccopy.exe |
"{35E2D5C6-0720-45BD-90E9-A9AD3ADCF22D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3C54723C-CA96-468B-BBC3-35C3633F1FB8}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{478CAE72-53B9-474F-AD74-F95A45ED74B5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hposid01.exe |
"{5AFE290E-FE0D-47FB-9333-E8A0BE21A12E}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqkygrp.exe |
"{5CF27E37-0504-49CE-B456-A3D320527FC5}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqtra08.exe |
"{6878582E-3701-4E21-90D4-4593E7F10913}" = dir=in | app=c:\program files\acer\acer arcade\kernel\dmp\clbrowserengine.exe |
"{76A1F953-49EA-4D13-8125-4A5C5107E1BA}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{77C3670E-F466-426F-B46C-F0D47905FDDC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{7A8B19E2-A6EE-4777-9B21-E273FC904E27}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{87DDFC1F-BCDD-4A8A-B981-25539DE2A838}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"{8BA27141-9D2F-4010-8382-A353B5B43E8C}" = dir=in | app=c:\program files\acer\acer arcade\kernel\dms\clmsservice.exe |
"{8FE30D6F-6995-4FEE-A424-3575CCAF2CD3}" = dir=in | app=c:\program files\acer\homemedia\homemedia.exe |
"{A66B8604-7C41-4DBB-9C1E-3F2401DD8267}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yserver.exe |
"{A67D2734-747C-4571-BA97-BD793AD44634}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgplgtupl.exe |
"{BD8E64B6-AB60-4D0B-9C84-8028A557EFD9}" = dir=in | app=c:\program files\acer\acer arcade\powercinema.exe |
"{CE58C72F-4812-403F-B019-90E7B145F9C5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{D0866C98-E509-4C45-A972-6BA4C2D730FD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{D5F1FDDD-8A8B-4B09-906D-210C60999942}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqgpc01.exe |
"{DB7B3774-806A-477E-875A-75EE675C603B}" = dir=in | app=c:\program files\hp\digital imaging\bin\hpqste08.exe |
"TCP Query User{0C93BA6C-16C9-4EC1-B0AE-AA3D1215DF92}C:\users\zane\appdata\local\abacastdistributedondemand\node\11\abacastdistributedondemand.exe" = protocol=6 | dir=in | app=c:\users\zane\appdata\local\abacastdistributedondemand\node\11\abacastdistributedondemand.exe |
"TCP Query User{15707CD5-D571-4B5D-944C-305EDA44A912}C:\users\zane\appdata\local\abacast\abaclient2.exe" = protocol=6 | dir=in | app=c:\users\zane\appdata\local\abacast\abaclient2.exe |
"TCP Query User{2A780754-8761-410A-846B-F4B483DC018B}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"TCP Query User{3EB4902D-B711-4314-9DE3-44EC8CE285B6}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{0B24D113-0995-44F7-AD0A-393C765508F9}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe |
"UDP Query User{1160BA68-7BED-44DD-B48F-DBD61A7E9340}C:\users\zane\appdata\local\abacast\abaclient2.exe" = protocol=17 | dir=in | app=c:\users\zane\appdata\local\abacast\abaclient2.exe |
"UDP Query User{13F65496-FE8B-4802-85E6-F94BFA9C1852}C:\program files\yahoo!\messenger\yahoomessenger.exe" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe |
"UDP Query User{B6E7257A-DD7A-4B26-A642-43499A610108}C:\users\zane\appdata\local\abacastdistributedondemand\node\11\abacastdistributedondemand.exe" = protocol=17 | dir=in | app=c:\users\zane\appdata\local\abacastdistributedondemand\node\11\abacastdistributedondemand.exe |

========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01F955B9-4C05-402C-B50A-2191D023F16E}" = NGISCT
"{0B5FDEC2-5A5C-4386-8D76-364AF790A86B}" = Perfect Attorney Platinum
"{10C69612-017B-45F5-B986-7D113D5A2EA3}" = MSN Toolbar
"{11316260-6666-467B-AC34-183FCB5D4335}" = Acer Mobility Center Plug-In
"{116FF17B-1A30-4FC2-9B01-5BC5BD46B0B3}" = Acer eLock Management
"{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"{1FDC8149-87DC-4261-8935-75BE95A0F8F2}" = NGISRD
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{24ED4D80-8294-11D5-96CD-0040266301AD}" = FinePixViewer Ver.5.1
"{2637C347-9DAD-11D6-9EA2-00055D0CA761}" = Acer Arcade
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java™ 6 Update 23
"{2DA85B02-13C0-4E6D-9A76-22E6B3DD0CB2}" = SymNet
"{2EB7F164-5841-43D4-9553-5BA10E1A629D}" = NGISCT
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java™ 6 Update 7
"{36C9E08A-BE2B-40A0-83C5-576748F7B777}" = TestDrive Client
"{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}" = ccCommon
"{47ECCB1F-2811-49C0-B6A7-26778639ABA0}" = 32 Bit HP CIO Components Installer
"{48185814-A224-447A-81DA-71BD20580E1B}" = Norton Internet Security
"{4843B611-8FCB-4428-8C23-31D0A5EAE164}" = Norton Confidential Browser Component
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{54355060-9A23-11D4-9D4B-00010240F659}" = NGIS
"{58E5844B-7CE2-413D-83D1-99294BF6C74F}" = Acer ePower Management
"{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security
"{5D2ACC4D-9DD6-4EC9-8CC8-41382D5908FC}" = NGISCT
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7641FD7D-E94E-424E-A95C-0593C84DC0C0}" = VZAccess Manager
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{774088D4-0777-4D78-904D-E435B318F5D2}" = Microsoft Antimalware
"{77A776C4-D10F-416D-88F0-53F2D9DCD9B3}" = Microsoft Security Client
"{79DD56FC-DB8B-47F5-9C80-78B62E05F9BC}" = Acer ScreenSaver
"{7A0B7B8A-7BFB-42DF-8109-14617F3E20DC}" = NGISCT
"{7B2ADCB5-3F3D-478A-90A9-A8C04EF82BF6}" = Mobile Broadband Generic Drivers
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}" = Zuma Deluxe
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11029123}" = Bricks of Egypt
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111263673}" = Treasures of the Deep
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111271497}" = Mystery Case Files - Prime Suspects
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111307457}" = Galapago
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111310630}" = Big Kahuna Reef 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111473353}" = Dynasty
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}" = Luxor 2
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}" = Jewel Quest Solitaire
"{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-112179547}" = Mystery Case Files Ravenhearst
"{89640DCE-E9CF-4BE3-8B00-D8E1938AAA27}" = NGISCT
"{90850409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{94389919-B0AA-4882-9BE8-9F0B004ECA35}" = Acer Tour
"{966C8381-97CB-4F20-A9B6-5DA4D9CEC6EF}" = NGISCT
"{9A129ABC-A53A-4209-A21E-D5DEDFB7CCA8}" = Norton Protection Center
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = ALPS Touch Pad Driver
"{AB6097D9-D722-4987-BD9E-A076E2848EE2}" = Acer Empowering Technology
"{AC76BA86-7AD7-1033-7B44-A81200000003}" = Adobe Reader 8.1.2
"{AEEAE013-92F1-4515-B278-139F1A692A36}" = Acer eDataSecurity Management
"{B44529FF-501E-47CD-A06D-223C161BE058}" = FinePixViewer Resource
"{B64F8944-DF74-4F87-8C8D-2B27545FFBA9}" = NGISCT
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = PowerProducer 3.72
"{B7C61755-DB48-4003-948F-3D34DB8EAF69}" = MSRedist
"{BF839132-BD43-4056-ACBF-4377F4A88E2A}" = Acer ePresentation Management
"{C06554A1-2C1E-4D20-B613-EE62C79927CC}" = Acer eNet Management
"{CD18059F-D771-4499-BAFB-000B171F9D88}" = NGISCT
"{CDA3025C-223D-4C74-9CEB-3FA1F93E923E}" = NGISCT
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE386A4E-D0DA-4208-8235-BCE43275C694}" = LightScribe 1.4.142.1
"{CE65A9A0-9686-45C6-9098-3C9543A412F0}" = Acer eSettings Management
"{D353CC51-430D-4C6F-9B7E-52003DA1E05A}" = Norton Confidential Web Protection Component
"{D680C913-5955-469D-9D88-C1940F7506D6}" = RAW FILE CONVERTER LE
"{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}" = LiveUpdate Notice (Symantec Corporation)
"{E08B9D24-D7A3-42A7-A01B-CC65EB10FAB9}" = NGISCT
"{E3EFA461-EB83-4C3B-9C47-2C1D58A01555}" = Norton Internet Security
"{E5EE9939-259F-4DE2-8023-5C49E16A4F43}" = Norton Internet Security
"{E6B87DC4-2B3D-4483-ADFF-E483BF718991}" = OpenOffice.org 3.1
"{EFB5B3B5-A280-4E25-BE1C-634EEFE32C1B}" = AppCore
"{F07B861C-72B9-40A4-8B1A-AAED4C06A7E8}" = QuickTime
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F34A94D5-F2C9-43E7-8BD3-49C32D5E9EAB}" = NGISCT
"{F4DB525F-A986-4249-B98B-42A8066251CA}" = AV
"{F6A9634E-3624-4E82-8E56-D7EBC62FBB5C}" = NGISCT
"{F9886B58-236B-473E-BA1C-AAB731D1EFF0}" = NGISCT
"{F9B7991E-6041-4815-955E-8EECA6F8E34D}" = NGISCT
"{FEB41102-B7F6-4FD3-9EC1-EC4FD89CAD30}" = NGISCT
"Acer Assist" = Acer Assist
"Acer Registration" = Acer Registration
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2BFAOR2C06_118" = HDAUDIO Soft Data Fax Modem with SmartCP
"EPSON Printer and Utilities" = EPSON Printer Software
"ESET Online Scanner" = ESET Online Scanner v3
"Google Updater" = Google Updater
"GridVista" = Acer GridVista
"HDMI" = Intel® Graphics Media Accelerator Driver
"InstallShield_{1577A05B-EE62-4BBC-9DB7-FE748FA44EC2}" = NTI CD & DVD-Maker
"InstallShield_{1598034D-7147-432C-8CA8-888E0632D124}" = NTI Backup NOW! 4.7
"LiveUpdate" = LiveUpdate 3.2 (Symantec Corporation)
"LManager" = Launch Manager
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft Security Client" = Microsoft Security Essentials
"Mobile Broadband Generic Drivers" = Mobile Broadband Generic Drivers
"QuickLink Mobile" = QuickLink Mobile
"SymSetup.{5AA2CD16-706F-41f3-87C5-2B5A031F2B3B}" = Norton Internet Security (Symantec Corporation)
"Verizon High Speed Internet_is1" = Verizon High Speed Internet
"Yahoo! Applications" = Verizon Yahoo! Applications
"Yahoo! Extras" = Yahoo! Browser Services
"Yahoo! Software Update" = Yahoo! Software Update

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 7/27/2009 11:51:37 PM | Computer Name = zane-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Initialization of the COM subsystem failed.
Error code: 0x8007041D

Error - 8/4/2009 10:43:39 AM | Computer Name = zane-PC | Source = VSS | ID = 8194
Description =

Error - 8/4/2009 10:47:23 AM | Computer Name = zane-PC | Source = VSS | ID = 8194
Description =

Error - 8/4/2009 5:36:23 PM | Computer Name = zane-PC | Source = VSS | ID = 8194
Description =

Error - 8/4/2009 5:50:17 PM | Computer Name = zane-PC | Source = MsiInstaller | ID = 11904
Description =

Error - 8/8/2009 6:15:29 PM | Computer Name = zane-PC | Source = Application Error | ID = 1000
Description = Faulting application iexplore.exe, version 8.0.6001.18813, time stamp
0x4a6621ae, faulting module QuickTime.qts, version 7.1.3.100, time stamp 0x44f8bf2f,
exception code 0xc0000005, fault offset 0x00069b97, process id 0x1b30, application
start time 0x01ca1869a77a7e80.

Error - 8/11/2009 5:58:05 PM | Computer Name = zane-PC | Source = Application Error | ID = 1000
Description = Faulting application msntask.exe, version 3.0.988.2, time stamp 0x49383d22,
faulting module unknown, version 0.0.0.0, time stamp 0x00000000, exception code
0xc0000096, fault offset 0x002c7e9f, process id 0x17d0, application start time 0x01ca1a17b207dc30.

Error - 8/15/2009 9:04:20 AM | Computer Name = zane-PC | Source = VSS | ID = 8194
Description =

Error - 8/16/2009 9:29:52 AM | Computer Name = zane-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Initialization of the COM subsystem failed.
Error code: 0x8007041D

Error - 8/16/2009 11:55:48 AM | Computer Name = zane-PC | Source = Automatic LiveUpdate Scheduler | ID = 101
Description = Information Level: error Initialization of the COM subsystem failed.
Error code: 0x8007041D

[ System Events ]
Error - 6/26/2008 3:29:08 PM | Computer Name = zane-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 6/26/2008 6:35:17 PM | Computer Name = zane-PC | Source = WPDMTPDriver | ID = 80836
Description =

Error - 6/27/2008 4:22:55 AM | Computer Name = zane-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.

Error - 6/27/2008 10:29:03 AM | Computer Name = zane-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 6/27/2008 10:29:38 AM | Computer Name = zane-PC | Source = Service Control Manager | ID = 7010
Description =

Error - 6/27/2008 2:44:23 PM | Computer Name = zane-PC | Source = EventLog | ID = 6008
Description = The previous system shutdown at 2:41:15 PM on 6/27/2008 was unexpected.

Error - 6/27/2008 9:49:49 PM | Computer Name = zane-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 6/28/2008 11:03:33 AM | Computer Name = zane-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 6/28/2008 3:33:38 PM | Computer Name = zane-PC | Source = Service Control Manager | ID = 7011
Description =

Error - 6/28/2008 8:45:16 PM | Computer Name = zane-PC | Source = ACPI | ID = 327693
Description = : The embedded controller (EC) did not respond within the specified
timeout period. This may indicate that there is an error in the EC hardware or
firmware or that the BIOS is accessing the EC incorrectly. You should check with
your computer manufacturer for an upgraded BIOS. In some situations, this error
may cause the computer to function incorrectly.


< End of report >
You appear clean of infections,please do the following.



ComboFix - Cleanup
Time for some housekeeping
  • Click Start…select Run from the menu.
  • Copy and paste the following into the text entry box:
    Combofix /Uninstall
  • Click the OK button. (See image below as reference.)
🖼Click to load external image (Posted Image)









Clean up with OTL:
  • Double-click OTL.exe to start the program.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CLEANUP button
  • Say Yes to the prompt and then allow the program to reboot your computer.






Clean out your temp files.
Download Attribune's ATF Cleaner and save to your desktop.
Double-click ATF-Cleaner.exe to run the program.
Under Main "Select Files to Delete" choose: Select All.
Click the Empty Selected button.

If you use Firefox or Opera browser click that browser at the top and choose: Select All
Click the Empty Selected button.
If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program
.





Here are some recommendations to help you stay clean.


Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.

Visit Microsoft often to get the latest updates for your computer.
http://www.update.microsoft.com/



Make sure you are running a FIREWALL.The windows firewall is not sufficient to protect your system. It doesn't monitor outgoing traffic and this is a must.
Please read this article 'Safe Computing Practices'.
So how did I get infected in the first place.

please take a moment to read quietman7's excellent prevention tips in post 3 here
Click >>>> Tips to protect yourself against malware and reduce the potential for re-infection:

Preventing Infections in the Future

Please also have a look at the following links, giving some advice and Tips to protect yourself against malware and reduce the potential for re-infection:

  • Avoid gaming sites, underground web pages, pirated software sites, and peer-to-peer (P2P) file sharing programs. They are a security risk which can make your computer susceptible to a smörgåsbord of malware infections, remote attacks, exposure of personal information, and identity theft. Many malicious worms and Trojans spread across P2P file sharing networks, gaming and underground sites. Users visiting such pages may see innocuous-looking banner ads containing code which can trigger pop-up ads and Flash ads that install viruses, Trojans and spyware. Ads are a target for hackers because they offer a stealthy way to distribute malware to a wide range of Internet users. The best way to reduce the risk of infection is to avoid these types of web sites and not use any P2P applications. Read P2P Software User Advisories and Risks of File-Sharing Technology.

Update Non-Microsoft Programs

It is also a good idea to check for the latest versions of commonly installed applications that are regularly patched to fix vulnerabilities. You can check these by visiting Secunia Software Inspector and Calendar of Updates.


Thats it you are good to go.Safe surfing
Things seem to be running normal again. Thanx to mowman and this site for the exellent service. never would have figured this out on my own. Keep up the good work. thanx again.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI