Welcome to MalwareRemoval.com,
What if we told you that you could get malware removal help from experts, and that it was 100% free? MalwareRemoval.com provides free support for people with infected computers. Our help, and the tools we use are always 100% free. No hidden catch. We simply enjoy helping others. You enjoy a clean, safe computer.

Malware Removal Instructions

Browser redirecting on links

MalwareRemoval.com provides free support for people with infected computers. Using plain language that anyone can understand, our community of volunteer experts will walk you through each step.

Browser redirecting on links

Unread postby LeicDave » November 11th, 2009, 7:36 am

Hi log is below for the scan having strange behavior for a week or so. Use the opera browser and on links when searching via google, yahoo any site clicking on the link causes a redirect to what seems to be ad.yieldmanger mainly though there seems to be some other names in there as well.

Taking the link and pasting it directly into the URL bar goes to the site no problem.

Thanks for any help you can give me.

The log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:30:17, on 11/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 10111 bytes
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am
Advertisement
Register to Remove

Re: Browser redirecting on links

Unread postby muppy03 » November 13th, 2009, 8:45 am

Hello and welcome to Malware Removal Forums

IMPORTANT

Whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.
To make cleaning this machine easier:-
  • Continue to respond to this thread until I give you the All Clean!
  • Please DO NOT uninstall/install any programs unless asked to. It is more difficult when files/programs appear or disappear from the logs.
  • Please do not run any scans other than those requested and do not post any logs/reports unless specifically requested to do so.
  • Please follow all instructions in the order posted.
  • If you have any questions or do not understand instructions, please ask before continuing.
  • Please reply to this thread. Do not start a new topic.

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer. Please note that all P2P will be removed in cleaning.

uTorrent

I'd like you to read the MRU policy for P2P Programs.

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

Please run a new HJT scan when finished and post the log back here.


Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:
  • Start HijackThis
  • Click on the Config button
  • Click on the Misc Tools button
  • Click on the Open Uninstall Manager button.
  • Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Save the file to your desktop.

Please post this log on your next reply along with a new HJT log
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 13th, 2009, 8:59 am

Thanks Muppy03.

The log with the named program removed.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:56:20, on 13/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\iTunes\iTunes.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 10200 bytes

The list of installed programs.

2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
2007 Microsoft Office Suite Service Pack 1 (SP1)
abgx360 v1.0.1
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Avidemux 2.5
Avira AntiVir Personal - Free Antivirus
Bonjour
FILE RECOVERY for Windows
Google Apps
Google Chrome
Google Desktop
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB935448)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
ImgBurn
iTunes
Java(TM) 6 Update 16
LG CyberLink LabelPrint
LG CyberLink PowerBackup
LG CyberLink PowerDVD 7.0
LG CyberLink PowerProducer
LG CyberLink YouCam
LG CyberLink YouCam
LG ODD Auto Firmware Update
LG Power Tools
LG Power Tools
LightScribe System Software
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Choice Guard
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Plus 2007
Microsoft Office Professional Plus 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
mkv2vob
MKVtoolnix 2.9.8
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 6 Service Pack 2 (KB954459)
neroxml
NVIDIA Drivers
Opera 10.00
PeerGuardian 2.0
QuickTime
Rapport
Realtek High Definition Audio Driver
Recover Data for NTFS
Security Update for 2007 Microsoft Office System (KB951550)
Security Update for 2007 Microsoft Office System (KB951944)
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office Outlook 2007 (KB972363)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office Publisher 2007 (KB969693)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974455)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
Skype web features
Skype™ 4.1
SMPlayer 0.6.8
SpeedFan (remove only)
Spybot - Search & Destroy
Spyware Doctor 7.0
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Outlook 2007 Junk Email Filter (kb975960)
Update for Windows XP (KB898461)
Update for Windows XP (KB925720)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Update for Windows XP (KB976749)
VLC media player 1.0.2
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Essentials
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Upload Tool
WinRAR archiver
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am

Re: Browser redirecting on links

Unread postby muppy03 » November 13th, 2009, 9:11 am

Disable Spybot's TeaTimer. This is a two step process.

Spybot S&D's tea timer normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.

First step:
  • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
  • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
  • If you have Version 1.4, Click on Exit Spybot S&D Resident
Second step, For Either Version :
  • Open Spybot S&D
  • Click Mode, choose Advanced Mode
  • Go To the bottom of the Vertical Panel on the Left, Click Tools
  • then, also in left panel, click Resident shows a red/white shield.
  • If your firewall raises a question, say OK
  • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
  • OK any prompts.
  • Use File, Exit to terminate Spybot
  • Reboot your machine for the changes to take effect.
Don't forget to re-enable it, when your computer is clean.


Please download Malwarebytes' Anti-Malware and save to your desktop.

  • Double-click mbam-setup.exe and follow the prompts to install the program.
  • At the end, be sure a checkmark is placed next to:

    Update Malwarebytes' Anti-Malware
    Launch Malwarebytes' Anti-Malware
  • Then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select Perform Full scan, then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Be sure that everything is checked, and click Remove Selected.
  • When completed, a log will open in Notepad. Please copy and paste the log back into your next reply

    Note:
  • The log can also be found here:
    C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
  • Or via the Logs tab when Malwarebytes' Anti-Malware is started.

NEXT Download and Run: RSIT

  • Download random's system information tool (RSIT) by random/random from here and save it to your desktop.
  • Double click on RSIT.exe to run RSIT.
  • Click Continue at the disclaimer screen.
  • Once it has finished, two logs will open. Please post the contents of both log.txt (<<will be maximized) and info.txt (<<will be minimized)


Please reply with:-
  • MBAM log
  • RSIT logs ( info.txt and log.txt)
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 13th, 2009, 3:15 pm

The logs as requested.

MBAM log

Malwarebytes' Anti-Malware 1.41
Database version: 3160
Windows 5.1.2600 Service Pack 2

13/11/2009 19:10:14
mbam-log-2009-11-13 (19-10-13).txt

Scan type: Full Scan (C:\|E:\|F:\|)
Objects scanned: 238405
Time elapsed: 1 hour(s), 30 minute(s), 55 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


RSIT logs info.txt

info.txt logfile of random's system information tool 1.06 2009-11-13 19:11:38

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {BEE75E01-DD3F-4D5F-B96C-609E6538D419}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {3EC77D26-799B-4CD8-914F-C1565E796173}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {430971B1-C31E-45DA-81E0-72C095BAB72C}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {F7A31780-33C4-4E39-951A-5EC9B91D7BF1}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {FAD8A83E-9BAC-4179-9268-A35948034D85}
2007 Microsoft Office Suite Service Pack 1 (SP1)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {4CA4ECC1-DBD4-4591-8F4C-AA12AD2D3E59}
abgx360 v1.0.1-->"C:\Program Files\abgx360\uninstall.exe"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Apple Application Support-->MsiExec.exe /I{B607C354-CD79-4D22-86D1-92DC94153F42}
Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Avidemux 2.5-->C:\Program Files\Avidemux 2.5\uninstall.exe
Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
FILE RECOVERY for Windows-->C:\Program Files\FILE RECOVERY for Windows\Uninstall.exe
Google Apps-->MsiExec.exe /I{C8E95BF5-C07F-4D98-BB42-F58FC98BC03E}
Google Chrome-->"C:\Program Files\Google\Chrome\Application\3.0.195.32\Installer\setup.exe" --uninstall --system-level
Google Desktop-->C:\Program Files\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_E582EA556D8DE101.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater-->"C:\Program Files\Google\Google Updater\GoogleUpdater.exe" -uninstall
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows XP (KB935448)-->"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
ImgBurn-->"C:\Program Files\ImgBurn\uninstall.exe"
iTunes-->MsiExec.exe /I{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}
Java(TM) 6 Update 16-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
LG CyberLink LabelPrint-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C59C179C-668D-49A9-B6EA-0121CCFC1243}\Setup.exe" -uninstall
LG CyberLink PowerBackup-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{ADD5DB49-72CF-11D8-9D75-000129760D75}\Setup.exe" -uninstall
LG CyberLink PowerDVD 7.0-->"C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
LG CyberLink PowerProducer-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B7A0CE06-068E-11D6-97FD-0050BACBF861}\Setup.exe" -uninstall
LG CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall
LG CyberLink YouCam-->"C:\Program Files\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall
LG ODD Auto Firmware Update-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6179550A-3E7C-499E-BCC9-9E8113E0A285}\Setup.exe"
LG Power Tools-->"C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" /z-uninstall
LG Power Tools-->"C:\Program Files\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\Setup.exe" /z-uninstall
LightScribe System Software-->MsiExec.exe /X{4A9849CA-E11C-4F24-8BB1-97C717A1C898}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Choice Guard-->MsiExec.exe /X{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}
Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}
Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}
Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}
Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}
Microsoft Office Professional Plus 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROPLUS /dll OSETUP.DLL
Microsoft Office Professional Plus 2007-->MsiExec.exe /X{90120000-0011-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}
Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}
Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}
Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}
Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}
Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
mkv2vob-->MsiExec.exe /X{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}
MKVtoolnix 2.9.8-->C:\Program Files\MKVtoolnix\uninst.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{1A528690-6A2D-4BC5-B143-8C4AE8D19D96}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NVIDIA Drivers-->C:\WINDOWS\system32\nvudisp.exe UninstallGUI
Opera 10.00-->MsiExec.exe /X{FC66E05E-8D39-47A6-8D07-759F33727EB0}
PeerGuardian 2.0-->"C:\Program Files\PeerGuardian2\unins000.exe"
QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}
Rapport-->MsiExec.exe /X{1DD81E7D-0D28-4CEB-87B2-C041A4FCB215}
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x9 -removeonly
Recover Data for NTFS-->"C:\Program Files\Recover Data for NTFS\unins000.exe"
Security Update for 2007 Microsoft Office System (KB951550)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {B243E9A5-ED77-4F1B-B338-2486FD82DC85}
Security Update for 2007 Microsoft Office System (KB951944)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {797AE457-BA17-4BBC-B501-25FB3A0103C7}
Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}
Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}
Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}
Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}
Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}
Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}
Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}
Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}
Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}
Security Update for Microsoft Office Word 2007 (KB969604)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {CF3D6499-709C-43D0-8908-BC5652656050}
Security Update for Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Security Update for Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9L$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958470)-->"C:\WINDOWS\$NtUninstallKB958470$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Security Update for Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Security Update for Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Security Update for Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971032)-->"C:\WINDOWS\$NtUninstallKB971032$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Security Update for Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Security Update for Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"
Security Update for Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Security Update for Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SMPlayer 0.6.8-->C:\Program Files\SMPlayer\uninst.exe
SpeedFan (remove only)-->"C:\Program Files\SpeedFan\uninstall.exe"
Spybot - Search & Destroy-->"C:\Program Files\Spybot - Search & Destroy\unins000.exe"
Spyware Doctor 7.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update for Outlook 2007 Junk Email Filter (kb975960)-->msiexec /package {90120000-0011-0000-0000-0000000FF1CE} /uninstall {F1AB1BED-7477-4D5A-BD0C-04C2109459A5}
Update for Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update for Windows XP (KB925720)-->"C:\WINDOWS\$NtUninstallKB925720$\spuninst\spuninst.exe"
Update for Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Update for Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update for Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update for Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Update for Windows XP (KB976749)-->"C:\WINDOWS\$NtUninstallKB976749$\spuninst\spuninst.exe"
VLC media player 1.0.2-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Live Call-->MsiExec.exe /I{F6BD194C-4190-4D73-B1B1-C48C99921BFE}
Windows Live Communications Platform-->MsiExec.exe /I{ED00D08A-3C5F-488D-93A0-A04F21F23956}
Windows Live Essentials-->C:\Program Files\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{81128EE8-8EAD-4DB0-85C6-17C2CE50FF71}
Windows Live Messenger-->MsiExec.exe /X{A85FD55B-891B-4314-97A5-EA96C0BD80B5}
Windows Live Sign-in Assistant-->MsiExec.exe /I{45338B07-A236-4270-9A77-EBB4115517B5}
Windows Live Upload Tool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AV: Spyware Doctor with AntiVirus
AV: AntiVir Desktop

======System event log======

Computer Name: DAVE
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.

Record Number: 366
Source Name: Disk
Time Written: 20091025211111.000000+000
Event Type: warning
User:

Computer Name: DAVE
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Record Number: 365
Source Name: W32Time
Time Written: 20091025210904.000000+000
Event Type: warning
User:

Computer Name: DAVE
Event Code: 4226
Message: TCP/IP has reached the security limit imposed on the number of concurrent TCP connect attempts.

Record Number: 364
Source Name: Tcpip
Time Written: 20091025203742.000000+000
Event Type: warning
User:

Computer Name: DAVE
Event Code: 51
Message: An error was detected on device \Device\Harddisk1\D during a paging operation.

Record Number: 363
Source Name: Disk
Time Written: 20091025203403.000000+000
Event Type: warning
User:

Computer Name: DAVE
Event Code: 36
Message: The time service has not been able to synchronize the system time
for 49152 seconds because none of the time providers has been able to
provide a usable time stamp. The system clock is unsynchronized.

Record Number: 215
Source Name: W32Time
Time Written: 20091024205751.000000+060
Event Type: warning
User:

=====Application event log=====

Computer Name: DAVE
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 18
Source Name: WinMgmt
Time Written: 20091024002104.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: DAVE
Event Code: 5603
Message: A provider, Rsop Planning Mode Provider, has been registered in the WMI namespace, root\RSOP, but did not specify the HostingModel property. This provider will be run using the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests. Ensure that provider has been reviewed for security behavior and update the HostingModel property of the provider registration to an account with the least privileges possible for the required functionality.

Record Number: 17
Source Name: WinMgmt
Time Written: 20091024002104.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: DAVE
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 13
Source Name: WinMgmt
Time Written: 20091024001854.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: DAVE
Event Code: 63
Message: A provider, CmdTriggerConsumer, has been registered in the WMI namespace, Root\cimv2, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 12
Source Name: WinMgmt
Time Written: 20091024001854.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

Computer Name: DAVE
Event Code: 63
Message: A provider, HiPerfCooker_v1, has been registered in the WMI namespace, Root\WMI, to use the LocalSystem account. This account is privileged and the provider may cause a security violation if it does not correctly impersonate user requests.

Record Number: 11
Source Name: WinMgmt
Time Written: 20091024001853.000000+060
Event Type: warning
User: NT AUTHORITY\SYSTEM

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\;C:\Program Files\MKVtoolnix
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=16
"PROCESSOR_IDENTIFIER"=x86 Family 16 Model 2 Stepping 3, AuthenticAMD
"PROCESSOR_REVISION"=0203
"NUMBER_OF_PROCESSORS"=3
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Program Files\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

RSIT log.txt

Logfile of random's system information tool 1.06 (written by random/random)
Run by David at 2009-11-13 19:11:16
Microsoft Windows XP Professional Service Pack 2
System drive C: has 18 GB (24%) free of 76 GB
Total RAM: 1791 MB (35% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:11:33, on 13/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\David\Desktop\RSIT.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\David.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 10024 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-08-04 1586472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Sign-in Helper - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-01-22 408448]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-10-23 256112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll [2009-10-26 762864]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll [2009-10-23 458736]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-07-31 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-07-31 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll [2009-10-23 256112]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-04-20 8429568]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-04-20 81920]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2007-06-15 1826816]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]
"Google Desktop Search"=C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-10-26 30192]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2009-09-22 1243088]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-07-31 149280]
"UpdateLBPShortCut"=C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe [2008-12-03 218408]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-03-14 71216]
"LanguageShortcut"=C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-01-08 52256]
"UCam_Menu"=C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [2008-12-03 218408]
"LGODDFU"=C:\Program Files\lg_fwupdate\fwupdate.exe [2009-10-29 557056]
"UpdatePSTShortCut"=C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe [2009-05-07 210216]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]
"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360]
"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-10-09 25623336]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-10-23 39408]
"LightScribe Control Panel"=C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe [2009-01-27 2387968]
"bluebirds"=C:\Documents and Settings\David\Bluebirds\BlueBirds.exe [2009-04-29 270336]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 239496]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSetActiveDesktop"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoSetActiveDesktop"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Skype\Plugin Manager\skypePM.exe"="C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\Java\jre6\bin\javaw.exe"="C:\Program Files\Java\jre6\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe"="C:\Program Files\CyberLink\PowerDVD\PowerDVD.exe:*:Enabled:CyberLink PowerDVD"
"C:\Program Files\Windows Live\Messenger\wlcsdk.exe"="C:\Program Files\Windows Live\Messenger\wlcsdk.exe:*:Enabled:Windows Live Call"
"C:\Program Files\Windows Live\Messenger\msnmsgr.exe"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{41fa70c3-c042-11de-b98a-806d6172696f}]
shell\AutoRun\command - G:\BlueBirds.exe


======List of files/folders created in the last 1 months======

2009-11-13 19:11:16 ----D---- C:\rsit
2009-11-11 23:57:15 ----D---- C:\Program Files\MKVtoolnix
2009-11-11 23:55:43 ----D---- C:\Program Files\Avidemux 2.5
2009-11-11 11:24:35 ----D---- C:\Program Files\Trend Micro
2009-11-11 11:09:45 ----A---- C:\WINDOWS\system32\tmp.txt
2009-11-11 11:09:29 ----A---- C:\rapport.txt
2009-11-11 11:00:25 ----A---- C:\smitfiles.txt
2009-11-11 10:39:47 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\WS2Fix.exe
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\VACFix.exe
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\o4Patch.exe
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\IEDFix.exe
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\IEDFix.C.exe
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\Agent.OMZ.Fix.exe
2009-11-11 10:38:44 ----A---- C:\WINDOWS\system32\404Fix.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\VCCLSID.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\swxcacls.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\swsc.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\swreg.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\SrchSTS.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\Process.exe
2009-11-11 10:38:43 ----A---- C:\WINDOWS\system32\dumphive.exe
2009-11-10 20:59:10 ----D---- C:\Documents and Settings\David\Application Data\ImgBurn
2009-11-10 20:29:34 ----D---- C:\Program Files\abgx360
2009-11-10 18:07:03 ----D---- C:\Program Files\ImgBurn
2009-11-08 12:58:27 ----D---- C:\Documents and Settings\David\Application Data\Trusteer
2009-11-08 12:58:15 ----D---- C:\Program Files\Trusteer
2009-11-08 12:57:18 ----D---- C:\Documents and Settings\All Users\Application Data\Trusteer
2009-11-08 01:07:37 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-11-08 01:06:32 ----HDC---- C:\WINDOWS\$NtUninstallKB925720$
2009-11-07 07:59:06 ----D---- C:\WINDOWS\system32\XPSViewer
2009-11-07 07:59:00 ----D---- C:\WINDOWS\system32\en-US
2009-11-07 07:58:53 ----D---- C:\Program Files\Reference Assemblies
2009-11-07 07:58:26 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-11-07 07:58:25 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-11-07 07:58:25 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-11-07 07:55:01 ----HDC---- C:\WINDOWS\$NtUninstallWIC$
2009-11-07 07:54:54 ----D---- C:\Program Files\MSXML 6.0
2009-11-06 14:00:47 ----RSD---- C:\WINDOWS\assembly
2009-11-06 14:00:13 ----D---- C:\WINDOWS\Microsoft.NET
2009-11-06 13:53:52 ----A---- C:\WINDOWS\system32\portio32.dll
2009-11-04 23:39:33 ----HDC---- C:\WINDOWS\$NtUninstallKB961503$
2009-11-04 23:38:59 ----HDC---- C:\WINDOWS\$NtUninstallKB976749$
2009-11-04 03:21:32 ----A---- C:\WINDOWS\system32\muweb.dll
2009-11-04 03:21:32 ----A---- C:\WINDOWS\system32\mucltui.dll.mui
2009-11-04 03:21:32 ----A---- C:\WINDOWS\system32\mucltui.dll
2009-11-03 16:16:58 ----D---- C:\Program Files\SpeedFan
2009-11-03 11:23:59 ----D---- C:\Program Files\Microsoft
2009-11-03 11:23:41 ----D---- C:\Program Files\Windows Live SkyDrive
2009-11-03 11:23:17 ----D---- C:\Program Files\Windows Live
2009-11-03 11:19:04 ----D---- C:\Program Files\Common Files\Windows Live
2009-11-02 10:29:27 ----D---- C:\Program Files\iPod
2009-11-02 10:29:25 ----D---- C:\Program Files\iTunes
2009-11-01 13:28:15 ----D---- C:\Documents and Settings\All Users\Application Data\LightScribe
2009-11-01 12:22:11 ----D---- C:\Documents and Settings\David\Application Data\Malwarebytes
2009-11-01 12:21:27 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2009-11-01 12:21:26 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-11-01 11:34:27 ----D---- C:\Program Files\Common Files\LightScribe
2009-10-31 17:50:04 ----D---- C:\Program Files\PeerGuardian2
2009-10-30 21:00:47 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-10-30 21:00:47 ----D---- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-30 00:50:22 ----D---- C:\Program Files\MSXML 4.0
2009-10-30 00:48:34 ----D---- C:\Program Files\SMPlayer
2009-10-29 18:18:34 ----D---- C:\Temp
2009-10-29 18:17:54 ----A---- C:\WINDOWS\lgfwup.ini
2009-10-29 18:17:51 ----D---- C:\Program Files\lg_fwupdate
2009-10-29 18:17:51 ----A---- C:\WINDOWS\system32\Vb6stkit.dll
2009-10-29 18:17:51 ----A---- C:\WINDOWS\system32\VB6KO.DLL
2009-10-29 18:17:51 ----A---- C:\WINDOWS\system32\lgfwunis.exe
2009-10-29 18:13:29 ----N---- C:\WINDOWS\system32\msxml3a.dll
2009-10-29 18:12:19 ----D---- C:\Documents and Settings\David\Application Data\CyberLink
2009-10-29 18:11:21 ----N---- C:\WINDOWS\system32\msvcr71.dll
2009-10-29 18:11:20 ----N---- C:\WINDOWS\system32\msvcp71.dll
2009-10-29 18:11:20 ----N---- C:\WINDOWS\system32\MFC71u.dll
2009-10-29 18:11:20 ----N---- C:\WINDOWS\system32\MFC71.dll
2009-10-29 18:10:31 ----D---- C:\Program Files\CyberLink
2009-10-29 18:10:10 ----D---- C:\Documents and Settings\All Users\Application Data\CyberLink
2009-10-29 11:37:52 ----D---- C:\Program Files\Microsoft Works
2009-10-29 11:37:44 ----D---- C:\Program Files\MSBuild
2009-10-29 11:37:32 ----D---- C:\Program Files\Microsoft Visual Studio
2009-10-29 11:37:31 ----D---- C:\Program Files\Common Files\DESIGNER
2009-10-29 11:35:07 ----D---- C:\WINDOWS\SHELLNEW
2009-10-29 11:34:40 ----D---- C:\Program Files\Microsoft Office
2009-10-29 11:34:40 ----D---- C:\Documents and Settings\All Users\Application Data\Microsoft Help
2009-10-29 11:34:06 ----RHD---- C:\MSOCache
2009-10-28 19:44:47 ----A---- C:\WINDOWS\system32\javaws.exe
2009-10-28 19:44:47 ----A---- C:\WINDOWS\system32\javaw.exe
2009-10-28 19:44:47 ----A---- C:\WINDOWS\system32\java.exe
2009-10-28 19:44:42 ----A---- C:\WINDOWS\system32\MRT.exe
2009-10-28 19:39:49 ----D---- C:\Program Files\Spyware Doctor
2009-10-28 19:39:49 ----D---- C:\Program Files\Common Files\PC Tools
2009-10-28 19:39:49 ----D---- C:\Documents and Settings\David\Application Data\PC Tools
2009-10-28 19:39:49 ----D---- C:\Documents and Settings\All Users\Application Data\PC Tools
2009-10-28 19:38:24 ----D---- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2009-10-27 18:26:06 ----D---- C:\Documents and Settings\David\Application Data\vlc
2009-10-27 15:49:49 ----A---- C:\WINDOWS\system32\wpa.bak
2009-10-26 11:39:24 ----D---- C:\WINDOWS\system32\appmgmt
2009-10-26 11:31:08 ----D---- C:\Documents and Settings\All Users\Application Data\Adobe
2009-10-26 11:31:02 ----D---- C:\Program Files\Common Files\Adobe
2009-10-26 11:31:02 ----D---- C:\Program Files\Adobe
2009-10-26 11:28:55 ----D---- C:\Documents and Settings\All Users\Application Data\Google Updater
2009-10-26 11:19:53 ----AD---- C:\Documents and Settings\All Users\Application Data\TEMP
2009-10-26 11:15:59 ----D---- C:\Program Files\SpyZooka
2009-10-26 11:09:13 ----D---- C:\Documents and Settings\David\Application Data\Google
2009-10-26 10:58:12 ----D---- C:\Program Files\1st NTFS Recovery
2009-10-26 10:57:09 ----D---- C:\Documents and Settings\David\Application Data\WinRAR
2009-10-26 10:56:56 ----D---- C:\Program Files\WinRAR
2009-10-26 00:03:59 ----SHD---- C:\RECYCLER
2009-10-25 21:51:37 ----D---- C:\Program Files\NTFS-RECOVERY.COM
2009-10-25 19:35:25 ----D---- C:\WINDOWS\system32\NtmsData
2009-10-25 19:28:51 ----A---- C:\WINDOWS\Getdisk.exe
2009-10-25 19:28:49 ----D---- C:\WINDOWS\Recover Data for NTFS
2009-10-25 19:28:49 ----D---- C:\Program Files\Recover Data for NTFS
2009-10-25 19:08:53 ----D---- C:\SGI Image
2009-10-25 19:08:41 ----D---- C:\JPEG Image
2009-10-25 18:59:14 ----D---- C:\VP6 encoded Video
2009-10-25 18:47:46 ----D---- C:\MPEG Layer III Audio
2009-10-25 18:47:28 ----D---- C:\VOB video files
2009-10-25 18:47:28 ----D---- C:\Unicode Document
2009-10-25 18:47:28 ----D---- C:\Text Document
2009-10-25 18:47:28 ----D---- C:\MPEG Video
2009-10-25 18:47:28 ----D---- C:\$$$Folder00031
2009-10-24 23:27:36 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-10-24 23:27:31 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-10-24 23:27:26 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-10-24 23:27:21 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-10-24 23:27:17 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-10-24 23:27:13 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$
2009-10-24 23:27:08 ----HDC---- C:\WINDOWS\$NtUninstallKB935448$
2009-10-24 23:26:53 ----HDC---- C:\WINDOWS\$NtUninstallKB974455$
2009-10-24 23:26:47 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$
2009-10-24 23:26:43 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$
2009-10-24 23:26:29 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$
2009-10-24 23:26:24 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$
2009-10-24 23:26:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-10-24 23:26:15 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$
2009-10-24 23:26:10 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$
2009-10-24 23:26:06 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-10-24 23:26:01 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$
2009-10-24 23:25:50 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-10-24 23:25:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$
2009-10-24 23:25:38 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$
2009-10-24 23:25:34 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$
2009-10-24 23:25:31 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-10-24 23:25:26 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-10-24 23:25:23 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$
2009-10-24 23:25:18 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$
2009-10-24 23:25:16 ----A---- C:\WINDOWS\system32\wmpns.dll
2009-10-24 23:25:12 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$
2009-10-24 23:25:06 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-10-24 23:25:01 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$
2009-10-24 23:24:57 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$
2009-10-24 23:24:53 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-10-24 23:24:48 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-10-24 23:24:44 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-10-24 23:24:40 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-10-24 23:24:35 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$
2009-10-24 23:24:28 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-10-24 23:24:22 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-10-24 23:24:16 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-10-24 23:24:11 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$
2009-10-24 23:24:07 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$
2009-10-24 23:23:58 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$
2009-10-24 23:23:52 ----D---- C:\WINDOWS\ServicePackFiles
2009-10-24 23:23:50 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$
2009-10-24 23:23:45 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-10-24 23:23:40 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$
2009-10-24 23:23:36 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$
2009-10-24 23:23:31 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$
2009-10-24 23:23:24 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$
2009-10-24 23:23:19 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-10-24 23:23:14 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-10-24 23:23:09 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-10-24 23:23:00 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$
2009-10-24 23:22:54 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-10-24 23:22:50 ----HDC---- C:\WINDOWS\$NtUninstallKB970653-v3$
2009-10-24 23:22:46 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$
2009-10-24 23:22:39 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$
2009-10-24 06:50:11 ----D---- C:\Program Files\FILE RECOVERY for Windows
2009-10-24 06:41:56 ----D---- C:\Documents and Settings\David\Application Data\Macromedia
2009-10-24 06:41:56 ----D---- C:\Documents and Settings\David\Application Data\Adobe
2009-10-24 06:24:00 ----D---- C:\WINDOWS\system32\CatRoot_bak
2009-10-24 06:20:58 ----A---- C:\WINDOWS\system32\xpsp3res.dll
2009-10-24 06:20:56 ----N---- C:\WINDOWS\system32\tzchange.exe
2009-10-24 02:16:23 ----A---- C:\WINDOWS\system32\h323log.txt
2009-10-24 02:14:43 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-10-24 02:13:25 ----A---- C:\WINDOWS\system32\usbui.dll
2009-10-24 02:12:24 ----A---- C:\WINDOWS\imsins.BAK
2009-10-24 02:12:21 ----SHD---- C:\WINDOWS\Installer
2009-10-24 02:12:21 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-10-24 02:12:20 ----D---- C:\Program Files\Common Files\ODBC
2009-10-24 02:12:20 ----A---- C:\WINDOWS\ODBCINST.INI
2009-10-24 02:12:18 ----D---- C:\Program Files\Common Files\SpeechEngines
2009-10-24 02:12:17 ----RD---- C:\Program Files
2009-10-24 02:12:17 ----D---- C:\Program Files\Common Files\Microsoft Shared
2009-10-24 02:12:17 ----D---- C:\Program Files\Common Files
2009-10-24 02:12:15 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-10-24 02:12:15 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-10-24 02:12:15 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-10-24 02:12:13 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-10-24 02:12:12 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-10-24 02:12:12 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-10-24 02:12:12 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-10-24 02:12:12 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-10-24 02:12:12 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-10-24 02:12:10 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-10-24 02:12:09 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-10-24 02:12:09 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-10-24 02:12:09 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-10-24 02:12:09 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-10-24 02:12:09 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-10-24 02:12:07 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-10-24 02:12:05 ----A---- C:\WINDOWS\system32\irclass.dll
2009-10-24 02:12:04 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-10-24 02:12:04 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-10-24 02:12:04 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-10-24 02:12:04 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-10-24 02:12:02 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-10-24 02:12:02 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-10-24 02:12:02 ----A---- C:\WINDOWS\system32\batt.dll
2009-10-24 02:12:01 ----A---- C:\WINDOWS\NOTEPAD.EXE
2009-10-24 02:11:59 ----A---- C:\WINDOWS\system32\storprop.dll
2009-10-24 02:11:52 ----ASH---- C:\Documents and Settings\All Users\Application Data\desktop.ini
2009-10-24 02:10:10 ----RA---- C:\WINDOWS\SET8.tmp
2009-10-24 02:10:08 ----RA---- C:\WINDOWS\SET4.tmp
2009-10-24 02:10:07 ----RA---- C:\WINDOWS\SET3.tmp
2009-10-24 02:10:03 ----D---- C:\WINDOWS\system32\CatRoot2
2009-10-24 02:10:03 ----D---- C:\WINDOWS\system32\CatRoot
2009-10-24 02:09:57 ----SD---- C:\Documents and Settings\All Users\Application Data\Microsoft
2009-10-24 02:09:39 ----A---- C:\WINDOWS\setuplog.txt
2009-10-24 02:09:35 ----SHD---- C:\System Volume Information
2009-10-24 02:09:35 ----D---- C:\Documents and Settings
2009-10-24 02:08:03 ----SH---- C:\boot.ini
2009-10-24 02:02:13 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-10-24 02:02:13 ----RSD---- C:\WINDOWS\Fonts
2009-10-24 02:02:13 ----RD---- C:\WINDOWS\Web
2009-10-24 02:02:13 ----HD---- C:\WINDOWS\inf
2009-10-24 02:02:13 ----D---- C:\WINDOWS\WinSxS
2009-10-24 02:02:13 ----D---- C:\WINDOWS\twain_32
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Temp
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\wins
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\wbem
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\usmt
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\spool
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\ShellExt
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\Setup
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\ras
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\oobe
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\npp
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\mui
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\inetsrv
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\IME
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\icsxml
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\ias
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\export
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\drivers
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\dhcp
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\config
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\3com_dmi
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\3076
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\2052
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1054
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1042
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1041
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1037
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1033
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1031
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1028
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32\1025
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system32
2009-10-24 02:02:13 ----D---- C:\WINDOWS\system
2009-10-24 02:02:13 ----D---- C:\WINDOWS\security
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Resources
2009-10-24 02:02:13 ----D---- C:\WINDOWS\repair
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Provisioning
2009-10-24 02:02:13 ----D---- C:\WINDOWS\PeerNet
2009-10-24 02:02:13 ----D---- C:\WINDOWS\pchealth
2009-10-24 02:02:13 ----D---- C:\WINDOWS\mui
2009-10-24 02:02:13 ----D---- C:\WINDOWS\msapps
2009-10-24 02:02:13 ----D---- C:\WINDOWS\msagent
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Media
2009-10-24 02:02:13 ----D---- C:\WINDOWS\java
2009-10-24 02:02:13 ----D---- C:\WINDOWS\ime
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Help
2009-10-24 02:02:13 ----D---- C:\WINDOWS\ehome
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Driver Cache
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Debug
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Cursors
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Connection Wizard
2009-10-24 02:02:13 ----D---- C:\WINDOWS\Config
2009-10-24 02:02:13 ----D---- C:\WINDOWS\AppPatch
2009-10-24 02:02:13 ----D---- C:\WINDOWS\addins
2009-10-24 02:02:13 ----D---- C:\WINDOWS
2009-10-24 00:16:39 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-10-24 00:16:23 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-10-24 00:16:23 ----D---- C:\WINDOWS\system32\PreInstall
2009-10-24 00:16:22 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-10-24 00:16:22 ----HD---- C:\WINDOWS\$hf_mig$
2009-10-24 00:08:43 ----D---- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2009-10-24 00:03:20 ----D---- C:\Program Files\VideoLAN
2009-10-24 00:01:08 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-10-24 00:00:56 ----D---- C:\Program Files\Java
2009-10-24 00:00:48 ----D---- C:\Documents and Settings\David\Application Data\Sun
2009-10-24 00:00:04 ----D---- C:\Program Files\PS3 Media Server
2009-10-23 23:59:40 ----D---- C:\Program Files\mkv2vob
2009-10-23 23:59:01 ----D---- C:\Documents and Settings\David\Application Data\Apple Computer
2009-10-23 23:58:56 ----A---- C:\WINDOWS\system32\GEARAspi.dll
2009-10-23 23:58:28 ----D---- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-23 23:58:18 ----D---- C:\Program Files\Bonjour
2009-10-23 23:58:00 ----D---- C:\Program Files\QuickTime
2009-10-23 23:57:59 ----D---- C:\Documents and Settings\All Users\Application Data\Apple Computer
2009-10-23 23:57:44 ----D---- C:\Program Files\Apple Software Update
2009-10-23 23:57:40 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-10-23 23:57:13 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-10-23 23:57:09 ----D---- C:\Program Files\Common Files\Apple
2009-10-23 23:57:09 ----D---- C:\Documents and Settings\All Users\Application Data\Apple
2009-10-23 23:51:42 ----D---- C:\Documents and Settings\David\Application Data\skypePM
2009-10-23 23:51:21 ----D---- C:\Documents and Settings\David\Application Data\Skype
2009-10-23 23:51:16 ----D---- C:\Program Files\Google
2009-10-23 23:51:16 ----D---- C:\Documents and Settings\All Users\Application Data\Google
2009-10-23 23:51:07 ----D---- C:\Program Files\Common Files\Skype
2009-10-23 23:51:04 ----RD---- C:\Program Files\Skype
2009-10-23 23:51:02 ----D---- C:\Documents and Settings\All Users\Application Data\Skype
2009-10-23 23:48:42 ----D---- C:\Documents and Settings\David\Application Data\Opera
2009-10-23 23:48:37 ----D---- C:\Program Files\Opera
2009-10-23 23:47:20 ----D---- C:\Program Files\Avira
2009-10-23 23:47:20 ----D---- C:\Documents and Settings\All Users\Application Data\Avira
2009-10-23 23:42:47 ----D---- C:\WINDOWS\system32\Lang
2009-10-23 23:37:53 ----RA---- C:\WINDOWS\system32\RtkCoInst.dll
2009-10-23 23:37:53 ----RA---- C:\WINDOWS\system32\maxxaudioapo.dll
2009-10-23 23:37:52 ----RA---- C:\WINDOWS\system32\SRSWOW.dll
2009-10-23 23:37:52 ----RA---- C:\WINDOWS\system32\SRSTSXT.dll
2009-10-23 23:37:52 ----RA---- C:\WINDOWS\system32\SRSTSHD.dll
2009-10-23 23:37:52 ----RA---- C:\WINDOWS\system32\SRSHP360.dll
2009-10-23 23:37:52 ----RA---- C:\WINDOWS\system32\RtkPgExt.dll
2009-10-23 23:37:52 ----RA---- C:\WINDOWS\system32\RtkApoApi.dll
2009-10-23 23:37:51 ----RA---- C:\WINDOWS\system32\RtkAPO.dll
2009-10-23 23:37:49 ----RA---- C:\WINDOWS\RtHDVCpl.exe
2009-10-23 23:37:44 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-10-23 23:37:24 ----R---- C:\WINDOWS\system32\ChCfg.exe
2009-10-23 23:37:03 ----D---- C:\WINDOWS\system32\RTCOM
2009-10-23 23:37:01 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-10-23 23:36:33 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-10-23 23:36:32 ----HDC---- C:\WINDOWS\$NtUninstallKB888111WXPSP2$
2009-10-23 23:36:30 ----RA---- C:\WINDOWS\SkyTel.exe
2009-10-23 23:36:30 ----R---- C:\WINDOWS\SoundMan.exe
2009-10-23 23:36:29 ----RA---- C:\WINDOWS\RtlUpd.exe
2009-10-23 23:36:26 ----R---- C:\WINDOWS\RTLCPL.exe
2009-10-23 23:36:16 ----R---- C:\WINDOWS\RTHDCPL.exe
2009-10-23 23:36:14 ----R---- C:\WINDOWS\MicCal.exe
2009-10-23 23:36:09 ----R---- C:\WINDOWS\Alcmtr.exe
2009-10-23 23:36:07 ----R---- C:\WINDOWS\alcwzrd.exe
2009-10-23 23:36:06 ----D---- C:\Program Files\Realtek
2009-10-23 23:36:05 ----HD---- C:\Program Files\InstallShield Installation Information
2009-10-23 23:36:00 ----R---- C:\WINDOWS\RtlExUpd.dll
2009-10-23 23:36:00 ----A---- C:\WINDOWS\HideWin.exe
2009-10-23 23:32:13 ----D---- C:\WINDOWS\nview
2009-10-23 23:32:13 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-10-23 23:32:05 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-10-23 23:31:16 ----RA---- C:\WINDOWS\system32\fdco1ins.dll
2009-10-23 23:31:16 ----RA---- C:\WINDOWS\system32\fdco1.dll
2009-10-23 23:31:14 ----A---- C:\WINDOWS\system32\nvunrm.exe
2009-10-23 23:31:13 ----RA---- C:\WINDOWS\system32\nvconrm.dll
2009-10-23 23:31:13 ----RA---- C:\WINDOWS\system32\bdco1ins.dll
2009-10-23 23:31:13 ----RA---- C:\WINDOWS\system32\bdco1.dll
2009-10-23 23:31:11 ----RA---- C:\WINDOWS\system32\nvusmb.exe
2009-10-23 23:31:02 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-10-23 23:30:57 ----D---- C:\Documents and Settings\David\Application Data\InstallShield
2009-10-23 23:29:53 ----D---- C:\WINDOWS\system32\Tools
2009-10-23 23:29:46 ----D---- C:\Program Files\Common Files\InstallShield
2009-10-23 23:26:58 ----D---- C:\Documents and Settings\David\Application Data\Identities
2009-10-23 23:26:57 ----HD---- C:\Program Files\Uninstall Information
2009-10-23 23:26:40 ----SD---- C:\Documents and Settings\David\Application Data\Microsoft
2009-10-23 23:26:40 ----ASH---- C:\Documents and Settings\David\Application Data\desktop.ini
2009-10-23 23:25:48 ----D---- C:\WINDOWS\SoftwareDistribution
2009-10-23 23:25:46 ----SD---- C:\WINDOWS\system32\Microsoft
2009-10-23 23:25:46 ----D---- C:\WINDOWS\Prefetch
2009-10-23 23:25:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-10-23 23:21:43 ----D---- C:\WINDOWS\system32\xircom
2009-10-23 23:21:43 ----D---- C:\Program Files\xerox
2009-10-23 23:21:43 ----D---- C:\Program Files\microsoft frontpage
2009-10-23 23:21:25 ----A---- C:\WINDOWS\control.ini
2009-10-23 23:21:25 ----A---- C:\AUTOEXEC.BAT
2009-10-23 23:21:16 ----A---- C:\WINDOWS\OEWABLog.txt
2009-10-23 23:21:13 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-10-23 23:20:28 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-10-23 23:20:28 ----RD---- C:\WINDOWS\Offline Web Pages
2009-10-23 23:20:28 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-10-23 23:20:23 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-10-23 23:20:19 ----HD---- C:\Program Files\WindowsUpdate
2009-10-23 23:20:02 ----D---- C:\WINDOWS\system32\DirectX
2009-10-23 23:19:44 ----A---- C:\WINDOWS\system32\atrace.dll
2009-10-23 23:19:42 ----A---- C:\WINDOWS\system32\desktop.ini
2009-10-23 23:19:42 ----A---- C:\WINDOWS\desktop.ini
2009-10-23 23:19:36 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-10-23 23:19:35 ----A---- C:\WINDOWS\system32\acctres.dll
2009-10-23 23:19:34 ----D---- C:\Program Files\Common Files\Services
2009-10-23 23:19:31 ----SD---- C:\WINDOWS\Tasks
2009-10-23 23:19:31 ----D---- C:\Program Files\Common Files\MSSoap
2009-10-23 23:19:31 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-10-23 23:19:27 ----D---- C:\WINDOWS\system32\Macromed
2009-10-23 23:19:27 ----D---- C:\WINDOWS\srchasst
2009-10-23 23:19:24 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-10-23 23:19:24 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-10-23 23:19:24 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-10-23 23:19:24 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-10-23 23:19:24 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\wups.dll
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-10-23 23:19:23 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-10-23 23:19:20 ----D---- C:\Program Files\Movie Maker
2009-10-23 23:19:16 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-10-23 23:19:16 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-10-23 23:19:16 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-10-23 23:19:16 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-10-23 23:19:13 ----D---- C:\WINDOWS\system32\Restore
2009-10-23 23:19:13 ----A---- C:\WINDOWS\system32\srsvc.dll
2009-10-23 23:19:13 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-10-23 23:19:13 ----A---- C:\WINDOWS\system32\fltMc.exe
2009-10-23 23:19:13 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-10-23 23:19:12 ----A---- C:\WINDOWS\system32\srclient.dll
2009-10-23 23:19:12 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-10-23 23:19:12 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-10-23 23:19:12 ----A---- C:\WINDOWS\system32\ils.dll
2009-10-23 23:19:11 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-10-23 23:19:11 ----A---- C:\WINDOWS\system32\msconf.dll
2009-10-23 23:19:11 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-10-23 23:19:09 ----D---- C:\Program Files\NetMeeting
2009-10-23 23:19:09 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-10-23 23:19:09 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-10-23 23:19:08 ----A---- C:\WINDOWS\system32\inetres.dll
2009-10-23 23:19:08 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-10-23 23:19:06 ----D---- C:\Program Files\Outlook Express
2009-10-23 23:19:06 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-10-23 23:19:06 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-10-23 23:19:06 ----A---- C:\WINDOWS\system32\mstask.dll
2009-10-23 23:19:05 ----A---- C:\WINDOWS\system32\isign32.dll
2009-10-23 23:19:05 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-10-23 23:19:05 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-10-23 23:19:05 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-10-23 23:19:00 ----D---- C:\Program Files\Common Files\System
2009-10-23 23:18:59 ----D---- C:\Program Files\Internet Explorer
2009-10-23 23:18:32 ----A---- C:\WINDOWS\vbaddin.ini
2009-10-23 23:18:32 ----A---- C:\WINDOWS\vb.ini
2009-10-23 23:18:28 ----D---- C:\WINDOWS\Registration
2009-10-23 23:18:22 ----D---- C:\Program Files\Windows Media Player
2009-10-23 23:18:16 ----D---- C:\Program Files\Messenger
2009-10-23 23:18:12 ----D---- C:\Program Files\MSN Gaming Zone
2009-10-23 23:18:12 ----A---- C:\WINDOWS\system32\write.exe
2009-10-23 23:18:04 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-10-23 23:18:04 ----A---- C:\WINDOWS\system32\hticons.dll
2009-10-23 23:18:03 ----A---- C:\WINDOWS\system32\winchat.exe
2009-10-23 23:18:03 ----A---- C:\WINDOWS\system32\avwav.dll
2009-10-23 23:18:03 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-10-23 23:18:03 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-10-23 23:17:56 ----A---- C:\WINDOWS\system32\sol.exe
2009-10-23 23:17:56 ----A---- C:\WINDOWS\system32\getuname.dll
2009-10-23 23:17:56 ----A---- C:\WINDOWS\system32\charmap.exe
2009-10-23 23:17:56 ----A---- C:\WINDOWS\system32\calc.exe
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\winmine.exe
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\tskill.exe
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\reset.exe
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-10-23 23:17:55 ----A---- C:\WINDOWS\system32\freecell.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\tscon.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\shadow.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\regini.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\msg.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\logoff.exe
2009-10-23 23:17:54 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-10-23 23:17:53 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-10-23 23:17:53 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-10-23 23:17:53 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-10-23 23:17:53 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-10-23 23:17:53 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-10-23 23:17:52 ----A---- C:\WINDOWS\system32\stclient.dll
2009-10-23 23:17:52 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-10-23 23:17:52 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-10-23 23:17:52 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-10-23 23:17:47 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-10-23 23:17:34 ----D---- C:\Program Files\MSN
2009-10-23 23:17:33 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-10-23 23:17:33 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-10-23 23:17:33 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-10-23 23:17:33 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-10-23 23:17:32 ----D---- C:\Program Files\Windows NT
2009-10-23 23:17:32 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-10-23 23:17:32 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-10-23 23:17:31 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-10-23 23:17:31 ----A---- C:\WINDOWS\system32\spider.exe
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-10-23 23:17:30 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-10-23 23:17:29 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-10-23 23:17:28 ----D---- C:\WINDOWS\system32\MsDtc
2009-10-23 23:17:28 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-10-23 23:17:28 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-10-23 23:17:28 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-10-23 23:17:27 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-10-23 23:17:27 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-10-23 23:17:27 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-10-23 23:17:27 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-10-23 23:17:26 ----D---- C:\WINDOWS\system32\Com
2009-10-23 23:17:26 ----A---- C:\WINDOWS\system32\colbact.dll
2009-10-23 23:17:26 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-10-23 23:17:26 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-10-23 23:17:25 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-10-23 23:17:25 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-10-23 23:17:25 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-10-23 23:17:24 ----A---- C:\WINDOWS\system32\comuid.dll
2009-10-23 23:17:24 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-10-23 23:17:17 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-10-23 23:17:17 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-10-23 23:17:17 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-10-23 23:17:17 ----A---- C:\WINDOWS\system32\cmprops.dll

======List of files/folders modified in the last 1 months======

2009-11-07 01:17:17 ----A---- C:\WINDOWS\win.ini
2009-10-24 02:12:17 ----N---- C:\WINDOWS\system.ini
2009-10-20 00:08:13 ----A---- C:\WINDOWS\system32\mshtml.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 kbdhid;Keyboard HID Driver; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R1 RapportKELL;RapportKELL; \??\C:\Program Files\Trusteer\Rapport\bin\RapportKELL.sys []
R1 RapportPG;RapportPG; \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2004-08-03 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-28 55656]
R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]
R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752]
R3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-10 4449280]
R3 mouhid;Mouse HID Driver; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-04-20 6728032]
R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2007-03-06 58752]
R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2007-03-06 19968]
R3 portio32;portio32; C:\WINDOWS\system32\drivers\portio32.sys [2004-07-14 2048]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-04 26624]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-04 57600]
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-08-04 17024]
R3 usbstor;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
S3 pgfilter;pgfilter; \??\C:\Program Files\PeerGuardian2\pgfilter.sys []
S3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Scheduler; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-07-21 185089]
R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-08-28 144672]
R2 Bonjour Service;Bonjour Service; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-07-31 153376]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2009-01-27 73728]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-04-20 163908]
R2 RapportMgmtService;Rapport Management Service; C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe [2009-11-05 972008]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2007-05-14 272024]
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-09-23 358600]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-09-23 1141200]
R3 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]
S2 gupdate;Google Update Service (gupdate); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-10-26 133104]
S2 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-10-26 194032]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 GoogleDesktopManager-093009-130223;Google Desktop Manager 5.9.909.30391; C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe [2009-10-26 30192]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am

Re: Browser redirecting on links

Unread postby muppy03 » November 14th, 2009, 5:04 am

Hi did you do a recovery or a clean install not long ago?

Download and Run ATF Cleaner
Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.
Make sure that all browser windows are closed.

    Double-click ATF-Cleaner.exe to run the program.
    Under Main choose: Select All
    Click the Empty Selected button.
    (If you use FireFox or the Opera browser,To keep saved passwords, click No at the prompt.)
    Click Exit on the Main menu to close the program.

GMER Rootkit Scanner
Download GMER Rootkit Scanner from here.
  • Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO

    Image
    Click the image to enlarge it
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • Sections
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All (don't miss this one)
  • Then click the Scan button & wait for it to finish
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
  • Save it where you can easily find it, such as your desktop, and post it in reply
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries


Please reply with:-
  • New HJT log
  • GMER Log
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 14th, 2009, 12:45 pm

Hi muppy03 yes it a was a clean install after upgrading to a better motherboard and processor did a fresh installation of XP. Think I know where the malware came from as well which is the most frustrating part of it all, I was trying to find a driver for one of my devices and stupidly downloaded it from an untrustworthy source.

The logs for you.

Gmer.txt

GMER 1.0.15.15220 - http://www.gmer.net
Rootkit scan 2009-11-14 16:40:34
Windows 5.1.2600 Service Pack 2
Running: j8dv5tg7.exe; Driver: C:\DOCUME~1\David\LOCALS~1\Temp\pxtdapow.sys


---- System - GMER 1.0.15 ----

SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwAssignProcessToJobObject [0xB6B7DCEC]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwCreateFile [0xB6B7E3E8]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateKey [0xBA6CBE22]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0xBA6ACCDC]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0xBA6ACECE]
SSDT BAEDB19C ZwCreateThread
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwDeleteFile [0xB6B7E534]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteKey [0xBA6CC610]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwDeleteValueKey [0xBA6CC8C4]
SSDT BAEDB1BA ZwLoadKey
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwOpenFile [0xB6B7E498]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwOpenKey [0xBA6CAB14]
SSDT BAEDB188 ZwOpenProcess
SSDT BAEDB18D ZwOpenThread
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwProtectVirtualMemory [0xB6B7E144]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwQueryValueKey [0xB6B81CD4]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xBA6CCD30]
SSDT BAEDB1C4 ZwReplaceKey
SSDT BAEDB1BF ZwRestoreKey
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetContextThread [0xB6B7DC9A]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSetInformationFile [0xB6B7E594]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwSetValueKey [0xBA6CC0E2]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwSuspendThread [0xB6B7DC3E]
SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0xBA6AC982]
SSDT \??\C:\Program Files\Trusteer\Rapport\bin\RapportPG.sys (RapportPG/Trusteer Ltd.) ZwTerminateThread [0xB6B7DBE2]

INT 0x93 \??\C:\Program Files\Trusteer\Rapport\bin\RapportKELL.sys (RapportKE/Trusteer Ltd.) BA96D800

---- Devices - GMER 1.0.15 ----

Device \Driver\atapi \Device\Ide\IdePort0 [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort1 [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort2 [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdePort3 [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-19 [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-e [BA6F59F2] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device \Driver\PCTSDInjDriver32 \Device\PCTSDInjDriver32 PCTSDInj32.sys
Device \Driver\usbccgp \Device\0000007a RapportKELL.sys (RapportKE/Trusteer Ltd.)

AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B144D938-EE68-92E1-FBFB-B659A9DD9898}

---- Files - GMER 1.0.15 ----

File C:\WINDOWS\system32\drivers\atapi.sys suspicious modification

---- EOF - GMER 1.0.15 ----


HJT Log New

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:42:08, on 14/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe
C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~4\GOEC62~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 10108 bytes
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am

Re: Browser redirecting on links

Unread postby muppy03 » November 14th, 2009, 9:34 pm

Please give me an update on how things are running after doing the following.

Download and run Combofix
This tool is not a toy and not for everyday use.
ComboFix SHOULD NOT be used unless requested by a forum helper


Please download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

  • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools.
  • If you need help to disable your protection programs see here.
  • Double click on ComboFix.exe & follow the prompts.
  • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Image
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Image
Click on Yes, to continue scanning for malware.

When finished, it will produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

If you need help, see this link:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Please reply with:-
  • Combofix log
  • New HJT log
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 16th, 2009, 7:03 am

Thanks Muppy,

Seems to have worked! What a great program Combofix is if that has fixed it.

Here is the log from Combofix

Cobmbofix.txt

ComboFix 09-11-16.05 - David 16/11/2009 10:39..3 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1791.1406 [GMT 0:00]
Running from: c:\documents and settings\David\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Spyware Doctor with AntiVirus *On-access scanning disabled* (Updated) {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\dumphive.exe
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\SrchSTS.exe
c:\windows\system32\tmp.reg
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\WS2Fix.exe

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it :p
.
((((((((((((((((((((((((( Files Created from 2009-10-16 to 2009-11-16 )))))))))))))))))))))))))))))))
.

2009-11-13 20:08 . 2009-11-13 20:08 691696 ----a-w- c:\windows\system32\drivers\sptd.sys
2009-11-13 20:07 . 2009-11-13 20:08 -------- d-----w- c:\program files\DAEMON Tools Lite
2009-11-13 20:07 . 2009-11-13 20:07 -------- d-----w- c:\documents and settings\David\Application Data\DAEMON Tools Lite
2009-11-13 20:07 . 2009-11-13 20:07 -------- d-----w- c:\documents and settings\All Users\Application Data\DAEMON Tools Lite
2009-11-13 19:11 . 2009-11-13 19:11 -------- d-----w- C:\rsit
2009-11-11 23:57 . 2009-11-11 23:57 -------- d-----w- c:\program files\MKVtoolnix
2009-11-11 23:55 . 2009-11-11 23:55 -------- d-----w- c:\program files\Avidemux 2.5
2009-11-11 11:24 . 2009-11-11 11:24 -------- d-----w- c:\program files\Trend Micro
2009-11-10 20:59 . 2009-11-10 22:28 -------- d-----w- c:\documents and settings\David\Application Data\ImgBurn
2009-11-10 20:29 . 2009-11-10 20:29 -------- d-----w- c:\program files\abgx360
2009-11-10 18:07 . 2009-11-10 18:07 -------- d-----w- c:\program files\ImgBurn
2009-11-10 15:27 . 2009-11-10 15:27 -------- d-----w- c:\documents and settings\David\.dvdcss
2009-11-09 10:24 . 2009-11-09 10:24 -------- d-----w- c:\documents and settings\NetworkService\Application Data\Trusteer
2009-11-09 10:24 . 2009-11-09 10:24 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Apple
2009-11-08 13:24 . 2009-11-08 13:24 -------- d-----w- c:\documents and settings\LocalService\Application Data\Trusteer
2009-11-08 12:58 . 2009-11-08 12:58 -------- d-----w- c:\documents and settings\David\Application Data\Trusteer
2009-11-08 12:58 . 2009-11-08 12:58 -------- d-----w- c:\program files\Trusteer
2009-11-08 12:57 . 2009-11-08 12:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Trusteer
2009-11-07 07:59 . 2009-11-07 07:59 -------- d-----w- c:\windows\system32\XPSViewer
2009-11-07 07:58 . 2009-11-07 07:58 -------- d-----w- c:\program files\Reference Assemblies
2009-11-07 07:58 . 2008-07-06 12:06 117760 ------w- c:\windows\system32\prntvpt.dll
2009-11-07 07:58 . 2008-07-06 12:06 89088 -c----w- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-11-07 07:58 . 2008-07-06 12:06 575488 -c----w- c:\windows\system32\dllcache\xpsshhdr.dll
2009-11-07 07:58 . 2008-07-06 12:06 575488 ------w- c:\windows\system32\xpsshhdr.dll
2009-11-07 07:58 . 2008-07-06 12:06 1676288 -c----w- c:\windows\system32\dllcache\xpssvcs.dll
2009-11-07 07:58 . 2008-07-06 12:06 1676288 ------w- c:\windows\system32\xpssvcs.dll
2009-11-07 07:58 . 2008-07-06 10:50 597504 -c----w- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-11-07 07:54 . 2009-11-07 07:54 -------- d-----w- c:\program files\MSXML 6.0
2009-11-06 14:18 . 2004-08-03 23:01 25856 -c--a-w- c:\windows\system32\dllcache\usbprint.sys
2009-11-06 14:18 . 2004-08-03 23:01 25856 ----a-w- c:\windows\system32\drivers\usbprint.sys
2009-11-06 13:53 . 2004-07-14 16:51 2048 ----a-w- c:\windows\system32\drivers\portio32.sys
2009-11-06 13:53 . 2004-07-14 16:51 19968 ----a-w- c:\windows\system32\portio32.dll
2009-11-04 23:38 . 2009-11-04 23:38 -------- d-----w- c:\documents and settings\Default User\Local Settings\Application Data\Microsoft Help
2009-11-04 03:21 . 2009-08-06 19:23 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-11-04 03:21 . 2009-08-06 19:23 215920 ----a-w- c:\windows\system32\muweb.dll
2009-11-03 16:16 . 2009-11-05 17:40 -------- d-----w- c:\program files\SpeedFan
2009-11-03 11:51 . 2009-11-06 00:27 -------- d-----w- c:\documents and settings\David\Tracing
2009-11-03 11:23 . 2009-11-03 11:23 -------- d-----w- c:\program files\Microsoft
2009-11-03 11:23 . 2009-11-03 11:23 -------- d-----w- c:\program files\Windows Live SkyDrive
2009-11-03 11:23 . 2009-11-03 11:23 -------- d-----w- c:\program files\Windows Live
2009-11-03 11:19 . 2009-11-03 11:19 -------- d-----w- c:\program files\Common Files\Windows Live
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\program files\iPod
2009-11-02 10:29 . 2009-11-02 10:29 -------- d-----w- c:\program files\iTunes
2009-11-02 10:25 . 2009-11-02 10:25 79144 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.2.25\SetupAdmin.exe
2009-11-01 13:28 . 2009-11-01 13:28 -------- d-----w- c:\documents and settings\All Users\Application Data\LightScribe
2009-11-01 12:22 . 2009-11-01 12:22 -------- d-----w- c:\documents and settings\David\Application Data\Malwarebytes
2009-11-01 12:21 . 2009-09-10 14:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-11-01 12:21 . 2009-11-01 12:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-11-01 12:21 . 2009-09-10 14:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-11-01 12:21 . 2009-11-01 12:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-11-01 11:34 . 2009-11-01 11:34 -------- d-----w- c:\program files\Common Files\LightScribe
2009-10-31 19:39 . 2009-11-10 12:38 -------- d-----w- c:\documents and settings\David\Bluebirds
2009-10-31 17:50 . 2009-10-31 17:56 -------- d-----w- c:\program files\PeerGuardian2
2009-10-30 21:00 . 2009-10-31 19:09 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-30 21:00 . 2009-10-30 21:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-10-30 00:50 . 2009-10-30 00:50 -------- d-----w- c:\program files\MSXML 4.0
2009-10-30 00:48 . 2009-10-30 00:49 -------- d-----w- c:\program files\SMPlayer
2009-10-29 18:18 . 2009-10-29 18:19 -------- d-----w- C:\Temp
2009-10-29 18:18 . 2009-10-29 18:18 53319 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\PostBuild.exe
2009-10-29 18:17 . 2009-11-16 10:54 -------- d-----w- c:\program files\lg_fwupdate
2009-10-29 18:17 . 2009-10-29 18:19 16384 ----a-w- c:\windows\system32\lgfwunis.exe
2009-10-29 18:17 . 1998-07-22 00:00 102912 ----a-w- c:\windows\system32\Vb6stkit.dll
2009-10-29 18:17 . 1998-07-22 00:00 102160 ----a-w- c:\windows\system32\VB6KO.DLL
2009-10-29 18:15 . 2009-10-29 18:15 36864 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\PostBuild.exe
2009-10-29 18:13 . 2007-01-08 22:17 27168 ------w- c:\windows\system32\msxml3a.dll
2009-10-29 18:12 . 2009-10-29 18:30 -------- d-----w- c:\documents and settings\David\Application Data\CyberLink
2009-10-29 18:11 . 2007-03-22 21:28 353840 ------w- c:\windows\system32\msvcr71.dll
2009-10-29 18:11 . 2007-03-22 21:28 1053232 ------w- c:\windows\system32\MFC71u.dll
2009-10-29 18:11 . 2007-03-22 21:28 1066544 ------w- c:\windows\system32\MFC71.dll
2009-10-29 18:11 . 2007-03-22 21:27 505392 ------w- c:\windows\system32\msvcp71.dll
2009-10-29 18:10 . 2009-10-29 18:19 -------- d-----w- c:\program files\CyberLink
2009-10-29 18:10 . 2009-10-29 18:30 -------- d-----w- c:\documents and settings\All Users\Application Data\CyberLink
2009-10-29 18:09 . 2009-10-29 18:10 53319 ----a-w- c:\documents and settings\All Users\Application Data\TEMP\{5DB1DF0C-AABC-4362-8A6D-CEFDFB036E41}\PostBuild.exe
2009-10-29 11:37 . 2009-10-29 11:37 -------- d-----w- c:\program files\Microsoft Works
2009-10-29 11:37 . 2009-11-07 07:59 -------- d-----w- c:\program files\MSBuild
2009-10-29 11:35 . 2009-10-29 11:37 -------- d-----w- c:\windows\SHELLNEW
2009-10-29 11:34 . 2009-10-29 11:34 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\Microsoft Help
2009-10-29 11:34 . 2009-11-11 10:42 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-10-29 11:34 . 2009-10-29 11:34 -------- d-----r- C:\MSOCache
2009-10-28 19:43 . 2009-10-28 19:43 152576 ----a-w- c:\documents and settings\David\Application Data\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-28 19:40 . 2009-09-24 08:55 229304 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-10-28 19:40 . 2009-10-06 16:31 87784 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-10-28 19:40 . 2009-09-23 16:10 207280 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-10-28 19:40 . 2009-09-03 09:45 70408 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-10-28 19:39 . 2009-11-16 10:27 -------- d-----w- c:\program files\Spyware Doctor
2009-10-28 19:39 . 2009-10-28 19:40 -------- d-----w- c:\program files\Common Files\PC Tools
2009-10-28 19:39 . 2009-10-28 19:39 -------- d-----w- c:\documents and settings\David\Application Data\PC Tools
2009-10-28 19:39 . 2009-10-28 19:39 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-10-28 19:32 . 2009-10-28 19:32 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-10-27 18:26 . 2009-11-12 00:39 -------- d-----w- c:\documents and settings\David\Application Data\vlc
2009-10-27 18:21 . 2009-11-05 12:15 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\Adobe
2009-10-26 11:34 . 2009-11-11 22:42 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\Temp
2009-10-26 11:31 . 2009-10-26 11:31 -------- d-----w- c:\program files\Common Files\Adobe
2009-10-26 11:29 . 2009-10-26 11:29 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-10-26 11:28 . 2009-10-28 19:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2009-10-26 11:19 . 2009-11-16 10:27 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-10-26 11:15 . 2009-10-29 11:46 -------- d-----w- c:\program files\SpyZooka
2009-10-26 11:09 . 2009-10-26 13:30 -------- d-----w- c:\documents and settings\David\Local Settings\Application Data\Google
2009-10-26 10:58 . 2009-10-26 10:58 -------- d-----w- c:\program files\1st NTFS Recovery
2009-10-25 21:51 . 2009-10-25 21:51 -------- d-----w- c:\program files\NTFS-RECOVERY.COM
2009-10-25 19:35 . 2009-10-25 19:36 -------- d-----w- c:\windows\system32\NtmsData
2009-10-25 19:28 . 2008-07-10 10:38 28672 ----a-w- c:\windows\Getdisk.exe
2009-10-25 19:28 . 2009-10-25 21:52 -------- d-----w- c:\program files\Recover Data for NTFS
2009-10-25 19:28 . 2009-10-25 21:52 -------- d-----w- c:\windows\Recover Data for NTFS
2009-10-25 19:08 . 2009-10-25 19:08 -------- d-----w- C:\SGI Image
2009-10-25 19:08 . 2009-10-25 19:08 -------- d-----w- C:\JPEG Image
2009-10-25 18:59 . 2009-10-25 18:59 -------- d-----w- C:\VP6 encoded Video
2009-10-25 18:47 . 2009-10-25 18:47 -------- d-----w- C:\MPEG Layer III Audio
2009-10-25 18:47 . 2009-10-25 19:28 -------- d-----w- C:\$$$Folder00031
2009-10-25 18:47 . 2009-10-25 18:47 -------- d-----w- C:\VOB video files
2009-10-25 18:47 . 2009-10-25 18:47 -------- d-----w- C:\Unicode Document
2009-10-25 18:47 . 2009-10-25 18:47 -------- d-----w- C:\Text Document
2009-10-25 18:47 . 2009-10-25 18:47 -------- d-----w- C:\MPEG Video
2009-10-24 23:25 . 2004-08-04 12:00 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-10-24 23:23 . 2009-10-24 23:23 -------- d-----w- c:\windows\ServicePackFiles
2009-10-24 06:50 . 2009-10-24 06:50 -------- d-----w- c:\program files\FILE RECOVERY for Windows
2009-10-24 06:24 . 2009-11-07 00:57 -------- d-----w- c:\windows\system32\CatRoot_bak
2009-10-24 06:22 . 2008-06-13 13:10 272128 -c----w- c:\windows\system32\dllcache\bthport.sys
2009-10-24 06:22 . 2008-06-13 13:10 272128 ------w- c:\windows\system32\drivers\bthport.sys
2009-10-24 06:21 . 2008-10-24 11:10 453632 -c----w- c:\windows\system32\dllcache\mrxsmb.sys
2009-10-24 06:21 . 2009-08-04 13:58 2136064 -c----w- c:\windows\system32\dllcache\ntkrnlmp.exe
2009-10-24 06:21 . 2009-08-04 14:00 2180352 -c----w- c:\windows\system32\dllcache\ntoskrnl.exe
2009-10-24 06:21 . 2009-08-04 13:13 2015744 -c----w- c:\windows\system32\dllcache\ntkrpamp.exe
2009-10-24 06:21 . 2009-08-04 13:13 2057728 -c----w- c:\windows\system32\dllcache\ntkrnlpa.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-16 10:55 . 2009-10-23 23:51 -------- d-----w- c:\documents and settings\David\Application Data\Skype
2009-11-16 08:04 . 2009-10-23 23:51 -------- d-----w- c:\documents and settings\David\Application Data\skypePM
2009-11-07 13:36 . 2009-10-23 23:35 68456 ----a-w- c:\documents and settings\David\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-02 10:29 . 2009-10-23 23:57 -------- d-----w- c:\program files\Common Files\Apple
2009-10-29 18:19 . 2009-10-23 23:36 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-29 18:10 . 2009-10-23 23:29 -------- d-----w- c:\program files\Common Files\InstallShield
2009-10-28 19:44 . 2009-10-24 00:00 -------- d-----w- c:\program files\Java
2009-10-28 14:00 . 2009-10-23 23:59 -------- d-----w- c:\documents and settings\David\Application Data\Apple Computer
2009-10-27 22:33 . 2009-10-24 00:08 -------- d-----w- c:\documents and settings\All Users\Application Data\nView_Profiles
2009-10-26 11:30 . 2009-10-23 23:51 -------- d-----w- c:\program files\Google
2009-10-24 00:11 . 2009-10-23 23:20 86327 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-24 00:03 . 2009-10-24 00:03 -------- d-----w- c:\program files\VideoLAN
2009-10-24 00:01 . 2009-10-24 00:00 -------- d-----w- c:\program files\PS3 Media Server
2009-10-24 00:00 . 2009-10-24 00:00 152576 ----a-w- c:\documents and settings\David\Application Data\Sun\Java\jre1.6.0_12\lzma.dll
2009-10-23 23:59 . 2009-10-23 23:59 29184 ----a-r- c:\documents and settings\David\Application Data\Microsoft\Installer\{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}\Icon21AE04E8.exe
2009-10-23 23:59 . 2009-10-23 23:59 -------- d-----w- c:\program files\mkv2vob
2009-10-23 23:58 . 2009-10-23 23:58 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
2009-10-23 23:58 . 2009-10-23 23:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
2009-10-23 23:58 . 2009-10-23 23:58 -------- d-----w- c:\program files\Bonjour
2009-10-23 23:58 . 2009-10-23 23:58 -------- d-----w- c:\program files\QuickTime
2009-10-23 23:57 . 2009-10-23 23:57 -------- d-----w- c:\program files\Apple Software Update
2009-10-23 23:57 . 2009-10-23 23:57 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-10-23 23:57 . 2009-10-23 23:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
2009-10-23 23:51 . 2009-10-23 23:51 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-10-23 23:51 . 2009-10-23 23:51 -------- d-----r- c:\program files\Skype
2009-10-23 23:51 . 2009-10-23 23:51 -------- d-----w- c:\program files\Common Files\Skype
2009-10-23 23:51 . 2009-10-23 23:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Skype
2009-10-23 23:48 . 2009-10-23 23:48 -------- d-----w- c:\program files\Opera
2009-10-23 23:47 . 2009-10-23 23:47 -------- d-----w- c:\program files\Avira
2009-10-23 23:47 . 2009-10-23 23:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-10-23 23:36 . 2009-10-23 23:36 -------- d-----w- c:\program files\Realtek
2009-10-23 23:36 . 2009-10-23 23:36 315392 ----a-w- c:\windows\HideWin.exe
2009-10-23 23:30 . 2009-10-23 23:30 -------- d-----w- c:\documents and settings\David\Application Data\InstallShield
2009-10-23 23:21 . 2009-10-23 23:21 -------- d-----w- c:\program files\microsoft frontpage
2009-10-23 23:18 . 2009-10-23 23:18 21640 ----a-w- c:\windows\system32\emptyregdb.dat
2009-09-25 05:56 . 2004-08-04 12:00 662016 ----a-w- c:\windows\system32\wininet.dll
2009-09-25 05:56 . 2004-08-04 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll
2009-09-11 14:33 . 2004-08-04 12:00 133632 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-04 20:45 . 2004-08-04 12:00 58880 ----a-w- c:\windows\system32\msasn1.dll
2009-08-26 08:16 . 2004-08-04 12:00 247326 ----a-w- c:\windows\system32\strmdll.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25623336]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-10-23 39408]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-01-27 2387968]
"bluebirds"="c:\documents and settings\David\Bluebirds\BlueBirds.exe" [2009-04-29 270336]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\DTLite.exe" [2009-10-30 369200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-04-20 8429568]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-04-20 81920]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2009-10-26 30192]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-31 149280]
"UpdateLBPShortCut"="c:\program files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2007-03-14 71216]
"LanguageShortcut"="c:\program files\CyberLink\PowerDVD\Language\Language.exe" [2007-01-08 52256]
"UCam_Menu"="c:\program files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" [2008-12-03 218408]
"LGODDFU"="c:\program files\lg_fwupdate\fwupdate.exe" [2009-10-29 557056]
"UpdatePSTShortCut"="c:\program files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" [2009-05-07 210216]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-28 141600]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-04-20 1626112]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2007-07-05 16380416]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2007-06-15 1826816]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\CyberLink\\PowerDVD\\PowerDVD.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [28/10/2009 19:40 207280]
R1 RapportKELL;RapportKELL;c:\program files\Trusteer\Rapport\bin\RapportKELL.sys [05/11/2009 13:33 58984]
R1 RapportPG;RapportPG;c:\program files\Trusteer\Rapport\bin\RapportPG.sys [05/11/2009 13:33 334440]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [23/10/2009 23:47 108289]
R2 RapportMgmtService;Rapport Management Service;c:\program files\Trusteer\Rapport\bin\RapportMgmtService.exe [05/11/2009 13:32 972008]
R3 portio32;portio32;c:\windows\system32\drivers\portio32.sys [06/11/2009 13:53 2048]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [26/10/2009 11:29 133104]
S3 GoogleDesktopManager-093009-130223;Google Desktop Manager 5.9.909.30391;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [26/10/2009 11:29 30192]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [28/10/2009 19:39 358600]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder

2009-11-16 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-11-16 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-10-23 11:28]

2009-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-26 11:29]

2009-11-16 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-10-26 11:29]
.
.
------- Supplementary Scan -------
.
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.

**************************************************************************
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1060284298-884357618-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{B144D938-EE68-92E1-FBFB-B659A9DD9898}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3648)
c:\windows\system32\nview.dll
c:\windows\system32\NVWRSENG.DLL
c:\program files\Trusteer\Rapport\bin\rooksbas.dll
c:\windows\system32\nvwddi.dll
c:\windows\system32\msi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\system32\RUNDLL32.EXE
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\system32\rundll32.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\CyberLink\Shared Files\RichVideo.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-11-16 10:58 - machine was rebooted
ComboFix-quarantined-files.txt 2009-11-16 10:57

Pre-Run: 19,037,544,448 bytes free
Post-Run: 18,911,199,232 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 5BF7B0E90DF636F0AA4530C5A4536FC5


HJT Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:02:15, on 16/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 9566 bytes
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am

Re: Browser redirecting on links

Unread postby muppy03 » November 16th, 2009, 7:38 am

Seems to have worked! What a great program Combofix is if that has fixed it.


Logs do look good, but lets do an online scan to make sure we have not missed anything.

A question before we do. Your Spyware Doctor appears to be an antivirus also? Is this correct?

Open Hijack This and select Do a System Scan Only place a check next to the below lines if still present

    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)


Once selected close all windows except HJT an click on Fix Checked

Kaspersky Online Scan
Do an online scan with >Kaspersky Online Scanner<
  • Read through the requirements and privacy statement and click on Accept button
  • It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run
  • When the downloads have finished, click on Settings
  • Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
      Spyware, Adware, Dialers, and other potentially dangerous programs
      Archives
      Mail databases
  • Click on My Computer under Scan
  • Once the scan is complete, it will display the results. Click on View Scan Report
  • You will see a list of infected items there. Click on Save Report As...
  • Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button
  • Please post this log in your next reply

Please reply with:-
  • Kaspersky report
  • New HJT log
  • Answer to question
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 16th, 2009, 3:57 pm

Hi Muppy,

Yes spyware doctor also runs as an antivirus of sorts, similar to spybot tea timer it provides some real time protection to threats. I installed both spybot and spyware doctor after I became infected trying to remove the problem obviously that didn't work! However for the future I think it will provide me with a bit more protection than Antivira which I have to say is quite good other than it going slightly bonkers for the last 2 weeks or so.

The kaspersky scan shows some infected objects, mainly on the F drive which I am formating tonight anyway so no trouble there.

HJT Log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:33:01, on 16/11/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\Program Files\Google\Update\1.2.183.13\GoogleCrashHandler.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\lg_fwupdate\fwupdate.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trusteer\Rapport\bin\RapportService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.0"
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [LGODDFU] "C:\Program Files\lg_fwupdate\fwupdate.exe" blrun
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden
O4 - HKCU\..\Run: [bluebirds] C:\Documents and Settings\David\Bluebirds\BlueBirds.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Desktop Manager 5.9.909.30391 (GoogleDesktopManager-093009-130223) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Rapport Management Service (RapportMgmtService) - Trusteer Ltd. - C:\Program Files\Trusteer\Rapport\bin\RapportMgmtService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 9517 bytes

Kaspersky Report.

--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0: scan report
Monday, November 16, 2009
Operating system: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Last database update: Monday, November 16, 2009 09:36:53
Records in database: 3222683
--------------------------------------------------------------------------------

Scan settings:
scan using the following database: extended
Scan archives: yes
Scan e-mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
F:\
G:\

Scan statistics:
Objects scanned: 404732
Threats found: 5
Infected objects found: 5
Suspicious objects found: 0
Scan duration: 06:51:47


File name / Threat / Threats count
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\atapi.sys.vir Infected: Rootkit.Win32.TDSS.u 1
F:\Documents and Settings\Dave\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst Infected: Trojan-Downloader.Win32.Pif.qc 2
F:\Documents and Settings\Dave\Local Settings\Temp\mirc635.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
F:\Documents and Settings\Dave\Local Settings\Temp\ywmurwjl.tmp\mirc635.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1
F:\Program Files\mIRC\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.g 1

Selected area has been scanned.
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am

Re: Browser redirecting on links

Unread postby muppy03 » November 16th, 2009, 6:52 pm

Yes spyware doctor also runs as an antivirus


It is not wise to run more than one Antivirus at a time. Anti-virus programs take up an enormous amount of your computer's resources when they are actively scanning your computer. Having two anti-virus programs running at the same time can cause your computer to run very slow, become unstable and even, in rare cases, crash. So wise to remove one of them.

The kaspersky scan shows some infected objects, mainly on the F drive which I am formating tonight anyway so no trouble there.


Kaspersky is not too bad, if you are formatting it, then fine. The only one I would be concerned about is that there is infection in the Outlook files. Kaskersky cannot show us which one, so if you do not format clean out the following.
    F:\Documents and Settings\Dave\Local Settings\Application Data\Microsoft\Outlook\Outlook.pst

You should Download and Install the newest version of Adobe Reader for reading pdf files, due to the vulnerabilities in earlier versions.
All versions numbered lower than 9.2 are vulnerable.
  • Go HERE and click on AdbeRdr920_en_US.exe to download the latest version of Adobe Acrobat Reader.
  • Save this file to your desktop and run it to install the latest version of Adobe Reader.


Update Java Runtime

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, and also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 16.
  • Go to Java Site
  • Click to Download Java SE Runtime Environment (JRE) 6 Update 16
  • In Platform box choose Windows.
  • Check the box to Accept License Agreement and click Continue.
  • Click on Windows Offline Installation, click on the link under it which says "jre-6u16-windows-i586.exe" and save the downloaded file to your desktop.
  • Go to Start => Control Panel => Add or Remove Programs
  • Uninstall all old versions of Java (Java 3 Runtime Environment, JRE or JSE) listed below in the code box.
    Code: Select all
    Java(TM) 6 Update 16
     
  • Install the new version by running the newly-downloaded file with the java icon which will be at your desktop, and follow the on-screen instructions.
  • Reboot your computer

Let me know when the above is done, and if there are no issues remaining we will clean up all our quarantines etc.
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 16th, 2009, 7:39 pm

Both installed and still no issues on the browser. I did know that it would slow down my system running both anti's however it was running so slowly anyway and the pop ups and ad's were driving me nuts between the 2 of them (antivira and spy dr) it seemed to stop a lot.

The Java update was JRE 6 Update 17 not 16.

Forgot to add the Outlook file on F is from my previous hard disk on a laptop that failed I moved it into the desktop as a back up, as such the outlook file there isn't needed at all.
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am

Re: Browser redirecting on links

Unread postby muppy03 » November 16th, 2009, 8:11 pm

Well then, I think we are done! :cheers: If you are not having any further problems, I would suggest you proceed as follows.

MBAM and ATF are great tools for you to keep and use on a regular basis.

You can delete RSIT from your Desktop and it associated folder C:\RSIT, you can also remove GMER.

Remove Combofix
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK ( please note the space between Combofix and the /, it is needed.)
  • Image
The above procedure will reset your System Restore and clear out the backups and quarantines created during the course of this fix.


Now that the infection is gone lets try to keep it that way by following the below recommendations.

Make your Internet Explorer more secure - This can be done by following these simple instructions:
  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click once on the Security tab
  • Click once on the Internet icon so it becomes highlighted.
  • Click once on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialise and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the settings, press the Yes button.

Here are some free programs I recommend that could help you improve your computer's security.

Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system. If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Install WinPatrol
Download it from here
Here you can find information about how WinPatrol works here

Install MVPS Hosts File from here
The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.
Find Tutorial here : http://www.mvps.org/winhelp2002/hosts.htm

Read some information here how to prevent Malware.


Please reply if you have any problems or questions

Happy Safe Surfing :)
User avatar
muppy03
MRU Emeritus
MRU Emeritus
 
Posts: 4782
Joined: December 4th, 2007, 5:30 am
Location: Australia

Re: Browser redirecting on links

Unread postby LeicDave » November 17th, 2009, 6:54 am

Thanks very much Muppy you have been a terrific help in cleaning up all my issues.

Think I might see if I can do your training course now my computer is all clean.
LeicDave
Active Member
 
Posts: 9
Joined: November 11th, 2009, 7:32 am
Advertisement
Register to Remove

Next

  • Similar Topics
    Replies
    Views
    Last post

Return to Infected? Virus, malware, adware, ransomware, oh my!



Who is online

Users browsing this forum: random/random and 66 guests

Contact us:

Advertisements do not imply our endorsement of that product or service. Register to remove all ads. The forum is run by volunteers who donate their time and expertise. We make every attempt to ensure that the help and advice posted is accurate and will not cause harm to your computer. However, we do not guarantee that they are accurate and they are to be used at your own risk. All trademarks are the property of their respective owners.

Member site: UNITE Against Malware