Google redirects and more

Hey there...2nd post as I didn't read the instructions thoroughly enough; I am sorry for that...wont happen again.

Google search page redirects when I click on whatever link I choose from the search. The redirects are not just to add sites but also fake search results.

I saw a similar problem posted just a couple down from this but there were a few different symptoms, so I posted this.

Thanks so much for any help you can give me.

Sincerely,
Mark

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 5:08:02 AM, on 3/5/2011
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS.1\System32\smss.exe
C:\WINDOWS.1\system32\winlogon.exe
C:\WINDOWS.1\system32\services.exe
C:\WINDOWS.1\system32\lsass.exe
C:\WINDOWS.1\system32\svchost.exe
C:\WINDOWS.1\System32\svchost.exe
C:\WINDOWS.1\system32\spoolsv.exe
C:\WINDOWS.1\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\WINDOWS.1\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS.1\system32\tcpsvcs.exe
C:\WINDOWS.1\System32\snmp.exe
C:\WINDOWS.1\system32\svchost.exe
C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
C:\Program Files\M-Audio\USB MIDI Series\AudioDevMon.exe
C:\WINDOWS.1\system32\mqsvc.exe
C:\WINDOWS.1\system32\mqtgsvc.exe
C:\WINDOWS.1\system32\wbem\wmiapsrv.exe
C:\WINDOWS.1\System32\svchost.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
C:\WINDOWS.1\Explorer.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS.1\vsnpstd3.exe
C:\WINDOWS.1\system32\hkcmd.exe
C:\WINDOWS.1\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS.1\system32\MAFWTray.exe
C:\Program Files\AVAST Software\Avast\avastUI.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
O4 - HKLM\..\Run: [IMONTRAY] C:\Program Files\Intel\Intel(R) Active Monitor\imontray.exe
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS.1\vsnpstd3.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS.1\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS.1\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS.1\system32\igfxpers.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [M-Audio Taskbar Icon] C:\WINDOWS.1\system32\MAFWTray.exe
O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKCU\..\Run: [Adobe Acrobat Synchronizer] "C:\Program Files\Adobe\Acrobat 10.0\Acrobat\AdobeCollabSync.exe"
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS.1\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS.1\system32\ctfmon.exe (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe
O9 - Extra button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.1\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS.1\Network Diagnostic\xpnetdiag.exe
O15 - Trusted Zone: *.line6.net
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS.1\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS.1\system32\browseui.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX® - C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
O23 - Service: Intel(R) Active Monitor (imonNT) - Intel Corp. - C:\Program Files\Intel\Intel(R) Active Monitor\imonnt.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies, Inc. - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: NST ToolTipFixer (TTFixerService) - NeoSmart Technologies - C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
O23 - Service: USB MIDI Series Audio Device Monitor (USBMIDIAudioDevMon) - M-Audio - C:\Program Files\M-Audio\USB MIDI Series\AudioDevMon.exe
O23 - Service: Windows Search (WSearch) - Unknown owner - C:\WINDOWS.1\system32\SearchIndexer.exe (file missing)

--
End of file - 10825 bytes

Looking over your log, back soon.

Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.

If you think you have similar problems, please post a log in the HJT forum and wait for help.

Unless informed of in advance, failure to post replies within 3 days will result in this thread being closed.

Hi MarkinVegas

I'm Gary R, I'll be glad to help you with your computer problems.

Before we start: Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Because of this, I advise you to backup any personal files and folders before you start.

Please observe these rules while we work:

• Perform all actions in the order given.
• If you don't know, stop and ask! Don't keep going on.
• Please reply to this thread. Do not start a new topic.
• Stick with it till you're given the all clear.
• Remember, absence of symptoms does not mean the infection is all gone.
• Don't attempt to install any new software (other than those I ask you to) until we've got your computer clean.
• Don't attempt to clean your computer with any tools other than the ones I ask you to use during the cleanup process. If your defensive programmes warn you about any of those tools, be assured that they are not infected, and are safe to use.

If you can do these things, everything should go smoothly.

• If you're using XP, you'll need Administrator privileges to perform the fixes. (XP accounts are Administrator by default)
• If you're using Vista or Windows7, it will be necessary to right click all tools we use and select ----> Run as Administrator

Important As I said earlier removing Malware is a potentially hazardous thing to do, so to increase our chances of recovery in the event of something unexpected happening, I'd like you to make a backup of your Registry before we start to clean your computer.

• Download ERUNT to your desktop
• Alternate Download
• Double-click on erunt_setup.exe to install the program
• Untick the NTREGOPT desktop shortcut option
• Click No when you get the option to run Erunt at Windows startup.
• During the installation, tick Launch Erunt.
• Accept the default options for running a backup.
• Erunt will then backup your registry.
• Click OK to finish.
• If you are unable to back up your Registry with ERUNT ....
  
  • Let me know.
  • Do not follow any further instructions until I tell you to.

It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Nothing of any concern in your HJT log, but then most re-directors don't show on HJT, so I'll need you to run an alternate scan for me.

Download DDS and save it to your Desktop (must be in this location).
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  
  • DDS.txt
  • Attach.txt
• Save both to your Desktop.
• Copy/Paste the contents of both into your next reply please.

Post each log separately please so it doesn't get cut short by the forum post size limiter.

Please Note: DDS will ask you to attach the 2nd log, just ignore that instruction and post it please.

Thank you so much for your help. I will certainly do my very best at following all directions.

Here are the two files. The backup went ultra smooth, no problems.


Thanks again
Mark Colquitt



.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS

LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 5/7/2010 8:19:38 AM
System Uptime: 3/5/2011 6:02:34 AM (7 hours ago)
.
Motherboard: Dell Computer Corp. | | 0TC667
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz |

Microprocessor | 2793/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 114 GiB total, 1.404 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is CDROM ()
G: is FIXED (NTFS) - 466 GiB total, 118.914 GiB free.
I: is FIXED (NTFS) - 149 GiB total, 51.753 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E972-E325-11CE-BFC1-08002BE10318}
Description: 3Com EtherLink XL 10/100 PCI TX NIC

(3C905B-TX)
Device ID:

PCI\VEN_10B7&DEV_9055&SUBSYS_905510B7&REV_30\4&1

C660DD6&0&00F0
Manufacturer: 3Com
Name: 3Com EtherLink XL 10/100 PCI TX NIC (3C905B-TX) #2
PNP Device ID:

PCI\VEN_10B7&DEV_9055&SUBSYS_905510B7&REV_30\4&1

C660DD6&0&00F0
Service: EL90XBC
.
==== System Restore Points ===================
.
RP366: 2/26/2011 5:40:46 PM - System Checkpoint
RP367: 2/27/2011 5:30:38 AM - Software Distribution Service

3.0
RP368: 2/27/2011 10:30:29 PM - Installed PocketControl
RP369: 2/28/2011 3:48:20 AM - Update to an unsigned driver
RP370: 2/28/2011 3:56:59 AM - Unsigned driver install
RP371: 2/28/2011 4:20:37 AM - Unsigned driver install
RP372: 2/28/2011 8:30:52 AM -
RP373: 2/28/2011 9:24:06 AM - Removed PocketControl
RP374: 2/28/2011 10:44:37 AM - Installed M-Audio FireWire

Driver 6.0.1 (x86)
RP375: 2/28/2011 10:50:01 AM - Unsigned driver install
RP376: 3/1/2011 2:10:44 AM - Installed Dell System Software
RP377: 3/1/2011 2:10:59 AM - Installed Desktop System

Software
RP378: 3/2/2011 5:42:53 AM - Installed Diskeeper 2011.
RP379: 3/3/2011 6:24:18 AM - System Checkpoint
RP380: 3/4/2011 6:38:47 AM - System Checkpoint
RP381: 3/4/2011 8:29:24 AM - avast! Free Antivirus Setup
RP382: 3/4/2011 9:45:29 PM - Installed HiJackThis
RP383: 3/5/2011 7:57:53 AM - avast! Free Antivirus Setup
.
==== Installed Programs ======================
.
µTorrent
3ivx MPEG-4 5.0.3 (remove only)
Absolute Piano Steinway VSTi Standalone v4.4
AC3Filter (remove only)
Adobe Acrobat X Pro - English, Français, Deutsch
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop 7.0
Adobe Shockwave Player 11.5
AIM 7
Alky for Applications (Windows XP)
AmpegSVX
AmpliTube Jimi Hendrix
Antares Microphone Modeler 1.31 DirectX
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Applied Accoustics UltraAnalog VA-1 v1.01
ARC System
ASIO4ALL
BBE Sonic Maximizer Plugin
BBE Sonic Maximizer Plugin v2.0
Bonjour
CameraHelperMsi
Camfrog Server 4.3 (remove only)
Camfrog Video Chat 5.5
Camtasia Studio 6
Creative WebCam NX Pro Driver (1.03.03.0326)
Diskeeper 2011
Download Updater (AOL LLC)
Dropbox
Drumagog 4
eLicenser Control
Elysia mpressor VST RTAS v1.0.3
erLT
ERUNT 1.1j
EZdrummer
EZplayer
EZXMetalHeads
EZXNashville
facemoods
ffdshow [rev 2975] [2009-05-28]
Firebird SQL Server - MAGIX Edition
FlipShare
Free M4a to MP3 Converter 6.2
Freez FLV to AVI/MPEG/WMV Converter
Freez FLV to MP3 Converter
GoldWave v5.58
Google Talk Plugin
Guitar Chords
Guitar Pro 5.2
Guitar World Digital
Hanso Converter
High Definition Audio Driver Package - KB835221
HiJackThis
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
IL Download Manager
ImageShack Uploader 2.2.0
Intel(R) Active Monitor
Intel(R) C++ Redistributables for Windows* on IA-32
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet for Wired Connections
ISEngineUpdate
iTunes
iZotope Alloy
iZotope Ozone 4
J2SE Runtime Environment 5.0 Update 21
Java Auto Updater
Java(TM) 6 Update 21
JDownloader
Junk Mail filter update
K-Lite Mega Codec Pack 4.1.7
Karaoke for DirectX (remove only)
Lawo Plug-In Collection VST v1.0
LimeWire 5.5.10
Line 6 Edit (remove only)
Line 6 Uninstaller
Linplug SaxLab v1.0.2
Live 8.0.1
LiveSynth Pro DXi
Logitech Vid HD
Logitech Webcam Software
LUXONIX LFX-1310
LUXONIX Purity
LWS Facebook
LWS Gallery
LWS Help_main
LWS Launcher
LWS Motion Detection
LWS Pictures And Video
LWS Twitter
LWS Video Mask Maker
LWS VideoEffects
LWS Webcam Software
LWS WLM Plugin
LWS YouTube Plugin
M-Audio FireWire Driver 6.0.1 (x86)
M-Audio Key Rig 1.0.1
M-Audio USB MIDI Series Driver 5.0.1 (x86)
Magic Burning Studio 11.6.0.289
MAGIX Screenshare
MAGIX Screenshare 4.3.6.1987 (D)
MAGIX Speed 2 (MSI)
Malwarebytes' Anti-Malware
Melodyne 3.2
Melodyne plugin
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office 2000 Premium
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel Viewer
Microsoft Office FrontPage 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86

8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x86

9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30304
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86

9.0.30729.4148
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
MobileMe Control Panel
Mozilla Firefox (3.6.15)
Mozilla Firefox 4.0b12 (x86 en-US)
Mozilla Firefox 4.0b8 (x86 en-US)
MSVCRT
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6.0 Parser
MusicLab RealGuitar 2.0
Musicnotes Software Suite 1.4.6
Native Instruments Controller Editor
Native Instruments Guitar Rig 4
Native Instruments Kontakt 4
Native Instruments Rig Kontrol 3 Driver
Native Instruments Service Center
NetShow Tools 3.0
NomadFactory Blue Tubes Effects Pack VST RTAS v3.2
NomadFactory Essential Studio Suite VST RTAS v1.5
NomadFactory Limiting Amplifier LM-662 VST RTAS v1.3
NomadFactory Rock Amp Legends VST RTAS v1.5
NomadFactory Studio Channel SC-226 VST RTAS v1.3
NVIDIA Drivers
OGA Notifier 2.0.0048.0
Overloud slego 1.0
PaltalkScene
Pianoteq v2.2.0
Pistonsoft BPM Detector 1.0
PowerISO
Proteus VX
PSP MixPack2 2.0.3
PSP VintageWarmer 1.5
PSP VintageWarmer v1.5d
PSP VintageWarmer2 2.1.4
QuickTime
Real Alternative 1.8.4 Lite
Reason 4.0
ReValver Mk IIIdotV
Rob Papen Albino 3
Rob Papen RP-Verb 1.0.3 Multi-Core
Rock Songs
Safari
Samplitude 11
Samplitude 11.5 Producer Download Version
Security Update for 2007 Microsoft Office System

(KB2288621)
Security Update for 2007 Microsoft Office System

(KB2288931)
Security Update for 2007 Microsoft Office System

(KB2289158)
Security Update for 2007 Microsoft Office System

(KB2344875)
Security Update for 2007 Microsoft Office System

(KB969559)
Security Update for 2007 Microsoft Office System

(KB976321)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 3.5 SP1

(KB2416473)
Security Update for Microsoft Office InfoPath 2007

(KB979441)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007

(KB974234)
Security Update for Microsoft Office Word 2007 (KB2344993)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2124261)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2290570)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB953155)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB970483)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975254)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB976323)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Segoe UI
SFX Machine PRO
Shred 1.5X
Sibelius Scorch (Firefox, Opera, Netscape only)
Skype Toolbars
Skype™ 5.1
Softube FET Compressor VST RTAS v1.0.3
SONAR 8.0 Producer Edition
SONAR X1 Producer
Songwriters Pack
Sony Sound Forge Audio Studio 9.0
SoundMAX
Speedsoft Virtual Sampler VSTi DXi v3.5.1
SpinAudio RoomVerb M2 2.0
Steinberg The Grand 2
Syncrosoft's License Control
TeamViewer 6
ToolTipFixer 1.0.1
TruePianos 1.4.1
TruePianos: Amber Module 1.4.0
TruePianos: Diamond Module 1.4.0
TruePianos: Emerald Module 1.4.0
TruePianos: Sapphire Module 1.4.0
Uniblue RegistryBooster
Uniblue SystemTweaker
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Windows (KB971513)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows Internet Explorer 8 (KB982632)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB955759)
Update for Windows XP (KB961503)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
vanBasco's Karaoke Player
Vegas Pro 9.0
Wave Arts Power Suite
Waves Complete VST RTAS TDM v7.1.16
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer
Windows Rights Management Client Backwards Compatibility

SP2
Windows Rights Management Client with Service Pack 2
Windows Search 4.0
WinPcap 4.1.2
WMP Tag Plus 1.2
Xvid 1.2.1 final uninstall
YouTube Downloader 2.6.5
YouTube Downloader Toolbar v4.3
.
==== Event Viewer Messages From Past Week ========
.
3/3/2011 12:20:51 AM, error: DCOM [10016] - The

application-specific permission settings do not grant Local

Launch permission for the COM Server application with CLSID

{D851F103-8C90-4321-AFF0-58BA5BD421C2} to the user NT

AUTHORITY\SYSTEM SID (S-1-5-18). This security permission

can be modified using the Component Services administrative

tool.
3/2/2011 6:05:00 AM, error: Service Control Manager [7031] -

The Apple Mobile Device service terminated unexpectedly. It

has done this 2 time(s). The following corrective action will

be taken in 60000 milliseconds: Restart the service.
3/2/2011 5:55:50 AM, error: Service Control Manager [7034] -

The Diskeeper service terminated unexpectedly. It has done

this 3 time(s).
3/2/2011 5:54:36 AM, error: Service Control Manager [7034] -

The Diskeeper service terminated unexpectedly. It has done

this 2 time(s).
3/2/2011 5:44:33 AM, error: Service Control Manager [7034] -

The Diskeeper service terminated unexpectedly. It has done

this 1 time(s).
3/1/2011 8:39:58 PM, error: Service Control Manager [7034] -

The World Wide Web Publishing service terminated

unexpectedly. It has done this 1 time(s).
3/1/2011 8:39:58 PM, error: Service Control Manager [7034] -

The Simple Mail Transfer Protocol (SMTP) service terminated

unexpectedly. It has done this 1 time(s).
3/1/2011 8:39:58 PM, error: Service Control Manager [7034] -

The FTP Publishing service terminated unexpectedly. It has

done this 1 time(s).
3/1/2011 8:39:58 PM, error: Service Control Manager [7031] -

The IIS Admin service terminated unexpectedly. It has done

this 1 time(s). The following corrective action will be taken in

1 milliseconds: Run the configured recovery program.
3/1/2011 3:42:59 PM, error: DCOM [10005] - DCOM got error

"%2" attempting to start the service WSearch with arguments

"" in order to run the server:

{7D096C5F-AC08-4F1F-BEB7-5C22C517CE39}
2/28/2011 9:22:18 AM, error: Service Control Manager [7034]

- The Senstic Pocket Service service terminated

unexpectedly. It has done this 1 time(s).
2/28/2011 4:19:31 AM, error: Service Control Manager [7001]

- The Intel(R) Active Monitor service depends on the Intel(R)

SMBus 2.0 Driver service which failed to start because of the

following error: The service cannot be started, either

because it is disabled or because it has no enabled devices

associated with it.
2/28/2011 4:19:31 AM, error: Service Control Manager [7000]

- The Windows Search service failed to start due to the

following error: The system cannot find the file specified.
2/28/2011 4:19:31 AM, error: Service Control Manager [7000]

- The Nsynas32 service failed to start due to the following

error: The system cannot find the file specified.
2/28/2011 4:14:00 AM, error: Service Control Manager [7009]

- Timeout (30000 milliseconds) waiting for the Apple Mobile

Device service to connect.
2/28/2011 4:14:00 AM, error: Service Control Manager [7000]

- The Apple Mobile Device service failed to start due to the

following error: The service did not respond to the start or

control request in a timely fashion.
2/28/2011 4:12:30 AM, error: Service Control Manager [7031]

- The Apple Mobile Device service terminated unexpectedly.

It has done this 1 time(s). The following corrective action will

be taken in 60000 milliseconds: Restart the service.
2/28/2011 4:12:09 AM, error: Service Control Manager [7034]

- The FlipShare Service service terminated unexpectedly. It

has done this 1 time(s).
2/28/2011 2:44:21 AM, error: Service Control Manager [7026]

- The following boot-start or system-start driver(s) failed to

load: agp440 IntelIde
2/27/2011 4:14:47 PM, error: Service Control Manager [7034]

- The Application Updater service terminated unexpectedly. It

has done this 1 time(s).
.
==== End Of File ===========================

.
DDS (Ver_11-03-05.01) - NTFSx86
Run by [removed] at 13:29:16.51 on Sat 03/05/2011
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_21
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2046.1376 [GMT -8:00]
.
.
============== Running Processes ===============
.
C:\WINDOWS.1\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS.1\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS.1\system32\spoolsv.exe
C:\WINDOWS.1\system32\rundll32.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS.1\system32\inetsrv\inetinfo.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\Common Files\Native Instruments\Hardware\NIHardwareService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS.1\system32\tcpsvcs.exe
C:\WINDOWS.1\System32\snmp.exe
C:\WINDOWS.1\system32\svchost.exe -k imgsvc
C:\Program Files\NeoSmart Technologies\ToolTipFixer\ToolTipFixer.exe
C:\Program Files\M-Audio\USB MIDI Series\AudioDevMon.exe
C:\WINDOWS.1\system32\mqsvc.exe
C:\WINDOWS.1\system32\mqtgsvc.exe
C:\WINDOWS.1\system32\wbem\wmiapsrv.exe
C:\WINDOWS.1\System32\svchost.exe -k HTTPFilter
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Uniblue\RegistryBooster\rbmonitor.exe
C:\WINDOWS.1\Explorer.EXE
C:\Program Files\PowerISO\PWRISOVM.EXE
C:\WINDOWS.1\vsnpstd3.exe
C:\WINDOWS.1\system32\igfxpers.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS.1\system32\MAFWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\administrator2\Local Settings\Application Data\Google\Google Talk Plugin\googletalkplugin.exe
C:\Program Files\Adobe\Acrobat 10.0\Acrobat\Acrobat.exe
C:\WINDOWS.1\system32\NOTEPAD.EXE
C:\Documents and Settings\administrator2\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://start.facemoods.com/?a=ddr&s={searchTerms}&f=4
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows

live\WindowsLiveLogin.dll
BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\common

files\adobe\acrobat\activex\AcroIEFavClient.dll
BHO: Skype Plug-In: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: SmartSelect Class: {f4971ee7-daa0-4053-9964-665d8ee6a077} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
EB: &Research: {ff059e31-cc5a-4e2e-bf3b-96e929d65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
uRun: [Adobe Acrobat Synchronizer] "c:\program files\adobe\acrobat 10.0\acrobat\AdobeCollabSync.exe"
mRun: [MsmqIntCert] regsvr32 /s mqrt.dll
mRun: [IMONTRAY] c:\program files\intel\intel(r) active monitor\imontray.exe
mRun: [PWRISOVM.EXE] c:\program files\poweriso\PWRISOVM.EXE
mRun: [snpstd3] c:\windows.1\vsnpstd3.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [<NO NAME>]
mRun: [igfxtray] c:\windows.1\system32\igfxtray.exe
mRun: [igfxhkcmd] c:\windows.1\system32\hkcmd.exe
mRun: [igfxpers] c:\windows.1\system32\igfxpers.exe
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [M-Audio Taskbar Icon] c:\windows.1\system32\MAFWTray.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
dRun: [ctfmon.exe] c:\windows.1\system32\ctfmon.exe
StartupFolder: c:\docume~1\alluse~1.1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OSA9.EXE
IE: Append Link Target to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Append to Existing PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIEAppend.html
IE: Convert Link Target to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Convert to Adobe PDF - c:\program files\common files\adobe\acrobat\activex\AcroIEFavClient.dll/AcroIECapture.html
IE: {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - c:\program files\paltalk messenger\Paltalk.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet

explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
Trusted Zone: line6.net
DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/produ ... wsdc32.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0015-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows.1\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop

search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\admini~2\applic~1\mozilla\firefox\profiles\7ogazkkp.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=fi ... S:official
FF - prefs.js: keyword.URL - hxxp://start.facemoods.com/results.php?f=5&a=ddr&q=
FF - plugin: c:\documents and settings\administrator2\application data\mozilla\plugins\npgoogletalk.dll
FF - plugin: c:\documents and settings\administrator2\application data\mozilla\plugins\npgtpo3dautoplugin.dll
FF - plugin: c:\documents and settings\administrator2\local settings\application data\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\magic burning studio\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\magic burning studio\real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npnul32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPOFF12.DLL
FF - plugin: c:\program files\mozilla firefox\plugins\NPOFFICE.DLL
FF - plugin: c:\program files\mozilla firefox\plugins\NPSibelius.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\musicnotes\npmusicn.dll
FF - plugin: c:\program files\musicnotes\NPSibelius.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox 4.0 beta

12\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Fast Youtube Downloader: [removed] - %profile%\extensions\[removed]
FF - Ext: FlashGot: {19503e42-ca3c-4c27-b1e2-9cdb2170ee34} - %profile%\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} -

%profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: Ad blocker: {4DC70064-89E2-4a55-8FC6-E8CDEAE3612C} - %profile%\extensions\{4DC70064-89E2-4a55-8FC6-E8CDEAE3612C}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows.1\microsoft.net\framework\v3.5\windows

presentation foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: Adobe Acrobat - Create PDF: [removed] - c:\program files\adobe\acrobat 10.0\acrobat\browser\WCFirefoxExtn
.
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, true
============= SERVICES / DRIVERS ===============
.
R2 fssfltr;FssFltr;c:\windows.1\system32\drivers\fssfltr_tdi.sys [2010-7-21 54760]
R2 Iprip;RIP Listener;c:\windows.1\system32\svchost.exe -k netsvcs [2008-4-14 14336]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2010-2-4 363344]
R2 NIHardwareService;NIHardwareService;c:\program files\common files\native instruments\hardware\NIHardwareService.exe [2010-2-26 3623424]
R2 NPF;NetGroup Packet Filter Driver;c:\windows.1\system32\drivers\npf.sys [2010-6-25 35088]
R2 TTFixerService;NST ToolTipFixer;c:\program files\neosmart technologies\tooltipfixer\ToolTipFixer.exe [2010-2-5 10240]
R2 USBMIDIAudioDevMon;USB MIDI Series Audio Device Monitor;c:\program files\m-audio\usb midi series\AudioDevMon.exe [2010-4-13 1636872]
R3 CompFilter;UVCCompositeFilter;c:\windows.1\system32\drivers\lvbusflt.sys [2010-11-9 20704]
R3 DKRtWrt;DKRtWrt;c:\windows.1\system32\drivers\DKRtWrt.sys [2011-3-2 38608]
R3 L6PODHD5;Service - Line 6 POD HD500;c:\windows.1\system32\drivers\L6PODHD5.sys [2010-10-10 579456]
R3 MAFW;Service for M-Audio FireWire;c:\windows.1\system32\drivers\mafw.sys [2011-2-28 192392]
R3 MAUSBMIDI;Service for M-Audio USB MIDI Series;c:\windows.1\system32\drivers\MAudioUSBMIDI.sys [2011-2-6 170248]
R3 MBAMProtector;MBAMProtector;c:\windows.1\system32\drivers\mbam.sys [2011-2-27 20952]
RUnknown aswFsBlk;aswFsBlk; [x]
RUnknown aswSnx;aswSnx; [x]
RUnknown aswSP;aswSP; [x]
S3 avshws;Senstic PocketCam;c:\windows.1\system32\drivers\camsource.sys [2010-7-5 29000]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance;c:\program files\magix\common\database\bin\fbserver.exe [2010-7-20 1527900]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-4-28 704872]
S3 L6GX;Service - Line 6 GX;c:\windows.1\system32\drivers\L6GX.sys [2010-5-8 579456]
S3 MagixASIODrv;MAGIX_ASIO_BoostDriver;c:\program files\magix\samplitude_11\mxasio.sys [2002-4-16 4899]
S3 PL-40R;CASIO USB MIDI;c:\windows.1\system32\drivers\pl40rwdm.sys [2005-1-6 18048]
S3 PocketAudio;Senstic PocketAudio (WDM);c:\windows.1\system32\drivers\senaudio.sys [2010-3-2 31304]
S3 RDID1003;EDIROL UM-2;c:\windows.1\system32\drivers\Rdwm1003.sys [2010-5-9 80481]
.
=============== Created Last 30 ================
.
2011-03-05 17:13:04 -------- d-----w- c:\program files\Pistonsoft BPM Detector
2011-03-05 05:45:34 388096 ----a-r-

c:\docume~1\admini~2\applic~1\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-03-05 05:45:33 -------- d-----w- c:\program files\Trend Micro
2011-03-05 02:19:54 -------- d-----w- c:\program files\Mozilla Firefox 4.0 Beta 12
2011-03-04 16:29:25 -------- d-----w- c:\program files\AVAST Software
2011-03-04 16:29:25 -------- d-----w- c:\docume~1\alluse~1.1\applic~1\AVAST Software
2011-03-04 04:27:40 -------- d-----w- c:\program files\MusicLab
2011-03-03 09:21:51 -------- d-----w- C:\3DP
2011-03-03 08:11:53 118784 ----a-w- c:\windows.1\system32\Prounstl.exe
2011-03-03 08:11:52 24064 ----a-w- c:\windows.1\system32\IntelNic.dll
2011-03-03 08:11:52 154112 -c--a-w- c:\windows.1\system32\dllcache\e100b325.sys
2011-03-03 08:11:52 154112 ----a-w- c:\windows.1\system32\drivers\e100b325.sys
2011-03-03 08:11:52 12288 ----a-w- c:\windows.1\system32\e100bmsg.dll
2011-03-02 18:00:30 0 ----a-w- c:\documents and settings\administrator2\ntuser.tmp
2011-03-02 13:43:16 38608 ----a-w- c:\windows.1\system32\drivers\DKRtWrt.sys
2011-03-02 13:43:08 -------- d-----w- c:\program files\common files\Diskeeper Corporation
2011-03-02 13:43:06 -------- d-----w- c:\docume~1\alluse~1.1\applic~1\Diskeeper Corporation
2011-03-02 13:43:00 -------- d-----w- c:\program files\Windows Home Server
2011-03-02 13:43:00 -------- d-----w- c:\program files\Diskeeper Corporation
2011-03-02 00:44:05 -------- d-----w- c:\docume~1\admini~2\applic~1\Uniblue
2011-03-02 00:43:48 -------- dc-h--w- c:\docume~1\alluse~1.1\applic~1\{DE8EABB5-1C85-4410-A68D-79BD8A4518F4}
2011-03-02 00:43:26 -------- d-----w- c:\docume~1\admini~2\locals~1\applic~1\PackageAware
2011-03-01 11:36:19 -------- d-----w- c:\docume~1\alluse~1.1\applic~1\AVS4YOU
2011-03-01 11:36:09 -------- d-----w- c:\docume~1\admini~2\applic~1\AVS4YOU
2011-03-01 11:35:06 24576 ----a-w- c:\windows.1\system32\msxml3a.dll
2011-02-28 18:44:52 192392 ----a-w- c:\windows.1\system32\drivers\mafw.sys
2011-02-28 11:57:17 53760 ----a-w- c:\windows.1\system32\drivers\vfwwdm32.dll
2011-02-28 06:32:01 -------- d-----w- c:\docume~1\admini~2\locals~1\applic~1\Senstic
2011-02-28 06:31:18 141056 ----a-w- c:\windows.1\system32\drivers\SET442.tmp
2011-02-28 06:31:18 141056 ----a-w- c:\windows.1\system32\drivers\SET43F.tmp
2011-02-28 06:31:13 0 ----a-w- c:\windows.1\system32\drivers\SET435.tmp
2011-02-28 06:30:33 -------- d-----w- c:\program files\Senstic
2011-02-28 05:51:25 -------- d-----w- c:\docume~1\admini~2\applic~1\TeamViewer
2011-02-28 05:51:05 -------- d-----w- c:\program files\TeamViewer
2011-02-27 23:55:30 -------- d-----w- c:\docume~1\admini~2\applic~1\Malwarebytes
2011-02-27 23:54:54 38224 ----a-w- c:\windows.1\system32\drivers\mbamswissarmy.sys
2011-02-27 23:54:52 20952 ----a-w- c:\windows.1\system32\drivers\mbam.sys
2011-02-27 23:54:52 -------- d-----w- c:\docume~1\alluse~1.1\applic~1\Malwarebytes
2011-02-27 17:25:07 -------- d-----w- c:\program files\SONAR X1 Producer
2011-02-27 13:30:48 -------- d-----w- c:\program files\Microsoft CAPICOM 2.1.0.2
2011-02-27 12:45:13 -------- d-----w- c:\docume~1\admini~2\applic~1\MAGIX
2011-02-27 12:43:53 -------- d-----w- c:\program files\common files\MAGIX Services
2011-02-27 10:59:52 -------- d-----w- c:\program files\Lawo Plug-in Collection
2011-02-26 23:42:52 -------- d-----w- c:\docume~1\admini~2\locals~1\applic~1\LogiShrd
2011-02-26 23:36:47 53248 ----a-r-

c:\docume~1\admini~2\applic~1\microsoft\installer\{3ee9bcae-e9a9-45e5-9b1c-83a4d357e05c}\ARPPRODUCTICON.exe
2011-02-26 23:36:33 -------- d-----w- c:\docume~1\admini~2\locals~1\applic~1\Benstat
2011-02-26 23:33:37 -------- d-----w- c:\windows.1\system32\logishrd
2011-02-26 23:31:51 -------- d-----w- c:\program files\common files\LWS
2011-02-26 23:26:22 20992 ----a-w- c:\windows.1\system32\dshowext.ax
2011-02-26 23:26:22 121984 -c--a-w- c:\windows.1\system32\dllcache\usbvideo.sys
2011-02-26 23:26:22 121984 ----a-w- c:\windows.1\system32\drivers\usbvideo.sys
2011-02-26 04:07:01 86528 ----a-w- c:\windows.1\system32\drivers\tpkd.sys
2011-02-26 04:07:01 203264 ----a-w- c:\windows.1\system32\libpng13.dll
2011-02-25 22:40:17 991232 ----a-w- c:\windows.1\system32\virtear.dll
2011-02-25 22:40:17 65536 ----a-w- c:\windows.1\system32\Audio3d.dll
2011-02-25 22:40:17 49152 ----a-w- c:\windows.1\system32\DSndUp.exe
2011-02-25 22:40:17 45056 ----a-w- c:\windows.1\system32\CleanUp.exe
2011-02-25 22:40:06 260352 ----a-w- c:\windows.1\system32\drivers\smwdm.sys
2011-02-25 22:40:05 765952 ----a-w- c:\windows.1\system\crlds3d.dll
2011-02-25 22:40:05 732928 ----a-w- c:\windows.1\system32\drivers\senfilt.sys
2011-02-25 22:40:05 311296 ----a-w- c:\windows.1\system32\Edcrypt.dll
2011-02-25 22:40:05 23040 ----a-w- c:\windows.1\system32\PostProc.dll
2011-02-25 22:11:09 -------- d-----w- C:\dell
2011-02-25 22:05:14 135168 ----a-w- c:\windows.1\system32\igfxres.dll
2011-02-24 00:51:01 -------- d-----w- c:\windows.1\GroundZero SHOUTcast Stream Recorder DEMO
2011-02-20 03:14:54 -------- d-----w- c:\program files\common files\Spigot
2011-02-20 03:14:54 -------- d-----w- c:\program files\Application Updater
2011-02-20 00:05:35 -------- d-----w- C:\gUITAR WORLD LESSON
2011-02-13 09:03:34 -------- d-----w- c:\docume~1\admini~2\locals~1\applic~1\Microsoft Help
2011-02-13 07:08:56 -------- d-----w- c:\windows.1\ShellNew
2011-02-11 21:32:03 -------- d-----w- c:\program files\Free M4a to MP3 Converter
2011-02-11 20:32:21 -------- d-----w- c:\windows.1\system32\wbem\repository\FS
2011-02-11 20:32:21 -------- d-----w- c:\windows.1\system32\wbem\Repository
2011-02-09 16:35:47 -------- d-----w- c:\program files\iPod
2011-02-07 00:42:47 170248 ----a-w- c:\windows.1\system32\drivers\MAudioUSBMIDI.sys
.
==================== Find3M ====================
.
2011-03-02 16:56:55 64 ----a-w- c:\windows.1\system32\msvcsv60.dll
2011-01-21 14:42:25 439808 ----a-w- c:\windows.1\system32\shimgvw.dll
2011-01-09 14:06:59 737280 ----a-w- c:\windows.1\iun6002.exe
2011-01-07 14:09:31 290048 ----a-w- c:\windows.1\system32\atmfd.dll
2011-01-02 02:19:00 233472 ----a-w- c:\windows.1\system32\REX Shared Library.dll
2010-12-31 13:14:45 1864064 ----a-w- c:\windows.1\system32\win32k.sys
2010-12-22 12:32:24 301568 ----a-w- c:\windows.1\system32\kerberos.dll
2010-12-21 05:19:17 53248 ----a-w- c:\documents and settings\administrator2\lametritonus_en.dll
2010-12-21 05:19:16 162304 ----a-w- c:\documents and settings\administrator2\lame_enc_en.dll
2010-12-20 23:59:20 916480 ----a-w- c:\windows.1\system32\wininet.dll
2010-12-20 23:59:19 43520 ----a-w- c:\windows.1\system32\licmgr10.dll
2010-12-20 23:59:19 1469440 ----a-w- c:\windows.1\system32\inetcpl.cpl
2010-12-20 17:24:18 730112 ----a-w- c:\windows.1\system32\lsasrv.dll
2010-12-20 12:55:26 385024 ----a-w- c:\windows.1\system32\html.iec
2010-12-10 02:39:28 2069376 ----a-w- c:\windows.1\system32\ntkrnlpa.exe
2010-12-09 15:15:41 718336 ----a-w- c:\windows.1\system32\ntdll.dll
2010-12-09 14:30:22 33280 ----a-w- c:\windows.1\system32\csrsrv.dll
2010-12-09 13:43:18 2192768 ----a-w- c:\windows.1\system32\ntoskrnl.exe
2010-02-13 09:22:33 591725568 ----a-w- c:\program files\agvtccms3.bin
2009-10-11 21:19:46 10993 ----a-w- c:\program files\common files\atul.bin
.
============= FINISH: 13:31:10.09 ===============

Not too much leaping out at me, however I do have a few questions.

• Did you set your start page to Facemoods search ?
• Is this a second hand machine, and if not can you tell me why you're not running a standard Windows install ?
• Did you recently attempt to install Avast Anti-Virus, since you appear to have a failed install of that program on your computer.

Next

I'm going to need to run some extra scans .....

First

• Download MGA Diagnostic Tool to your Desktop.
• Double click MGADiag.exe to launch the programme.
• Click Continue and let the scan run.
• When finished it will have created a log.
• Click Copy.
• Next open Notepad.
  
  • Click Start > Run type Notepad click OK.
  • This will open an empty Notepad file.
  • Right click in the empty file and choose Paste to copy the log from MGA Diagnostics into it.
  • Save the file to your Desktop.
• Close MGA Diagnostic Tool.
• Copy/Paste the log in your next reply please.

Next

Download CKScanner to your Desktop.

• Doubleclick CKScanner.exe to launch it.
• Click Search For Files.
• After a couple minutes a list will appear in the panel to the right.
• Click Save List To File.
• A message box will verify the file saved.
• Close CKScanner.
• Copy/paste the contents of ckfiles.txt in your next reply please (it will be on your Desktop).

Next

Download OTL by OldTimer to your Desktop.

Alternative Download

If you already have a copy of OTL delete it and use this version.

• Double click OTL.exe to launch the programme.
• Check the following.
  
  • Scan all users.
  • Lop check.
  • Purity check.
• Under Extra Registry section, select Use SafeList
• Under Custom Scans/Fixes copy/paste the contents of the code box below.

netsvcs

msconfig

safebootminimal

safebootnetwork

activex

drivers32

%SYSTEMDRIVE%\*.*

/md5start

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

sceclt.dll

ntelogon.dll

logevent.dll

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

nvrd32.sys

symmpi.sys

adp3132.sys

mv61xx.sys

nvraid.sys

/md5stop

%systemroot%\*. /mp /s

%systemroot%\system32\*.dll /lockedfiles

%systemroot%\system32\*.exe /lockedfiles

%systemroot%\Tasks\*.job /lockedfiles

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\drivers\*.sys /90

CREATERESTOREPOINT

%PROGRAMFILES%\*.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WPAEvents

• Click the Run Scan button and wait for the scan to finish (usually about 10-15 mins).
• When finished it will produce two logs.
  
  • OTL.txt (open on your desktop).
  • Extras.txt (minimised in your taskbar)
• Please post me both logs.

Next

Please download Rootkit Unhooker and extract it to your desktop.

• Double-click RKUnhookerLE.exe to run it.
• Click the Report tab, then click Scan
• Check Drivers, Stealth Code, Files, and Code Hooks
• Uncheck the rest, then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished then go File > Save Report
• Save the report somewhere you can find it. Click Close
• Copy the entire contents of the report and paste it in your next reply.

Summary of the logs I need from you in your next post:

• Answers to my questions.
• MGADiagnostic log
• CKScanner log
• OTL.txt
• Extras.txt
• RKUnhooker log

Please post each log separately to prevent it being cut off by the forum post size limiter. Check each after you've posted it to make sure it's all present, if any log is cut off you'll have to post it in sections.

lack of response,