Google redirecting to search engines

SilentDeath12886 · November 26, 2011

When I use google to search for something, when I click on the website it redirects me to a search engine, yellowpages, sporting good stores etc.

Logfile of Trend Micro HijackThis v2.0.4

Scan saved at 10:21:20 PM, on 11/25/2011

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v8.00 (8.00.6001.18702)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\franklin\Application Data\901F8\17B43.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\F8BD8\lvvm.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Belkin\F7D4101\V1\wlansrv.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\Common Files\SupportSoft\bin\bcont.exe

C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe

C:\Program Files\Belkin\F7D4101\V1\PBN.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\Program Files\LP\4B39\D7D.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://hotmail.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:55192

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)

O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll

O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll

O4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [skyTel] SkyTel.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /installquiet

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"

O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2

O4 - HKLM\..\Run: [Malwarebytes' Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

O4 - HKLM\..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming

O4 - HKLM\..\Run: [XCwkIVrlOtAuSiF8234A] C:\WINDOWS\system32\AV Protection 2011v121.exe

O4 - HKLM\..\Run: [D7D.exe] C:\Program Files\LP\4B39\D7D.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden

O4 - HKCU\..\Run: [Desktop Software] "C:\Program Files\Common Files\SupportSoft\bin\bcont.exe" /ini "C:\Program Files\ComcastUI\Desktop Software\uinstaller.ini" /fromrun /starthidden

O4 - HKCU\..\Run: [Garmin Lifetime Updater] C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe /StartMinimized

O4 - Startup: Logitech . Product Registration.lnk = C:\Program Files\Common Files\Logishrd\eReg\SetPoint\eReg.exe

O4 - Global Startup: Play Wireless USB Adapter Utility.lnk = C:\Program Files\Belkin\F7D4101\V1\PBN.exe

O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284601051546

O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://connect.tjuh.org/dana-cached/sc/JuniperSetupClient.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

O23 - Service: Logitech Bluetooth Service (LBTServ) - Logitech, Inc. - C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe

O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE

O23 - Service: LMIGuardianSvc - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

O23 - Service: PnkBstrB - Unknown owner - C:\WINDOWS\system32\PnkBstrB.exe

O23 - Service: Symantec Management Client (SmcService) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

O23 - Service: Symantec Endpoint Protection (Symantec AntiVirus) - Symantec Corporation - C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

O23 - Service: Belkin WLAN service (WLANBelkinService) - Unknown owner - C:\Program Files\Belkin\F7D4101\V1\wlansrv.exe

--

End of file - 12837 bytes

SilentDeath12886 · November 26, 2011

With DDS/Attach

.

DDS (Ver_2011-08-26.01) - NTFSx86

Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_26

Run by franklin at 22:38:52 on 2011-11-25

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.906 [GMT -5:00]

.

AV: Symantec Endpoint Protection *Enabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: ActiveArmor Firewall *Enabled*

.

============== Running Processes ===============

.

C:\WINDOWS\system32\nvsvc32.exe

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup

C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe

C:\WINDOWS\Explorer.EXE

C:\Documents and Settings\franklin\Application Data\901F8\17B43.exe

svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\F8BD8\lvvm.exe

svchost.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

C:\Program Files\Java\jre6\bin\jqs.exe

C:\Program Files\Common Files\LightScribe\LSSrvc.exe

C:\Program Files\LogMeIn\x86\LMIGuardianSvc.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

C:\WINDOWS\system32\PnkBstrA.exe

C:\WINDOWS\system32\PnkBstrB.exe

C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

C:\WINDOWS\system32\svchost.exe -k imgsvc

C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

C:\Program Files\Belkin\F7D4101\V1\wlansrv.exe

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe

C:\Program Files\LogMeIn\x86\LogMeInSystray.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Program Files\Winamp\winampa.exe

C:\WINDOWS\system32\RUNDLL32.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe

C:\Program Files\Common Files\Java\Java Update\jusched.exe

C:\Program Files\Logitech\SetPointP\SetPoint.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe

C:\Program Files\Common Files\SupportSoft\bin\bcont.exe

C:\Program Files\Garmin\Lifetime Updater\GarminLifetime.exe

C:\Program Files\Belkin\F7D4101\V1\PBN.exe

C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

C:\Program Files\LP\4B39\D7D.exe

C:\Program Files\Common Files\Java\Java Update\jucheck.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Windows Live\Toolbar\wltuser.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\franklin\Local Settings\Temporary Internet Files\Content.IE5\NOW6UO18\mbam-setup-1.51.2.1300[2].exe

C:\DOCUME~1\franklin\LOCALS~1\Temp\is-07DU9.tmp\mbam-setup-1.51.2.1300[2].tmp

C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

.

============== Pseudo HJT Report ===============

.

uStart Page = hxxp://hotmail.com/

uInternet Settings,ProxyServer = http=127.0.0.1:55192

mWinlogon: Userinit=c:\windows\system32\userinit.exe

uWinlogon: Shell=explorer.exe,c:\documents and settings\franklin\application data\901f8\D754B.exe

BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll

BHO: Winamp Toolbar Loader: {25cee8ec-5730-41bc-8b58-22ddc8ab8c20} - c:\program files\winamp toolbar\winamptb.dll

BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\program files\spybot - search & destroy\SDHelper.dll

BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File

BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll

BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: Winamp Toolbar: {ebf2ba02-9094-4c5a-858b-bb198f3d8de2} - c:\program files\winamp toolbar\winamptb.dll

TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll

TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File

uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe

uRun: [spybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe

uRun: [LightScribe Control Panel] c:\program files\common files\lightscribe\LightScribeControlPanel.exe -hidden

uRun: [Desktop Software] "c:\program files\common files\supportsoft\bin\bcont.exe" /ini "c:\program files\comcastui\desktop software\uinstaller.ini" /fromrun /starthidden

uRun: [Garmin Lifetime Updater] c:\program files\garmin\lifetime updater\GarminLifetime.exe /StartMinimized

mRun: [LogMeIn GUI] "c:\program files\logmein\x86\LogMeInSystray.exe"

mRun: [RTHDCPL] RTHDCPL.EXE

mRun: [skyTel] SkyTel.EXE

mRun: [Alcmtr] ALCMTR.EXE

mRun: [WinampAgent] "c:\program files\winamp\winampa.exe"

mRun: [NeroFilterCheck] c:\program files\common files\nero\lib\NeroCheck.exe

mRun: [nwiz] c:\program files\nvidia corporation\nview\nwiz.exe /installquiet

mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup

mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"

mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"

mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"

mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"

mRun: [ddoctorv2] "c:\program files\comcast\desktop doctor\bin\sprtcmd.exe" /P ddoctorv2

mRun: [Malwarebytes' Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript

mRun: [sunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"

mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming

mRun: [XCwkIVrlOtAuSiF8234A] c:\windows\system32\AV Protection 2011v121.exe

mRun: [D7D.exe] c:\program files\lp\4b39\D7D.exe

mRunOnce: [Malwarebytes' Anti-Malware] c:\program files\malwarebytes' anti-malware\mbamgui.exe /install /silent

StartupFolder: c:\docume~1\franklin\startm~1\programs\startup\logite~1.lnk - c:\program files\common files\logishrd\ereg\setpoint\eReg.exe

StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\playwi~1.lnk - c:\program files\belkin\f7d4101\v1\PBN.exe

IE: &Winamp Search - c:\documents and settings\all users\application data\winamp toolbar\ietoolbar\resources\en-us\local\search.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL

IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\program files\spybot - search & destroy\SDHelper.dll

LSP: %SYSTEMROOT%\system32\nvappfilter.dll

LSP: mswsock.dll

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1284601051546

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab

DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab

DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} - hxxps://connect.tjuh.org/dana-cached/sc/JuniperSetupClient.cab

TCP: DhcpNameServer = 68.87.64.150 68.87.75.198

TCP: Interfaces\{9EBE1F44-A989-4FB7-98D0-62E492ED247C} : DhcpNameServer = 68.87.64.150 68.87.75.198

TCP: Interfaces\{AB61ECC5-CA27-4E9A-8A5B-2A3DD4BCB9E9} : DhcpNameServer = 68.87.64.150 68.87.75.198

TCP: Interfaces\{AE405622-0AE0-4B4C-920A-AE62056355CF} : DhcpNameServer = 68.87.64.150 68.87.75.198

Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL

Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll

Notify: LMIinit - LMIinit.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"

Hosts: 127.0.0.1 www.spywareinfo.com

.

================= FIREFOX ===================

.

FF - ProfilePath - c:\documents and settings\franklin\application data\mozilla\firefox\profiles\qx1f5vv1.default\

FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=

FF - prefs.js: browser.search.selectedEngine - Ask.com

FF - prefs.js: browser.startup.homepage - hotmail.com

FF - prefs.js: network.proxy.http - 127.0.0.1

FF - prefs.js: network.proxy.http_port - 55192

FF - prefs.js: network.proxy.type - 1

FF - component: c:\documents and settings\franklin\application data\mozilla\firefox\profiles\qx1f5vv1.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}\components\WinampTBPlayer.dll

FF - plugin: c:\documents and settings\franklin\application data\mozilla\firefox\profiles\qx1f5vv1.default\extensions\{195a3098-0bd5-4e90-ae22-ba1c540afd1e}\plugins\npGarmin.dll

FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll

FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll

FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll

FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll

FF - plugin: c:\program files\microsoft\office live\npOLW.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnu.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npdnupdater2.dll

FF - plugin: c:\program files\mozilla firefox\plugins\npwachk.dll

FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}

FF - Ext: Java Console: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

FF - Ext: Winamp Toolbar: {0b38152b-1b20-484d-a11f-5e04a9b0661f} - %profile%\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}

FF - Ext: Garmin Communicator: {195A3098-0BD5-4e90-AE22-BA1C540AFD1E} - %profile%\extensions\{195A3098-0BD5-4e90-AE22-BA1C540AFD1E}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension

FF - Ext: Java Quick Starter: jqs@sun.com - c:\program files\java\jre6\lib\deploy\jqs\ff

.

---- FIREFOX POLICIES ----

FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(network.protocol-handler.warn-external.dnupdate, false

============= SERVICES / DRIVERS ===============

.

R1 NEOFLTR_650_15215;Juniper Networks TDI Filter Driver (NEOFLTR_650_15215);c:\windows\system32\drivers\NEOFLTR_650_15215.SYS [2011-7-30 85360]

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2010-2-17 12872]

R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2010-5-10 67656]

R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2010-1-25 108392]

R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSvcHst.exe [2010-1-25 108392]

R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2011-9-23 12184]

R2 LMIGuardianSvc;LMIGuardianSvc;c:\program files\logmein\x86\LMIGuardianSvc.exe [2011-2-6 374152]

R2 LMIInfo;LogMeIn Kernel Information Provider;c:\program files\logmein\x86\rainfo.sys [2010-1-27 12856]

R2 LMIRfsDriver;LogMeIn Remote File System Driver;c:\windows\system32\drivers\LMIRfsDriver.sys [2010-9-15 47640]

R2 Symantec AntiVirus;Symantec Endpoint Protection;c:\program files\symantec\symantec endpoint protection\Rtvscan.exe [2010-4-22 1831024]

R2 WLANBelkinService;Belkin WLAN service;c:\program files\belkin\f7d4101\v1\wlansrv.exe [2009-12-28 36864]

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2011-11-10 106104]

R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20111125.019\NAVENG.SYS [2011-11-25 86136]

R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20111125.019\NAVEX15.SYS [2011-11-25 1576312]

R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]

S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]

S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-9-20 136176]

S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2010-9-15 1691480]

S3 BCMH43XX;N+ Wireless USB Adapter Driver;c:\windows\system32\drivers\bcmwlhigh5.sys [2009-11-6 642432]

S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-9-20 136176]

S3 MBAMSwissArmy;MBAMSwissArmy;\??\c:\windows\system32\drivers\mbamswissarmy.sys --> c:\windows\system32\drivers\mbamswissarmy.sys [?]

S3 radpms;Driver for RADPMS Device;c:\windows\system32\drivers\radpms.sys [2010-5-18 13408]

S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-12 14336]

S4 LMIRfsClientNP;LMIRfsClientNP; [x]

.

=============== Created Last 30 ================

.

2011-11-26 03:38:48 607260 ------r- c:\program files\dds.scr

2011-11-26 03:38:38 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-26 03:38:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-26 03:37:12 1189014 ----a-w- c:\program files\mbam-setup-1.51.2.1300.exe

2011-11-26 03:10:56 388096 ----a-r- c:\documents and settings\franklin\application data\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe

2011-11-26 03:10:55 -------- d-----w- c:\program files\Trend Micro

2011-11-22 20:06:09 -------- d-----w- c:\program files\F8BD8

2011-11-22 20:05:38 -------- d-----w- c:\documents and settings\franklin\application data\UVrlONtxAuSiFp

2011-11-22 20:05:38 -------- d-----w- c:\documents and settings\franklin\application data\amH5sWJ7dLgZhCk

2011-11-22 20:05:36 -------- d-----w- c:\documents and settings\franklin\application data\901F8

2011-11-22 20:05:35 -------- d-----w- c:\program files\LP

2011-11-22 20:05:31 -------- d-----w- c:\documents and settings\franklin\application data\UZ9hTXwjUeItPy

2011-11-22 20:05:30 -------- d-----w- c:\documents and settings\franklin\application data\wqjUCelIBz

.

==================== Find3M ====================

.

2011-11-11 13:25:15 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-15 05:41:37 14656 ----a-w- c:\windows\gdrv.sys

2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 15:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 15:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 15:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2011-09-23 19:44:49 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

2011-09-06 13:20:51 1858944 ----a-w- c:\windows\system32\win32k.sys

2011-09-01 16:30:36 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-03-31 13:50:31 7130944 ----a-w- c:\program files\HitmanPro35_x64.exe

2011-03-31 13:49:26 10779424 ----a-w- c:\program files\SUPERAntiSpyware.exe

2011-03-31 13:48:46 7734208 ----a-w- c:\program files\Malwarebytes.exe

2011-03-31 13:46:34 388608 ----a-w- c:\program files\HijackThis.exe

2011-03-31 13:45:56 1402880 ----a-w- c:\program files\HijackThis.msi

2010-09-16 17:26:03 86668936 ----a-w- c:\program files\258.96_desktop_winxp_32bit_english_whql.exe

2010-09-16 16:56:10 16409960 ----a-w- c:\program files\spybotsd162.exe

2010-09-16 16:45:26 7278160 ----a-w- c:\program files\Install_AIM.exe

2010-05-16 16:20:27 812344 ----a-w- c:\program files\HJTInstall.exe

2010-01-16 21:08:50 948090 ----a-w- c:\program files\free-wma-mp3-converter 2.exe

2009-08-27 02:24:12 612214 ----a-w- c:\program files\Remington Shooting.exe

2008-11-10 04:26:29 22189968 ----a-w- c:\program files\NVIDIA_PureVideo_Decoder_Retail_1.02-223.exe

.

============= FINISH: 22:39:25.45 ===============

.

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.

IF REQUESTED, ZIP IT UP & ATTACH IT

.

DDS (Ver_2011-08-26.01)

.

Microsoft Windows XP Professional

Boot Device: \Device\HarddiskVolume2

Install Date: 9/14/2010 11:25:40 PM

System Uptime: 11/25/2011 10:01:49 PM (0 hours ago)

.

Motherboard: Gigabyte Technology Co., Ltd. | | M57SLI-S4

Processor: AMD Athlon 64 X2 Dual Core Processor 6000+ | Socket M2 | 3015/200mhz

.

==== Disk Partitions =========================

.

A: is Removable

C: is FIXED (NTFS) - 699 GiB total, 638.234 GiB free.

D: is CDROM ()

E: is FIXED (NTFS) - 233 GiB total, 162.206 GiB free.

.

==== Disabled Device Manager Items =============

.

==== System Restore Points ===================

.

RP279: 8/30/2011 11:10:02 PM - System Checkpoint

RP280: 8/31/2011 9:38:29 AM - Software Distribution Service 3.0

RP281: 9/1/2011 10:44:25 AM - System Checkpoint

RP282: 6/2/2011 2:22:53 AM - System Checkpoint

RP283: 6/3/2011 3:31:18 AM - System Checkpoint

RP284: 6/4/2011 4:19:50 AM - System Checkpoint

RP285: 6/5/2011 5:19:50 AM - System Checkpoint

RP286: 6/6/2011 6:19:49 AM - System Checkpoint

RP287: 6/7/2011 7:19:49 AM - System Checkpoint

RP288: 6/8/2011 8:19:49 AM - System Checkpoint

RP289: 6/9/2011 9:19:49 AM - System Checkpoint

RP290: 6/10/2011 9:59:06 AM - System Checkpoint

RP291: 6/11/2011 10:19:49 AM - System Checkpoint

RP292: 6/12/2011 11:19:49 AM - System Checkpoint

RP293: 6/13/2011 11:46:52 AM - System Checkpoint

RP294: 6/14/2011 1:15:21 PM - System Checkpoint

RP295: 6/15/2011 10:44:31 AM - Software Distribution Service 3.0

RP296: 6/16/2011 11:53:48 AM - System Checkpoint

RP297: 6/18/2011 11:35:06 AM - System Checkpoint

RP298: 6/19/2011 2:19:12 PM - System Checkpoint

RP299: 6/20/2011 2:56:56 PM - System Checkpoint

RP300: 6/21/2011 3:56:57 PM - System Checkpoint

RP301: 6/22/2011 4:56:56 PM - System Checkpoint

RP302: 6/23/2011 5:56:57 PM - System Checkpoint

RP303: 6/24/2011 6:51:13 PM - System Checkpoint

RP304: 6/25/2011 7:51:15 PM - System Checkpoint

RP305: 6/26/2011 9:49:23 PM - System Checkpoint

RP306: 6/27/2011 9:51:13 PM - System Checkpoint

RP307: 6/28/2011 10:05:05 PM - System Checkpoint

RP308: 6/29/2011 10:51:16 PM - System Checkpoint

RP309: 6/30/2011 5:00:15 AM - Software Distribution Service 3.0

RP310: 7/1/2011 5:21:37 AM - System Checkpoint

RP311: 7/2/2011 4:04:20 AM - Software Distribution Service 3.0

RP312: 7/3/2011 4:15:43 AM - System Checkpoint

RP313: 7/4/2011 4:20:49 AM - System Checkpoint

RP314: 7/5/2011 5:07:14 AM - System Checkpoint

RP315: 7/6/2011 5:58:44 AM - System Checkpoint

RP316: 7/7/2011 6:08:41 AM - System Checkpoint

RP317: 7/8/2011 6:55:15 AM - System Checkpoint

RP318: 7/9/2011 7:54:10 AM - System Checkpoint

RP319: 7/10/2011 8:54:11 AM - System Checkpoint

RP320: 7/11/2011 9:37:11 AM - System Checkpoint

RP321: 7/12/2011 10:37:11 AM - System Checkpoint

RP322: 7/13/2011 5:00:20 AM - Software Distribution Service 3.0

RP323: 7/14/2011 5:24:58 AM - System Checkpoint

RP324: 7/15/2011 6:21:08 AM - System Checkpoint

RP325: 7/16/2011 6:24:58 AM - System Checkpoint

RP326: 7/17/2011 7:24:58 AM - System Checkpoint

RP327: 7/18/2011 8:24:58 AM - System Checkpoint

RP328: 7/19/2011 9:24:58 AM - System Checkpoint

RP329: 7/20/2011 9:38:04 AM - System Checkpoint

RP330: 7/21/2011 10:24:15 AM - System Checkpoint

RP331: 7/22/2011 10:26:54 AM - System Checkpoint

RP332: 7/23/2011 11:24:58 AM - System Checkpoint

RP333: 7/24/2011 12:24:58 PM - System Checkpoint

RP334: 7/25/2011 12:28:38 PM - System Checkpoint

RP335: 7/26/2011 12:35:06 PM - System Checkpoint

RP336: 7/27/2011 1:24:59 PM - System Checkpoint

RP337: 7/28/2011 2:20:35 PM - System Checkpoint

RP338: 7/29/2011 3:01:01 PM - System Checkpoint

RP339: 7/29/2011 10:00:06 PM - Software Distribution Service 3.0

RP340: 7/30/2011 10:36:52 PM - System Checkpoint

RP341: 7/31/2011 10:37:58 PM - System Checkpoint

RP342: 8/1/2011 11:43:16 PM - System Checkpoint

RP343: 8/3/2011 2:47:07 AM - System Checkpoint

RP344: 8/4/2011 4:00:54 AM - System Checkpoint

RP345: 8/5/2011 4:36:52 AM - System Checkpoint

RP346: 8/6/2011 5:37:57 AM - System Checkpoint

RP347: 8/7/2011 6:36:52 AM - System Checkpoint

RP348: 8/8/2011 7:36:52 AM - System Checkpoint

RP349: 8/9/2011 7:41:52 AM - System Checkpoint

RP350: 8/10/2011 8:57:47 AM - System Checkpoint

RP351: 8/11/2011 5:00:21 AM - Software Distribution Service 3.0

RP352: 8/11/2011 9:38:39 AM - Installed Java 6 Update 26

RP353: 8/12/2011 10:01:14 AM - System Checkpoint

RP354: 8/13/2011 11:00:09 AM - System Checkpoint

RP355: 8/14/2011 11:14:45 AM - System Checkpoint

RP356: 8/15/2011 12:00:10 PM - System Checkpoint

RP357: 8/16/2011 1:00:10 PM - System Checkpoint

RP358: 8/17/2011 2:15:22 PM - System Checkpoint

RP359: 8/18/2011 5:41:58 PM - System Checkpoint

RP360: 8/19/2011 6:12:10 PM - System Checkpoint

RP361: 8/20/2011 7:00:10 PM - System Checkpoint

RP362: 8/21/2011 9:10:26 PM - System Checkpoint

RP363: 8/22/2011 9:11:07 PM - System Checkpoint

RP364: 8/23/2011 9:27:42 PM - System Checkpoint

RP365: 8/24/2011 5:00:14 AM - Software Distribution Service 3.0

RP366: 8/25/2011 7:34:04 AM - System Checkpoint

RP367: 8/26/2011 8:10:01 AM - System Checkpoint

RP368: 8/27/2011 8:30:11 AM - System Checkpoint

RP369: 8/27/2011 8:37:37 PM - Installed Garmin Lifetime Updater

RP370: 8/28/2011 10:51:04 PM - System Checkpoint

RP371: 8/29/2011 11:37:42 PM - System Checkpoint

RP372: 8/30/2011 11:59:29 PM - System Checkpoint

RP373: 9/1/2011 12:46:41 AM - System Checkpoint

RP374: 9/2/2011 1:48:23 AM - System Checkpoint

RP375: 9/3/2011 2:47:07 AM - System Checkpoint

RP376: 9/4/2011 3:31:48 AM - System Checkpoint

RP377: 9/5/2011 4:07:24 AM - System Checkpoint

RP378: 9/6/2011 4:30:41 AM - System Checkpoint

RP379: 9/7/2011 4:32:04 AM - System Checkpoint

RP380: 9/7/2011 10:18:21 AM - Software Distribution Service 3.0

RP381: 9/8/2011 10:21:30 AM - System Checkpoint

RP382: 9/9/2011 10:39:48 AM - System Checkpoint

RP383: 9/10/2011 11:06:47 AM - System Checkpoint

RP384: 9/11/2011 11:56:23 AM - System Checkpoint

RP385: 9/12/2011 12:39:49 PM - System Checkpoint

RP386: 9/13/2011 1:39:50 PM - System Checkpoint

RP387: 9/14/2011 5:00:26 AM - Software Distribution Service 3.0

RP388: 9/15/2011 5:28:51 AM - System Checkpoint

RP389: 9/16/2011 6:19:53 AM - System Checkpoint

RP390: 9/17/2011 11:26:48 AM - System Checkpoint

RP391: 9/18/2011 12:19:54 PM - System Checkpoint

RP392: 9/19/2011 1:19:53 PM - System Checkpoint

RP393: 9/20/2011 2:09:38 PM - System Checkpoint

RP394: 9/21/2011 2:25:10 PM - System Checkpoint

RP395: 9/22/2011 3:19:59 PM - System Checkpoint

RP396: 9/23/2011 3:44:44 PM - Installed Windows XP Wdf01009.

RP397: 9/24/2011 4:19:59 PM - System Checkpoint

RP398: 9/25/2011 5:02:54 PM - System Checkpoint

RP399: 9/26/2011 5:45:08 PM - System Checkpoint

RP400: 9/27/2011 7:18:29 PM - System Checkpoint

RP401: 9/28/2011 5:00:15 AM - Software Distribution Service 3.0

RP402: 9/29/2011 5:20:15 AM - System Checkpoint

RP403: 9/30/2011 6:20:15 AM - System Checkpoint

RP404: 10/1/2011 10:20:25 AM - System Checkpoint

RP405: 10/2/2011 11:20:14 AM - System Checkpoint

RP406: 10/3/2011 12:20:14 PM - System Checkpoint

RP407: 10/4/2011 1:20:16 PM - System Checkpoint

RP408: 10/5/2011 2:20:18 PM - System Checkpoint

RP409: 10/6/2011 3:44:12 PM - System Checkpoint

RP410: 10/7/2011 4:20:19 PM - System Checkpoint

RP411: 10/9/2011 12:18:04 AM - System Checkpoint

RP412: 10/10/2011 12:36:05 AM - System Checkpoint

RP413: 10/11/2011 1:19:24 AM - System Checkpoint

RP414: 10/12/2011 2:19:25 AM - System Checkpoint

RP415: 10/13/2011 4:17:41 AM - System Checkpoint

RP416: 10/13/2011 5:00:21 AM - Software Distribution Service 3.0

RP417: 10/14/2011 5:33:18 AM - System Checkpoint

RP418: 10/15/2011 5:37:47 AM - System Checkpoint

RP419: 10/16/2011 6:38:52 AM - System Checkpoint

RP420: 10/17/2011 7:38:52 AM - System Checkpoint

RP421: 10/18/2011 8:37:47 AM - System Checkpoint

RP422: 10/19/2011 9:37:48 AM - System Checkpoint

RP423: 10/20/2011 10:37:49 AM - System Checkpoint

RP424: 10/21/2011 10:41:18 AM - System Checkpoint

RP425: 10/22/2011 12:02:45 PM - System Checkpoint

RP426: 10/23/2011 1:20:10 PM - System Checkpoint

RP427: 10/24/2011 1:41:17 PM - System Checkpoint

RP428: 10/25/2011 2:41:16 PM - System Checkpoint

RP429: 10/26/2011 3:41:17 PM - System Checkpoint

RP430: 10/27/2011 4:42:32 PM - System Checkpoint

RP431: 10/28/2011 6:26:08 PM - System Checkpoint

RP432: 10/29/2011 6:41:19 PM - System Checkpoint

RP433: 10/30/2011 8:00:22 PM - System Checkpoint

RP434: 10/31/2011 9:12:30 PM - System Checkpoint

RP435: 11/1/2011 9:56:47 PM - System Checkpoint

RP436: 11/2/2011 10:57:12 PM - System Checkpoint

RP437: 11/3/2011 11:41:23 PM - System Checkpoint

RP438: 11/5/2011 1:27:35 AM - System Checkpoint

RP439: 11/6/2011 12:41:24 AM - System Checkpoint

RP440: 11/7/2011 1:41:24 AM - System Checkpoint

RP441: 11/8/2011 3:43:10 AM - System Checkpoint

RP442: 11/9/2011 4:17:30 AM - System Checkpoint

RP443: 11/9/2011 5:00:14 AM - Software Distribution Service 3.0

RP444: 11/10/2011 5:41:24 AM - System Checkpoint

RP445: 11/11/2011 5:00:16 AM - Software Distribution Service 3.0

RP446: 11/12/2011 5:26:41 AM - System Checkpoint

RP447: 11/13/2011 6:39:40 AM - System Checkpoint

RP448: 11/14/2011 7:35:15 AM - System Checkpoint

RP449: 11/15/2011 8:26:39 AM - System Checkpoint

RP450: 11/16/2011 9:26:38 AM - System Checkpoint

RP451: 11/17/2011 10:26:40 AM - System Checkpoint

RP452: 11/18/2011 11:26:39 AM - System Checkpoint

RP453: 11/19/2011 11:52:22 AM - System Checkpoint

RP454: 11/20/2011 12:38:16 PM - System Checkpoint

RP455: 11/21/2011 12:54:40 PM - System Checkpoint

RP456: 11/22/2011 1:54:40 PM - System Checkpoint

RP457: 11/22/2011 3:12:00 PM - Removed Ask Toolbar.

RP458: 11/23/2011 5:00:15 AM - Software Distribution Service 3.0

RP459: 11/24/2011 5:56:18 AM - System Checkpoint

RP460: 11/25/2011 6:56:19 AM - System Checkpoint

RP461: 11/25/2011 10:10:51 PM - Installed HiJackThis

.

==== Installed Programs ======================

.

Adobe AIR

Adobe Flash Player 10 Plugin

Adobe Flash Player 11 ActiveX

Adobe Reader 9.4.6

AIM 7

Canon MF Toolbox 4.9.1.1.mf11

Canon MF4500 Series

Comcast Desktop Software (v1.2.0.9)

Desktop Doctor

DMIView B7.0108.01

Download Updater (AOL LLC)

eReg

FrostWire 4.20.9

Garmin Lifetime Updater

Google Earth Plug-in

Google Update Helper

HiJackThis

Hitman Pro 3.5

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)

Hotfix for Windows Media Format 11 SDK (KB929399)

Hotfix for Windows Media Player 11 (KB939683)

Hotfix for Windows XP (KB2158563)

Hotfix for Windows XP (KB2443685)

Hotfix for Windows XP (KB2570791)

Hotfix for Windows XP (KB952287)

Hotfix for Windows XP (KB954550-v5)

Hotfix for Windows XP (KB961118)

Hotfix for Windows XP (KB981793)

i-Cool

Java Auto Updater

Java 6 Update 26

Juniper Networks Secure Application Manager

Juniper Networks Setup Client

Junk Mail filter update

LightScribe System Software 1.10.19.1

LiveUpdate 3.3 (Symantec Corporation)

Logitech SetPoint 6.30

LogMeIn

Malwarebytes' Anti-Malware version 1.51.2.1300

Medal of Honor

Microsoft .NET Framework 1.1

Microsoft .NET Framework 1.1 Security Update (KB2572067)

Microsoft .NET Framework 1.1 Security Update (KB979906)

Microsoft .NET Framework 2.0 Service Pack 2

Microsoft .NET Framework 3.0 Service Pack 2

Microsoft .NET Framework 3.5 SP1

Microsoft .NET Framework 4 Client Profile

Microsoft .NET Framework 4 Extended

Microsoft Application Error Reporting

Microsoft Base Smart Card Cryptographic Service Provider Package

Microsoft Choice Guard

Microsoft Compression Client Pack 1.0 for Windows XP

Microsoft Kernel-Mode Driver Framework Feature Pack 1.9

Microsoft Office 2007 Service Pack 2 (SP2)

Microsoft Office Access MUI (English) 2007

Microsoft Office Access Setup Metadata MUI (English) 2007

Microsoft Office Enterprise 2007

Microsoft Office Excel MUI (English) 2007

Microsoft Office File Validation Add-In

Microsoft Office Groove MUI (English) 2007

Microsoft Office Groove Setup Metadata MUI (English) 2007

Microsoft Office InfoPath MUI (English) 2007

Microsoft Office Live Add-in 1.3

Microsoft Office OneNote MUI (English) 2007

Microsoft Office Outlook Connector

Microsoft Office Outlook MUI (English) 2007

Microsoft Office PowerPoint MUI (English) 2007

Microsoft Office Proof (English) 2007

Microsoft Office Proof (French) 2007

Microsoft Office Proof (Spanish) 2007

Microsoft Office Proofing (English) 2007

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)

Microsoft Office Publisher MUI (English) 2007

Microsoft Office Shared MUI (English) 2007

Microsoft Office Shared Setup Metadata MUI (English) 2007

Microsoft Office Word MUI (English) 2007

Microsoft Search Enhancement Pack

Microsoft Silverlight

Microsoft Software Update for Web Folders (English) 12

Microsoft Sync Framework Runtime Native v1.0 (x86)

Microsoft Sync Framework Services Native v1.0 (x86)

Microsoft User-Mode Driver Framework Feature Pack 1.0

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

Microsoft Visual C++ 2005 Redistributable

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148

Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161

Microsoft XML Parser

Mozilla Firefox (3.6.24)

MSVCRT

MSXML 4.0 SP2 (KB954430)

MSXML 4.0 SP2 (KB973688)

MSXML 6.0 Parser (KB933579)

Nero 8 Essentials

neroxml

NVIDIA Display Control Panel

NVIDIA Drivers

NVIDIA ForceWare Network Access Manager

NVIDIA nView Desktop Manager

NVIDIA PhysX

NVIDIA PureVideo Decoder

OGA Notifier 2.0.0048.0

Play Wireless USB Adapter

PunkBuster Services

Realtek High Definition Audio Driver

Security Update for 2007 Microsoft Office System (KB2288621)

Security Update for 2007 Microsoft Office System (KB2288931)

Security Update for 2007 Microsoft Office System (KB2345043)

Security Update for 2007 Microsoft Office System (KB2553074)

Security Update for 2007 Microsoft Office System (KB2553089)

Security Update for 2007 Microsoft Office System (KB2553090)

Security Update for 2007 Microsoft Office System (KB2584063)

Security Update for 2007 Microsoft Office System (KB969559)

Security Update for 2007 Microsoft Office System (KB976321)

Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)

Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)

Security Update for Microsoft .NET Framework 4 Extended (KB2416472)

Security Update for Microsoft .NET Framework 4 Extended (KB2487367)

Security Update for Microsoft Office Access 2007 (KB979440)

Security Update for Microsoft Office Excel 2007 (KB2553073)

Security Update for Microsoft Office Groove 2007 (KB2552997)

Security Update for Microsoft Office InfoPath 2007 (KB2510061)

Security Update for Microsoft Office InfoPath 2007 (KB979441)

Security Update for Microsoft Office PowerPoint 2007 (KB2535818)

Security Update for Microsoft Office PowerPoint Viewer 2007 (KB2464623)

Security Update for Microsoft Office Publisher 2007 (KB2284697)

Security Update for Microsoft Office system 2007 (972581)

Security Update for Microsoft Office system 2007 (KB974234)

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)

Security Update for Microsoft Office Word 2007 (KB2344993)

Security Update for Microsoft Windows (KB2564958)

Security Update for Windows Internet Explorer 8 (KB2183461)

Security Update for Windows Internet Explorer 8 (KB2360131)

Security Update for Windows Internet Explorer 8 (KB2416400)

Security Update for Windows Internet Explorer 8 (KB2482017)

Security Update for Windows Internet Explorer 8 (KB2497640)

Security Update for Windows Internet Explorer 8 (KB2510531)

Security Update for Windows Internet Explorer 8 (KB2530548)

Security Update for Windows Internet Explorer 8 (KB2544521)

Security Update for Windows Internet Explorer 8 (KB2559049)

Security Update for Windows Internet Explorer 8 (KB2586448)

Security Update for Windows Internet Explorer 8 (KB981332)

Security Update for Windows Internet Explorer 8 (KB982381)

Security Update for Windows Media Player (KB2378111)

Security Update for Windows Media Player (KB952069)

Security Update for Windows Media Player (KB954155)

Security Update for Windows Media Player (KB973540)

Security Update for Windows Media Player (KB975558)

Security Update for Windows Media Player (KB978695)

Security Update for Windows Media Player 11 (KB954154)

Security Update for Windows XP (KB2079403)

Security Update for Windows XP (KB2115168)

Security Update for Windows XP (KB2121546)

Security Update for Windows XP (KB2160329)

Security Update for Windows XP (KB2183461)

Security Update for Windows XP (KB2229593)

Security Update for Windows XP (KB2259922)

Security Update for Windows XP (KB2279986)

Security Update for Windows XP (KB2286198)

Security Update for Windows XP (KB2296011)

Security Update for Windows XP (KB2296199)

Security Update for Windows XP (KB2347290)

Security Update for Windows XP (KB2360937)

Security Update for Windows XP (KB2387149)

Security Update for Windows XP (KB2393802)

Security Update for Windows XP (KB2412687)

Security Update for Windows XP (KB2419632)

Security Update for Windows XP (KB2423089)

Security Update for Windows XP (KB2436673)

Security Update for Windows XP (KB2440591)

Security Update for Windows XP (KB2443105)

Security Update for Windows XP (KB2476490)

Security Update for Windows XP (KB2476687)

Security Update for Windows XP (KB2478960)

Security Update for Windows XP (KB2478971)

Security Update for Windows XP (KB2479628)

Security Update for Windows XP (KB2479943)

Security Update for Windows XP (KB2481109)

Security Update for Windows XP (KB2483185)

Security Update for Windows XP (KB2485376)

Security Update for Windows XP (KB2485663)

Security Update for Windows XP (KB2503658)

Security Update for Windows XP (KB2503665)

Security Update for Windows XP (KB2506212)

Security Update for Windows XP (KB2506223)

Security Update for Windows XP (KB2507618)

Security Update for Windows XP (KB2507938)

Security Update for Windows XP (KB2508272)

Security Update for Windows XP (KB2508429)

Security Update for Windows XP (KB2509553)

Security Update for Windows XP (KB2511455)

Security Update for Windows XP (KB2524375)

Security Update for Windows XP (KB2535512)

Security Update for Windows XP (KB2536276-v2)

Security Update for Windows XP (KB2536276)

Security Update for Windows XP (KB2544893-v2)

Security Update for Windows XP (KB2544893)

Security Update for Windows XP (KB2555917)

Security Update for Windows XP (KB2562937)

Security Update for Windows XP (KB2566454)

Security Update for Windows XP (KB2567053)

Security Update for Windows XP (KB2567680)

Security Update for Windows XP (KB2570222)

Security Update for Windows XP (KB2570947)

Security Update for Windows XP (KB2592799)

Security Update for Windows XP (KB923561)

Security Update for Windows XP (KB941569)

Security Update for Windows XP (KB946648)

Security Update for Windows XP (KB950760)

Security Update for Windows XP (KB950762)

Security Update for Windows XP (KB950974)

Security Update for Windows XP (KB951376-v2)

Security Update for Windows XP (KB951748)

Security Update for Windows XP (KB952004)

Security Update for Windows XP (KB952954)

Security Update for Windows XP (KB955069)

Security Update for Windows XP (KB956572)

Security Update for Windows XP (KB956744)

Security Update for Windows XP (KB956802)

Security Update for Windows XP (KB956803)

Security Update for Windows XP (KB956844)

Security Update for Windows XP (KB958644)

Security Update for Windows XP (KB958869)

Security Update for Windows XP (KB959426)

Security Update for Windows XP (KB960225)

Security Update for Windows XP (KB960803)

Security Update for Windows XP (KB960859)

Security Update for Windows XP (KB961501)

Security Update for Windows XP (KB969059)

Security Update for Windows XP (KB970238)

Security Update for Windows XP (KB970430)

Security Update for Windows XP (KB971468)

Security Update for Windows XP (KB971657)

Security Update for Windows XP (KB971961)

Security Update for Windows XP (KB972270)

Security Update for Windows XP (KB973507)

Security Update for Windows XP (KB973869)

Security Update for Windows XP (KB973904)

Security Update for Windows XP (KB974112)

Security Update for Windows XP (KB974318)

Security Update for Windows XP (KB974392)

Security Update for Windows XP (KB974571)

Security Update for Windows XP (KB975025)

Security Update for Windows XP (KB975467)

Security Update for Windows XP (KB975560)

Security Update for Windows XP (KB975561)

Security Update for Windows XP (KB975562)

Security Update for Windows XP (KB975713)

Security Update for Windows XP (KB977816)

Security Update for Windows XP (KB977914)

Security Update for Windows XP (KB978037)

Security Update for Windows XP (KB978338)

Security Update for Windows XP (KB978542)

Security Update for Windows XP (KB978601)

Security Update for Windows XP (KB978706)

Security Update for Windows XP (KB979309)

Security Update for Windows XP (KB979482)

Security Update for Windows XP (KB979559)

Security Update for Windows XP (KB979683)

Security Update for Windows XP (KB979687)

Security Update for Windows XP (KB980195)

Security Update for Windows XP (KB980218)

Security Update for Windows XP (KB980232)

Security Update for Windows XP (KB980436)

Security Update for Windows XP (KB981322)

Security Update for Windows XP (KB981349)

Security Update for Windows XP (KB981852)

Security Update for Windows XP (KB981957)

Security Update for Windows XP (KB981997)

Security Update for Windows XP (KB982132)

Security Update for Windows XP (KB982214)

Security Update for Windows XP (KB982381)

Security Update for Windows XP (KB982665)

Security Update for Windows XP (KB982802)

Segoe UI

Spybot - Search & Destroy

SUPERAntiSpyware

Symantec Endpoint Protection

Update for 2007 Microsoft Office System (KB967642)

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)

Update for Microsoft Office 2007 System (KB2539530)

Update for Microsoft Office OneNote 2007 (KB980729)

Update for Microsoft Office Outlook 2007 (KB2583910)

Update for Microsoft Windows (KB971513)

Update for Outlook 2007 Junk Email Filter (KB2596560)

Update for Windows XP (KB2141007)

Update for Windows XP (KB2345886)

Update for Windows XP (KB2467659)

Update for Windows XP (KB2541763)

Update for Windows XP (KB2607712)

Update for Windows XP (KB2616676)

Update for Windows XP (KB2641690)

Update for Windows XP (KB951978)

Update for Windows XP (KB955759)

Update for Windows XP (KB961503)

Update for Windows XP (KB967715)

Update for Windows XP (KB968389)

Update for Windows XP (KB971029)

Update for Windows XP (KB971737)

Update for Windows XP (KB973687)

Update for Windows XP (KB973815)

VCRedistSetup

WebFldrs XP

Winamp

Winamp Detector Plug-in

Winamp Toolbar

Windows Driver Package - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)

Windows Genuine Advantage Notifications (KB905474)

Windows Genuine Advantage Validation Tool (KB892130)

Windows Imaging Component

Windows Internet Explorer 8

Windows Live Call

Windows Live Communications Platform

Windows Live Essentials

Windows Live Mail

Windows Live Messenger

Windows Live Sign-in Assistant

Windows Live Toolbar

Windows Live Upload Tool

Windows Management Framework Core

Windows Media Format 11 runtime

Windows Media Format SDK Hotfix - KB891122

Windows Media Player 11

Windows XP Service Pack 3

Yahoo! Detect

.

==== Event Viewer Messages From Past Week ========

.

11/25/2011 9:43:09 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK8 eeCtrl Fips IPSec MRxSmb NEOFLTR_650_15215 NetBIOS NetBT nvport NVTCP RasAcd Rdbss SASDIFSV SASKUTIL SPBBCDrv SRTSP SRTSPX SYMTDI Tcpip WS2IFSL

11/25/2011 9:43:09 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

11/25/2011 9:43:09 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.

11/25/2011 9:43:09 PM, error: Service Control Manager [7001] - The Forceware Web Interface service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.

11/25/2011 9:43:09 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.

11/25/2011 9:43:09 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.

11/25/2011 9:42:22 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}

11/25/2011 10:03:53 PM, error: Disk [11] - The driver detected a controller error on \Device\Harddisk1\D.

.

==== End Of File ===========================

LDTate · November 26, 2011

:welcome:

Whether you wish to continue with cleaning or not, you should be aware that you may have been infected by a backdoor trojan. This type of program has the ability to steal passwords and other information from your system. If you are using your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:

Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
Consider what other private information could possibly have been taken from your computer and take appropriate steps
Removing this infection can also disable the ability to connect to the internet.

This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

The infection you have is called ZA (Zero Access)

In most cases when attempting to remove the infection it disables access to the internet.

I would suggest a Repair Install.

http://www.geekstogo.com/forum/topic/138-how-to-repair-windows-xp/

SilentDeath12886 · November 26, 2011

Thanks.

I ran Malwarebytes, Symantec, and Spybot. Once it was cleaned, I rebooted and lost connection to the internet. Ran all 3 programs again and further cleaned my computer. Rebooted and everything appears to run as it should. Google is working along with my connection.

Should it still be on concern? I guess now is a good time as ever to update my OS.

Thanks.

Franklin

LDTate · November 27, 2011

I suggest we do this now

Please do not attach the scan results from Combofx. Use copy/paste.

Vista and Windows 7 users:

1. These tools MUST be run from the executable. (.exe) every time you run them

2. With Admin Rights (Right click, choose "Run as Administrator")

Download ComboFix from one of these locations:

Link 1

Link 2 If using this link, Right Click and select Save As.

* IMPORTANT !!! Save ComboFix.exe to your Desktop

Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. Note: If you are having difficulty properly disabling your protective programs, or are unsure as to what programs need to be disabled, please refer to the information available through this link : Protective Programs
Double click on ComboFix.exe & follow the prompts.
Notes: Combofix will run without the Recovery Console installed. Skip the Recovery Console part if you're running Vista or Windows 7.
Note: If you have XP SP3, use the XP SP2 package.
If Vista or Windows 7, skip the Recovery Console part
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt using Copy / Paste in your next reply.

Notes:

1.Do not mouse-click Combofix's window while it is running. That may cause it to stall.

2. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser.

3. Combofix prevents autorun of ALL CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper.

4. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Give it atleast 20-30 minutes to finish if needed.

Please do not attach the scan results from Combofx. Use copy/paste.

Also please describe how your computer behaves at the moment.

SilentDeath12886 · November 27, 2011

I currently have no issues. Goggle searches run just fine.

Occassionally when I reboot, when everything loads up it will have issues with loading my "profile" on windows and it will not load my settings/folders/background on my desktop. Just a generic desktop. I reboot without issues.

ComboFix 11-11-26.04 - franklin 11/26/2011 23:04:43.1.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1461 [GMT -5:00]

Running from: c:\documents and settings\franklin\Desktop\ComboFix.exe

AV: Symantec Endpoint Protection *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: ActiveArmor Firewall *Enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\franklin\WINDOWS

c:\program files\258.96_desktop_winxp_32bit_english_whql.exe

c:\program files\Internet Explorer\SET1A0.tmp

c:\program files\Internet Explorer\SET1A5.tmp

c:\program files\LP

c:\program files\LP\4B39\11FD.tmp

c:\program files\LP\4B39\12C8.tmp

c:\program files\LP\4B39\145B.tmp

c:\program files\LP\4B39\145D.tmp

c:\program files\LP\4B39\228E.tmp

c:\program files\LP\4B39\228F.tmp

c:\program files\LP\4B39\25.tmp

c:\program files\mbam-setup-1.51.2.1300.exe

c:\windows\$NtUninstallKB59610$

c:\windows\$NtUninstallKB59610$\2735792414

c:\windows\$NtUninstallKB59610$\289995154\@

c:\windows\$NtUninstallKB59610$\289995154\bckfg.tmp

c:\windows\$NtUninstallKB59610$\289995154\cfg.ini

c:\windows\$NtUninstallKB59610$\289995154\Desktop.ini

c:\windows\$NtUninstallKB59610$\289995154\keywords

c:\windows\$NtUninstallKB59610$\289995154\kwrd.dll

c:\windows\$NtUninstallKB59610$\289995154\L\aamzmafa

c:\windows\$NtUninstallKB59610$\289995154\lsflt7.ver

c:\windows\$NtUninstallKB59610$\289995154\U\00000001.@

c:\windows\$NtUninstallKB59610$\289995154\U\00000002.@

c:\windows\$NtUninstallKB59610$\289995154\U\00000004.@

c:\windows\$NtUninstallKB59610$\289995154\U\80000000.@

c:\windows\$NtUninstallKB59610$\289995154\U\80000004.@

c:\windows\$NtUninstallKB59610$\289995154\U\80000032.@

c:\windows\CSC\d6

c:\windows\system32\drivers\npf.sys

c:\windows\system32\Packet.dll

c:\windows\system32\pthreadVC.dll

c:\windows\system32\WanPacket.dll

c:\windows\system32\wpcap.dll

E:\Autorun.inf

.

((((((((((((((((((((((((( Files Created from 2011-10-27 to 2011-11-27 )))))))))))))))))))))))))))))))

.

2011-11-27 04:01 . 2011-11-27 04:01 -------- d-----w- c:\documents and settings\TEMP

2011-11-26 03:38 . 2011-11-26 03:36 607260 ------r- c:\program files\dds.scr

2011-11-26 03:38 . 2011-11-26 03:38 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware

2011-11-26 03:38 . 2011-08-31 22:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys

2011-11-26 03:10 . 2011-11-26 03:10 388096 ----a-r- c:\documents and settings\franklin\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe

2011-11-26 03:10 . 2011-11-26 03:10 -------- d-----w- c:\program files\Trend Micro

2011-11-22 20:06 . 2011-11-26 03:56 -------- d-----w- c:\program files\F8BD8

2011-11-22 20:05 . 2011-11-22 20:05 -------- d-----w- c:\documents and settings\franklin\Application Data\UVrlONtxAuSiFp

2011-11-22 20:05 . 2011-11-22 20:05 -------- d-----w- c:\documents and settings\franklin\Application Data\amH5sWJ7dLgZhCk

2011-11-22 20:05 . 2011-11-26 02:42 -------- d-----w- c:\documents and settings\franklin\Application Data\901F8

2011-11-22 20:05 . 2011-11-22 20:05 -------- d-----w- c:\documents and settings\franklin\Application Data\UZ9hTXwjUeItPy

2011-11-22 20:05 . 2011-11-22 20:05 -------- d-----w- c:\documents and settings\franklin\Application Data\wqjUCelIBz

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2011-11-11 13:25 . 2011-06-18 22:54 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl

2011-10-15 05:41 . 2010-09-16 15:09 14656 ----a-w- c:\windows\gdrv.sys

2011-10-10 14:22 . 2010-09-15 03:22 692736 ----a-w- c:\windows\system32\inetcomm.dll

2011-09-28 07:06 . 2004-08-12 08:18 599040 ----a-w- c:\windows\system32\crypt32.dll

2011-09-26 15:41 . 2008-07-29 23:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll

2011-09-26 15:41 . 2004-08-12 08:25 220160 ----a-w- c:\windows\system32\oleacc.dll

2011-09-26 15:41 . 2004-08-12 08:25 20480 ----a-w- c:\windows\system32\oleaccrc.dll

2011-09-23 19:45 . 2011-09-23 19:45 53248 ----a-r- c:\documents and settings\franklin\Application Data\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2011-09-23 19:44 . 2011-09-23 19:44 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys

2011-09-06 13:20 . 2004-08-12 08:33 1858944 ----a-w- c:\windows\system32\win32k.sys

2011-09-01 16:30 . 2011-03-31 13:51 17480 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys

2011-03-31 13:50 . 2011-03-31 13:50 7130944 ----a-w- c:\program files\HitmanPro35_x64.exe

2011-03-31 13:49 . 2011-03-31 13:49 10779424 ----a-w- c:\program files\SUPERAntiSpyware.exe

2011-03-31 13:48 . 2011-03-31 13:48 7734208 ----a-w- c:\program files\Malwarebytes.exe

2011-03-31 13:46 . 2011-03-31 13:46 388608 ----a-w- c:\program files\HijackThis.exe

2011-03-31 13:45 . 2011-03-31 13:45 1402880 ----a-w- c:\program files\HijackThis.msi

2010-09-16 16:56 . 2010-09-16 16:55 16409960 ----a-w- c:\program files\spybotsd162.exe

2010-09-16 16:45 . 2010-09-16 16:45 7278160 ----a-w- c:\program files\Install_AIM.exe

2010-05-16 16:20 . 2010-09-16 15:58 812344 ----a-w- c:\program files\HJTInstall.exe

2010-01-16 21:08 . 2010-09-16 15:57 948090 ----a-w- c:\program files\free-wma-mp3-converter 2.exe

2009-08-27 02:24 . 2010-09-16 15:57 612214 ----a-w- c:\program files\Remington Shooting.exe

2008-11-10 04:26 . 2010-09-16 15:57 22189968 ----a-w- c:\program files\NVIDIA_PureVideo_Decoder_Retail_1.02-223.exe

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-10-18 455968]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"LogMeIn GUI"="c:\program files\LogMeIn\x86\LogMeInSystray.exe" [2010-01-27 63048]

"RTHDCPL"="RTHDCPL.EXE" [2006-10-30 16269312]

"SkyTel"="SkyTel.EXE" [2006-05-16 2879488]

"WinampAgent"="c:\program files\Winamp\winampa.exe" [2010-07-12 74752]

"NeroFilterCheck"="c:\program files\Common Files\Nero\Lib\NeroCheck.exe" [2007-03-01 153136]

"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2010-07-08 1753192]

"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2010-07-09 13923432]

"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2010-07-09 110696]

"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2010-01-25 115560]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]

"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]

"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-03-30 937920]

"ddoctorv2"="c:\program files\Comcast\Desktop Doctor\bin\sprtcmd.exe" [2008-04-24 202560]

"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-04-08 254696]

"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-06-23 1386776]

.

c:\documents and settings\franklin\Start Menu\Programs\Startup\

Logitech . Product Registration.lnk - c:\program files\Common Files\Logishrd\eReg\SetPoint\eReg.exe [2009-11-16 517384]

.

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Play Wireless USB Adapter Utility.lnk - c:\program files\Belkin\F7D4101\V1\PBN.exe [2009-11-25 110592]

.

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

2009-09-03 22:21 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

2011-06-17 07:3ðÿÿÿ·: ˆ·: t \ ˜ÿÿÿnk ÜQ‰6OUË Hñ2 (º: ÿÿÿÿ €·: ÿÿÿÿ" . r #RearMicInGoldenWave Øÿÿÿvk ¸: r SymbolicLinke s àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 5 e 8 7 7 3 d - 8 f 5 6 - 1 1 d 0 - a 3 b 9 - 0 0 a 0 c 9 2 2 3 1 9 6 } \ R e a r M i c I n G o l d e n W a v e o g ˜ÿÿÿnk ÜQ‰6OUË ¸: ÿÿÿÿÿÿÿÿ »: Ø° ÿÿÿÿ N 5 0 Device Parameters s t e ðÿÿÿlh À¹: dNÄ)Øÿÿÿvk < `º: ? FriendlyNameo g ÀÿÿÿM i c i n a t r e a r p a n e l ( G o l d e n ) øÿÿÿ˜»: àÿÿÿvk N Èº: CLSID \ ¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } 0 . 5 ðÿÿÿ8º: ¨º: \ c ˜ÿÿÿnk ÜQ‰6OUË p‘2 H½: ÿÿÿÿ º: ÿÿÿÿ" l #RearMicInGoldenTopor a Øÿÿÿvk À»: r SymbolicLinkS i àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 9 9 4 a d 0 4 - 9 3 e f - 1 1 d 0 - a 3 c c - 0 0 a 0 c 9 2 2 3 1 9 6 } \ R e a r M i c I n G o l d e n T o p o 8 2 ˜ÿÿÿnk ÜQ‰6OUË 0»: ÿÿÿÿÿÿÿÿ è½: Ø° ÿÿÿÿ N Device ParameterstureØ4 ðÿÿÿlh à¼: dNÄ)Øÿÿÿvk < €½: 5 FriendlyName™B}ÀÿÿÿM i c i n a t r e a r m i x e r ( G o l d e n ) øÿÿÿàÐ: àÿÿÿvk N Ð: : CLSID»: ðÿÿÿX½: È½: H½: ÿÿÿnk nlNpùTË è‰4 ($ ÿÿÿÿ ÿÿÿÿ ÿÿÿÿ ß ServiceModelOperation 3.0.0.0 n ÿÿÿnk •Z`(âÌ ø½: ÿÿÿÿÿÿÿÿ W$ ÿÿÿÿ * ú Performance i c àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 5 e 8 7 7 3 d - 8 f 5 6 - 1 1 d 0 - a 3 b 9 - 0 0 a 0 c 9 2 2 3 1 9 6 } \ R e a r M i c I n P u r p l e W a v e d ðÿÿÿÈÏ: ¸8 uðøÿÿÿHè: hbin À: p Øÿÿÿvk HÀ: »7SymbolicLinkð66àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 9 9 4 a d 0 4 - 9 3 e f - 1 1 d 0 - a 3 c c - 0 0 a 0 c 9 2 2 3 1 9 6 } \ F r o n t M i c I n Y e l l o w T o p o yð˜ÿÿÿnk êx6OUË Xè< ÿÿÿÿÿÿÿÿ ÀÂ: Ø° ÿÿÿÿ N ß4 Device Parametersí4 xiýØÿÿÿvk > øÁ: õFriendlyName·í‡C¸ÿÿÿM i c i n a t f r o n t m i x e r ( Y e l l o w ) 5 ¼\‰”øÿÿÿ8Ã: àÿÿÿvk N hÂ: PxCLSIDÏRx¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } 8 FteèðÿÿÿÐÁ: HÂ: Õâ¼P˜ÿÿÿnk êx6OUË ˜•2 Èï< ÿÿÿÿ @Â: ÿÿÿÿ" 8:8 #FrontMicInYellowTopoø_xØÿÿÿvk `Ã: k–SymbolicLink(,á

àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { d d a 5 4 a 4 0 - 1 e 4 c - 1 1 d 1 - a 0 5 0 - 4 0 5 7 0 5 c 1 0 0 0 0 } \ F r o n t M i c I n Y e l l o w T o p o ÝÙ˜ÿÿÿnk ÜQ‰6OUË ˜•2 pè: ÿÿÿÿ ø¿: ÿÿÿÿ" a s #RearMicInPurpleTopo. d àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { d d a 5 4 a 4 0 - 1 e 4 c - 1 1 d 1 - a 0 5 0 - 4 0 5 7 0 5 c 1 0 0 0 0 } \ R e a r M i c I n P u r p l e T o p o g \ ˜ÿÿÿnk ÜQ‰6OUË €Ä: ÿÿÿÿÿÿÿÿ 0Ç: Ø° ÿÿÿÿ N c r Device Parameters r l i Øÿÿÿvk < ˜Æ: 2 FriendlyName\ s ÀÿÿÿM i c i n a t r e a r m i x e r ( P u r p l e ) ¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } . 0 \ ðÿÿÿpÆ: €è: us5 ˜ÿÿÿnk ÜQ‰6OUË p‘2 ¨Ç: ÿÿÿÿ (â: ÿÿÿÿ" ð¾: #RearMicInPinkWave: Å: ðÿÿÿlh xÎ: dNÄ)ðÿÿÿàÎ: HÏ: Ç: ÿÿÿnk nlNpùTË è‰4 ˜0$ ÿÿÿÿ ÿÿÿÿ ÿÿÿÿ à ServiceModelService 3.0.0.0 s t ÿÿÿnk (âÌ ÈÇ: ÿÿÿÿÿÿÿÿ À O ÿÿÿÿ * ® Performance e r ˜ÿÿÿnk ÜQ‰6OUË p‘2 ¸Ü: ÿÿÿÿ ¨ï: ÿÿÿÿ" ( #RearMicInPinkTopounter èþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 9 9 4 a d 0 4 - 9 3 e f - 1 1 d 0 - a 3 c c - 0 0 a 0 c 9 2 2 3 1 9 6 } \ R e a r M i c I n P i n k T o p o ˜ÿÿÿnk ÜQ‰6OUË ˜È: ÿÿÿÿÿÿÿÿ ÐÜ: Ø° ÿÿÿÿ N 7 3 Device Parameters 6 2 Øÿÿÿvk 8 ¨Ê: 5 FriendlyName6 9 ÀÿÿÿM i c i n a t r e a r m i x e r ( P i n k ) 6 9 àÿÿÿvk N Ë: 2 CLSID 9 ¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } 6 2 ˜ÿÿÿnk ÜQ‰6OUË ˜•2 Í: ÿÿÿÿ ÈÜ: ÿÿÿÿ" 6 3 #RearMicInPinkTopo2 6 9 Øÿÿÿvk ðË: 2 SymbolicLink2 0 èþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { d d a 5 4 a 4 0 - 1 e 4 c - 1 1 d 1 - a 0 5 0 - 4 0 5 7 0 5 c 1 0 0 0 0 } \ R e a r M i c I n P i n k T o p o ðÿÿÿlh ¨³: dNÄ)øÿÿÿXµ: ðÿÿÿ´: x´: ˜.5 øÿÿÿ¸Ý: Øÿÿÿvk `Í: SymbolicLink èþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 9 9 4 a d 0 4 - 9 3 e f - 1 1 d 0 - a 3 c c - 0 0 a 0 c 9 2 2 3 1 9 6 } \ R e a r M i c I n P i n k W a v e ˜ÿÿÿnk ÜQ‰6OUË @Ç: ÿÿÿÿÿÿÿÿ ¸Ç: Ø° ÿÿÿÿ N ( Device ParametersbemAdapØÿÿÿvk 8 Ï: ôFriendlyNamevk ÀÿÿÿM i c i n a t r e a r p a n e l ( P i n k ) Ì: àÿÿÿvk N (Ù: : CLSIDÍ: øÿÿÿèÙ: ¨ÿÿÿnk r¹pþ¼¬Ì è‰4 ÿÿÿÿÿÿÿÿ °Ÿ ÿÿÿÿ

á Sfloppy Øÿÿÿvk < xæ: FriendlyNamep ðÿÿÿlh 0Þ: Î35æhbin Ð: p ¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } g h t ˜ÿÿÿnk ÜQ‰6OUË ˜•2 Ò: ÿÿÿÿ À½: ÿÿÿÿ" r a #RearMicInGoldenTopoo s Øÿÿÿvk Ñ: i SymbolicLink0 . àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { d d a 5 4 a 4 0 - 1 e 4 c - 1 1 d 1 - a 0 5 0 - 4 0 5 7 0 5 c 1 0 0 0 0 } \ R e a r M i c I n G o l d e n T o p o t ˜ÿÿÿnk ÜQ‰6OUË xÐ: ÿÿÿÿÿÿÿÿ ˆÓ: Ø° ÿÿÿÿ N r e Device Parameters \ ðÿÿÿlh (Ò: dNÄ)Øÿÿÿvk < ÈÒ: \ FriendlyNameo f ÀÿÿÿM i c i n a t r e a r m i x e r ( G o l d e n ) øÿÿÿ Ô: àÿÿÿvk N 0Ó: : CLSID o ¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } 4 . 0 ðÿÿÿ Ò: Ó: s t ˜ÿÿÿnk 6´‹6OUË p‘2 °Õ: ÿÿÿÿ Ó: ÿÿÿÿ" e s #RearMicInSilverWavei l Øÿÿÿvk (Ô: 0 SymbolicLink. 0 àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 9 9 4 a d 0 4 - 9 3 e f - 1 1 d 0 - a 3 c c - 0 0 a 0 c 9 2 2 3 1 9 6 } \ R e a r M i c I n S i l v e r W a v e \ 4 ˜ÿÿÿnk 6´‹6OUË ˜Ó: ÿÿÿÿÿÿÿÿ ¨Ö: Ø° ÿÿÿÿ N Device Parameters r a m ðÿÿÿlh HÕ: dNÄ)Øÿÿÿvk < èÕ: l FriendlyNameh t ÀÿÿÿM i c i n a t r e a r p a n e l ( S i l v e r ) øÿÿÿ ×: àÿÿÿvk N PÖ: e CLSID i ¨ÿÿÿ{ 1 7 C C A 7 1 B - E C D 7 - 1 1 D 0 - B 9 0 8 - 0 0 A 0 C 9 2 2 3 1 9 6 } . r e ðÿÿÿÀÕ: 0Ö: s . ˜ÿÿÿnk 6´‹6OUË Hñ2 hØ: ÿÿÿÿ (Ö: ÿÿÿÿ" S i #RearMicInSilverWave0 . Øÿÿÿvk H×: SymbolicLink\ P àþÿÿ\ \ ? \ H D A U D I O # F U N C _ 0 1 & V E N _ 1 0 E C & D E V _ 0 8 8 8 & S U B S Y S _ 1 4 5 8 E 6 0 1 & R E V _ 1 0 0 0 # 4 & 2 A B 7 D 8 E 1 & 0 & 0 0 0 1 # { 6 5 e 8 7 7 3 d ion\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\program files\Java\jre6\bin\jqs.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe

c:\program files\Common Files\LightScribe\LSSrvc.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe

c:\windows\system32\PnkBstrA.exe

c:\windows\system32\PnkBstrB.exe

c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe

c:\program files\Comcast\Desktop Doctor\bin\sprtsvc.exe

c:\program files\Symantec\Symantec Endpoint Protection\Rtvscan.exe

c:\program files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exe

c:\program files\Symantec\Symantec Endpoint Protection\SmcGui.exe

c:\windows\system32\msiexec.exe

c:\windows\RTHDCPL.EXE

c:\windows\system32\RUNDLL32.EXE

c:\program files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE

.

**************************************************************************

.

Completion time: 2011-11-26 23:25:24 - machine was rebooted

ComboFix-quarantined-files.txt 2011-11-27 04:25

.

Pre-Run: 685,213,761,536 bytes free

Post-Run: 685,719,101,440 bytes free

.

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

UnsupportedDebug="do not select this" /debug

multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer

[spybotsd]

timeout.old=0

.

- - End Of File - - 84D6C275068F03C24419F79E0D8ECFC5

LDTate · November 27, 2011

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

That Logitech_Bluetooth device looks pretty messed up.

If you have such a device you might need to re-install it.

Copy/paste the text in the Codebox below into notepad:

Here's how to do that:

Click Start > Run type Notepad click OK.

This will open an empty notepad file:

Take your mouse, and place your cursor at the beginning of the text in the box below, then click and hold the left mouse button, while pulling your mouse over the text. This should highlight the text. Now release the left mouse button. Now, with the cursor over the highlighted text, right click the mouse for options, and select 'copy'. Now over the empty Notepad box, right click your mouse again, and select 'paste' and you will have copied and pasted the text.

KillAll::

Folder::
c:\program files\F8BD8
c:\documents and settings\franklin\Application Data\UVrlONtxAuSiFp
c:\documents and settings\franklin\Application Data\amH5sWJ7dLgZhCk
c:\documents and settings\franklin\Application Data\901F8
c:\documents and settings\franklin\Application Data\UZ9hTXwjUeItPy
c:\documents and settings\franklin\Application Data\wqjUCelIBz

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]

Save this file to your desktop, Save this as "CFScript"

Here's how to do that:

1.Click File;

2.Click Save As... Change the directory to your desktop;

3.Change the Save as type to "All Files";

4.Type in the file name: CFScript

5.Click Save ...

Drag CFScript.txt into ComboFix.exe

Then post the results log using Copy / Paste

Also please describe how your computer behaves at the moment.

SilentDeath12886 · November 28, 2011

It appears to be functioning as it should.

ComboFix 11-11-26.04 - franklin 11/27/2011 21:58:51.2.2 - x86

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1073 [GMT -5:00]

Running from: c:\documents and settings\franklin\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\franklin\Desktop\CFScript.txt

AV: Symantec Endpoint Protection *Disabled/Updated* {FB06448E-52B8-493A-90F3-E43226D3305C}

FW: ActiveArmor Firewall *Enabled* {EDC10449-64D1-46c7-A59A-EC20D662F26D}

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\franklin\Application Data\901F8

c:\documents and settings\franklin\Application Data\901F8\8BD8.01F

c:\documents and settings\franklin\Application Data\amH5sWJ7dLgZhCk

c:\documents and settings\franklin\Application Data\UVrlONtxAuSiFp

c:\documents and settings\franklin\Application Data\UVrlONtxAuSiFp\AV Protection 2011.ico

c:\documents and settings\franklin\Application Data\UZ9hTXwjUeItPy

c:\documents and settings\franklin\Application Data\wqjUCelIBz

c:\program files\F8BD8

.

((((((((((((((((((((((((( Files Created from 2011-10-28 to 2011-11-28 )))))))))))))))))))))))))))))))

.

2011-11-28 03:08 . 2011-11-28 03:08 -------- d-----w- C:\found.000

2011-11-27 05:05 . 2011-09-05 09:25 85064 ----a-w- c:\windows\system32\drivers\NEOFLTR_710_19235.SYS

2011-11-27 05:05 . 2011-11-27 05:05 -------- d-----w- c:\windows\LastGood.Tmp