google redirect (coollook9?) and lack of access to gmail

TrueBlueMajority · May 24, 2010

I hope you guys can help. I know very little about software but am very good at following directions.

For the last several weeks I have had a worsening google redirect problem. it used to happen only occasionally, now it is all the time. i used to be able to get around it by typing directly in the url bar but now it is redirecting from there also.

I have avira and mbam and SAS and those scans are coming up clean.

today i used spybot for the first time and it found a few more infections but did not fix the problems.

i am desperate now because I have not been able to get into gmail all day. a screen comes up telling me that google.com is not a trusted site!

on another malware help site i saw something about coollook9 and I have seen that word appear in the address of some of the redirect files.

i came back here because mbam helped me when I had the fake windows security XP pop ups. i think you guys know what you are doing and i hope you will be patient with an old fogy who used to be a computer whiz but hasn't done any programming since the 1970s!

i can't afford to buy a new computer right now, and even if I did, I don't know how I got this so I don't know how to keep from getting this again. I don't go on P2P or pron sites and only visit a few well traveled sites every day.

I tried to follow the instructions in the pinned topic but I get an error message when I try to run Defogger and the GMER rootkit scanner: "not a valid Win32 application."

many thanks for anything you can do.

peace be with you,

TBM

Elise · May 25, 2010

Hello ,

And My name is Elise and I'll be glad to help you with your computer problems.

I will be working on your malware issues, this may or may not solve other issues you may have with your machine.

Please note that whatever repairs we make, are for fixing your computer problems only and by no means should be used on another computer.

The cleaning process is not instant. Logs can take some time to research, so please be patient with me. I know that you need your computer working as quickly as possible, and I will work hard to help see that happen.
Please reply using the Add/Reply button in the lower right hand corner of your screen. Do not start a new topic.
The logs that you post should be pasted directly into the reply. Only attach them if requested or if they do not fit into the post.
Unfortunately, if I do not hear back from you within 5 days, I will be forced to close your topic. If you still need help after I have closed your topic, send me or a moderator a personal message with the address of the thread or feel free to create a new one.

You may want to keep the link to this topic in your favorites. Alternatively, you can click the button at the top bar of this topic and Track this Topic, where you can choose email notifications.

-----------------------------------------------------------

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

If you have already posted a log, please do so again, as your situation may have changed.

Use the 'Add Reply' and add the new log to this thread.

We need to see some information about what is happening in your machine. Please perform the following scan:

Please download OTL from one of the following mirrors:
- This is THE Mirror
[*]Save it to your desktop.
[*]Double click on the icon on your desktop.
[*]Click the "Scan All Users" checkbox.
[*]Push the button.
[*]Two reports will open, copy and paste them in a reply here:
- OTListIt.txt <-- Will be opened
- Extra.txt <-- Will be minimized

Please download GMER from one of the following locations and save it to your desktop:

Main Mirror
This version will download a randomly named file (Recommended)
Zipped Mirror
This version will download a zip file you will need to extract first. If you use this mirror, please extract the zip file to your desktop.

Disconnect from the Internet and close all running programs.
Temporarily disable any real-time active protection so your security programs will not conflict with gmer's driver.
Double-click on the randomly named GMER file (i.e. n7gmo46c.exe) and allow the gmer.sys driver to load if asked.
Note: If you downloaded the zipped version, extract the file to its own folder such as C:\gmer and then double-click on gmer.exe.
GMER will open to the Rootkit/Malware tab and perform an automatic quick scan when first run. (do not use the computer while the scan is in progress)
If you receive a WARNING!!! about rootkit activity and are asked to fully scan your system...click NO.
Now click the Scan button. If you see a rootkit warning window, click OK.
When the scan is finished, click the Save... button to save the scan results to your Desktop. Save the file as gmer.log.
Click the Copy button and paste the results into your next reply.
Exit GMER and re-enable all active protection when done.

-- If you encounter any problems, try running GMER in Safe Mode.

-------------------------------------------------------------

In the meantime please, do NOT install any new programs or update anything unless told to do so while we are fixing your problem

If you still need help, please include the following in your next reply

A detailed description of your problems
A new OTL log (don't forget extra.txt)
GMER log

TrueBlueMajority · May 25, 2010

I guess I'm screwed, then. I cannot run GMER or OTL--I get an error box that says "not a valid win32 application".

I'm going to my office now so I can read my email. Not having email or research ability at home is going to be a real problem.

Thanks for trying to help.

TBM

P.S. Just so the record is complete, in addition to the google redirect and lack of access to gmail I am also getting random tab pop ups as others are reporting.

Elise · May 25, 2010

Hello there, we can use an alternative tool to get around this issue

Please download OTLPE (filesize 120,9 MB)

When downloaded double click on OTLPENet.exe and make sure there is a blank CD in your CD drive. This will automatically create a bootable CD.
Reboot your system using the boot CD you just created.
Note : If you do not know how to set your computer to boot from CD follow the steps here
Your system should now display a REATOGO-X-PE desktop.
Depending on your type of internet connection, you should be able to get online as well so you can access this topic more easily.
Double-click on the OTLPE icon.
Ensure the box "Automatically Load All Remaining Users" is checked and press OK
OTL should now start.
Press Run Scan to start the scan.
When finished, the file will be saved in drive C:\OTL.txt
Copy this file to your USB drive if you do not have internet connection on this system
Please post the contents of the OTL.txt file in your reply.

TrueBlueMajority · May 27, 2010

sorry. nothing is working. i cannot even get OTLPE to download. all i get is a file 0 bytes in size.

i click on the icon and it will not run or open (i still get the win32 error).

i looked for another mirror but coollook9 sent me someplace else. apparently they know about these fixes?

do you think it would help if I went to one of those "my clean PC" places and let them try to fix it remotely? i can't afford it right now but I get paid next week.

someone at work also said he thought Norton 360 could fix "anything", but I don't have that much faith in Norton.

i lost a computer to persistent malware four years ago and thought it would never happen again...

this is sad. i know there are a lot of very smart people working on this and someday there will be an answer, but right now i am completely discouraged.

thanks for trying.

TBM

TrueBlueMajority · May 27, 2010

I have MBAM and SAS and Avira logs. Do you think posting them would help? Probably not, since they are all coming back clean. TBM

Elise · May 27, 2010

Hello, don't worry, usually we are able to fix things nicely :welcome:

do you think it would help if I went to one of those "my clean PC" places and let them try to fix it remotely? i can't afford it right now but I get paid next week.

I would not recommend it. At best they do the same as we do here for free, at worst they will not be able to fix it and you have to pay anyway.

From what I have read this appears to be a download problem. The downloads do not complete on your computer and thats why you get the error message. Can you try to download the tools on a USB drive or CD and transfer them to your computer?

The most handy thing would be if you could create the OTLPE disk on another computer (maybe you can use a friend/family members computer). This disk will allow us to access your computer in such a way that we will not be hindered by any active malware and makes it easier to clean.

I would not recommend to pay for Norton 360. There are freeware Antivirus application that are just as good or even better. Anyway, they will not help you at the moment, so lets leave that until you are cleaned up

TrueBlueMajority · May 28, 2010

I have a piece of news and I don't know if it is good or bad.

I tricked the computer into letting me download GMER. I saw on another site that they recommend downloading GMER in IE, so I opened IE and was able to download and extract a zipped version of GMER before the malware could stop me!

I was SO EXCITED about that!

But the GMER full scan came back clean!!! "GMER has not found any system modification" and a completely blank log!

The quickscan did find something though. Here is the log:

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit quick scan 2010-05-27 22:22:17

Windows 5.1.2600 Service Pack 3

Running: gmer.exe; Driver: C:\DOCUME~1\LKS\LOCALS~1\Temp\kfpyqfod.sys

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs SiWinAcc.sys (Windows Accelerator Driver/Silicon Image, Inc.)

AttachedDevice \FileSystem\Ntfs \Ntfs mozy.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)

---- EOF - GMER 1.0.15 ----

Still working on trying to download OTL/OTLPE, and I like your idea of going to an uninfected computer and creating a CD. I will try that at my work computer tomorrow.

Thanks also for your recommendation about Norton 360 and mycleanPC. I'll stick with you guys!

I deeply appreciate your hanging in there with me.

Peace,

TBM

Elise · May 28, 2010

Hi TBM, lets focus on OTLPE for now, that seems the most simple solution. We can use that to get your computer in decent shape again after which we will continue from Normal mode.

I will wait for your OTLPE log. If you have any problem, just let me know, thats what I am here for :welcome:

TrueBlueMajority · May 28, 2010

OK, I have some progress. Using a work computer I was able to download OTL onto a CD and then move it onto my desktop and I got it to run.

However, it only provided me with one log. I did not see anything called extra.txt anywhere.

Here is the one log:

OTL logfile created on: 5/28/2010 5:27:08 PM - Run 3

OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\LKS\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.00 Mb Total Physical Memory | 377.00 Mb Available Physical Memory | 39.00% Memory free

2.00 Gb Paging File | 2.00 Gb Available in Paging File | 72.00% Paging File free

Paging file location(s): C:\pagefile.sys 1440 2880 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 232.88 Gb Total Space | 217.59 Gb Free Space | 93.43% Space Free | Partition Type: NTFS

D: Drive not present or media not loaded

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded

Computer Name: YOUR-82AA59282B

Current User Name: LKS

Logged in as Administrator.

Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard

========== Processes (SafeList) ==========

PRC - [2010/05/28 14:13:36 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LKS\Desktop\OTL.com

PRC - [2010/02/19 10:37:28 | 002,012,912 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE

PRC - [2010/01/04 12:36:28 | 002,893,624 | ---- | M] (Mozy, Inc.) -- C:\Program Files\MozyHome\mozystat.exe

PRC - [2009/10/30 12:18:16 | 000,359,624 | ---- | M] (PC Tools) -- C:\Program Files\Spyware Doctor\pctsAuxs.exe

PRC - [2009/10/08 13:13:52 | 000,818,288 | ---- | M] (The Weather Channel Interactive, Inc.) -- C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe

PRC - [2009/07/21 13:34:33 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2009/07/05 22:44:04 | 000,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe

PRC - [2009/05/13 15:48:22 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2009/03/05 16:07:20 | 002,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

PRC - [2009/03/02 12:08:47 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2008/04/24 13:25:22 | 000,202,560 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe

PRC - [2008/04/13 20:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006/08/04 20:37:12 | 000,036,864 | ---- | M] (Logitech) -- C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

PRC - [2005/06/02 15:28:19 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE

PRC - [2004/06/03 04:51:27 | 000,172,032 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft IntelliType Pro\type32.exe

PRC - [2004/05/12 22:32:38 | 000,045,056 | ---- | M] ( ) -- C:\WINDOWS\system32\slserv.exe

PRC - [2003/11/14 09:50:00 | 000,037,888 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE

========== Modules (SafeList) ==========

MOD - [2010/05/28 14:13:36 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\LKS\Desktop\OTL.com

MOD - [2008/04/13 20:12:01 | 000,413,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcp60.dll

MOD - [2008/04/13 20:10:20 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx

MOD - [2006/08/04 18:39:17 | 000,024,613 | ---- | M] (BackWeb) -- C:\Documents and Settings\LKS\Local Settings\Temp\IadHide5.dll

MOD - [2003/11/14 09:50:00 | 000,024,064 | ---- | M] (Logitech Inc.) -- C:\Program Files\Common Files\Logitech\Scrolling\LGMSGHK.DLL

MOD - [2003/11/14 09:50:00 | 000,006,144 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\MouseWare\system\LgWndHk.dll

========== Win32 Services (SafeList) ==========

SRV - [2009/10/30 12:18:16 | 000,359,624 | ---- | M] (PC Tools) [Auto | Running] -- C:\Program Files\Spyware Doctor\pctsAuxs.exe -- (sdAuxService)

SRV - [2009/07/21 13:34:33 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009/05/13 15:48:22 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2008/04/24 13:26:18 | 000,202,560 | ---- | M] (SupportSoft, Inc.) [Auto | Stopped] -- C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe -- (sprtsvc_ddoctorv2) SupportSoft Sprocket Service (ddoctorv2)

SRV - [2004/05/12 22:32:38 | 000,045,056 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\slserv.exe -- (SLService)

========== Driver Services (SafeList) ==========

DRV - [2010/03/20 23:49:33 | 000,056,816 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2010/02/19 10:37:28 | 000,066,632 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)

DRV - [2010/02/19 10:37:28 | 000,012,872 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)

DRV - [2010/02/19 10:37:28 | 000,012,872 | ---- | M] ( SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | On_Demand | Running] -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM)

DRV - [2009/11/09 12:20:12 | 000,207,792 | ---- | M] (PC Tools) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore)

DRV - [2009/05/11 09:12:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009/03/30 09:33:07 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avipbb.sys -- (avipbb)

DRV - [2009/02/13 11:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)

DRV - [2005/09/22 08:06:01 | 000,069,504 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Rtlnic51.sys -- (RTL8023)

DRV - [2005/06/02 15:28:16 | 002,319,680 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)

DRV - [2005/03/09 19:53:00 | 000,036,352 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)

DRV - [2005/02/22 22:36:04 | 000,986,624 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)

DRV - [2004/08/27 04:18:50 | 000,097,920 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SI3112r.sys -- (SI3112r)

DRV - [2004/05/20 05:35:16 | 000,010,240 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\SiWinAcc.sys -- (SiFilter)

DRV - [2004/05/12 21:41:32 | 000,652,360 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slntamr.sys -- (Slntamr)

DRV - [2004/05/12 21:38:02 | 000,014,408 | ---- | M] ( ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\RecAgent.sys -- (RecAgent)

DRV - [2004/05/12 21:35:08 | 000,231,224 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mtlmnt5.sys -- (Mtlmnt5)

DRV - [2004/05/12 21:29:50 | 000,100,384 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\slnthal.sys -- (SlNtHal)

DRV - [2004/05/12 21:28:06 | 001,395,296 | ---- | M] ( ) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mtlstrm.sys -- (Mtlstrm)

DRV - [2004/05/12 21:21:18 | 000,013,232 | ---- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\slwdmsup.sys -- (SlWdmSup)

DRV - [2004/04/13 23:14:12 | 000,070,144 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp)

DRV - [2003/11/07 05:50:00 | 000,070,798 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFlt2.Sys -- (LMouFlt2)

DRV - [2003/11/07 05:50:00 | 000,051,486 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\L8042pr2.Sys -- (L8042pr2)

DRV - [2003/11/07 05:50:00 | 000,037,884 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidUsb.sys -- (LHidUsb)

DRV - [2003/11/07 05:50:00 | 000,025,502 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFlt2.Sys -- (LHidFlt2)

DRV - [2001/08/17 17:57:38 | 000,016,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\MODEMCSA.sys -- (MODEMCSA)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=135963"

FF - prefs.js..browser.search.selectedEngine: "Yahoo"

FF - prefs.js..browser.search.useDBForOrder: true

FF - prefs.js..browser.startup.homepage: "http://www.dailykos.com"

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/07/05 22:44:24 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010/05/18 17:52:27 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010/05/03 14:54:11 | 000,000,000 | ---D | M]

[2008/08/26 08:05:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LKS\Application Data\Mozilla\Extensions

[2010/05/28 16:21:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\extensions

[2009/09/04 12:32:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}

[2006/07/15 19:28:30 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\extensions\{9A2DA8C0-A778-4438-A892-D5CCEFC7BB85}

[2008/06/23 21:58:47 | 000,001,712 | ---- | M] () -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\searchplugins\ask.xml

[2008/06/02 18:52:31 | 000,001,340 | ---- | M] () -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\searchplugins\bbcnews.xml

[2008/06/23 21:58:47 | 000,001,712 | ---- | M] () -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\searchplugins\jeeves.xml

[2010/05/27 09:31:18 | 000,001,835 | ---- | M] () -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\searchplugins\weather.xml

[2008/06/23 21:58:47 | 000,000,681 | ---- | M] () -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\searchplugins\webster.xml

[2008/06/23 21:58:48 | 000,001,108 | ---- | M] () -- C:\Documents and Settings\LKS\Application Data\Mozilla\Firefox\Profiles\5idik255.default\searchplugins\wikipedia.xml

[2010/05/28 16:21:35 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010/05/03 14:54:12 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}

[2010/05/03 14:53:54 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

[2005/12/05 23:31:00 | 000,114,688 | ---- | M] () -- C:\Program Files\Mozilla Firefox\plugins\npmozax.dll

[2003/11/18 13:37:32 | 000,241,664 | ---- | M] (Musicnotes, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npmusicn.dll

O1 HOSTS File: ([2010/05/24 14:11:13 | 000,396,583 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O1 - Hosts: 89.149.225.59 www.google.com

O1 - Hosts: 89.149.225.59 www.google.de

O1 - Hosts: 89.149.225.59 www.google.fr

O1 - Hosts: 89.149.225.59 www.google.co.uk

O1 - Hosts: 89.149.225.59 www.google.com.br

O1 - Hosts: 89.149.225.59 www.google.it

O1 - Hosts: 89.149.225.59 www.google.es

O1 - Hosts: 89.149.225.59 www.google.co.jp

O1 - Hosts: 89.149.225.59 www.google.com.mx

O1 - Hosts: 89.149.225.59 www.google.ca

O1 - Hosts: 89.149.225.59 www.google.com.au

O1 - Hosts: 89.149.225.59 www.google.nl

O1 - Hosts: 89.149.225.59 www.google.co.za

O1 - Hosts: 89.149.225.59 www.google.be

O1 - Hosts: 89.149.225.59 www.google.gr

O1 - Hosts: 89.149.225.59 www.google.at

O1 - Hosts: 89.149.225.59 www.google.se

O1 - Hosts: 89.149.225.59 www.google.ch

O1 - Hosts: 89.149.225.59 www.google.pt

O1 - Hosts: 89.149.225.59 www.google.dk

O1 - Hosts: 89.149.225.59 www.google.fi

O1 - Hosts: 89.149.225.59 www.google.ie

O1 - Hosts: 89.149.225.59 www.google.no

O1 - Hosts: 89.149.225.59 www.google.ru

O1 - Hosts: 13696 more lines...

O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)

O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)

O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O2 - BHO: (no name) - {ec4944ed-250f-4301-a9e1-5f06c38e8ed7} - File not found

O3 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\..\Toolbar\ShellBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\..\Toolbar\ShellBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - No CLSID value found.

O3 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\..\Toolbar\WebBrowser: (no name) - {0B53EAC3-8D69-4B9E-9B19-A37C9A5676A7} - No CLSID value found.

O3 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\..\Toolbar\WebBrowser: (no name) - {C4069E3A-68F1-403E-B40E-20066696354B} - No CLSID value found.

O3 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\..\Toolbar\WebBrowser: (no name) - {C7768536-96F8-4001-B1A2-90EE21279187} - No CLSID value found.

O4 - HKLM..\Run: [] File not found

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [Cleanup] Reg Error: Invalid data type. File not found

O4 - HKLM..\Run: [ddoctorv2] C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe (SupportSoft, Inc.)

O4 - HKLM..\Run: [Logitech Utility] C:\WINDOWS\LOGI_MWX.EXE (Logitech Inc.)

O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)

O4 - HKLM..\Run: [soundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)

O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)

O4 - HKLM..\Run: [type32] C:\Program Files\Microsoft IntelliType Pro\type32.exe (Microsoft Corporation)

O4 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005..\Run: [DW6] C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe (The Weather Channel Interactive, Inc.)

O4 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe (Logitech)

O4 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Nero\data\Xtras\mssysmgr.exe File not found

O4 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)

O4 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE (SUPERAntiSpyware.com)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe (Logitech)

O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\MozyHome Status.lnk = C:\Program Files\MozyHome\mozystat.exe (Mozy, Inc.)

O4 - Startup: C:\Documents and Settings\guest 1\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe File not found

O4 - Startup: C:\Documents and Settings\LKS\Start Menu\Programs\Startup\OpenOffice.org 2.0.lnk = C:\Program Files\OpenOffice.org 2.0\program\quickstart.exe File not found

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)

O15 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\..Trusted Domains: dailykos.com ([www] * in Trusted sites)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_16)

O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-...indows-i586.cab (Java Plug-in 1.6.0_20)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/get/flash...ent/swflash.cab (Shockwave Flash Object)

O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 68.87.71.230 68.87.73.246

O18 - Protocol\Handler\bw+0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw+0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw-0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw00 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw00s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw-0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw10 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw10s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw20 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw20s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw30 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw30s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw40 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw40s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw50 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw50s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw60 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw60s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw70 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw70s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw80 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw80s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw90 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bw90s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwa0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwa0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwb0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwb0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwc0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwc0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwd0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwd0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwe0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwe0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwf0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwf0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwfile-8876480 {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwg0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwg0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwh0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwh0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwi0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwi0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwj0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwj0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwk0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwk0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwl0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwl0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwm0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwm0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwn0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwn0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwo0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwo0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwp0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwp0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwq0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwq0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwr0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwr0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bws0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bws0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwt0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwt0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwu0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwu0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwv0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwv0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bww0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bww0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwx0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwx0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwy0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwy0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwz0 {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\bwz0s {8f7c56a9-2af9-48c7-9564-69bbba330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O18 - Protocol\Handler\offline-8876480 {8F7C56A9-2AF9-48C7-9564-69BBBA330359} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll (Logitech)

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll (SUPERAntiSpyware.com)

O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)

O20 - Winlogon\Notify\puinsd: DllName - puinsd.dll - C:\WINDOWS\System32\puinsd.dll ()

O21 - SSODL: fakoremog - {0d194558-5aea-471e-9b36-128b755165e0} - C:\WINDOWS\System32\tenedefi.dll File not found

O21 - SSODL: junusuyuw - {573e2d8a-72ae-49da-87bc-d979d1c1705b} - C:\WINDOWS\System32\tilufewa.dll File not found

O21 - SSODL: nujodufup - {c4ec402d-d731-4246-a420-ba45349f4e90} - C:\WINDOWS\System32\kihipapo.dll File not found

O22 - SharedTaskScheduler: {0d194558-5aea-471e-9b36-128b755165e0} - tokatiluy - C:\WINDOWS\System32\tenedefi.dll File not found

O22 - SharedTaskScheduler: {573e2d8a-72ae-49da-87bc-d979d1c1705b} - kupuhivus - C:\WINDOWS\System32\tilufewa.dll File not found

O22 - SharedTaskScheduler: {c4ec402d-d731-4246-a420-ba45349f4e90} - kupuhivus - C:\WINDOWS\System32\kihipapo.dll File not found

O24 - Desktop WallPaper: C:\Documents and Settings\LKS\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\LKS\Local Settings\Application Data\Microsoft\Wallpaper1.bmp

O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2006/02/08 17:16:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) - File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = secfile] -- Reg Error: Value error. File not found

O37 - HKU\.DEFAULT\...exe [@ = secfile] -- "C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe" /START "%1" %* File not found

O37 - HKU\S-1-5-18\...exe [@ = secfile] -- "C:\Documents and Settings\NetworkService\Local Settings\Application Data\ave.exe" /START "%1" %* File not found

O37 - HKU\S-1-5-21-3701653516-458291496-3615524280-1005\...exe [@ = exefile] -- Reg Error: Key error. File not found

========== Files/Folders - Created Within 30 Days ==========

[2010/05/28 17:26:12 | 126,850,486 | ---- | C] (Igor Pavlov) -- C:\DOCUME~1\LKS\Desktop\OTLPENet.exe

[2010/05/28 17:26:09 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\DOCUME~1\LKS\Desktop\OTL.com

[2010/05/28 17:25:39 | 126,850,486 | ---- | C] (Igor Pavlov) -- C:\DOCUME~1\LKS\My Documents\OTLPENet.exe

[2010/05/28 17:25:29 | 000,571,904 | ---- | C] (OldTimer Tools) -- C:\DOCUME~1\LKS\My Documents\OTL.com

[2010/05/27 22:08:15 | 000,000,000 | ---D | C] -- C:\DOCUME~1\LKS\Desktop\gmer

[2010/05/26 14:20:44 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2010/05/24 15:55:07 | 000,000,000 | ---D | C] -- C:\DOCUME~1\LKS\My Documents\tdsskiller

[2010/05/24 12:57:46 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy

[2010/05/24 12:57:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

[2010/05/24 12:55:19 | 016,409,960 | ---- | C] (Safer Networking Limited ) -- C:\DOCUME~1\LKS\My Documents\spybotsd162.exe

[2010/05/17 19:47:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LKS\Local Settings\Application Data\SUPERSystemInspector

[2010/05/17 19:46:58 | 000,913,544 | ---- | C] (SUPERAdBlocker.com) -- C:\DOCUME~1\LKS\My Documents\CSR00049181-1274139088.exe

[2010/05/03 14:54:45 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java

[2010/05/03 14:54:10 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010/05/03 14:54:10 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010/05/03 14:54:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010/05/03 14:54:10 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2006/02/14 12:57:25 | 000,014,992 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\winddx.sys

[2006/02/08 15:59:49 | 000,013,232 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slwdmsup.sys

[2006/02/08 15:59:48 | 001,395,296 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlstrm.sys

[2006/02/08 15:59:48 | 000,652,360 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slntamr.sys

[2006/02/08 15:59:48 | 000,231,224 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys

[2006/02/08 15:59:48 | 000,100,384 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\slnthal.sys

[2006/02/08 15:59:48 | 000,014,408 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\RecAgent.sys

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010/05/28 17:19:09 | 000,002,855 | ---- | M] () -- C:\DOCUME~1\LKS\Desktop\Shortcut to OTL.com.pif

[2010/05/28 17:17:00 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2010/05/28 17:16:10 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT

[2010/05/28 17:16:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2010/05/28 17:16:03 | 1005,113,344 | -HS- | M] () -- C:\hiberfil.sys

[2010/05/28 17:07:00 | 007,864,320 | -H-- | M] () -- C:\Documents and Settings\LKS\NTUSER.DAT

[2010/05/28 17:07:00 | 000,000,178 | -HS- | M] () -- C:\Documents and Settings\LKS\ntuser.ini

[2010/05/28 17:06:45 | 003,760,516 | -H-- | M] () -- C:\Documents and Settings\LKS\Local Settings\Application Data\IconCache.db

[2010/05/28 16:13:30 | 000,004,340 | ---- | M] () -- C:\WINDOWS\mozy.blk

[2010/05/28 16:13:29 | 000,004,082 | ---- | M] () -- C:\WINDOWS\mozy.flt

[2010/05/28 14:30:51 | 126,850,486 | ---- | M] (Igor Pavlov) -- C:\DOCUME~1\LKS\My Documents\OTLPENet.exe

[2010/05/28 14:30:51 | 126,850,486 | ---- | M] (Igor Pavlov) -- C:\DOCUME~1\LKS\Desktop\OTLPENet.exe

[2010/05/28 14:13:36 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\DOCUME~1\LKS\My Documents\OTL.com

[2010/05/28 14:13:36 | 000,571,904 | ---- | M] (OldTimer Tools) -- C:\DOCUME~1\LKS\Desktop\OTL.com

[2010/05/27 22:07:43 | 000,284,915 | ---- | M] () -- C:\DOCUME~1\LKS\Desktop\gmer.zip

[2010/05/26 19:32:03 | 000,000,293 | ---- | M] () -- C:\WINDOWS\system.ini

[2010/05/24 23:00:19 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2010/05/24 17:36:02 | 000,000,000 | ---- | M] () -- C:\DOCUME~1\LKS\My Documents\GooredFix.exe

[2010/05/24 15:52:13 | 000,949,152 | ---- | M] () -- C:\DOCUME~1\LKS\My Documents\tdsskiller.zip

[2010/05/24 14:11:13 | 000,396,583 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts

[2010/05/24 12:57:53 | 000,000,933 | ---- | M] () -- C:\DOCUME~1\LKS\Desktop\Spybot - Search & Destroy.lnk

[2010/05/24 12:55:17 | 016,409,960 | ---- | M] (Safer Networking Limited ) -- C:\DOCUME~1\LKS\My Documents\spybotsd162.exe

[2010/05/24 09:16:01 | 000,096,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\atapi.sys

[2010/05/24 07:46:45 | 000,022,528 | ---- | M] () -- C:\WINDOWS\System32\puinsd.dll

[2010/05/24 07:46:45 | 000,002,025 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts.20100524-141113.backup

[2010/05/17 19:46:30 | 000,913,544 | ---- | M] (SUPERAdBlocker.com) -- C:\DOCUME~1\LKS\My Documents\CSR00049181-1274139088.exe

[2010/05/16 07:20:08 | 000,020,074 | ---- | M] () -- C:\DOCUME~1\LKS\My Documents\easter 7 2010 notes.odt

[2010/05/05 18:28:58 | 000,019,407 | ---- | M] () -- C:\DOCUME~1\LKS\My Documents\dkos5-5.odt

[2010/05/03 14:53:53 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll

[2010/05/03 14:53:53 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe

[2010/05/03 14:53:53 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe

[2010/05/03 14:53:53 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe

[2010/05/03 14:53:53 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010/05/28 17:19:09 | 000,002,855 | ---- | C] () -- C:\DOCUME~1\LKS\Desktop\Shortcut to OTL.com.pif

[2010/05/28 17:16:03 | 1005,113,344 | -HS- | C] () -- C:\hiberfil.sys

[2010/05/27 22:07:42 | 000,284,915 | ---- | C] () -- C:\DOCUME~1\LKS\Desktop\gmer.zip

[2010/05/24 15:52:31 | 000,949,152 | ---- | C] () -- C:\DOCUME~1\LKS\My Documents\tdsskiller.zip

[2010/05/24 15:52:01 | 000,000,000 | ---- | C] () -- C:\DOCUME~1\LKS\My Documents\GooredFix.exe

[2010/05/24 12:57:53 | 000,000,933 | ---- | C] () -- C:\DOCUME~1\LKS\Desktop\Spybot - Search & Destroy.lnk

[2010/05/24 07:46:45 | 000,022,528 | ---- | C] () -- C:\WINDOWS\System32\puinsd.dll

[2010/05/13 12:20:54 | 000,020,074 | ---- | C] () -- C:\DOCUME~1\LKS\My Documents\easter 7 2010 notes.odt

[2010/05/05 18:05:00 | 000,019,407 | ---- | C] () -- C:\DOCUME~1\LKS\My Documents\dkos5-5.odt

[2010/04/15 00:02:04 | 000,000,204 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI

[2007/12/28 13:22:27 | 000,000,094 | -H-- | C] () -- C:\WINDOWS\System32\wup_W1ssg.ini

[2007/07/12 09:52:33 | 000,000,098 | ---- | C] () -- C:\WINDOWS\cdplayer.ini

[2007/03/31 17:09:51 | 000,000,204 | ---- | C] () -- C:\WINDOWS\RtlRack.ini

[2007/03/22 11:59:51 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini

[2007/01/11 10:55:54 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Webspace.INI

[2006/07/30 10:08:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\WinInit.Ini

[2006/07/29 10:12:05 | 000,000,034 | ---- | C] () -- C:\WINDOWS\AuthMgr.INI

[2006/07/09 15:37:47 | 000,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI

[2006/07/09 15:28:08 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2006/07/09 05:06:39 | 000,000,097 | ---- | C] () -- C:\WINDOWS\usrwiz.ini

[2006/02/14 14:26:40 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini

[2006/02/14 12:57:25 | 000,528,384 | ---- | C] () -- C:\WINDOWS\System32\SLLights.dll

[2006/02/14 12:57:25 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\amr_cpl.dll

[2006/02/14 12:57:25 | 000,131,072 | ---- | C] () -- C:\WINDOWS\System32\SLMOHServ.dll

[2006/02/08 17:24:54 | 000,000,773 | ---- | C] () -- C:\WINDOWS\orun32.ini

[2006/02/08 15:59:48 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\slextspk.dll

[2006/02/08 15:59:48 | 000,163,840 | ---- | C] () -- C:\WINDOWS\System32\SLGen.dll

[2006/02/08 15:59:47 | 000,049,152 | ---- | C] () -- C:\WINDOWS\System32\coinst.dll

[2006/02/08 15:57:55 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll

[2006/02/08 15:57:24 | 000,002,072 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini

[2002/03/13 15:46:46 | 000,053,248 | R--- | C] () -- C:\WINDOWS\System32\zlib.dll

========== Alternate Data Streams ==========

@Alternate Data Stream - 114 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:DFC5A2B2

< End of report >

TrueBlueMajority · May 28, 2010

I am not sure whether I turned off Avira before I did the previous log, so I just scanned again with the Avira umbrella closed:

OTL logfile created on: 5/28/2010 6:06:11 PM - Run 4

OTL by OldTimer - Version 3.2.5.0 Folder = C:\Documents and Settings\LKS\Desktop

Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

958.00 Mb Total Physical Memory | 441.00 Mb Available Physical Memory | 46.00% Memory free