BleepingComputer.com: Infected with Trojan Agent_r.XJ

So here's what I've done so far. I've ran updated versions of Spybot S&D, Ad-Aware, AVG and TDSSkiller all in Normal and Safe Mode. AVG Removes part of the Trojan, but says it is unable to remove it from Explorer.exe Memory 1040 or something like that, and internet explorer as well. I am unable to update my Windows, and my taskbar changed backed to Windows Classic theme on its own. My firefox changes at times too. I get a pop up in a new tab for firefox which if i don't close right away causes a blue screen of death.
I followed the instructions of this forum, but GMER causes my computer to Blue screen of death, in regular and safe mode (i've tried aobut 6 times now)
Oh im running 32 bit Vista.
Here's my DDS
.
DDS (Ver_11-03-05.01) - NTFSx86
Run by Chris at 22:59:47.32 on 25/04/2011
Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_21
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3071.1656 [GMT -4:00]
.
AV: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Enabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
.
============== Running Processes ===============
.
C:\PROGRA~1\AVG\AVG10\avgchsvx.exe
C:\PROGRA~1\AVG\AVG10\avgrsx.exe
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Windows\StiD1690.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Windows\Philips\SPC230NC\Monitor.exe
C:\Windows\UMStor\Res.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
C:\Windows\WindowsMobile\wmdc.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\Hewlett-Packard\HP Advisor\HPAdvisor.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\AVG\AVG10\Identity Protection\agent\bin\avgidsmonitor.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\PnkBstrA.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\TRENDnet\TEW-424UB\WlanCU.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Windows\system32\WUDFHost.exe
C:\Program Files\AVG\AVG10\avgnsx.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\System32\mobsync.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Ventrilo\Ventrilo.exe
C:\Windows\system32\conime.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\hp\kbd\kbd.exe
C:\Windows\system32\wbem\wmiprvse.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wuauclt.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Chris\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.ca/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:29775
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: BitComet Helper: {39f7e362-828a-4b5a-bcaf-5b79bfdfea60} - c:\program files\bitcomet\tools\BitCometBHO_1.4.12.6.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg10\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: Windows Live ID Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.1.1309.3572\swg.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Hotspot Shield Class: {f9e4a054-e9b1-4bc3-83a3-76a1ae736170} - c:\program files\hotspot shield\hssie\HssIE.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [HPAdvisor] c:\program files\hewlett-packard\hp advisor\HPAdvisor.exe autorun=AUTORUN
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [ares] "c:\program files\ares\Ares.exe" -h
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [Google Update] "c:\users\chris\appdata\local\google\update\GoogleUpdate.exe" /c
uRun: [BitComet] "c:\program files\bitcomet\BitComet.exe" /tray
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KbdStub.EXE
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [<NO NAME>]
mRun: [IAAnotif] "c:\program files\intel\intel matrix storage manager\Iaanotif.exe"
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [UnlockerAssistant] "c:\program files\unlocker\UnlockerAssistant.exe"
mRun: [Waiting1690] c:\windows\stid1690.exe
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
mRun: [SPC_Monitor] c:\windows\philips\spc230nc\Monitor.exe
mRun: [SPC230NC_Monitor] c:\windows\philips\spc230nc\Monitor.exe
mRun: [USB Storage Toolbox] c:\windows\umstor\Res.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [AVG_TRAY] c:\program files\avg\avg10\avgtray.exe
mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
mRun: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe
mRun: [Windows Mobile-based device management] %windir%\WindowsMobile\wmdSync.exe
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\snapfi~1.lnk - c:\program files\snapfish picture mover\SnapfishMediaDetector.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\traymi~1.lnk - c:\program files\philips\philips spc230nc webcam\TrayMin230.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\wirele~1.lnk - c:\program files\trendnet\tew-424ub\WlanCU.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: &D&ownload &with BitComet - c:\program files\bitcomet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\bitcomet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet
IE: E&xport to Microsoft Excel
IE: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - c:\program files\pokerstars\PokerStarsUpdate.exe
IE: {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://c:\program files\bitcomet\tools\BitCometBHO_1.4.12.6.dll/206
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
DPF: {5F519B46-96EF-499F-BF24-C9E1548FA56B} - hxxp://oasisservery.webcam.carleton.ca/program/SonySncDf70View.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg10\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\users\chris\appdata\roaming\mozilla\firefox\profiles\9fsq0hkh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - component: c:\program files\avg\avg10\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg10\firefox4\components\avgssff4.dll
FF - component: c:\users\chris\appdata\roaming\mozilla\firefox\profiles\9fsq0hkh.default\extensions\{b042753d-f57e-4e8e-a01b-7379a6d4cefb}\components\IBitCometExtension.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\programdata\id software\quakelive\npquakezero.dll
FF - plugin: c:\users\chris\appdata\local\google\update\1.2.183.23\npGoogleOneClick8.dll
FF - plugin: c:\users\chris\appdata\roaming\mozilla\firefox\profiles\9fsq0hkh.default\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg10\Firefox
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\divx\divx plus web player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\divx\divx plus web player\firefox\wpa
FF - Ext: AVG Safe Search: {1E73965B-8B48-48be-9C8D-68B920ABC1C4} - c:\program files\avg\avg10\Firefox4
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: BitComet Video Downloader: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB} - %profile%\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
FF - Ext: TV-Fox: {2f17f610-5e97-4fed-828f-9940b7b577a4} - %profile%\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
FF - Ext: YouTube Video Download Wizard: ytvdw@pgport.com - %profile%\extensions\ytvdw@pgport.com
.
============= SERVICES / DRIVERS ===============
.
R0 AVGIDSEH;AVGIDSEH;c:\windows\system32\drivers\AVGIDSEH.sys [2010-9-13 25680]
R0 Avgrkx86;AVG Anti-Rootkit Driver;c:\windows\system32\drivers\avgrkx86.sys [2010-9-7 26064]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-1 64160]
R1 Avgldx86;AVG AVI Loader Driver;c:\windows\system32\drivers\avgldx86.sys [2010-12-8 251728]
R1 Avgmfx86;AVG Mini-Filter Resident Anti-Virus Shield;c:\windows\system32\drivers\avgmfx86.sys [2010-9-7 34384]
R1 Avgtdix;AVG TDI Driver;c:\windows\system32\drivers\avgtdix.sys [2010-11-12 299984]
R1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\drivers\RtlProt.sys [2009-7-24 25896]
R2 AVGIDSAgent;AVGIDSAgent;c:\program files\avg\avg10\identity protection\agent\bin\AVGIDSAgent.exe [2011-1-6 6128720]
R2 avgwd;AVG WatchDog;c:\program files\avg\avg10\avgwdsvc.exe [2010-10-22 265400]
R2 FontCache;Windows Font Cache Service;c:\windows\system32\svchost.exe -k LocalServiceAndNoImpersonation [2008-1-20 21504]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
R3 AVGIDSDriver;AVGIDSDriver;c:\windows\system32\drivers\AVGIDSDriver.sys [2010-8-19 123472]
R3 AVGIDSFilter;AVGIDSFilter;c:\windows\system32\drivers\AVGIDSFilter.sys [2010-8-19 30288]
R3 AVGIDSShim;AVGIDSShim;c:\windows\system32\drivers\AVGIDSShim.sys [2010-8-19 27216]
R3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2009-7-14 1443584]
R3 HSXHWBS3;HSXHWBS3;c:\windows\system32\drivers\HSXHWBS3.sys [2008-3-11 206336]
S1 NetPeeker;NetPeeker;c:\windows\system32\drivers\NetPeeker.sys [2009-9-11 200788]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-1-6 135664]
S2 Realtek92U;Realtek92U;c:\program files\realtek\8192u wireless lan utility\rtlservice.exe --> c:\program files\realtek\8192u wireless lan utility\RtlService.exe [?]
S3 CAM1690;USB PC Camera;c:\windows\system32\drivers\cam1690.sys [2007-11-21 182656]
S3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\drivers\PAEAFLT.sys [2009-9-2 8576]
S3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\system32\drivers\RTL8187B.sys [2007-7-19 281088]
S3 RTL8192U;Realtek RTL8192u 802.11n Wireless LAN USB 2.0 Network Adapter;c:\windows\system32\drivers\rtl8192u.sys [2009-7-24 410624]
S3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\drivers\SPC230NC.SYS [2009-9-2 461056]
.
=============== Created Last 30 ================
.
2011-04-26 01:03:54 -------- d-----w- c:\users\chris\appdata\roaming\1ECF02CA9ACBF187D64019E78412BD99
2011-04-25 20:30:46 388096 ----a-r- c:\users\chris\appdata\roaming\microsoft\installer\{45a66726-69bc-466b-a7a4-12fcba4883d7}\HiJackThis.exe
2011-04-25 20:30:46 -------- d-----w- c:\program files\Trend Micro
2011-04-19 16:32:30 -------- d-----w- c:\users\chris\appdata\local\FLVService
2011-04-19 16:32:22 -------- d-----w- c:\windows\Freecorder
2011-04-11 04:58:11 -------- d-----w- c:\program files\osu!
2011-04-11 04:57:31 -------- d-----w- c:\users\chris\appdata\roaming\Downloaded Installations
2011-03-27 18:16:05 -------- d-----w- c:\program files\Heroes of Newerth
.
==================== Find3M ====================
.
.
============= FINISH: 23:00:31.56 ===============


Let me know if I've missed anything. Thx for your help.

This post has been edited by chriswinsor: 26 April 2011 - 12:56 PM

Hi,

Welcome to Bleeping Computer. My name is m0le and I will be helping you with your log.

• Please subscribe to this topic, if you haven't already. Click the Watch This Topic button at the top on the right.
  
  
  
• Please avoid installing/uninstalling or updating any programs and attempting any unsupervised fixes or scans. This can make helping you impossible.
  
  
  
• Please reply to this post so I know you are there.

The forum is busy and we need to have replies as soon as possible. If I haven't had a reply after 3 days I will bump the topic and if you do not reply by the following day after that then I will close the topic.

Once I receive a reply then I will return with your first instructions.

Thanks

Hi! Glad to see your reply.

So some updates on my computer woes. I now get a funky looking french google.ca when I try to go to google.com. All the links I click on in google or bing redirect me to a different popup.

AVG at one point stopped worknig and instead gave me ynn.exe (which i got rid of it safe mode) I also had Vista Anti-Virys spyware that was subsequently deleted in safe mode.

Finally my computer stopped booting and the windows repair funciton didnt fix it. The computer then booted in the HP help thing, scanned all the drives etc and said it was fine, then would boot ok.

It feels like a losing battle, I hope you guys can help. I've never reformatted in my life and hope never to have to do so. I know you PC gurus can help me! even if it means deleted half my stuff

Interesting that from what you've run only AVG attempts to deal with it. I take it that TDSSKiller came up clean?

Please run Rkill

Download and Run RKill

Please download RKill by Grinler from one of the 4 links below and save it to your desktop.

Link 1
Link 2
Link 3
Link 4

• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
  
• Double-click on Rkill on your desktop to run it. (If you are using Windows Vista, please right-click on it and select Run As Administrator)
  
• A black screen will appear and then disappear. Please do not worry, that is normal. This means that the tool has been successfully executed.
  
• Please post the resulting log in your next reply.

Now download and run Combofix and let's see if we can get in amongst this malware

Please download ComboFix from one of these locations:

• Bleepingcomputer
  
• ForoSpyware

* IMPORTANT !!! Save ComboFix.exe to your Desktop making sure you rename it comfix.exe

• Disable your AntiVirus and AntiSpyware applications including Firewalls, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Click on this link to see a list of programs that should be disabled. The list is not all inclusive.)
  
• Double click on Comfix.exe & follow the prompts.
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.



Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:



Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.

I ran rkill in Safe mode and regular mode, since I was having trouble disabling antivirus programs.
Here's safe mode
Processes terminated by Rkill or while it was running:

C:\Windows\system32\conime.exe
C:\Windows\system32\conime.exe

Here's regular


Rkill was run on 04/05/2011 at 21:27:48.
Operating System: Windows Vista ™ Home Premium


Processes terminated by Rkill or while it was running:

C:\hp\KBD\KbdStub.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\AVG\AVG10\avgtray.exe
C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\AVG\AVG10\avgwdsvc.exe
C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
C:\Program Files\iPod\bin\iPodService.exe


Rkill completed on 04/05/2011 at 21:28:00.


Here's my log for ComFix. I dont see anything aobut the Trojan

ComboFix 11-05-04.02 - Chris 04/05/2011 22:09:52.1.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3071.1604 [GMT -4:00]
Running from: c:\users\Chris\Desktop\ComFix.exe
AV: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {5A2746B1-DEE9-F85A-FBCD-ADB11639C5F0}
SP: AVG Anti-Virus Free Edition 2011 *Disabled/Updated* {E146A755-F8D3-F7D4-C17D-96C36DBE8F4D}
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\Search Toolbar
c:\program files\Search Toolbar\History\a_picot2559961150.xml
c:\program files\Search Toolbar\History\ablackmore251775388631.xml
c:\program files\Search Toolbar\History\absolute_dave1223430389.xml
c:\program files\Search Toolbar\History\adam.wilson665144022.xml
c:\program files\Search Toolbar\History\adamnewlands3228066962.xml
c:\program files\Search Toolbar\History\afsweetie7054005916436.xml
c:\program files\Search Toolbar\History\aircarter2002761058344.xml
c:\program files\Search Toolbar\History\alex_noonan84052514279406.xml
c:\program files\Search Toolbar\History\ali.beveridge472148052.xml
c:\program files\Search Toolbar\History\ali_beveridge_42104716104.xml
c:\program files\Search Toolbar\History\allie_a771402495948.xml
c:\program files\Search Toolbar\History\alsarabura3450193753.xml
c:\program files\Search Toolbar\History\andyrooclements2858553230.xml
c:\program files\Search Toolbar\History\annabanana_19973986030715.xml
c:\program files\Search Toolbar\History\apb2506293087411.xml
c:\program files\Search Toolbar\History\aussiedingo2847495402.xml
c:\program files\Search Toolbar\History\baller1822182098932.xml
c:\program files\Search Toolbar\History\ballet_grrl766073293.xml
c:\program files\Search Toolbar\History\basketball_gurlie3511986571.xml
c:\program files\Search Toolbar\History\beaver_clever353498964452.xml
c:\program files\Search Toolbar\History\blue_ducky_3151452568898.xml
c:\program files\Search Toolbar\History\bottom_glove976293108.xml
c:\program files\Search Toolbar\History\bubbles_blue773062996451.xml
c:\program files\Search Toolbar\History\buskerboy182697566.xml
c:\program files\Search Toolbar\History\bvmforrester2754303692.xml
c:\program files\Search Toolbar\History\bvmforrester3224064692.xml
c:\program files\Search Toolbar\History\byulbalaki491158539.xml
c:\program files\Search Toolbar\History\cahl902624995996.xml
c:\program files\Search Toolbar\History\caitlin_cullum885180200.xml
c:\program files\Search Toolbar\History\caitlin_egan2004628161.xml
c:\program files\Search Toolbar\History\cajm292818250053.xml
c:\program files\Search Toolbar\History\canad_ian151708299219.xml
c:\program files\Search Toolbar\History\caolan_cullum3522877406.xml
c:\program files\Search Toolbar\History\captain_moe881081201499.xml
c:\program files\Search Toolbar\History\carlytoth2708982297.xml
c:\program files\Search Toolbar\History\carolyncornford3674729112.xml
c:\program files\Search Toolbar\History\carries_island1758141350.xml
c:\program files\Search Toolbar\History\cbrett61655790108.xml
c:\program files\Search Toolbar\History\chrismlepan717735953.xml
c:\program files\Search Toolbar\History\christopherwinsor3823642520.xml
c:\program files\Search Toolbar\History\coady1114252000406.xml
c:\program files\Search Toolbar\History\coffeebreak301965220507 - Archive.xml
c:\program files\Search Toolbar\History\coffeebreak301965220507.xml
c:\program files\Search Toolbar\History\cool_nl4160897765.xml
c:\program files\Search Toolbar\History\cute_without_the_e1823202163454.xml
c:\program files\Search Toolbar\History\darealdeal40002888369438.xml
c:\program files\Search Toolbar\History\dawaller69940539670.xml
c:\program files\Search Toolbar\History\dead_dwarves1977486188.xml
c:\program files\Search Toolbar\History\dominicperabo3640882270.xml
c:\program files\Search Toolbar\History\dragony_991913495608.xml
c:\program files\Search Toolbar\History\drew_pihlainen1351184992.xml
c:\program files\Search Toolbar\History\drewclip4015741761.xml
c:\program files\Search Toolbar\History\e_keeble1305685683.xml
c:\program files\Search Toolbar\History\edkeeble585944240.xml
c:\program files\Search Toolbar\History\elisabeena1837236284.xml
c:\program files\Search Toolbar\History\elizabethclarkemiller614387270.xml
c:\program files\Search Toolbar\History\elmo_love553134310383.xml
c:\program files\Search Toolbar\History\em.parker3392155136.xml
c:\program files\Search Toolbar\History\evan_akins11762541879.xml
c:\program files\Search Toolbar\History\fee_tom2850291982.xml
c:\program files\Search Toolbar\History\francoiskunstmann1119917091.xml
c:\program files\Search Toolbar\History\fraser_mac851676101443.xml
c:\program files\Search Toolbar\History\g_uitar1725560138.xml
c:\program files\Search Toolbar\History\godda_b_kd4165111429.xml
c:\program files\Search Toolbar\History\griphonswimmer1170904962.xml
c:\program files\Search Toolbar\History\hanrattygirl2655088932.xml
c:\program files\Search Toolbar\History\hawian_snowflake9004194261733.xml
c:\program files\Search Toolbar\History\heatherannethegarbagecan958195162.xml
c:\program files\Search Toolbar\History\hockeystar_brendan825126433.xml
c:\program files\Search Toolbar\History\ianfreeman400187057.xml
c:\program files\Search Toolbar\History\j00ie2005764823.xml
c:\program files\Search Toolbar\History\jackson_snell3662016769.xml
c:\program files\Search Toolbar\History\jameyducros742801433.xml
c:\program files\Search Toolbar\History\jaysun_73848433287.xml
c:\program files\Search Toolbar\History\jed_8853832522554.xml
c:\program files\Search Toolbar\History\jennaleigh_1682815641974.xml
c:\program files\Search Toolbar\History\jennylepan92615379.xml
c:\program files\Search Toolbar\History\jess_beveridge3758127588.xml
c:\program files\Search Toolbar\History\jma8m4184555404.xml
c:\program files\Search Toolbar\History\johnzamparo394629468.xml
c:\program files\Search Toolbar\History\julia_stanfield1960087425.xml
c:\program files\Search Toolbar\History\katekurys1203593262.xml
c:\program files\Search Toolbar\History\kb120001963299075.xml
c:\program files\Search Toolbar\History\kilogowitum022748136628.xml
c:\program files\Search Toolbar\History\kipuronisyv472675383389.xml
c:\program files\Search Toolbar\History\kira__oh464392227.xml
c:\program files\Search Toolbar\History\kyler5183226546928.xml
c:\program files\Search Toolbar\History\lauraluu21934700677.xml
c:\program files\Search Toolbar\History\laurastonie1420500426.xml
c:\program files\Search Toolbar\History\linds.parker672845104.xml
c:\program files\Search Toolbar\History\lisa_gillich340292839.xml
c:\program files\Search Toolbar\History\maris_107785160282.xml
c:\program files\Search Toolbar\History\marykstewart871907956868.xml
c:\program files\Search Toolbar\History\mason_beveridge2051133225.xml
c:\program files\Search Toolbar\History\mego_kaner3070675439.xml
c:\program files\Search Toolbar\History\MessageLog.xsl
c:\program files\Search Toolbar\History\more_of_morg1430087250.xml
c:\program files\Search Toolbar\History\mrfantom77544343.xml
c:\program files\Search Toolbar\History\naish82776151696.xml
c:\program files\Search Toolbar\History\naomiabbeyesq35471495.xml
c:\program files\Search Toolbar\History\nathan.473406186114.xml
c:\program files\Search Toolbar\History\nathan_jhon_denys71967721.xml
c:\program files\Search Toolbar\History\nathandapyro2168494880.xml
c:\program files\Search Toolbar\History\ngriller118211901.xml
c:\program files\Search Toolbar\History\nikkilynn.232915544817.xml
c:\program files\Search Toolbar\History\o.i.s.c1564437723.xml
c:\program files\Search Toolbar\History\off_the_wagon524148029236.xml
c:\program files\Search Toolbar\History\ohsnap691435644567.xml
c:\program files\Search Toolbar\History\one_buff_guy_693072293569.xml
c:\program files\Search Toolbar\History\pearlo_wisdom4215664580.xml
c:\program files\Search Toolbar\History\peterdoyle453566572437.xml
c:\program files\Search Toolbar\History\pinkpanther501114852488.xml
c:\program files\Search Toolbar\History\queejibo2312114415.xml
c:\program files\Search Toolbar\History\r.m.suarez102317312.xml
c:\program files\Search Toolbar\History\rh_cp2787806331.xml
c:\program files\Search Toolbar\History\rightboyz2316398405.xml
c:\program files\Search Toolbar\History\rm.hm448153433.xml
c:\program files\Search Toolbar\History\saltandpepper50522645271.xml
c:\program files\Search Toolbar\History\sam.gratte2356611873.xml
c:\program files\Search Toolbar\History\samkin692216661969.xml
c:\program files\Search Toolbar\History\sarah_sproule4257208107.xml
c:\program files\Search Toolbar\History\sebstark1279114174.xml
c:\program files\Search Toolbar\History\senorters_bich378381421.xml
c:\program files\Search Toolbar\History\shmalexi25415654.xml
c:\program files\Search Toolbar\History\showmaster98187861097.xml
c:\program files\Search Toolbar\History\showstoppa_7544160029.xml
c:\program files\Search Toolbar\History\sillysarah88452554135.xml
c:\program files\Search Toolbar\History\sirjohnaview3176140008.xml
c:\program files\Search Toolbar\History\skitz00002425088636.xml
c:\program files\Search Toolbar\History\soccer_monkey8883086422448.xml
c:\program files\Search Toolbar\History\sophie-was-here2648273076.xml
c:\program files\Search Toolbar\History\special_r_d_s259464542.xml
c:\program files\Search Toolbar\History\stevekwinsor3336602867.xml
c:\program files\Search Toolbar\History\ted_mirsky2126502110.xml
c:\program files\Search Toolbar\History\tom9tay2892406174.xml
c:\program files\Search Toolbar\History\tommacdonalddepew662611007.xml
c:\program files\Search Toolbar\History\tommctee133539572245.xml
c:\program files\Search Toolbar\History\traceyguptill1587775312.xml
c:\program files\Search Toolbar\History\tralfangar3722252949.xml
c:\program files\Search Toolbar\History\twinklesox261769163.xml
c:\program files\Search Toolbar\History\twoody_3331015699277.xml
c:\program files\Search Toolbar\History\uki91419000469.xml
c:\program files\Search Toolbar\History\weava1day4152820538.xml
c:\program files\Search Toolbar\History\whitney_m_lee727736388.xml
c:\program files\Search Toolbar\History\wwjg735451358.xml
c:\program files\Search Toolbar\History\youngin_aaron1201590792.xml
c:\users\Chris\AppData\Roaming\1ECF02CA9ACBF187D64019E78412BD99
c:\users\Chris\AppData\Roaming\1ECF02CA9ACBF187D64019E78412BD99\enemies-names.txt
c:\users\Chris\AppData\Roaming\1ECF02CA9ACBF187D64019E78412BD99\local.ini
c:\users\Chris\AppData\Roaming\Adobe\plugs
c:\users\Chris\AppData\Roaming\Adobe\shed
c:\users\Chris\AppData\Roaming\Local
c:\windows\system32\jusched.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-04-05 to 2011-05-05 )))))))))))))))))))))))))))))))
.
.
2011-05-05 02:19 . 2011-05-05 02:19 -------- d-----w- c:\users\Chris\AppData\Local\temp
2011-05-05 02:19 . 2011-05-05 02:19 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-04-25 20:30 . 2011-04-25 20:30 388096 ----a-r- c:\users\Chris\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-25 20:30 . 2011-04-25 20:30 -------- d-----w- c:\program files\Trend Micro
2011-04-19 16:32 . 2011-04-22 16:16 -------- d-----w- c:\users\Chris\AppData\Local\FLVService
2011-04-19 16:32 . 2011-04-19 16:32 -------- d-----w- c:\windows\Freecorder
2011-04-11 04:58 . 2011-04-11 05:03 -------- d-----w- c:\program files\osu!
2011-04-11 04:57 . 2011-04-25 00:51 -------- d-----w- c:\users\Chris\AppData\Roaming\Downloaded Installations
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-12 04:10 . 2010-06-24 16:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-01-19 942080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2010-09-23 4240760]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"BitComet"="c:\program files\BitComet\BitComet.exe" [2010-12-08 10811696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2008-06-02 178712]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Waiting1690"="c:\windows\stid1690.exe" [2007-06-05 60416]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-07-09 524632]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"USB Storage Toolbox"="c:\windows\UMStor\Res.EXE" [2005-09-15 65536]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-23 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-23 92704]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-02-15 1230704]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Snapfish Media Detector.lnk - c:\program files\Snapfish Picture Mover\SnapfishMediaDetector.exe [2007-5-7 1273856]
TrayMin230.lnk - c:\program files\Philips\Philips SPC230NC Webcam\TrayMin230.exe [2009-9-2 241664]
Wireless Configuration Utility.lnk - c:\program files\TRENDnet\TEW-424UB\WlanCU.exe [2007-4-29 434176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-08-08 12:11 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2008-11-02 08:38 167936 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-06-02 15:56 24264488 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R1 NetPeeker;NetPeeker;c:\windows\System32\Drivers\NetPeeker.sys [2009-09-12 200788]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R2 Realtek92U;Realtek92U;c:\program files\Realtek\8192U Wireless LAN Utility\RtlService.exe [x]
R3 CAM1690;USB PC Camera;c:\windows\system32\Drivers\cam1690.sys [2007-11-21 182656]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\DRIVERS\PAEAFLT.sys [2007-09-26 8576]
R3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-07-19 281088]
R3 RTL8192U;Realtek RTL8192u 802.11n Wireless LAN USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192u.sys [2008-07-01 410624]
R3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\DRIVERS\SPC230NC.SYS [2007-12-31 461056]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-08-29 717296]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-07-01 64160]
S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2007-04-23 25896]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-07-09 1029456]
S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2009-07-15 1443584]
S3 HSXHWBS3;HSXHWBS3;c:\windows\system32\DRIVERS\HSXHWBS3.sys [2007-04-26 206336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:39]
.
2011-05-05 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-30 00:36]
.
2011-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 04:13]
.
2011-05-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 04:13]
.
2011-04-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3678477006-3842480120-3575067080-1000Core.job
- c:\users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-09 06:53]
.
2011-05-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3678477006-3842480120-3575067080-1000UA.job
- c:\users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-09 06:53]
.
2011-05-03 c:\windows\Tasks\HPCeeScheduleForChris.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-03-11 19:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:29775
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet
IE: E&xport to Microsoft Excel
DPF: {5F519B46-96EF-499F-BF24-C9E1548FA56B} - hxxp://oasisservery.webcam.carleton.ca/program/SonySncDf70View.cab
FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\9fsq0hkh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: BitComet Video Downloader: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB} - %profile%\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
FF - Ext: TV-Fox: {2f17f610-5e97-4fed-828f-9940b7b577a4} - %profile%\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
FF - Ext: YouTube Video Download Wizard: ytvdw@pgport.com - %profile%\extensions\ytvdw@pgport.com
.
- - - - ORPHANS REMOVED - - - -
.
HKCU-Run-ares - c:\program files\Ares\Ares.exe
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
MSConfigStartUp-Aim6 - c:\program files\AIM6\aim6.exe
MSConfigStartUp-ares vista - c:\program files\Ares Vista\AresVista.exe
AddRemove-Debut - c:\program files\NCH Software\Debut\uninst.exe
AddRemove-FINAL FANTASY VIII - c:\program files\Eidos Interactive\Square Soft
AddRemove-GLOBEYES - c:\program files\GLOBEYES\DeIsL1.isu
AddRemove-HotspotShield - c:\program files\Hotspot Shield\Uninstall.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe
AddRemove-{933EB5A7-8654-4E2E-8A21-F230D7A09318} - c:\program files\InstallShield Installation Information\{933EB5A7-8654-4E2E-8A21-F230D7A09318}\setup.exe
AddRemove-????_is1 - c:\program files\WESTVISION\????\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-04 22:19
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3678477006-3842480120-3575067080-1000\Software\BISHOP\9 ³*Æç*}
w* ±*]
"DataPath"=""
"InstallPath"="c:\\Program Files\\BISHOP\\ks"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-05-04 22:21:27
ComboFix-quarantined-files.txt 2011-05-05 02:21
.
Pre-Run: 211,419,017,216 bytes free
Post-Run: 211,448,971,264 bytes free
.
- - End Of File - - 167549A72CFC5FC436DCBE9A7FB0EFDD

Let me know if Im missing anything.

Please rerun Combofix, as shown below.

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the box below into it:

Quote

Save this as CFScript.txt, in the same location as Comfix.exe (called ComboFix.exe in the below graphic)




Refering to the picture above, drag CFScript into ComboFix.exe

If the program requests for you to update Combofix then click Yes.

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Here ya go.

ComboFix 11-05-05.01 - Chris 06/05/2011 0:00.2.4 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6002.2.1252.2.1033.18.3071.1560 [GMT -4:00]
Running from: c:\users\Chris\Desktop\ComFix.exe
Command switches used :: c:\users\Chris\Desktop\CFScript.txt
SP: Lavasoft Ad-Watch Live! *Disabled/Updated* {61CDFD9D-3CAC-9270-C6FC-52325ACB795B}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((( Files Created from 2011-04-06 to 2011-05-06 )))))))))))))))))))))))))))))))
.
.
2011-05-06 04:09 . 2011-05-06 04:09 -------- d-----w- c:\users\Chris\AppData\Local\temp
2011-05-06 04:09 . 2011-05-06 04:09 -------- d-----w- c:\users\Guest\AppData\Local\temp
2011-05-06 04:09 . 2011-05-06 04:09 -------- d-----w- c:\users\Default\AppData\Local\temp
2011-05-06 04:09 . 2011-05-06 04:09 -------- d-----w- c:\users\chris2\AppData\Local\temp
2011-05-06 04:09 . 2011-05-06 04:09 -------- d-----w- c:\users\chris1\AppData\Local\temp
2011-04-25 20:30 . 2011-04-25 20:30 388096 ----a-r- c:\users\Chris\AppData\Roaming\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2011-04-25 20:30 . 2011-04-25 20:30 -------- d-----w- c:\program files\Trend Micro
2011-04-19 16:32 . 2011-04-22 16:16 -------- d-----w- c:\users\Chris\AppData\Local\FLVService
2011-04-19 16:32 . 2011-04-19 16:32 -------- d-----w- c:\windows\Freecorder
2011-04-11 04:58 . 2011-04-11 05:03 -------- d-----w- c:\program files\osu!
2011-04-11 04:57 . 2011-04-25 00:51 -------- d-----w- c:\users\Chris\AppData\Roaming\Downloaded Installations
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-03-12 04:10 . 2010-06-24 16:33 18328 ----a-w- c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-11 1233920]
"HPAdvisor"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-01-19 942080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2010-09-23 4240760]
"SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"BitComet"="c:\program files\BitComet\BitComet.exe" [2010-12-08 10811696]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"KBD"="c:\hp\KBD\KbdStub.EXE" [2006-12-08 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\Iaanotif.exe" [2008-06-02 178712]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872]
"Waiting1690"="c:\windows\stid1690.exe" [2007-06-05 60416]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2010-07-09 524632]
"LogitechCommunicationsManager"="c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 563984]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"SPC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"SPC230NC_Monitor"="c:\windows\Philips\SPC230NC\Monitor.exe" [2007-12-10 323584]
"USB Storage Toolbox"="c:\windows\UMStor\Res.EXE" [2005-09-15 65536]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-09-05 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-10-29 141600]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-23 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-23 92704]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 648072]
"Windows Mobile-based device management"="c:\windows\WindowsMobile\wmdSync.exe" [2008-01-21 215552]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-02-15 1230704]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Snapfish Media Detector.lnk - c:\program files\Snapfish Picture Mover\SnapfishMediaDetector.exe [2007-5-7 1273856]
TrayMin230.lnk - c:\program files\Philips\Philips SPC230NC Webcam\TrayMin230.exe [2009-9-2 241664]
Wireless Configuration Utility.lnk - c:\program files\TRENDnet\TEW-424UB\WlanCU.exe [2007-4-29 434176]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
.
[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^VPN Client.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\VPN Client.lnk
backup=c:\windows\pss\VPN Client.lnk.CommonStartup
backupExtension=.CommonStartup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2008-08-08 12:11 490952 ----a-w- c:\program files\DAEMON Tools Lite\daemon.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
2008-11-02 08:38 167936 ----a-w- c:\program files\PowerISO\PWRISOVM.EXE
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
2009-06-02 15:56 24264488 ----a-r- c:\program files\Skype\Phone\Skype.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
R1 NetPeeker;NetPeeker;c:\windows\System32\Drivers\NetPeeker.sys [2009-09-12 200788]
R2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R2 Realtek92U;Realtek92U;c:\program files\Realtek\8192U Wireless LAN Utility\RtlService.exe [x]
R3 CAM1690;USB PC Camera;c:\windows\system32\Drivers\cam1690.sys [2007-11-21 182656]
R3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 135664]
R3 PAEAFLT.sys;USB Composite Device;c:\windows\system32\DRIVERS\PAEAFLT.sys [2007-09-26 8576]
R3 RTL8187B;TRENDnet TEW-424UB 54M USB Dongle;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-07-19 281088]
R3 RTL8192U;Realtek RTL8192u 802.11n Wireless LAN USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192u.sys [2008-07-01 410624]
R3 SPC230NC;Philips SPC230NC Webcam;c:\windows\system32\DRIVERS\SPC230NC.SYS [2007-12-31 461056]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [2008-08-29 717296]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-07-01 64160]
S1 RtlProt;Realtke RtlProt WLAN Utility Protocol Driver;c:\windows\system32\DRIVERS\rtlprot.sys [2007-04-23 25896]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2010-07-09 1029456]
S3 HCW85BDA;Hauppauge WinTV 885 Video Capture;c:\windows\system32\drivers\HCW85BDA.sys [2009-07-15 1443584]
S3 HSXHWBS3;HSXHWBS3;c:\windows\system32\DRIVERS\HSXHWBS3.sys [2007-04-26 206336]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr
.
Contents of the 'Scheduled Tasks' folder
.
2011-04-20 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 02:39]
.
2011-05-06 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-09-30 00:36]
.
2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 04:13]
.
2011-05-06 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-06 04:13]
.
2011-04-20 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3678477006-3842480120-3575067080-1000Core.job
- c:\users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-09 06:53]
.
2011-05-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3678477006-3842480120-3575067080-1000UA.job
- c:\users\Chris\AppData\Local\Google\Update\GoogleUpdate.exe [2008-11-09 06:53]
.
2011-05-03 c:\windows\Tasks\HPCeeScheduleForChris.job
- c:\program files\hewlett-packard\sdp\ceement\HPCEE.exe [2008-03-11 19:10]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.ca/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_ca&c=81&bd=Pavilion&pf=desktop
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: Download all videos using BitComet
IE: E&xport to Microsoft Excel
DPF: {5F519B46-96EF-499F-BF24-C9E1548FA56B} - hxxp://oasisservery.webcam.carleton.ca/program/SonySncDf70View.cab
FF - ProfilePath - c:\users\Chris\AppData\Roaming\Mozilla\Firefox\Profiles\9fsq0hkh.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: DivX Plus Web Player HTML5 &lt;video&gt;: {23fcfd51-4958-4f00-80a3-ae97e717ed8b} - c:\program files\DivX\DivX Plus Web Player\firefox\html5video
FF - Ext: DivX HiQ: {6904342A-8307-11DF-A508-4AE2DFD72085} - c:\program files\DivX\DivX Plus Web Player\firefox\wpa
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: BitComet Video Downloader: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB} - %profile%\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}
FF - Ext: TV-Fox: {2f17f610-5e97-4fed-828f-9940b7b577a4} - %profile%\extensions\{2f17f610-5e97-4fed-828f-9940b7b577a4}
FF - Ext: YouTube Video Download Wizard: ytvdw@pgport.com - %profile%\extensions\ytvdw@pgport.com
.
- - - - ORPHANS REMOVED - - - -
.
AddRemove-????_is1 - c:\program files\WESTVISION\????\unins000.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-05-06 00:09
Windows 6.0.6002 Service Pack 2 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-3678477006-3842480120-3575067080-1000\Software\BISHOP\9 ³*Æç*}
w* ±*]
"DataPath"=""
"InstallPath"="c:\\Program Files\\BISHOP\\ks"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2011-05-06 00:10:40
ComboFix-quarantined-files.txt 2011-05-06 04:10
ComboFix2.txt 2011-05-05 02:21
.
Pre-Run: 211,372,007,424 bytes free
Post-Run: 211,322,908,672 bytes free
.
- - End Of File - - 89940F75581CE44F74FBD5ED62714BC0

That's fine so far. Please next run ESET's online scan

I'd like us to scan your machine with ESET OnlineScan

• Hold down Control and click on the following link to open ESET OnlineScan in a new window.
  ESET OnlineScan
  
• Click the button.
  
• For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
  • Click on to download the ESET Smart Installer. Save it to your desktop.
    
  • Double click on the icon on your desktop.
  
  
• Check
  
• Click the button.
  
• Accept any security warnings from your browser.
  
• Under scan settings, check and check Remove found threats
  
• Click Advanced settings and select the following:
  • Scan potentially unwanted applications
    
  • Scan for potentially unsafe applications
    
  • Enable Anti-Stealth technology
  
  
• ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
  
• When the scan completes, push
  
• Push , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
  
• Push the button.
  
• Push

If no log is generated that means nothing was found. Please let me know if this happens.

C:\Program Files\Unlocker\eBay_shortcuts_1016.exe Win32/Adware.ADON application deleted - quarantined
C:\Qoobox\Quarantine\C\Users\Chris\AppData\Roaming\1ECF02CA9ACBF187D64019E78412BD99\enemies-names.txt.vir Win32/Adware.AntimalwareDoctor.AE.Gen application cleaned by deleting - quarantined
C:\Qoobox\Quarantine\C\Users\Chris\AppData\Roaming\1ECF02CA9ACBF187D64019E78412BD99\local.ini.vir Win32/Adware.AntimalwareDoctor.AE.Gen application cleaned by deleting - quarantined
C:\Users\Chris\Downloads\XvidSetup(2).exe a variant of Win32/Adware.HotBar.H application cleaned by deleting - quarantined
C:\Users\Chris\Downloads\XvidSetup.exe a variant of Win32/Adware.HotBar.H application cleaned by deleting - quarantined
C:\Users\Chris\Music\10-plain_white_ts-someday.mp3 a variant of WMA/TrojanDownloader.GetCodec.gen trojan cleaned - quarantined

Some malware in the form of infected files, no nasty surprises though.

How is the machine running now?

I still have the problem of when I google or search with bing, about 90% of the time i click on the link, it redirects me to some crap. Also since uninstalling AVG, I don't get the alerts catching new malware/viruses. Can you suggest a good free anyti virus program to download? But yeah other than that, no problems yet.

Let's deal with the redirects first then I will recommend some options.

Please tell me which browser(s) you use

I use Firefox.

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
  
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista/Windows 7).
  
• When prompted to run the scan, click Yes.
  
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).

GooredFix by jpshortstuff (03.07.10.1)
Log created at 17:11 on 09/05/2011 (Chris)
Firefox version 3.0.19 (en-GB)

========== GooredScan ==========


========== GooredLog ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [19:36 31/08/2008]
{B13721C7-F507-4982-B2E5-502A71474FED} [17:18 29/06/2009]
{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [00:05 21/01/2009]
{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [02:26 03/09/2009]
{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [23:33 05/09/2010]

C:\Users\Chris\Application Data\Mozilla\Firefox\Profiles\9fsq0hkh.default\extensions\
DeviceDetection@logitech.com [03:59 06/09/2010]
ytvdw@pgport.com [16:33 19/04/2011]
{1392B8D2-5C05-419F-A8F6-B9F15A596612}-TRASH [20:29 25/04/2011]
{20a82645-c095-46ed-80e3-08825760534b} [19:07 11/08/2009]
{2f17f610-5e97-4fed-828f-9940b7b577a4} [20:00 07/02/2010]
{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [16:55 19/01/2011]
{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash [16:55 19/01/2011]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [00:03 21/03/2009]
"{23fcfd51-4958-4f00-80a3-ae97e717ed8b}"="C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video" [06:03 19/01/2011]
"{6904342A-8307-11DF-A508-4AE2DFD72085}"="C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa" [06:03 19/01/2011]

-=E.O.F=-