BleepingComputer.com: infected with TDSS, google redirects and spyware programs close seconds after opening

Everytime I click on a search result I am redirected. I have also been received pop-ups stating threat detected:trojan horse something or other. I have tried running several antispyware programs, but as soon as the scan starts the program just disappears. Also, I had no problem creating the DDS logs, however I was unable to create the GMER log. I followed the steps perfectly and mid-scan GMER just disappeared. Any help would be very very very much appreciated.
.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_23
Run by Josh at 18:43:07 on 2011-08-17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.306 [GMT -5:00]
.
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\3203397148:3809022017.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\Explorer.EXE
c:\Program Files\Zune\ZuneBusEnum.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\History Channel Games\kgsystray\Kuma_tray.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: GoogleBar: {31dafb0b-1090-4e86-91db-11a77fba5361} - c:\documents and settings\josh\application data\google.com\googlebar\adxloader.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [HP Mobile Broadband] c:\swsetup\hpqwwan\HPMobileBroadband.exe /TrayMode
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [CarboniteSetupLite] "c:\program files\carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\josh\startm~1\programs\startup\kuma_t~1.lnk - c:\program files\history channel games\kgsystray\Kuma_tray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{E9477F00-51F7-4D30-8D5D-CD15B8218E3D} : DhcpNameServer = 192.168.1.254
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\josh\application data\mozilla\firefox\profiles\qycjo2bs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-28 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-28 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-29 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-14 14336]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-8-28 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-28 297752]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-3-19 113664]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\zune\WMZuneComm.exe [2010-11-11 268528]
.
=============== Created Last 30 ================
.
2011-08-17 23:18:08 709968 ----a-w- c:\windows\isRS-000.tmp
2011-08-17 21:56:12 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-17 08:52:54 -------- d-----w- c:\documents and settings\josh\application data\SUPERAntiSpyware.com
2011-08-17 08:52:06 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-08-13 10:42:20 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-13 10:42:13 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-13 10:42:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\rekn.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\pmuv.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\ohrg.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\fdop.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\ugqc.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\etnq.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\ejrh.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\eeqq.exe
2011-08-13 09:16:44 358912 ----a-w- c:\documents and settings\josh\local settings\application data\kyc.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\tjpo.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\ruwk.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\qrnq.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\onbu.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\xgra.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\rtqa.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\ihvy.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\cvgs.exe
2011-07-26 15:41:48 -------- d-----w- c:\documents and settings\josh\Downloads
2011-07-26 07:47:07 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2011-07-26 07:47:07 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2011-07-26 07:47:07 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2011-07-26 07:47:03 6144 ----a-w- c:\windows\system32\ff_acm.acm
2011-07-26 07:47:03 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2011-07-26 07:47:03 57344 ----a-w- c:\windows\system32\ff_vfw.dll
2011-07-26 07:47:03 258352 ----a-w- c:\windows\system32\unicows.dll
2011-07-26 07:47:03 -------- d-----w- c:\documents and settings\josh\local settings\application data\Cucusoft
2011-07-26 07:46:59 372736 ----a-w- c:\windows\system32\xvid.ax
2011-07-26 07:46:38 -------- d-----w- c:\program files\Cucusoft
2011-07-26 07:44:13 -------- d-----w- c:\documents and settings\josh\application data\GetRightToGo
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\pt-PT
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\pt-BR
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\nl-NL
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\it-IT
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\fr-FR
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\es-ES
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\de-DE
2011-07-26 04:31:59 -------- d-----w- c:\windows\system32\drivers\umdf\pt-BR
2011-07-26 04:31:51 -------- d-----w- c:\windows\system32\drivers\umdf\pt-PT
2011-07-26 04:31:38 -------- d-----w- c:\windows\system32\drivers\umdf\nl-NL
2011-07-26 04:31:26 -------- d-----w- c:\windows\system32\drivers\umdf\it-IT
2011-07-26 04:31:15 -------- d-----w- c:\windows\system32\drivers\umdf\de-DE
2011-07-26 04:31:02 -------- d-----w- c:\windows\system32\drivers\umdf\fr-FR
2011-07-26 04:30:48 -------- d-----w- c:\windows\system32\drivers\umdf\es-ES
2011-07-26 04:26:05 -------- d-----w- c:\windows\system32\drivers\umdf\en-US
2011-07-26 04:21:01 62976 ------w- c:\windows\system32\dllcache\cdrom.sys
2011-07-26 04:21:00 465920 ------w- c:\windows\system32\imapi2fs.dll
2011-07-26 04:21:00 465920 ------w- c:\windows\system32\dllcache\imapi2fs.dll
2011-07-26 04:20:59 317952 ------w- c:\windows\system32\imapi2.dll
2011-07-26 04:20:59 317952 ------w- c:\windows\system32\dllcache\imapi2.dll
2011-07-26 04:20:57 -------- d-----w- C:\0e91795a3babe86db35fedbe26be08
.
==================== Find3M ====================
.
2011-07-15 09:47:46 0 ---ha-w- c:\documents and settings\josh\jhiurqjcku.tmp
2011-05-20 05:18:41 0 ----a-w- c:\windows\system32\ConduitEngine.tmp
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SanDisk_pSSD_16GB rev.SSD_4.46 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xAA671660]<<
_asm { MOV EAX, [ESP+0x4]; MOV ECX, [EAX+0x28]; PUSH EBP; MOV EBP, [ECX+0x4]; PUSH ESI; MOV ESI, [ESP+0x10]; PUSH EDI; MOV EDI, [ESI+0x60]; MOV AL, [EDI]; CMP AL, 0x16; JNZ 0x36; PUSH ESI; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x86567AB8]
3 CLASSPNP[0xF75E8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x863E9BB0]
\Driver\00000591[0x85DB4D58] -> IRP_MJ_CREATE -> 0xAA671660
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { CLI ; XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV SI, SP; PUSH AX; POP ES; PUSH AX; POP DS; STI ; CLD ; MOV DI, 0x600; MOV CX, 0x100; REPNZ MOVSW ; JMP FAR 0x0:0x61d; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8650E51B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 18:45:05.12 ===============

Hello and welcome to Bleeping Computer!

I am HelpBot: an automated program designed to help the Bleeping Computer Staff better assist you! This message contains very important information, so please read through all of it before doing anything.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

To help Bleeping Computer better assist you please perform the following steps:

***************************************************

In order to continue receiving help at BleepingComputer.com, YOU MUST tell me if you still need help or if your issue has already been resolved on your own or through another resource! To tell me this, please click on the following link and follow the instructions there.

CLICK THIS LINK >>> http://www.bleepingcomputer.com/logreply/414897 <<< CLICK THIS LINK

If you no longer need help, then all you needed to do was the previous instructions of telling me so. You can skip the rest of this post. If you do need help please continue with Step 2 below.

***************************************************

If you still need help, I would like you to post a Reply to this topic (click the "Add Reply" button in the lower right hand of this page). In that reply, please include the following information:

• If you have not done so already, include a clear description of the problems you're having, along with any steps you may have performed so far.
  
• A new DDS and GMER log. For your convenience, you will find the instructions for generating these logs repeated at the bottom of this post.
  
  • Please do this even if you have previously posted logs for us.
    
  • If you were unable to produce the logs originally please try once more.
    
  • If you are unable to create a log please provide detailed information about your installed Windows Operating System including the Version, Edition and if it is a 32bit or a 64bit system.
    
  • If you are unsure about any of these characteristics just post what you can and we will guide you.
  
  
• Please tell us if you have your original Windows CD/DVD available.
  
• Upon completing the above steps and posting a reply, another staff member will review your topic and do their best to resolve your issues.

Thank you for your patience, and again sorry for the delay.

***************************************************

We need to see some information about what is happening in your machine. Please perform the following scan again:

• Download DDS by sUBs from one of the following links if you no longer have it available. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explanation about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE


We also need a new log from the GMER anti-rootkit Scanner.

Please note that if you are running a 64-bit version of Windows you will not be able to run GMER and you may skip this step.

Please first disable any CD emulation programs using the steps found in this topic:


Then create another GMER log and post it as an attachment to the reply where you post your new DDS log. Instructions on how to properly create a GMER log can be found here:



As I am just a silly little program running on the BleepingComputer.com servers, please do not send me private messages as I do not know how to read and reply to them! Thanks!

Yes, I do still need help. Thank you - any help you guys can offer is very much appreciated.
I have had a lot of problems on this computer recently. Right now, everytime I click on search result links I am automatically redirected. It seems as though the computer is running slower as well. I am also getting pop-ups stating the computer has been infected with a back door trojan horse. My computer also had the XP Home Internet Security 2011 virus, but that part of the problem seems to be gone now with all I have tried.
I have used RKILL and Malwarebytes and Spybot in an attempt to fix these problems. At first the programs were successful in running their scans and each found problems and I used those programs to fix or delete what was found. Now, I am still able to use Spybot, but it doesn't detect any problems. Now, when I click on Malwarebytes it says "Windows cannot access the specified device, path, or file. You may not have the appropriate permissions to access the item." I tried reinstalling Malwarebytes and it seemed like that was going to work, but after the scan started the program just disappeared. I also tried running this in Safe Mode with Networking which didn't help. I also installed Super-Anti Spyware but that scan was also not successful because it also disappeared - this time just after opening the program. This is also the same problem I had with GMER - it closed before the scan finished. I tried to run GMER again tonight - twice - but again it disappeared right after the scan started each time.
I am using Windows XP Home Edition, a 32 bit system on an HP Mini. I do still have the Windows CDs that came with the computer. However, I don't at this time have an external CD/DVD drive. If it comes to that, I would get one... Really, THANK YOU so much for your help with this. I really appreciate it.

.
DDS (Ver_2011-06-23.01) - NTFSx86
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_23
Run by Josh at 1:37:22 on 2011-08-23
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.498 [GMT -5:00]
.
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\3203397148:3809022017.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
C:\WINDOWS\System32\svchost.exe -k Akamai
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
c:\Program Files\Zune\ZuneBusEnum.exe
C:\WINDOWS\system32\igfxtray.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\AESTFltr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\Program Files\DivX\DivX Update\DivXUpdate.exe
C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe
C:\Program Files\IDT\WDM\sttray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\uTorrent\uTorrent.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\History Channel Games\kgsystray\Kuma_tray.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
uURLSearchHooks: H - No File
uURLSearchHooks: H - No File
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
BHO: DivX Plus Web Player HTML5 <video>: {326e768d-4182-46fd-9c16-1449a49795f4} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DivX HiQ: {593ddec6-7468-4cdd-90e1-42dadaa222e9} - c:\program files\divx\divx plus web player\npdivx32.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
BHO: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
BHO: Microsoft Live Search Toolbar Helper: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Microsoft Live Search Toolbar: {1e61ed7c-7cb8-49d6-b9e9-ab4c880c8414} - c:\program files\msn\toolbar\3.0.0541.0\msneshellx.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg8\toolbar\IEToolbar.dll
TB: Conduit Engine : {30f9b915-b755-4826-820b-08fba6bd249d} - c:\program files\conduitengine\prxConduitEngine.dll
TB: uTorrentBar Toolbar: {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - c:\program files\utorrentbar\tbuTor.dll
TB: {604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - No File
EB: GoogleBar: {31dafb0b-1090-4e86-91db-11a77fba5361} - c:\documents and settings\josh\application data\google.com\googlebar\adxloader.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [uTorrent] "c:\program files\utorrent\uTorrent.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [AESTFltr] %SystemRoot%\system32\AESTFltr.exe /NoDlg
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [HP Mobile Broadband] c:\swsetup\hpqwwan\HPMobileBroadband.exe /TrayMode
mRun: [hpWirelessAssistant] c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [CarboniteSetupLite] "c:\program files\carbonite\CarbonitePreinstaller.exe" /preinstalled /showonfirst /reshowat=900
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [DivXUpdate] "c:\program files\divx\divx update\DivXUpdate.exe" /CHECKNOW
mRun: [DivX Download Manager] "c:\program files\divx\divx plus web player\DDmService.exe" start
mRun: [SysTrayApp] %ProgramFiles%\IDT\WDM\sttray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
dRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
StartupFolder: c:\docume~1\josh\startm~1\programs\startup\kuma_t~1.lnk - c:\program files\history channel games\kgsystray\Kuma_tray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
LSP: mswsock.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{E9477F00-51F7-4D30-8D5D-CD15B8218E3D} : DhcpNameServer = 192.168.1.254
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
Hosts: 127.0.0.1 www.spywareinfo.com
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\josh\application data\mozilla\firefox\profiles\qycjo2bs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - plugin: c:\program files\divx\divx ovs helper\npovshelper.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\microsoft silverlight\4.0.60310.0\npctrlui.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
FF - plugin: c:\program files\nos\bin\np_gp.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
.
---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-8-28 335240]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-8-28 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-6-29 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2008-4-14 14336]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-8-28 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-8-28 297752]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [2009-3-19 113664]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\zune\WMZuneComm.exe [2010-11-11 268528]
.
=============== Created Last 30 ================
.
2011-08-17 21:56:12 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-17 08:52:54 -------- d-----w- c:\documents and settings\josh\application data\SUPERAntiSpyware.com
2011-08-17 08:52:06 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
2011-08-13 10:42:20 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-13 10:42:13 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-13 10:42:13 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\rekn.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\pmuv.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\ohrg.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\josh\local settings\application data\fdop.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\ugqc.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\etnq.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\ejrh.exe
2011-08-13 09:16:47 0 ----a-w- c:\documents and settings\all users\application data\eeqq.exe
2011-08-13 09:16:44 358912 ----a-w- c:\documents and settings\josh\local settings\application data\kyc.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\tjpo.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\ruwk.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\qrnq.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\josh\local settings\application data\onbu.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\xgra.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\rtqa.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\ihvy.exe
2011-08-11 10:20:09 0 ----a-w- c:\documents and settings\all users\application data\cvgs.exe
2011-07-26 15:41:48 -------- d-----w- c:\documents and settings\josh\Downloads
2011-07-26 07:47:07 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2011-07-26 07:47:07 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2011-07-26 07:47:07 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2011-07-26 07:47:03 6144 ----a-w- c:\windows\system32\ff_acm.acm
2011-07-26 07:47:03 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2011-07-26 07:47:03 57344 ----a-w- c:\windows\system32\ff_vfw.dll
2011-07-26 07:47:03 258352 ----a-w- c:\windows\system32\unicows.dll
2011-07-26 07:47:03 -------- d-----w- c:\documents and settings\josh\local settings\application data\Cucusoft
2011-07-26 07:46:59 372736 ----a-w- c:\windows\system32\xvid.ax
2011-07-26 07:46:38 -------- d-----w- c:\program files\Cucusoft
2011-07-26 07:44:13 -------- d-----w- c:\documents and settings\josh\application data\GetRightToGo
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\pt-PT
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\pt-BR
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\nl-NL
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\it-IT
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\fr-FR
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\es-ES
2011-07-26 04:41:29 -------- d-----w- c:\windows\system32\de-DE
2011-07-26 04:31:59 -------- d-----w- c:\windows\system32\drivers\umdf\pt-BR
2011-07-26 04:31:51 -------- d-----w- c:\windows\system32\drivers\umdf\pt-PT
2011-07-26 04:31:38 -------- d-----w- c:\windows\system32\drivers\umdf\nl-NL
2011-07-26 04:31:26 -------- d-----w- c:\windows\system32\drivers\umdf\it-IT
2011-07-26 04:31:15 -------- d-----w- c:\windows\system32\drivers\umdf\de-DE
2011-07-26 04:31:02 -------- d-----w- c:\windows\system32\drivers\umdf\fr-FR
2011-07-26 04:30:48 -------- d-----w- c:\windows\system32\drivers\umdf\es-ES
2011-07-26 04:26:05 -------- d-----w- c:\windows\system32\drivers\umdf\en-US
2011-07-26 04:21:01 62976 ------w- c:\windows\system32\dllcache\cdrom.sys
2011-07-26 04:21:00 465920 ------w- c:\windows\system32\imapi2fs.dll
2011-07-26 04:21:00 465920 ------w- c:\windows\system32\dllcache\imapi2fs.dll
2011-07-26 04:20:59 317952 ------w- c:\windows\system32\imapi2.dll
2011-07-26 04:20:59 317952 ------w- c:\windows\system32\dllcache\imapi2.dll
2011-07-26 04:20:57 -------- d-----w- C:\0e91795a3babe86db35fedbe26be08
.
==================== Find3M ====================
.
2011-07-15 09:47:46 0 ---ha-w- c:\documents and settings\josh\jhiurqjcku.tmp
.
=================== ROOTKIT ====================
.
Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
Windows 5.1.2600 Disk: SanDisk_pSSD_16GB rev.SSD_4.46 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
.
device: opened successfully
user: MBR read successfully
.
Disk trace:
called modules: ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0xA7ED8660]<<
_asm { MOV EAX, [ESP+0x4]; MOV ECX, [EAX+0x28]; PUSH EBP; MOV EBP, [ECX+0x4]; PUSH ESI; MOV ESI, [ESP+0x10]; PUSH EDI; MOV EDI, [ESI+0x60]; MOV AL, [EDI]; CMP AL, 0x16; JNZ 0x36; PUSH ESI; }
1 ntkrnlpa!IofCallDriver[0x804EF1A6] -> \Device\Harddisk0\DR0[0x8657CAB8]
3 CLASSPNP[0xF75E8FD7] -> ntkrnlpa!IofCallDriver[0x804EF1A6] -> [0x86206960]
\Driver\00000418[0x8617B930] -> IRP_MJ_CREATE -> 0xA7ED8660
error: Read A device attached to the system is not functioning.
kernel: MBR read successfully
_asm { CLI ; XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; MOV SI, SP; PUSH AX; POP ES; PUSH AX; POP DS; STI ; CLD ; MOV DI, 0x600; MOV CX, 0x100; REPNZ MOVSW ; JMP FAR 0x0:0x61d; }
detected disk devices:
detected hooks:
\Driver\atapi DriverStartIo -> 0x8651051B
user & kernel MBR OK
Warning: possible TDL3 rootkit infection !
.
============= FINISH: 1:39:07.67 ===============

Hi,

Welcome to Bleeping Computer.

My name is Shannon and I am a real person. I will be working with you to remove the malware that is on your machine.

I apologize for the delay in replying to your post, but this forum is extremely busy.

The logs you sent did show some problems and one was a backdoor trojan. A backdoor trojan allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

If you decide to continue with the cleanup -

Please Track this topic - On the top right on this tread, click on the Option button, and, in the drop-down list, click on 'Track this topic'. Under Subscription Information, click on 'Immediate Email Notification' and then click on the Proceed button at the bottom.

Do Not make any changes on your own to the infected computer.

Please set your system to show all files.
Click Start, open My Computer, select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm.

Please download the TDSS Rootkit Removing Tool (TDSSKiller.exe) and save it to your Desktop. <-Important!!!
Be sure to download TDSSKiller.exe (v2.5.8.0) from Kaspersky's website.

• Double-click on TDSSKiller.exe to run the tool for known TDSS variants.
  Vista/Windows 7 users right-click and select Run As Administrator.
  
• If TDSSKiller does not run, try renaming it.
  
  To do this, right-click on TDSSKiller.exe, select Rename and give it a random name with the .com file extension (i.e. 123abc.com). If you do not see the file extension, please refer to How to change the file extension.
  
  
• Click the Start Scan button.
  
• Do not use the computer during the scan
  
• If the scan completes with nothing found, click Close to exit.
  
• If malicious objects are found, they will show in the Scan results - Select action for found objects and offer three options.
  
• Ensure Cure (default) is selected, then click Continue > Reboot now to finish the cleaning process.
  
• A log file named TDSSKiller_version_date_time_log.txt (i.e. C:\TDSSKiller.2.5.0_23.07.2010_15.31.43_log.txt) will be created and saved to the root directory (usually Local Disk C:).
  
• Copy and paste the contents of that file in your next reply.

Once you have the above report, click on the Add Reply button below, copy in the contents of the above report.

Hi Shannon,

I would like to go ahead with the cleanup. Thank you for your help. I followed the steps in your reply, here is the log that was produced. Thanks again!

2011/08/23 16:27:58.0578 3144 TDSS rootkit removing tool 2.5.17.0 Aug 22 2011 15:46:57
2011/08/23 16:27:59.0218 3144 ================================================================================
2011/08/23 16:27:59.0218 3144 SystemInfo:
2011/08/23 16:27:59.0218 3144
2011/08/23 16:27:59.0218 3144 OS Version: 5.1.2600 ServicePack: 3.0
2011/08/23 16:27:59.0218 3144 Product type: Workstation
2011/08/23 16:27:59.0218 3144 ComputerName: MINI
2011/08/23 16:27:59.0218 3144 UserName: Josh
2011/08/23 16:27:59.0218 3144 Windows directory: C:\WINDOWS
2011/08/23 16:27:59.0218 3144 System windows directory: C:\WINDOWS
2011/08/23 16:27:59.0218 3144 Processor architecture: Intel x86
2011/08/23 16:27:59.0218 3144 Number of processors: 2
2011/08/23 16:27:59.0218 3144 Page size: 0x1000
2011/08/23 16:27:59.0218 3144 Boot type: Normal boot
2011/08/23 16:27:59.0234 3144 ================================================================================
2011/08/23 16:28:03.0484 3144 Initialize success
2011/08/23 16:28:10.0406 3692 ================================================================================
2011/08/23 16:28:10.0406 3692 Scan started
2011/08/23 16:28:10.0406 3692 Mode: Manual;
2011/08/23 16:28:10.0406 3692 ================================================================================
2011/08/23 16:28:20.0937 3692 1cf6efbe (8f2bb1827cac01aee6a16e30a1260199) C:\WINDOWS\3203397148:3809022017.exe
2011/08/23 16:28:21.0031 3692 Suspicious file (Hidden): C:\WINDOWS\3203397148:3809022017.exe. md5: 8f2bb1827cac01aee6a16e30a1260199
2011/08/23 16:28:21.0046 3692 1cf6efbe - detected HiddenFile.Multi.Generic (1)
2011/08/23 16:28:21.0156 3692 abp480n5 (6abb91494fe6c59089b9336452ab2ea3) C:\WINDOWS\system32\DRIVERS\ABP480N5.SYS
2011/08/23 16:28:21.0218 3692 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
2011/08/23 16:28:21.0265 3692 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys
2011/08/23 16:28:21.0328 3692 adpu160m (9a11864873da202c996558b2106b0bbc) C:\WINDOWS\system32\DRIVERS\adpu160m.sys
2011/08/23 16:28:22.0296 3692 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
2011/08/23 16:28:22.0421 3692 AESTAud (f0f8212d86ef2bfdd5ad01f6ab7b017c) C:\WINDOWS\system32\drivers\AESTAud.sys
2011/08/23 16:28:22.0484 3692 Afc (fe3ea6e9afc1a78e6edca121e006afb7) C:\WINDOWS\system32\drivers\Afc.sys
2011/08/23 16:28:22.0656 3692 AFD (8087eeb2f2ce9d62656410cf7ddc1112) C:\WINDOWS\System32\drivers\afd.sys
2011/08/23 16:28:22.0671 3692 AFD - detected Rootkit.Win32.ZAccess.c (0)
2011/08/23 16:28:22.0718 3692 agp440 (08fd04aa961bdc77fb983f328334e3d7) C:\WINDOWS\system32\DRIVERS\agp440.sys
2011/08/23 16:28:22.0765 3692 agpCPQ (03a7e0922acfe1b07d5db2eeb0773063) C:\WINDOWS\system32\DRIVERS\agpCPQ.sys
2011/08/23 16:28:22.0812 3692 Aha154x (c23ea9b5f46c7f7910db3eab648ff013) C:\WINDOWS\system32\DRIVERS\aha154x.sys
2011/08/23 16:28:22.0859 3692 aic78u2 (19dd0fb48b0c18892f70e2e7d61a1529) C:\WINDOWS\system32\DRIVERS\aic78u2.sys
2011/08/23 16:28:22.0906 3692 aic78xx (b7fe594a7468aa0132deb03fb8e34326) C:\WINDOWS\system32\DRIVERS\aic78xx.sys
2011/08/23 16:28:22.0984 3692 AliIde (1140ab9938809700b46bb88e46d72a96) C:\WINDOWS\system32\DRIVERS\aliide.sys
2011/08/23 16:28:23.0031 3692 alim1541 (cb08aed0de2dd889a8a820cd8082d83c) C:\WINDOWS\system32\DRIVERS\alim1541.sys
2011/08/23 16:28:23.0078 3692 amdagp (95b4fb835e28aa1336ceeb07fd5b9398) C:\WINDOWS\system32\DRIVERS\amdagp.sys
2011/08/23 16:28:23.0125 3692 amsint (79f5add8d24bd6893f2903a3e2f3fad6) C:\WINDOWS\system32\DRIVERS\amsint.sys
2011/08/23 16:28:23.0765 3692 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
2011/08/23 16:28:23.0828 3692 asc (62d318e9a0c8fc9b780008e724283707) C:\WINDOWS\system32\DRIVERS\asc.sys
2011/08/23 16:28:23.0921 3692 asc3350p (69eb0cc7714b32896ccbfd5edcbea447) C:\WINDOWS\system32\DRIVERS\asc3350p.sys
2011/08/23 16:28:23.0968 3692 asc3550 (5d8de112aa0254b907861e9e9c31d597) C:\WINDOWS\system32\DRIVERS\asc3550.sys
2011/08/23 16:28:24.0046 3692 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
2011/08/23 16:28:24.0093 3692 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
2011/08/23 16:28:24.0171 3692 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
2011/08/23 16:28:24.0234 3692 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
2011/08/23 16:28:24.0328 3692 AvgLdx86 (bc12f2404bb6f2b6b2ff3c4c246cb752) C:\WINDOWS\System32\Drivers\avgldx86.sys
2011/08/23 16:28:24.0609 3692 AvgMfx86 (5903d729d4f0c5bca74123c96a1b29e0) C:\WINDOWS\System32\Drivers\avgmfx86.sys
2011/08/23 16:28:24.0656 3692 AvgTdiX (92d8e1e8502e649b60e70074eb29c380) C:\WINDOWS\System32\Drivers\avgtdix.sys
2011/08/23 16:28:24.0765 3692 BCM43XX (c89327377d4b62dc792e8930ea55f571) C:\WINDOWS\system32\DRIVERS\bcmwl5.sys
2011/08/23 16:28:24.0859 3692 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
2011/08/23 16:28:25.0171 3692 cbidf (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\DRIVERS\cbidf2k.sys
2011/08/23 16:28:25.0218 3692 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
2011/08/23 16:28:25.0265 3692 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
2011/08/23 16:28:25.0312 3692 cd20xrnt (f3ec03299634490e97bbce94cd2954c7) C:\WINDOWS\system32\DRIVERS\cd20xrnt.sys
2011/08/23 16:28:25.0375 3692 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
2011/08/23 16:28:25.0421 3692 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
2011/08/23 16:28:25.0468 3692 Cdrom (4b0a100eaf5c49ef3cca8c641431eacc) C:\WINDOWS\system32\DRIVERS\cdrom.sys
2011/08/23 16:28:25.0593 3692 CmBatt (0f6c187d38d98f8df904589a5f94d411) C:\WINDOWS\system32\DRIVERS\CmBatt.sys
2011/08/23 16:28:25.0640 3692 CmdIde (e5dcb56c533014ecbc556a8357c929d5) C:\WINDOWS\system32\DRIVERS\cmdide.sys
2011/08/23 16:28:25.0687 3692 Compbatt (6e4c9f21f0fae8940661144f41b13203) C:\WINDOWS\system32\DRIVERS\compbatt.sys
2011/08/23 16:28:25.0765 3692 Cpqarray (3ee529119eed34cd212a215e8c40d4b6) C:\WINDOWS\system32\DRIVERS\cpqarray.sys
2011/08/23 16:28:25.0843 3692 dac2w2k (e550e7418984b65a78299d248f0a7f36) C:\WINDOWS\system32\DRIVERS\dac2w2k.sys
2011/08/23 16:28:25.0890 3692 dac960nt (683789caa3864eb46125ae86ff677d34) C:\WINDOWS\system32\DRIVERS\dac960nt.sys
2011/08/23 16:28:25.0953 3692 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
2011/08/23 16:28:26.0046 3692 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
2011/08/23 16:28:26.0125 3692 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
2011/08/23 16:28:26.0156 3692 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
2011/08/23 16:28:26.0218 3692 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
2011/08/23 16:28:26.0296 3692 dpti2o (40f3b93b4e5b0126f2f5c0a7a5e22660) C:\WINDOWS\system32\DRIVERS\dpti2o.sys
2011/08/23 16:28:26.0328 3692 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
2011/08/23 16:28:26.0437 3692 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
2011/08/23 16:28:26.0484 3692 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\drivers\Fdc.sys
2011/08/23 16:28:26.0531 3692 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
2011/08/23 16:28:26.0703 3692 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\drivers\Flpydisk.sys
2011/08/23 16:28:26.0750 3692 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\DRIVERS\fltMgr.sys
2011/08/23 16:28:26.0796 3692 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
2011/08/23 16:28:26.0859 3692 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
2011/08/23 16:28:26.0906 3692 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
2011/08/23 16:28:26.0953 3692 HDAudBus (573c7d0a32852b48f3058cfd8026f511) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys
2011/08/23 16:28:27.0015 3692 HidUsb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
2011/08/23 16:28:27.0078 3692 hpn (b028377dea0546a5fcfba928a8aefae0) C:\WINDOWS\system32\DRIVERS\hpn.sys
2011/08/23 16:28:27.0156 3692 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
2011/08/23 16:28:27.0218 3692 i2omgmt (9368670bd426ebea5e8b18a62416ec28) C:\WINDOWS\system32\drivers\i2omgmt.sys
2011/08/23 16:28:27.0265 3692 i2omp (f10863bf1ccc290babd1a09188ae49e0) C:\WINDOWS\system32\DRIVERS\i2omp.sys
2011/08/23 16:28:27.0328 3692 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
2011/08/23 16:28:27.0781 3692 ialm (48846b31be5a4fa662ccfde7a1ba86b9) C:\WINDOWS\system32\DRIVERS\igxpmp32.sys
2011/08/23 16:28:28.0093 3692 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
2011/08/23 16:28:28.0156 3692 ini910u (4a40e045faee58631fd8d91afc620719) C:\WINDOWS\system32\DRIVERS\ini910u.sys
2011/08/23 16:28:28.0218 3692 IntelIde (b5466a9250342a7aa0cd1fba13420678) C:\WINDOWS\system32\DRIVERS\intelide.sys
2011/08/23 16:28:28.0265 3692 intelppm (8c953733d8f36eb2133f5bb58808b66b) C:\WINDOWS\system32\DRIVERS\intelppm.sys
2011/08/23 16:28:28.0312 3692 Ip6Fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys
2011/08/23 16:28:28.0718 3692 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
2011/08/23 16:28:29.0156 3692 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
2011/08/23 16:28:29.0218 3692 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
2011/08/23 16:28:29.0281 3692 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
2011/08/23 16:28:29.0343 3692 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
2011/08/23 16:28:29.0484 3692 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
2011/08/23 16:28:29.0546 3692 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
2011/08/23 16:28:29.0765 3692 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
2011/08/23 16:28:29.0812 3692 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
2011/08/23 16:28:29.0968 3692 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
2011/08/23 16:28:30.0046 3692 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
2011/08/23 16:28:30.0093 3692 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
2011/08/23 16:28:30.0156 3692 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
2011/08/23 16:28:30.0203 3692 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
2011/08/23 16:28:30.0250 3692 mraid35x (3f4bb95e5a44f3be34824e8e7caf0737) C:\WINDOWS\system32\DRIVERS\mraid35x.sys
2011/08/23 16:28:30.0296 3692 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
2011/08/23 16:28:30.0531 3692 MRxSmb (0ea4d8ed179b75f8afa7998ba22285ca) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
2011/08/23 16:28:30.0625 3692 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
2011/08/23 16:28:30.0687 3692 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
2011/08/23 16:28:30.0734 3692 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2011/08/23 16:28:30.0781 3692 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
2011/08/23 16:28:30.0828 3692 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
2011/08/23 16:28:30.0890 3692 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
2011/08/23 16:28:30.0937 3692 Mup (2f625d11385b1a94360bfc70aaefdee1) C:\WINDOWS\system32\drivers\Mup.sys
2011/08/23 16:28:30.0984 3692 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
2011/08/23 16:28:31.0062 3692 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
2011/08/23 16:28:31.0109 3692 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
2011/08/23 16:28:31.0140 3692 NdisTapi (1ab3d00c991ab086e69db84b6c0ed78f) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
2011/08/23 16:28:31.0203 3692 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
2011/08/23 16:28:31.0250 3692 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
2011/08/23 16:28:31.0296 3692 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
2011/08/23 16:28:31.0343 3692 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
2011/08/23 16:28:31.0390 3692 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
2011/08/23 16:28:31.0500 3692 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
2011/08/23 16:28:31.0546 3692 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
2011/08/23 16:28:31.0671 3692 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
2011/08/23 16:28:31.0765 3692 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
2011/08/23 16:28:31.0812 3692 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
2011/08/23 16:28:31.0859 3692 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
2011/08/23 16:28:31.0906 3692 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
2011/08/23 16:28:31.0953 3692 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\drivers\Parport.sys
2011/08/23 16:28:32.0000 3692 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
2011/08/23 16:28:32.0046 3692 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
2011/08/23 16:28:32.0093 3692 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
2011/08/23 16:28:32.0171 3692 PCIIde (ccf5f451bb1a5a2a522a76e670000ff0) C:\WINDOWS\system32\DRIVERS\pciide.sys
2011/08/23 16:28:32.0234 3692 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
2011/08/23 16:28:32.0437 3692 perc2 (6c14b9c19ba84f73d3a86dba11133101) C:\WINDOWS\system32\DRIVERS\perc2.sys
2011/08/23 16:28:32.0484 3692 perc2hib (f50f7c27f131afe7beba13e14a3b9416) C:\WINDOWS\system32\DRIVERS\perc2hib.sys
2011/08/23 16:28:32.0609 3692 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
2011/08/23 16:28:32.0671 3692 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
2011/08/23 16:28:32.0718 3692 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
2011/08/23 16:28:32.0765 3692 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\WINDOWS\system32\Drivers\PxHelp20.sys
2011/08/23 16:28:32.0812 3692 ql1080 (0a63fb54039eb5662433caba3b26dba7) C:\WINDOWS\system32\DRIVERS\ql1080.sys
2011/08/23 16:28:32.0859 3692 Ql10wnt (6503449e1d43a0ff0201ad5cb1b8c706) C:\WINDOWS\system32\DRIVERS\ql10wnt.sys
2011/08/23 16:28:32.0906 3692 ql12160 (156ed0ef20c15114ca097a34a30d8a01) C:\WINDOWS\system32\DRIVERS\ql12160.sys
2011/08/23 16:28:32.0937 3692 ql1240 (70f016bebde6d29e864c1230a07cc5e6) C:\WINDOWS\system32\DRIVERS\ql1240.sys
2011/08/23 16:28:32.0984 3692 ql1280 (907f0aeea6bc451011611e732bd31fcf) C:\WINDOWS\system32\DRIVERS\ql1280.sys
2011/08/23 16:28:33.0031 3692 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
2011/08/23 16:28:33.0093 3692 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
2011/08/23 16:28:33.0156 3692 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
2011/08/23 16:28:33.0203 3692 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
2011/08/23 16:28:33.0250 3692 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
2011/08/23 16:28:33.0296 3692 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
2011/08/23 16:28:33.0562 3692 rdpdr (15cabd0f7c00c47c70124907916af3f1) C:\WINDOWS\system32\DRIVERS\rdpdr.sys
2011/08/23 16:28:33.0734 3692 RDPWD (6728e45b66f93c08f11de2e316fc70dd) C:\WINDOWS\system32\drivers\RDPWD.sys
2011/08/23 16:28:33.0796 3692 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
2011/08/23 16:28:33.0968 3692 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
2011/08/23 16:28:34.0031 3692 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
2011/08/23 16:28:34.0109 3692 sdbus (8d04819a3ce51b9eb47e5689b44d43c4) C:\WINDOWS\system32\DRIVERS\sdbus.sys
2011/08/23 16:28:34.0140 3692 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
2011/08/23 16:28:34.0218 3692 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\drivers\Serial.sys
2011/08/23 16:28:34.0296 3692 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
2011/08/23 16:28:34.0484 3692 sisagp (6b33d0ebd30db32e27d1d78fe946a754) C:\WINDOWS\system32\DRIVERS\sisagp.sys
2011/08/23 16:28:34.0531 3692 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
2011/08/23 16:28:34.0750 3692 Sparrow (83c0f71f86d3bdaf915685f3d568b20e) C:\WINDOWS\system32\DRIVERS\sparrow.sys
2011/08/23 16:28:34.0796 3692 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
2011/08/23 16:28:34.0859 3692 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
2011/08/23 16:28:34.0921 3692 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
2011/08/23 16:28:35.0062 3692 STHDA (b9f114edd564f2c0795df14ccb8fbda7) C:\WINDOWS\system32\drivers\sthda.sys
2011/08/23 16:28:35.0187 3692 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
2011/08/23 16:28:35.0234 3692 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
2011/08/23 16:28:35.0281 3692 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
2011/08/23 16:28:35.0343 3692 symc810 (1ff3217614018630d0a6758630fc698c) C:\WINDOWS\system32\DRIVERS\symc810.sys
2011/08/23 16:28:35.0406 3692 symc8xx (070e001d95cf725186ef8b20335f933c) C:\WINDOWS\system32\DRIVERS\symc8xx.sys
2011/08/23 16:28:35.0515 3692 sym_hi (80ac1c4abbe2df3b738bf15517a51f2c) C:\WINDOWS\system32\DRIVERS\sym_hi.sys
2011/08/23 16:28:35.0578 3692 sym_u3 (bf4fab949a382a8e105f46ebb4937058) C:\WINDOWS\system32\DRIVERS\sym_u3.sys
2011/08/23 16:28:35.0625 3692 SynTP (aee6e411a915f50101895ba8dc5c15d4) C:\WINDOWS\system32\DRIVERS\SynTP.sys
2011/08/23 16:28:35.0687 3692 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
2011/08/23 16:28:35.0781 3692 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
2011/08/23 16:28:35.0828 3692 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
2011/08/23 16:28:35.0875 3692 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
2011/08/23 16:28:35.0921 3692 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
2011/08/23 16:28:35.0984 3692 TosIde (f2790f6af01321b172aa62f8e1e187d9) C:\WINDOWS\system32\DRIVERS\toside.sys
2011/08/23 16:28:36.0046 3692 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
2011/08/23 16:28:36.0093 3692 ultra (1b698a51cd528d8da4ffaed66dfc51b9) C:\WINDOWS\system32\DRIVERS\ultra.sys
2011/08/23 16:28:36.0156 3692 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
2011/08/23 16:28:36.0234 3692 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
2011/08/23 16:28:36.0281 3692 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
2011/08/23 16:28:36.0328 3692 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
2011/08/23 16:28:36.0531 3692 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
2011/08/23 16:28:36.0593 3692 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
2011/08/23 16:28:36.0640 3692 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
2011/08/23 16:28:36.0703 3692 usbvideo (63bbfca7f390f4c49ed4b96bfb1633e0) C:\WINDOWS\system32\Drivers\usbvideo.sys
2011/08/23 16:28:36.0750 3692 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
2011/08/23 16:28:36.0796 3692 viaagp (754292ce5848b3738281b4f3607eaef4) C:\WINDOWS\system32\DRIVERS\viaagp.sys
2011/08/23 16:28:36.0843 3692 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
2011/08/23 16:28:36.0890 3692 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
2011/08/23 16:28:36.0968 3692 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
2011/08/23 16:28:37.0031 3692 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
2011/08/23 16:28:37.0140 3692 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
2011/08/23 16:28:37.0250 3692 WinUSB (fd600b032e741eb6aab509fc630f7c42) C:\WINDOWS\system32\DRIVERS\WinUSB.sys
2011/08/23 16:28:37.0296 3692 WmiAcpi (c42584fd66ce9e17403aebca199f7bdb) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
2011/08/23 16:28:37.0421 3692 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
2011/08/23 16:28:37.0468 3692 WudfPf (eaa6324f51214d2f6718977ec9ce0def) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
2011/08/23 16:28:37.0531 3692 WudfRd (f91ff1e51fca30b3c3981db7d5924252) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
2011/08/23 16:28:37.0765 3692 yukonwxp (849494d3f85a45231744ca7470246c71) C:\WINDOWS\system32\DRIVERS\yk51x86.sys
2011/08/23 16:28:37.0812 3692 zumbus (337b9607f041b77824411750069aff2d) C:\WINDOWS\system32\DRIVERS\zumbus.sys
2011/08/23 16:28:37.0906 3692 MBR (0x1B8) (035ce1c0bf49cb716bd6db7a4cf480b7) \Device\Harddisk0\DR0
2011/08/23 16:28:37.0937 3692 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
2011/08/23 16:28:37.0953 3692 Boot (0x1200) (500fa83764a46f9c561db1571c647e69) \Device\Harddisk0\DR0\Partition0
2011/08/23 16:28:37.0984 3692 ================================================================================
2011/08/23 16:28:37.0984 3692 Scan finished
2011/08/23 16:28:37.0984 3692 ================================================================================
2011/08/23 16:28:38.0031 4084 Detected object count: 3
2011/08/23 16:28:38.0031 4084 Actual detected object count: 3
2011/08/23 16:30:37.0500 4084 HiddenFile.Multi.Generic(1cf6efbe) - User select action: Skip
2011/08/23 16:30:37.0546 4084 AFD (8087eeb2f2ce9d62656410cf7ddc1112) C:\WINDOWS\System32\drivers\afd.sys
2011/08/23 16:30:37.0546 4084 VerifyFileNameVersionInfo: GetFileVersionInfoSizeW(C:\WINDOWS\system32\drivers\afd.sys) error 1813
2011/08/23 16:30:39.0359 4084 Backup copy found, using it..
2011/08/23 16:30:39.0437 4084 C:\WINDOWS\System32\drivers\afd.sys - will be cured after reboot
2011/08/23 16:30:39.0437 4084 Rootkit.Win32.ZAccess.c(AFD) - User select action: Cure
2011/08/23 16:30:39.0531 4084 \Device\Harddisk0\DR0 (Rootkit.Win32.TDSS.tdl4) - will be cured after reboot
2011/08/23 16:30:39.0531 4084 \Device\Harddisk0\DR0 - ok
2011/08/23 16:30:39.0531 4084 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Cure
2011/08/23 16:30:50.0281 1372 Deinitialize success

Hi-

Looks like TDSSKiller took care of the main infection. Let's clear off some more.

Download Combofix from either of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: how-to-use-combofix

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.


Double click on combofix.exe & follow the prompts.

• When finished, it will produce a report for you.
  
• Please copy the "C:\ComboFix.txt" into your reply.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

ComboFix 11-08-24.01 - Josh 08/24/2011 3:17.1.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.721 [GMT -5:00]
Running from: c:\documents and settings\Josh\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *Disabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\Tarma Installer
c:\documents and settings\Josh\Application Data\8F5B.B45
c:\documents and settings\Josh\Application Data\Local
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\0.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\1.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\291383eb47f9555.avi.ddr
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\3.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\4.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\5.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\6.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\settings.ddi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\291383eb47f9555.avi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi(2).ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi(3).ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi(4).ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi(5).ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi(6).ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi(7).ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\gqugqkdhcbhp.avi.ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\the.vampire.diaries.s02e09.hdtv.xvid-2hd_ns(2).avi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\the.vampire.diaries.s02e09.hdtv.xvid-2hd_ns.avi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\the.vampire.diaries.s02e11_ns.avi.ddp
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\video(2).avi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\Temporary Downloaded Files\video.avi
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\the.vampire.diaries.s02e09.hdtv.xvid-2hd_ns.avi(2).ddr
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\the.vampire.diaries.s02e09.hdtv.xvid-2hd_ns.avi.ddr
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\the.vampire.diaries.s02e11_ns.avi.ddr
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\video.avi(2).ddr
c:\documents and settings\Josh\Application Data\Local\Temp\DDM\Settings\video.avi.ddr
c:\documents and settings\Josh\Application Data\PriceGong
c:\documents and settings\Josh\Application Data\PriceGong\Data\1.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\a.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\b.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\c.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\d.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\e.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\f.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\g.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\h.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\i.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\j.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\k.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\l.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\m.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\mru.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\n.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\o.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\p.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\q.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\r.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\s.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\t.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\u.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\v.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\w.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\x.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\y.xml
c:\documents and settings\Josh\Application Data\PriceGong\Data\z.xml
c:\documents and settings\Josh\jhiurqjcku.tmp
c:\documents and settings\Josh\Local Settings\Application Data\fdop.exe
c:\documents and settings\Josh\Local Settings\Application Data\kyc.exe
c:\documents and settings\Josh\Local Settings\Application Data\ohrg.exe
c:\documents and settings\Josh\Local Settings\Application Data\onbu.exe
c:\documents and settings\Josh\Local Settings\Application Data\pmuv.exe
c:\documents and settings\Josh\Local Settings\Application Data\qrnq.exe
c:\documents and settings\Josh\Local Settings\Application Data\rekn.exe
c:\documents and settings\Josh\Local Settings\Application Data\ruwk.exe
c:\documents and settings\Josh\Local Settings\Application Data\tjpo.exe
c:\windows\$NtUninstallKB3255$\485945278\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB3255$\485945278\click.tlb
c:\windows\$NtUninstallKB3255$\485945278\L\dnnkaqhd
c:\windows\$NtUninstallKB3255$\485945278\loader.tlb
c:\windows\$NtUninstallKB3255$\485945278\U\@00000001
c:\windows\$NtUninstallKB3255$\485945278\U\@000000c0
c:\windows\$NtUninstallKB3255$\485945278\U\@000000cb
c:\windows\$NtUninstallKB3255$\485945278\U\@000000cf
c:\windows\$NtUninstallKB3255$\485945278\U\@80000000
c:\windows\$NtUninstallKB3255$\485945278\U\@800000c0
c:\windows\$NtUninstallKB3255$\485945278\U\@800000cb
c:\windows\$NtUninstallKB3255$\485945278\U\@800000cf
c:\windows\assembly\GAC_MSIL\desktop.ini
c:\windows\system32\_000006_.tmp.dll
c:\windows\system32\drivers\etc\hosts.txt
c:\windows\TEMP\MPENGINE.DLL
Pass LEGAL for license information. Built Sat Jun 25 23:20 2011c:\windows\system32\drivers\avgldx86.sys
c:\windows\$NtUninstallKB3255$\778504579 . . . . Failed to delete
.
c:\windows\system32\drivers\avgldx86.sys . . . is infected!! . . . Failed to find a valid replacement.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_1cf6efbe
.
.
((((((((((((((((((((((((( Files Created from 2011-07-24 to 2011-08-24 )))))))))))))))))))))))))))))))
.
.
2011-08-24 08:25 . 2011-08-24 09:19 -------- d-----w- c:\windows\SxsCaPendDel
2011-08-23 21:32 . 2011-08-23 21:32 43408 --sha-w- c:\windows\system32\c_47915.nl_
2011-08-17 21:56 . 2011-08-17 21:56 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-17 08:52 . 2011-08-17 08:52 -------- d-----w- c:\documents and settings\Josh\Application Data\SUPERAntiSpyware.com
2011-08-17 08:52 . 2011-08-17 08:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-13 10:42 . 2011-07-07 00:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-13 10:42 . 2011-08-17 23:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-13 10:42 . 2011-07-07 00:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\ugqc.exe
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\etnq.exe
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\ejrh.exe
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\eeqq.exe
2011-08-13 09:05 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-13 09:05 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys
2011-08-13 08:56 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-12 09:06 . 2011-08-12 09:06 -------- d-----w- c:\documents and settings\Administrator
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\xgra.exe
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\rtqa.exe
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\ihvy.exe
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\cvgs.exe
2011-07-26 15:41 . 2011-07-27 07:00 -------- d-----w- c:\documents and settings\Josh\Downloads
2011-07-26 07:47 . 2003-03-19 03:20 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2011-07-26 07:47 . 2003-03-19 02:14 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2011-07-26 07:47 . 2003-02-21 10:42 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2011-07-26 07:47 . 2011-07-26 07:47 -------- d-----w- c:\documents and settings\Josh\Local Settings\Application Data\Cucusoft
2011-07-26 07:47 . 2008-12-18 06:22 57344 ----a-w- c:\windows\system32\ff_vfw.dll
2011-07-26 07:47 . 2008-06-16 02:13 6144 ----a-w- c:\windows\system32\ff_acm.acm
2011-07-26 07:47 . 2008-06-15 15:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2011-07-26 07:47 . 2008-06-15 15:01 258352 ----a-w- c:\windows\system32\unicows.dll
2011-07-26 07:46 . 2003-03-31 01:08 372736 ----a-w- c:\windows\system32\xvid.ax
2011-07-26 07:46 . 2011-07-26 07:46 -------- d-----w- c:\program files\Cucusoft
2011-07-26 07:44 . 2011-07-26 07:46 -------- d-----w- c:\documents and settings\Josh\Application Data\GetRightToGo
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\pt-PT
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\pt-BR
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\nl-NL
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\it-IT
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\fr-FR
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\es-ES
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\de-DE
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\pt-BR
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\pt-PT
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\nl-NL
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\it-IT
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\de-DE
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\fr-FR
2011-07-26 04:30 . 2011-07-26 04:30 -------- d-----w- c:\windows\system32\drivers\UMDF\es-ES
2011-07-26 04:26 . 2011-07-26 04:26 -------- d-----w- c:\windows\system32\drivers\UMDF\en-US
2011-07-26 04:24 . 2011-07-26 04:33 -------- d-----w- c:\program files\Zune
2011-07-26 04:21 . 2008-05-02 10:49 62976 ------w- c:\windows\system32\dllcache\cdrom.sys
2011-07-26 04:21 . 2008-05-02 13:25 465920 ------w- c:\windows\system32\imapi2fs.dll
2011-07-26 04:21 . 2008-05-02 13:25 465920 ------w- c:\windows\system32\dllcache\imapi2fs.dll
2011-07-26 04:20 . 2008-05-02 13:25 317952 ------w- c:\windows\system32\imapi2.dll
2011-07-26 04:20 . 2008-05-02 13:25 317952 ------w- c:\windows\system32\dllcache\imapi2.dll
2011-07-26 04:20 . 2011-07-26 04:22 -------- d-----w- C:\0e91795a3babe86db35fedbe26be08
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-22 16:35 . 2011-07-22 16:35 3613696 ----a-w- c:\windows\system32\SET61.tmp
2011-07-15 13:29 . 2009-06-27 23:59 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-15 04:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-04-15 04:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:45 . 2011-06-21 18:45 832512 ----a-w- c:\windows\system32\SET58.tmp
2011-06-21 18:45 . 2011-06-21 18:45 52224 ----a-w- c:\windows\system32\SET62.tmp
2011-06-21 18:45 . 2011-06-21 18:45 1168896 ----a-w- c:\windows\system32\SET5A.tmp
2011-06-21 18:45 . 2011-06-21 18:45 106496 ----a-w- c:\windows\system32\SET5B.tmp
2011-06-21 18:45 . 2011-06-21 18:45 63488 ----a-w- c:\windows\system32\SET72.tmp
2011-06-21 18:45 . 2011-06-21 18:45 6076416 ----a-w- c:\windows\system32\SET6B.tmp
2011-06-21 18:45 . 2011-06-21 18:45 468480 ----a-w- c:\windows\system32\SET63.tmp
2011-06-21 18:45 . 2011-06-21 18:45 380928 ----a-w- c:\windows\system32\SET6D.tmp
2011-06-21 18:45 . 2011-06-21 18:45 268288 ----a-w- c:\windows\system32\SET67.tmp
2011-06-21 18:45 . 2011-06-21 18:45 124928 ----a-w- c:\windows\system32\SET76.tmp
2011-06-21 18:45 . 2009-10-29 07:46 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-21 18:45 . 2009-10-29 07:46 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:45 . 2009-10-29 07:46 17408 ----a-w- c:\windows\system32\corpol.dll
2011-06-21 11:47 . 2009-10-28 14:36 389120 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2011-06-20 17:44 293376 ------w- c:\windows\system32\SETDC.tmp
2011-06-02 14:02 . 2009-08-14 13:21 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-01 15:26 . 2011-03-27 01:58 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
.
[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 21:01 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 18:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-15 399736]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-08-12 4603264]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-18 737280]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-04 1410344]
"HP Mobile Broadband"="c:\swsetup\HPQWWAN\HPMobileBroadband.exe" [2008-07-08 439600]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-11 2048352]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-06-04 450652]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-11-11 159472]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
.
c:\documents and settings\Josh\Start Menu\Programs\Startup\
Kuma_Tray.lnk - c:\program files\History Channel Games\kgsystray\Kuma_tray.exe [2011-3-30 33472]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-08-28 20:18 11952 ----a-w- c:\windows\system32\avgrsstx.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\History Channel Games\\Kuma.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\DivX\\DivX Plus Web Player\\DDMService.exe"=
"c:\\Program Files\\History Channel Games\\kgsystray\\Kuma_tray.exe"=
"c:\\Program Files\\DivX\\DivX Update\\DivXUpdate.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Spybot - Search & Destroy\\SDUpdate.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\SUPERAntiSpyware.exe"=
"c:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller(1).exe"=
"c:\\Documents and Settings\\Josh\\Local Settings\\Temp\\Temporary Directory 1 for tdsskiller.zip\\TDSSKiller.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller(1)\\TDSSKiller.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller\\TDSSKiller.exe"=
"c:\\Documents and Settings\\Josh\\Desktop\\tdsskiller.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"1035:TCP"= 1035:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [8/28/2009 3:18 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [6/29/2009 1:36 PM 108552]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 6:38 PM 116608]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/14/2008 11:00 PM 14336]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [8/28/2009 3:17 PM 297752]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [3/19/2009 3:55 PM 113664]
S2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [8/28/2009 3:17 PM 908056]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [11/11/2010 1:57 PM 268528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
URLSearchHooks-*{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - (no file)
HKLM-Run-SunJavaUpdateSched - c:\program files\Java\jre6\bin\jusched.exe
SafeBoot-58916725.sys
SafeBoot-WudfPf
SafeBoot-WudfRd
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-24 04:21
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2\Parameters]
@DACL=(02 0000)
@SACL=
"WinSock_Registry_Version"="2.0"
"Current_NameSpace_Catalog"="NameSpace_Catalog5"
"Current_Protocol_Catalog"="Protocol_Catalog9"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(792)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(3688)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Zune\ZuneBusEnum.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
.
**************************************************************************
.
Completion time: 2011-08-24 04:28:58 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-24 09:28
.
Pre-Run: 1,187,651,584 bytes free
Post-Run: 1,063,636,992 bytes free
.
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
[spybotsd]
timeout.old=30
.
- - End Of File - - DBCCCF310A5C17CFBF29D699E3229A29

Hi-

ComboFix cleared up some infections. It also identified an infection in avgldx86.sys, an AVG driver, but was unable to replace it with a good copy since none was available. Probably, the easiest way to take care of that infection is for you to uninstall AVG Free 8.5, and replace it with AVG Anti-Virus Free 2011. After you uninstall AVG 8.5 but before you install the 2011 version, rerun ComboFix and copy the new report into your reply.

Hi,

I uninstalled AVG Free 8.5 and ran combofix again. Here is the new log.

Thank you.

ComboFix 11-08-24.06 - Josh 08/24/2011 22:34:07.2.2 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1015.725 [GMT -5:00]
Running from: c:\documents and settings\Josh\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{23c0ced8-8028-4aa8-ab45-572e8f8e4e02}
c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{23c0ced8-8028-4aa8-ab45-572e8f8e4e02}\chrome.manifest
c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{23c0ced8-8028-4aa8-ab45-572e8f8e4e02}\chrome\xulcache.jar
c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{23c0ced8-8028-4aa8-ab45-572e8f8e4e02}\defaults\preferences\xulcache.js
c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{23c0ced8-8028-4aa8-ab45-572e8f8e4e02}\install.rdf
c:\windows\$NtUninstallKB3255$
c:\windows\$NtUninstallKB3255$\202307640
c:\windows\$NtUninstallKB3255$\485945278\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}
c:\windows\$NtUninstallKB3255$\485945278\L\dnnkaqhd
c:\windows\$NtUninstallKB3255$\485945278\loader.tlb
c:\windows\$NtUninstallKB3255$\485945278\U\@00000001
c:\windows\$NtUninstallKB3255$\485945278\U\@000000c0
c:\windows\$NtUninstallKB3255$\485945278\U\@000000cb
c:\windows\$NtUninstallKB3255$\485945278\U\@000000cf
c:\windows\$NtUninstallKB3255$\485945278\U\@80000000
c:\windows\$NtUninstallKB3255$\485945278\U\@800000c0
c:\windows\$NtUninstallKB3255$\485945278\U\@800000cb
c:\windows\$NtUninstallKB3255$\485945278\U\@800000cf
c:\windows\$NtUninstallKB3255$\778504579
c:\windows\system32\_000007_.tmp.dll
c:\windows\system32\c_47915.nls
.
Infected copy of c:\windows\system32\drivers\i8042prt.sys was found and disinfected
Restored copy from - The cat found it
Infected copy of c:\program files\SUPERAntiSpyware\SASCORE.EXE was found and disinfected
Restored copy from - c:\system volume information\_restore{E0F24961-02F2-45C4-9A86-797FFEC8BF9E}\RP408\A0073050.exe
.
Infected copy of c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe was found and disinfected
Restored copy from - c:\system volume information\_restore{E0F24961-02F2-45C4-9A86-797FFEC8BF9E}\RP405\A0070585.exe
.
Infected copy of c:\program files\Java\jre6\bin\jqs.exe was found and disinfected
Restored copy from - c:\system volume information\_restore{E0F24961-02F2-45C4-9A86-797FFEC8BF9E}\RP405\A0070592.exe
.
Infected copy of c:\program files\Zune\ZuneBusEnum.exe was found and disinfected
Restored copy from - c:\system volume information\_restore{E0F24961-02F2-45C4-9A86-797FFEC8BF9E}\RP405\A0070591.exe
.
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_1cf6efbe
.
.
((((((((((((((((((((((((( Files Created from 2011-07-25 to 2011-08-25 )))))))))))))))))))))))))))))))
.
.
2011-08-25 03:29 . 2008-04-14 08:48 52480 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2011-08-24 08:25 . 2011-08-24 09:19 -------- d-----w- c:\windows\SxsCaPendDel
2011-08-23 21:32 . 2011-08-25 03:21 43408 --sha-w- c:\windows\system32\c_47915.nl_
2011-08-17 21:56 . 2011-08-25 03:42 -------- d-----w- c:\program files\SUPERAntiSpyware
2011-08-17 08:52 . 2011-08-17 08:52 -------- d-----w- c:\documents and settings\Josh\Application Data\SUPERAntiSpyware.com
2011-08-17 08:52 . 2011-08-17 08:52 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2011-08-13 10:42 . 2011-07-07 00:52 41272 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-08-13 10:42 . 2011-08-17 23:20 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-08-13 10:42 . 2011-07-07 00:52 22712 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\ugqc.exe
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\etnq.exe
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\ejrh.exe
2011-08-13 09:16 . 2011-08-13 09:16 0 ----a-w- c:\documents and settings\All Users\Application Data\eeqq.exe
2011-08-13 09:05 . 2011-06-24 14:10 139656 ------w- c:\windows\system32\dllcache\rdpwd.sys
2011-08-13 09:05 . 2011-04-21 13:37 105472 ------w- c:\windows\system32\dllcache\mup.sys
2011-08-13 08:56 . 2011-07-08 14:02 10496 ------w- c:\windows\system32\dllcache\ndistapi.sys
2011-08-12 09:06 . 2011-08-25 03:18 -------- d-----w- c:\documents and settings\Administrator
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\xgra.exe
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\rtqa.exe
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\ihvy.exe
2011-08-11 10:20 . 2011-08-11 10:20 0 ----a-w- c:\documents and settings\All Users\Application Data\cvgs.exe
2011-07-26 15:41 . 2011-07-27 07:00 -------- d-----w- c:\documents and settings\Josh\Downloads
2011-07-26 07:47 . 2003-03-19 03:20 1060864 ----a-w- c:\windows\system32\MFC71.DLL
2011-07-26 07:47 . 2003-03-19 02:14 499712 ----a-w- c:\windows\system32\MSVCP71.DLL
2011-07-26 07:47 . 2003-02-21 10:42 348160 ----a-w- c:\windows\system32\MSVCR71.DLL
2011-07-26 07:47 . 2011-07-26 07:47 -------- d-----w- c:\documents and settings\Josh\Local Settings\Application Data\Cucusoft
2011-07-26 07:47 . 2008-12-18 06:22 57344 ----a-w- c:\windows\system32\ff_vfw.dll
2011-07-26 07:47 . 2008-06-16 02:13 6144 ----a-w- c:\windows\system32\ff_acm.acm
2011-07-26 07:47 . 2008-06-15 15:01 60273 ----a-w- c:\windows\system32\pthreadGC2.dll
2011-07-26 07:47 . 2008-06-15 15:01 258352 ----a-w- c:\windows\system32\unicows.dll
2011-07-26 07:46 . 2003-03-31 01:08 372736 ----a-w- c:\windows\system32\xvid.ax
2011-07-26 07:46 . 2011-07-26 07:46 -------- d-----w- c:\program files\Cucusoft
2011-07-26 07:44 . 2011-07-26 07:46 -------- d-----w- c:\documents and settings\Josh\Application Data\GetRightToGo
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\pt-PT
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\pt-BR
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\nl-NL
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\it-IT
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\fr-FR
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\es-ES
2011-07-26 04:41 . 2011-07-26 04:41 -------- d-----w- c:\windows\system32\de-DE
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\pt-BR
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\pt-PT
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\nl-NL
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\it-IT
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\de-DE
2011-07-26 04:31 . 2011-07-26 04:31 -------- d-----w- c:\windows\system32\drivers\UMDF\fr-FR
2011-07-26 04:30 . 2011-07-26 04:30 -------- d-----w- c:\windows\system32\drivers\UMDF\es-ES
2011-07-26 04:26 . 2011-07-26 04:26 -------- d-----w- c:\windows\system32\drivers\UMDF\en-US
2011-07-26 04:24 . 2011-08-25 03:44 -------- d-----w- c:\program files\Zune
2011-07-26 04:21 . 2008-05-02 10:49 62976 ------w- c:\windows\system32\dllcache\cdrom.sys
2011-07-26 04:21 . 2008-05-02 13:25 465920 ------w- c:\windows\system32\imapi2fs.dll
2011-07-26 04:21 . 2008-05-02 13:25 465920 ------w- c:\windows\system32\dllcache\imapi2fs.dll
2011-07-26 04:20 . 2008-05-02 13:25 317952 ------w- c:\windows\system32\imapi2.dll
2011-07-26 04:20 . 2008-05-02 13:25 317952 ------w- c:\windows\system32\dllcache\imapi2.dll
2011-07-26 04:20 . 2011-07-26 04:22 -------- d-----w- C:\0e91795a3babe86db35fedbe26be08
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-07-22 16:35 . 2011-07-22 16:35 3613696 ----a-w- c:\windows\system32\SET61.tmp
2011-07-15 13:29 . 2009-06-27 23:59 456320 ----a-w- c:\windows\system32\drivers\mrxsmb.sys
2011-07-08 14:02 . 2008-04-15 04:00 10496 ----a-w- c:\windows\system32\drivers\ndistapi.sys
2011-06-24 14:10 . 2008-04-15 04:00 139656 ----a-w- c:\windows\system32\drivers\rdpwd.sys
2011-06-21 18:45 . 2011-06-21 18:45 832512 ----a-w- c:\windows\system32\SET58.tmp
2011-06-21 18:45 . 2011-06-21 18:45 52224 ----a-w- c:\windows\system32\SET62.tmp
2011-06-21 18:45 . 2011-06-21 18:45 1168896 ----a-w- c:\windows\system32\SET5A.tmp
2011-06-21 18:45 . 2011-06-21 18:45 106496 ----a-w- c:\windows\system32\SET5B.tmp
2011-06-21 18:45 . 2011-06-21 18:45 63488 ----a-w- c:\windows\system32\SET72.tmp
2011-06-21 18:45 . 2011-06-21 18:45 6076416 ----a-w- c:\windows\system32\SET6B.tmp
2011-06-21 18:45 . 2011-06-21 18:45 468480 ----a-w- c:\windows\system32\SET63.tmp
2011-06-21 18:45 . 2011-06-21 18:45 380928 ----a-w- c:\windows\system32\SET6D.tmp
2011-06-21 18:45 . 2011-06-21 18:45 268288 ----a-w- c:\windows\system32\SET67.tmp
2011-06-21 18:45 . 2011-06-21 18:45 124928 ----a-w- c:\windows\system32\SET76.tmp
2011-06-21 18:45 . 2009-10-29 07:46 1830912 ----a-w- c:\windows\system32\inetcpl.cpl
2011-06-21 18:45 . 2009-10-29 07:46 78336 ----a-w- c:\windows\system32\ieencode.dll
2011-06-21 18:45 . 2009-10-29 07:46 17408 ----a-w- c:\windows\system32\corpol.dll
2011-06-21 11:47 . 2009-10-28 14:36 389120 ----a-w- c:\windows\system32\html.iec
2011-06-20 17:44 . 2011-06-20 17:44 293376 ------w- c:\windows\system32\SETDC.tmp
2011-06-02 14:02 . 2009-08-14 13:21 1858944 ----a-w- c:\windows\system32\win32k.sys
2011-05-01 15:26 . 2011-03-27 01:58 142296 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((( SnapShot@2011-08-24_09.21.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2011-08-25 03:47 . 2011-08-25 03:47 16384 c:\windows\temp\Perflib_Perfdata_2bc.dat
+ 2011-08-25 03:47 . 2011-08-25 03:47 16384 c:\windows\temp\Perflib_Perfdata_280.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}]
2011-03-28 16:22 176936 ----a-w- c:\program files\ConduitEngine\prxConduitEngine.dll
.
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
2010-12-09 18:51 3911776 ----a-w- c:\program files\uTorrentBar\tbuTor.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{30F9B915-B755-4826-820B-08FBA6BD249D}"= "c:\program files\ConduitEngine\prxConduitEngine.dll" [2011-03-28 176936]
"{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{30f9b915-b755-4826-820b-08fba6bd249d}]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC}"= "c:\program files\uTorrentBar\tbuTor.dll" [2010-12-09 3911776]
.
[HKEY_CLASSES_ROOT\clsid\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"uTorrent"="c:\program files\uTorrent\uTorrent.exe" [2011-06-15 399736]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-08-12 4603264]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-02-15 135168]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-02-15 159744]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-02-15 131072]
"AESTFltr"="c:\windows\system32\AESTFltr.exe" [2009-02-18 737280]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-04 1410344]
"HP Mobile Broadband"="c:\swsetup\HPQWWAN\HPMobileBroadband.exe" [2008-07-08 439600]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752]
"CarboniteSetupLite"="c:\program files\Carbonite\CarbonitePreinstaller.exe" [2009-08-04 318096]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-01-31 35760]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-12-09 1226608]
"DivX Download Manager"="c:\program files\DivX\DivX Plus Web Player\DDmService.exe" [2010-12-08 63360]
"SysTrayApp"="c:\program files\IDT\WDM\sttray.exe" [2009-06-04 450652]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2010-11-11 159472]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-15 15360]
.
c:\documents and settings\Josh\Start Menu\Programs\Startup\
Kuma_Tray.lnk - c:\program files\History Channel Games\kgsystray\Kuma_tray.exe [2011-3-30 33472]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\History Channel Games\\Kuma.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\DivX\\DivX Plus Web Player\\DDMService.exe"=
"c:\\Program Files\\History Channel Games\\kgsystray\\Kuma_tray.exe"=
"c:\\Program Files\\DivX\\DivX Update\\DivXUpdate.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\java.exe"=
"c:\\Program Files\\Spybot - Search & Destroy\\SDUpdate.exe"=
"c:\\Program Files\\Malwarebytes' Anti-Malware\\mbam.exe"=
"c:\\Program Files\\Mozilla Firefox\\plugin-container.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\SUPERAntiSpyware.exe"=
"c:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller(1).exe"=
"c:\\Documents and Settings\\Josh\\Local Settings\\Temp\\Temporary Directory 1 for tdsskiller.zip\\TDSSKiller.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller(1)\\TDSSKiller.exe"=
"c:\\Documents and Settings\\Josh\\My Documents\\Downloads\\tdsskiller\\TDSSKiller.exe"=
"c:\\Documents and Settings\\Josh\\Desktop\\tdsskiller.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009
"1033:TCP"= 1033:TCP:Akamai NetSession Interface
"5000:UDP"= 5000:UDP:Akamai NetSession Interface
.
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 11:27 AM 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 4:55 PM 67664]
R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE.EXE [8/11/2011 6:38 PM 116608]
R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [4/14/2008 11:00 PM 14336]
R3 AESTAud;AE Audio Service;c:\windows\system32\drivers\AESTAud.sys [3/19/2009 3:55 PM 113664]
S3 WMZuneComm;Zune Windows Mobile Connectivity Service;c:\program files\Zune\WMZuneComm.exe [11/11/2010 1:57 PM 268528]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
Akamai REG_MULTI_SZ Akamai
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
TCP: DhcpNameServer = 192.168.1.254
FF - ProfilePath - c:\documents and settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q=
FF - user.js: yahoo.homepage.dontask - true
.
- - - - ORPHANS REMOVED - - - -
.
Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
WebBrowser-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-08-24 22:48
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_LOCAL_MACHINE\software\Swearware\backup\winsock2\Parameters]
@DACL=(02 0000)
@SACL=
"WinSock_Registry_Version"="2.0"
"Current_NameSpace_Catalog"="NameSpace_Catalog5"
"Current_Protocol_Catalog"="Protocol_Catalog9"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(792)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll
.
- - - - - - - > 'explorer.exe'(2336)
c:\windows\system32\WININET.dll
c:\windows\system32\IEFRAME.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Zune\ZuneBusEnum.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\igfxsrvc.exe
c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
c:\program files\Hewlett-Packard\Shared\HpqToaster.exe
.
**************************************************************************
.
Completion time: 2011-08-24 22:54:04 - machine was rebooted
ComboFix-quarantined-files.txt 2011-08-25 03:53
ComboFix2.txt 2011-08-24 09:28
.
Pre-Run: 1,218,924,544 bytes free
Post-Run: 1,206,661,120 bytes free
.
- - End Of File - - 0738EDE369E52874D424D4B497E0B5CA

Hi-

Hopefully, ComboFix has found and cleaned most of the infections. We need to do some more looking.

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
  
• If the AV Scan window appears, select (none).
  
• Click Scan (if asked to update the Avast anti-virus definitions, click on No).
  
• When you get the "Scan finished successfully" message, click the save log button, save it to your desktop (MBR.txt) and post it in your next reply.
  
• It will also copy the MBR (Master Boot Record) into a file on your desktop as MBR.dat.

Please run Malwarebytes' Anti-Malware (MBAM)

• Click on the Update tab and click the Check for Updates button.
  
• When the update is finished, click on the Scanner tab.
  
• Select "Perform Full Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy & Paste the entire report in your next reply.

Go ahead and install AVG 2011, if you haven't already.

Next, do a new OTL scan.

• Double click on the icon on your desktop.
  
• In the Extra Registry Box, check None
  
• Click the "Scan All Users" checkbox.
  
• Push the button.
  
• A report will open, copy and paste it into your reply:
  
• OTL.txt <-- Will be the opened report

In your reply, please copy in the aswMBR, MBAM, and OTL reports. How is your computer running?

I did install AVG 2011. Here are the aswMBR and the MBAM reports. However, I do not have the OTL report. I do not have the OTL icon on my desktop. I couldn't find it on my computer. Where can I download that from again?
Thank you

aswMBR version 0.9.8.986 Copyright© 2011 AVAST Software
Run date: 2011-08-26 00:10:44
-----------------------------
00:10:44.671 OS Version: Windows 5.1.2600 Service Pack 3
00:10:44.671 Number of processors: 2 586 0x1C02
00:10:44.671 ComputerName: MINI UserName: Josh
00:10:47.078 Initialize success
00:11:09.234 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
00:11:09.250 Disk 0 Vendor: SanDisk_pSSD_16GB SSD_4.46 Size: 15631MB BusType: 3
00:11:11.265 Disk 0 MBR read successfully
00:11:11.265 Disk 0 MBR scan
00:11:11.281 Disk 0 unknown MBR code
00:11:11.312 Disk 0 scanning sectors +31985415
00:11:11.343 Disk 0 scanning C:\WINDOWS\system32\drivers
00:11:15.687 Service scanning
00:11:17.250 Modules scanning
00:11:19.937 Disk 0 trace - called modules:
00:11:19.968 ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys hal.dll atapi.sys pciide.sys PCIIDEX.SYS
00:11:19.984 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8657bab8]
00:11:20.000 3 CLASSPNP.SYS[f75e8fd7] -> nt!IofCallDriver -> \Device\00000066[0x8657c9e8]
00:11:20.015 5 ACPI.sys[f745f620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x86549d98]
00:11:20.046 Scan finished successfully
00:11:47.875 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Josh\Desktop\MBR.dat"
00:11:47.921 The log file has been saved successfully to "C:\Documents and Settings\Josh\Desktop\aswMBR.txt"


Malwarebytes' Anti-Malware 1.51.1.1800
www.malwarebytes.org

Database version: 7573

Windows 5.1.2600 Service Pack 3
Internet Explorer 7.0.5730.13

8/26/2011 12:34:55 AM
mbam-log-2011-08-26 (00-34-55).txt

Scan type: Full scan (C:\|)
Objects scanned: 201128
Time elapsed: 19 minute(s), 51 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\documents and settings\Josh\application data\Sun\Java\deployment\cache\6.0\51\37a2ee33-6539157b (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\documents and settings\Josh\application data\Sun\Java\deployment\cache\6.0\60\6e2e39fc-3b1cd19b (Trojan.Agent) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\documents and settings\Josh\local settings\application data\kyc.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
c:\system volume information\_restore{e0f24961-02f2-45c4-9a86-797ffec8bf9e}\RP406\A0070764.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{e0f24961-02f2-45c4-9a86-797ffec8bf9e}\RP406\A0070758.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
c:\system volume information\_restore{e0f24961-02f2-45c4-9a86-797ffec8bf9e}\RP410\A0073514.exe (Trojan.Agent) -> Quarantined and deleted successfully.
c:\documents and settings\all users\application data\ugqc.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Hi-

Here is the info for OTL.

• Please download OTL from here:
  
• Main Mirror
  
• Save it to your desktop.
  
• Double click on the icon on your desktop.
  
• Click the "Scan All Users" checkbox.
  
• Change the "Extra Registry" option to "None"
  
• Push the button.
  
• One report will open, copy and paste it into your reply:

• OTL.txt <-- Will be opened

In your reply, copy in the OTL report and let me know how your computer is doing.

Thank you. Here is the OTL report. My computer seems to be running well now.



OTL logfile created on: 8/26/2011 3:47:22 PM - Run 1
OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\Josh\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

1015.23 Mb Total Physical Memory | 476.39 Mb Available Physical Memory | 46.92% Memory free
2.39 Gb Paging File | 1.93 Gb Available in Paging File | 80.95% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 15.25 Gb Total Space | 0.60 Gb Free Space | 3.93% Space Free | Partition Type: NTFS

Computer Name: MINI | User Name: Josh | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/08/26 15:45:51 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Josh\Desktop\OTL.exe
PRC - [2011/08/11 18:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/06/15 03:55:44 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe
PRC - [2011/04/18 17:40:08 | 002,334,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgtray.exe
PRC - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe
PRC - [2011/04/14 05:36:42 | 001,080,672 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgnsx.exe
PRC - [2011/03/16 16:05:20 | 001,025,888 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgemcx.exe
PRC - [2011/03/16 16:05:14 | 000,656,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgchsvx.exe
PRC - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
PRC - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgwdsvc.exe
PRC - [2011/02/08 05:33:20 | 000,658,784 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG10\avgrsx.exe
PRC - [2010/12/09 14:28:24 | 001,226,608 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2010/12/08 16:15:44 | 000,063,360 | ---- | M] (DivX, LLC) -- C:\Program Files\DivX\DivX Plus Web Player\DDMService.exe
PRC - [2010/11/11 13:55:56 | 000,057,072 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Zune\ZuneBusEnum.exe
PRC - [2010/08/10 18:09:26 | 000,033,472 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\Kuma_tray.exe
PRC - [2009/06/03 20:43:18 | 000,450,652 | ---- | M] (IDT, Inc.) -- C:\Program Files\IDT\WDM\sttray.exe
PRC - [2009/02/18 18:41:56 | 000,737,280 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\AESTFltr.exe
PRC - [2008/04/14 23:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2011/08/01 16:32:48 | 003,542,616 | ---- | M] () -- c:\Program Files\Common Files\Akamai\netsession_win_2da1ebd.dll
MOD - [2011/02/10 07:55:18 | 001,148,256 | ---- | M] () -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSMonitor.exe
MOD - [2010/12/09 14:29:16 | 000,096,112 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010/12/09 14:28:24 | 001,226,608 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
MOD - [2010/08/10 18:09:26 | 000,033,472 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\Kuma_tray.exe
MOD - [2006/10/18 08:35:26 | 000,049,152 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\_socket.pyd
MOD - [2006/10/18 08:35:16 | 000,135,168 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\pyexpat.pyd
MOD - [2006/10/18 08:35:14 | 000,069,632 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\zlib.pyd
MOD - [2006/10/18 08:35:10 | 001,871,872 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\python24.dll
MOD - [2006/10/18 08:18:58 | 000,499,712 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\_ssl.pyd
MOD - [2006/09/22 21:12:02 | 000,131,072 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\winxpgui.pyd
MOD - [2006/09/22 21:11:58 | 000,114,688 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\win32gui.pyd
MOD - [2006/09/22 21:02:10 | 000,086,016 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\win32api.pyd
MOD - [2006/09/22 21:01:50 | 000,102,400 | ---- | M] () -- C:\Program Files\History Channel Games\kgsystray\pywintypes24.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- -- (STacSV)
SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt)
SRV - File not found [On_Demand | Stopped] -- -- (ACDaemon)
SRV - [2011/08/11 18:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011/08/01 16:32:48 | 003,542,616 | ---- | M] () [Auto | Running] -- c:\Program Files\Common Files\Akamai\netsession_win_2da1ebd.dll -- (Akamai)
SRV - [2011/07/26 10:16:02 | 001,025,352 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe -- (AVG Security Toolbar Service)
SRV - [2011/04/18 17:39:42 | 007,398,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\Identity Protection\Agent\Bin\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011/02/08 05:33:42 | 000,269,520 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG10\avgwdsvc.exe -- (avgwd)
SRV - [2010/11/11 13:57:04 | 000,268,528 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm)
SRV - [2010/11/11 13:57:02 | 000,444,656 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2010/11/11 13:55:56 | 006,351,600 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- c:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2010/11/11 13:55:56 | 000,057,072 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Zune\ZuneBusEnum.exe -- (ZuneBusEnum)


========== Driver Services (SafeList) ==========

DRV - [2011/07/22 11:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys -- (SASDIFSV)
DRV - [2011/07/12 16:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/07/06 19:52:42 | 000,041,272 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2011/04/14 21:28:42 | 000,134,480 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV - [2011/04/05 00:59:56 | 000,297,168 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgtdix.sys -- (Avgtdix)
DRV - [2011/03/16 16:03:20 | 000,032,592 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\avgrkx86.sys -- (Avgrkx86)
DRV - [2011/03/01 14:25:18 | 000,034,896 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\avgmfx86.sys -- (Avgmfx86)
DRV - [2011/02/22 08:13:02 | 000,022,992 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\AVGIDSEH.Sys -- (AVGIDSEH)
DRV - [2011/02/10 07:53:54 | 000,027,216 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSShim.sys -- (AVGIDSShim)
DRV - [2011/02/10 07:53:52 | 000,024,144 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV - [2011/01/07 06:41:46 | 000,248,656 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\avgldx86.sys -- (Avgldx86)
DRV - [2009/06/03 20:43:18 | 001,640,131 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sthda.sys -- (STHDA)
DRV - [2009/03/19 15:55:06 | 000,113,664 | ---- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AESTAud.sys -- (AESTAud)
DRV - [2009/03/05 01:35:56 | 001,294,200 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BCMWL5.SYS -- (BCM43XX)
DRV - [2008/06/27 13:02:00 | 000,289,024 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2006/11/10 15:05:00 | 000,018,688 | ---- | M] (Arcsoft, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\afc.sys -- (Afc)
DRV - [2006/11/02 07:00:08 | 000,039,368 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\winusb.sys -- (WinUSB)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]

IE - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=91&bd=minipavilion&pf=cnnb
IE - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo! Search"
FF - prefs.js..browser.search.defaultthis.engineName: " "
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: " "
FF - prefs.js..browser.startup.homepage: "http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official"
FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:8.5.0.429
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {6904342A-8307-11DF-A508-4AE2DFD72085}:2.1.0.900
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2786678&q="
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 53636


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX OVS Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2010/12/22 14:53:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2010/12/22 14:53:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files\AVG\AVG10\Firefox4\ [2011/08/26 01:03:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG10\Toolbar\Firefox\avg@igeared [2011/08/26 01:05:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/05/01 10:27:10 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/05/19 22:55:28 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\googlebar@google.com: C:\Documents and Settings\Josh\Application Data\ToolbarInstaller\ToolbarInstaller\1.0.0.0 [2011/05/20 00:48:39 | 000,000,000 | ---D | M]

[2009/06/25 20:20:05 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Josh\Application Data\Mozilla\Extensions
[2011/08/16 05:09:59 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions
[2010/07/22 18:52:18 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/08/15 05:47:16 | 000,000,000 | ---D | M] (PageRage Community Toolbar) -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{9565115d-c7d6-46d3-bd63-b67b481a4368}
[2011/08/16 05:09:59 | 000,000,000 | ---D | M] (uTorrentBar Community Toolbar) -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\{bf7380fa-e3b4-4db2-af3e-9d8783a45bfc}
[2011/08/15 05:47:10 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\extensions\engine@conduit.com
[2011/06/09 22:07:42 | 000,002,264 | ---- | M] () -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\searchplugins\bing-zugo.xml
[2011/06/09 22:08:38 | 000,000,863 | ---- | M] () -- C:\Documents and Settings\Josh\Application Data\Mozilla\Firefox\Profiles\qycjo2bs.default\searchplugins\conduit.xml
[2011/03/26 20:58:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/08/25 16:08:30 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2011/01/17 06:25:01 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
File not found (No name found) --
[2011/05/20 00:48:39 | 000,000,000 | ---D | M] (Googlebar) -- C:\DOCUMENTS AND SETTINGS\JOSH\APPLICATION DATA\TOOLBARINSTALLER\TOOLBARINSTALLER\1.0.0.0
[2011/08/26 01:03:54 | 000,000,000 | ---D | M] (AVG Safe Search) -- C:\PROGRAM FILES\AVG\AVG10\FIREFOX4
[2011/08/26 01:05:02 | 000,000,000 | ---D | M] ("urn:mozilla:install-manifest" em:id="avg@igeared" em:name="AVG Security Toolbar" em:version="7.007.026.001" em:displayname="AVG Security Toolbar" em:iconURL="chrome://tavgp/skin/logo.ico" em:creator="AVG Technologies" em:description="AVG Security Toolbar" em:homepageURL="http://www.avg.com" >) -- C:\PROGRAM FILES\AVG\AVG10\TOOLBAR\FIREFOX\AVG@IGEARED
[2011/01/17 06:23:13 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF
[2011/05/01 10:26:17 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/01/17 06:23:08 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2010/01/01 03:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml.old

O1 HOSTS File: ([2011/08/24 22:47:26 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG10\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O2 - BHO: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O2 - BHO: (Microsoft Live Search Toolbar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Microsoft Live Search Toolbar) - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - c:\Program Files\MSN\Toolbar\3.0.0541.0\msneshellx.dll (Microsoft Corp.)
O3 - HKLM\..\Toolbar: (Conduit Engine ) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\prxConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (uTorrentBar Toolbar) - {bf7380fa-e3b4-4db2-af3e-9d8783a45bfc} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O3 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\..\Toolbar\WebBrowser: (uTorrentBar Toolbar) - {BF7380FA-E3B4-4DB2-AF3E-9D8783A45BFC} - C:\Program Files\uTorrentBar\tbuTor.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AESTFltr] C:\WINDOWS\System32\AESTFltr.exe (Andrea Electronics Corporation)
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files\AVG\AVG10\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [CarboniteSetupLite] C:\Program Files\Carbonite\CarbonitePreinstaller.exe (Carbonite, Inc.)
O4 - HKLM..\Run: [DivX Download Manager] C:\Program Files\DivX\DivX Plus Web Player\DDmService.exe (DivX, LLC)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HP Mobile Broadband] c:\SWsetup\HPQWWAN\HPMobileBroadband.exe (Hewlett-Packard Company)
O4 - HKLM..\Run: [SysTrayApp] C:\Program Files\IDT\WDM\sttray.exe (IDT, Inc.)
O4 - HKLM..\Run: [Zune Launcher] c:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe ()
O4 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.)
O4 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006..\RunOnce: [spchecker] C:\Program Files\AVG\AVG10\Notification\SPCheckerTE.exe ()
O4 - Startup: C:\Documents and Settings\Josh\Start Menu\Programs\Startup\Kuma_Tray.lnk = C:\Program Files\History Channel Games\kgsystray\Kuma_tray.exe ()
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_23.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O18 - Protocol\Handler\avgsecuritytoolbar {F2DDE6B2-9684-4A55-86D4-E255E237B77C} - C:\Program Files\AVG\AVG10\Toolbar\IEToolbar.dll ()
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG10\avgpp.dll (AVG Technologies CZ, s.r.o.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O24 - Desktop WallPaper: C:\Documents and Settings\Josh\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Josh\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgchsvx.exe /sync) - C:\Program Files\AVG\AVG10\avgchsvx.exe (AVG Technologies CZ, s.r.o.)
O34 - HKLM BootExecute: (C:\PROGRA~1\AVG\AVG10\avgrsx.exe /sync /restart) - C:\Program Files\AVG\AVG10\avgrsx.exe (AVG Technologies CZ, s.r.o.)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O35 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\.DEFAULT\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-18\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/08/26 15:45:46 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Josh\Desktop\OTL.exe
[2011/08/26 01:57:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh\Local Settings\Application Data\AVG Security Toolbar
[2011/08/26 01:52:26 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/08/26 01:41:59 | 000,000,000 | -H-D | C] -- C:\$AVG
[2011/08/26 01:08:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh\Application Data\AVG10
[2011/08/26 01:05:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG Security Toolbar
[2011/08/26 01:04:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\AVG 2011
[2011/08/26 00:55:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVG10
[2011/08/26 00:55:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\AVG
[2011/08/26 00:40:32 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/08/26 00:40:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\MFAData
[2011/08/26 00:10:21 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\Josh\Desktop\aswMBR.exe
[2011/08/24 03:25:10 | 000,000,000 | ---D | C] -- C:\WINDOWS\SxsCaPendDel
[2011/08/24 03:07:18 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/08/24 03:04:09 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/08/24 03:04:09 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/08/24 03:04:09 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/08/24 03:04:09 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/08/24 03:04:00 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/08/24 03:03:49 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/08/24 03:02:07 | 004,182,373 | R--- | C] (Swearware) -- C:\Documents and Settings\Josh\Desktop\ComboFix.exe
[2011/08/23 16:27:11 | 001,406,768 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Josh\Desktop\tdsskiller.exe
[2011/08/17 18:47:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh\Desktop\gmer
[2011/08/17 18:42:31 | 000,607,017 | R--- | C] (Swearware) -- C:\Documents and Settings\Josh\Desktop\dds.scr
[2011/08/17 16:56:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\SUPERAntiSpyware
[2011/08/17 16:56:12 | 000,000,000 | ---D | C] -- C:\Program Files\SUPERAntiSpyware
[2011/08/17 03:52:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh\Application Data\SUPERAntiSpyware.com
[2011/08/17 03:52:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/08/13 05:47:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Josh\My Documents\New Folder
[2011/08/13 05:42:20 | 000,041,272 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/08/13 05:42:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/08/13 05:42:13 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/08/13 05:42:13 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/08/13 04:05:52 | 000,139,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rdpwd.sys
[2011/08/13 04:05:30 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys
[2011/08/13 03:56:35 | 000,010,496 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndistapi.sys
[2011/08/11 05:45:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/08/11 05:35:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/08/11 05:34:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[18 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/08/26 15:53:34 | 129,786,012 | ---- | M] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/08/26 15:45:51 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Josh\Desktop\OTL.exe
[2011/08/26 15:41:38 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/08/26 15:41:33 | 1064,620,032 | -HS- | M] () -- C:\hiberfil.sys
[2011/08/26 01:04:06 | 000,000,690 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/08/26 00:13:34 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/26 00:11:47 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\Josh\Desktop\MBR.dat
[2011/08/26 00:10:23 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\Josh\Desktop\aswMBR.exe
[2011/08/26 00:07:48 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/08/24 23:06:34 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/08/24 22:47:26 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/08/24 22:24:31 | 004,182,373 | R--- | M] (Swearware) -- C:\Documents and Settings\Josh\Desktop\ComboFix.exe
[2011/08/24 22:21:19 | 000,043,408 | -HS- | M] () -- C:\WINDOWS\System32\c_47915.nl_
[2011/08/24 04:19:59 | 000,224,816 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/08/24 04:17:57 | 000,464,764 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/08/24 04:17:57 | 000,080,942 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/08/24 03:07:54 | 000,000,355 | RHS- | M] () -- C:\boot.ini
[2011/08/23 16:27:30 | 001,406,768 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Josh\Desktop\tdsskiller.exe
[2011/08/23 02:07:43 | 000,294,216 | ---- | M] () -- C:\Documents and Settings\Josh\Desktop\gmer.zip
[2011/08/17 18:42:33 | 000,607,017 | R--- | M] (Swearware) -- C:\Documents and Settings\Josh\Desktop\dds.scr
[2011/08/13 05:29:30 | 000,018,940 | -HS- | M] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\1368o7703b0e16b0r1vntbgfx5h41h
[2011/08/13 05:29:30 | 000,018,940 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\1368o7703b0e16b0r1vntbgfx5h41h
[2011/08/13 05:21:12 | 000,000,245 | ---- | M] () -- C:\Boot.bak
[2011/08/13 04:16:47 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\etnq.exe
[2011/08/13 04:16:47 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\ejrh.exe
[2011/08/13 04:16:47 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\eeqq.exe
[2011/08/12 04:09:36 | 000,001,324 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/08/12 03:58:51 | 000,005,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\g08jta1b237g2821dv0
[2011/08/12 02:34:57 | 000,017,072 | -HS- | M] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e
[2011/08/12 02:34:57 | 000,017,072 | -HS- | M] () -- C:\Documents and Settings\All Users\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e
[2011/08/11 05:20:09 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\xgra.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\rtqa.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\ihvy.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\All Users\Application Data\cvgs.exe
[2011/08/07 16:25:24 | 000,145,920 | ---- | M] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/07/28 21:47:22 | 000,000,065 | ---- | M] () -- C:\WINDOWS\System32\1057832649
[18 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/08/26 15:53:34 | 129,786,012 | ---- | C] () -- C:\WINDOWS\System32\drivers\AVG\incavi.avm
[2011/08/26 01:04:06 | 000,000,690 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\AVG 2011.lnk
[2011/08/26 00:11:47 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\Josh\Desktop\MBR.dat
[2011/08/24 03:07:53 | 000,000,245 | ---- | C] () -- C:\Boot.bak
[2011/08/24 03:07:37 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/08/24 03:04:09 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/08/24 03:04:09 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/08/24 03:04:09 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/08/24 03:04:09 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/08/24 03:04:09 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/08/23 16:32:15 | 000,043,408 | -HS- | C] () -- C:\WINDOWS\System32\c_47915.nl_
[2011/08/17 18:47:38 | 000,294,216 | ---- | C] () -- C:\Documents and Settings\Josh\Desktop\gmer.zip
[2011/08/17 18:20:22 | 1064,620,032 | -HS- | C] () -- C:\hiberfil.sys
[2011/08/17 02:04:08 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/08/13 04:16:48 | 000,018,940 | -HS- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\1368o7703b0e16b0r1vntbgfx5h41h
[2011/08/13 04:16:48 | 000,018,940 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\1368o7703b0e16b0r1vntbgfx5h41h
[2011/08/13 04:16:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\etnq.exe
[2011/08/13 04:16:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ejrh.exe
[2011/08/13 04:16:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\eeqq.exe
[2011/08/12 03:57:51 | 000,005,272 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\g08jta1b237g2821dv0
[2011/08/12 03:57:51 | 000,005,272 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\g08jta1b237g2821dv0
[2011/08/11 05:20:10 | 000,017,072 | -HS- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e
[2011/08/11 05:20:10 | 000,017,072 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xgra.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\rtqa.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ihvy.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\cvgs.exe
[2011/07/26 02:47:03 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2011/06/15 04:13:13 | 000,013,388 | -HS- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\66dsg1mdbgt85b5f45gg35h421wci35d
[2011/06/15 04:13:13 | 000,013,388 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\66dsg1mdbgt85b5f45gg35h421wci35d
[2011/06/09 23:48:32 | 000,001,324 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2011/05/23 15:17:40 | 000,019,918 | -HS- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\h0387md7ekpl3vuk24yy
[2011/05/23 15:17:40 | 000,019,918 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\h0387md7ekpl3vuk24yy
[2010/07/31 22:53:55 | 000,233,240 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\FontCache3.0.0.0.dat
[2010/01/18 19:52:55 | 000,000,036 | ---- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\housecall.guid.cache
[2009/12/19 14:34:36 | 000,001,408 | ---- | C] () -- C:\WINDOWS\WININIT.INI
[2009/10/03 17:14:25 | 000,000,252 | ---- | C] () -- C:\Documents and Settings\Josh\Application Data\wklnhst.dat
[2009/07/02 20:49:23 | 000,145,920 | ---- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/06/25 20:20:06 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/03/05 01:45:26 | 000,028,510 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2009/03/05 01:22:58 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4926.dll
[2008/06/24 12:48:32 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/06/24 12:48:20 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2008/06/24 12:26:44 | 000,464,764 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/06/24 12:26:44 | 000,080,942 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/06/24 12:16:28 | 000,224,816 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2008/06/24 12:12:12 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/06/24 12:10:36 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/04/14 23:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/14 23:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/14 23:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/14 23:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/14 23:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/14 23:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/14 23:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/14 23:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2002/05/28 16:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2002/05/28 16:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat

< End of report >

Hi-

Thank you for OTL report. You couldn't find OTL earlier because I never had you install it - my fault.

Your version of Java is out of date. Older versions have vulnerabilities that malicious sites can use to exploit and infect your system.
Please follow these steps to remove older version Java components and update:

• Download the latest version of Java Runtime Environment (JRE) Version 6 and save it to your desktop.
  
• Look for "Java Platform, Standard Edition".
  
• Click the "Download JRE" button to the right.
  
• Read the License Agreement, and then check the box that says: "Accept License Agreement".
  
• Select your Platform: Windows x86 Offline.
  
• Save the file to your desktop.
  
• Close any programs you may have running - especially your web browser.

Go to > Control Panel, double-click on Add/Remove Programs and remove all older versions of Java.

• Check (highlight) any item with Java™ 6 Update in the name.
  
• Click the Remove or Change/Remove button and follow the onscreen instructions for the Java uninstaller.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u26-windows-i586.exe to install the newest version.
  
• When the Java Setup - Welcome window opens, click the Install > button.
  
• If offered to install a Toolbar, just uncheck the box before continuing unless you want it.

-- Java is updated frequently. If you want to be automatically notified of future updates, just turn on the Java Automatic Update feature and you will not have to remember to update when Java releases a new version.

Note: The Java Quick Starter (JQS.exe) adds a service to improve the initial startup time of Java applets and applications but it's not necessary.
To disable the JQS service if you don't want to use it:

• Go to Start > Control Panel > Java > Advanced > Miscellaneous and uncheck the box for Java Quick Starter.
  
• Click Ok and reboot your computer.

Next, we need to run an OTL Fix.

• Please reopen on your desktop.
  
• Copy and Paste the following code into the textbox.

:OTL
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
IE - HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Internet Explorer\Main,XMLHTTP_UUID_Default = 51 27 23 18 EB AD C2 4E 83 E8 02 5C 06 69 EC 9B [binary data]
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 53636
[2011/08/13 04:16:48 | 000,018,940 | -HS- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\1368o7703b0e16b0r1vntbgfx5h41h
[2011/08/13 04:16:48 | 000,018,940 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\1368o7703b0e16b0r1vntbgfx5h41h
[2011/08/13 04:16:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\etnq.exe
[2011/08/13 04:16:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ejrh.exe
[2011/08/13 04:16:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\eeqq.exe
[2011/08/12 03:57:51 | 000,005,272 | -HS- | C] () -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\g08jta1b237g2821dv0
[2011/08/12 03:57:51 | 000,005,272 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\g08jta1b237g2821dv0
[2011/08/11 05:20:10 | 000,017,072 | -HS- | C] () -- C:\Documents and Settings\Josh\Local Settings\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e
[2011/08/11 05:20:10 | 000,017,072 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\xgra.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\rtqa.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\ihvy.exe
[2011/08/11 05:20:09 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\cvgs.exe

• Push
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• Click .
  
• A report will open. Copy and Paste that report in your next reply.
  
• If you have to reboot, once back up, open the C:\_OTL\MovedFiles folder and copy the newest log into your next reply.

In your reply, please copy in the OTL Fix report. How is your computer doing?

My computer seems to be running well. (There was a bit of lag time in the computer's response time after each mouse click during the new java installation. I'm thinking perhaps the computer wasn't fully booted when I started? but I thought it was - I always wait for the hour glass to disappear and all of the icons to show up at the bottom of the screen. I don't know if that's anything, but I figured I would mention it.)

Here's the new OTL report

========== OTL ==========
HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main\\XMLHTTP_UUID_Default| /E : value set successfully!
HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main\\XMLHTTP_UUID_Default| /E : value set successfully!
HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main\\XMLHTTP_UUID_Default| /E : value set successfully!
HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main\\XMLHTTP_UUID_Default| /E : value set successfully!
HKU\S-1-5-21-3462475991-3570121275-3982254515-1006\SOFTWARE\Microsoft\Internet Explorer\Main\\XMLHTTP_UUID_Default| /E : value set successfully!
Prefs.js: "127.0.0.1" removed from network.proxy.http
Prefs.js: 53636 removed from network.proxy.http_port
C:\Documents and Settings\Josh\Local Settings\Application Data\1368o7703b0e16b0r1vntbgfx5h41h moved successfully.
C:\Documents and Settings\All Users\Application Data\1368o7703b0e16b0r1vntbgfx5h41h moved successfully.
C:\Documents and Settings\All Users\Application Data\etnq.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\ejrh.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\eeqq.exe moved successfully.
C:\Documents and Settings\NetworkService\Local Settings\Application Data\g08jta1b237g2821dv0 moved successfully.
C:\Documents and Settings\All Users\Application Data\g08jta1b237g2821dv0 moved successfully.
C:\Documents and Settings\Josh\Local Settings\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e moved successfully.
C:\Documents and Settings\All Users\Application Data\rmms52gc0yo4rv114740ie44jh3yt3r7hi5e5ln4p7e moved successfully.
C:\Documents and Settings\All Users\Application Data\xgra.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\rtqa.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\ihvy.exe moved successfully.
C:\Documents and Settings\All Users\Application Data\cvgs.exe moved successfully.

OTL by OldTimer - Version 3.2.26.5 log created on 08272011_114853