BleepingComputer.com: Browser Redirect Problem

I run XP Professional SP2 with MS Firewall and Avira AntiVir Personal - Free Antivirus 10.2.0.704.

For the past week I've experienced random redirects from Bing when using either Firefox 1.9.2.4324 or IE 8.0.6001.18702. The redirects take the system to what appear to be genuine commercial websites. Back and a retry of the Bing search results usually takes me to the correct website, though occasionally attempts at Back are met with a popup asking "Are you sure you want to navigate away from this page . .".

Suspecting an intruder, I've run the latest versions of Avira, MBAM, Spybot, SAS and Ad-Aware. Together, these unearthed a very large number of Tracker Cookies but no other Malware. Active Avira, meanwhile has on four occasions detected and quarantined HTML/Infected.WebPage.Gen2 - the latest as I type!

Your assistance in finding and removing this irritating gremlin would be greeted with a resounding cheer!

DDS.txt in line below. Attach.txt and ARK.txt attached.

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702
Run by BCWork at 16:38:15 on 2011-11-22
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.511.164 [GMT 0:00]
.
AV: Lavasoft Ad-Watch Live! Anti-Virus *Enabled/Updated* {A1C4F2E0-7FDE-4917-AFAE-013EFC3EDE33}
AV: AntiVir Desktop *Enabled/Updated* {AD166499-45F9-482A-A743-FDD3350758C7}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\CTFMON.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
.
============== Pseudo HJT Report ===============
.
mSearch Bar = hxxp://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: DhcpNameServer = 192.168.1.254
TCP: Interfaces\{8E0E0E42-A93E-4E1E-9BF5-68F530998DC9} : DhcpNameServer = 192.168.1.254
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\bcwork\application data\mozilla\firefox\profiles\1yqjv1s9.default\
FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\motive\npMotive.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: PC Sync 2 Synchronisation Extension: bkmrksync@nokia.com - c:\program files\nokia\nokia pc suite 7\bkmrksync
.
============= SERVICES / DRIVERS ===============
.
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2011-11-21 64512]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2010-5-12 11608]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2010-5-12 136360]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2010-5-12 269480]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2010-5-12 66616]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2011-11-3 2152152]
R3 TotRec8;Total Recorder WDM audio filter driver;c:\windows\system32\drivers\TotRec8.sys [2011-2-17 90192]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 cpuz132;cpuz132;\??\c:\docume~1\peter\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\peter\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
S3 Lavasoft Kernexplorer;Lavasoft helper driver;c:\program files\lavasoft\ad-aware\kernexplorer.sys [2011-11-3 15232]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
S4 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
.
=============== Created Last 30 ================
.
2011-11-22 16:34:06 -------- d-----w- c:\documents and settings\bcwork\local settings\application data\Mozilla
2011-11-22 16:30:17 221184 ----a-w- c:\windows\system32\wmpns.dll
2011-11-21 23:30:42 64512 ----a-w- c:\windows\system32\drivers\Lbd.sys
2011-11-21 23:30:05 -------- d-----w- c:\program files\Lavasoft
2011-11-19 22:05:55 -------- d-----w- c:\windows\ie8updates
2011-11-19 21:57:52 -------- dc-h--w- c:\windows\ie8
2011-11-19 21:52:25 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2011-11-19 21:52:22 743424 -c----w- c:\windows\system32\dllcache\iedvtool.dll
2011-11-19 21:52:21 247808 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2011-11-17 18:09:10 -------- d-----w- c:\program files\CCleaner
2011-11-07 01:22:04 2207744 ----a-w- c:\windows\system32\HomePlanet.scr
2011-11-02 09:34:31 -------- d-----w- c:\windows\system32\LogFiles
.
==================== Find3M ====================
.
2011-11-21 23:38:17 101720 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2011-08-31 16:00:50 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
.
============= FINISH: 16:39:58.19 ===============

This post has been edited by Brawgates: 22 November 2011 - 02:32 PM

Hello and Welcome to the forums!

My name is Gringo and I'll be glad to help you with your computer problems.

Somethings to remember while we are working together.

• Do not run any other tool untill instructed to do so!
  
• Please Do not Attach logs or put in code boxes.
  
• Tell me about any problems that have occurred during the fix.
  
• Tell me of any other symptoms you may be having as these can help also.
  
• Do not run anything while running a fix.

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

Click on the Watch Topic Button and select Immediate Notification and click on proceed, this will help you to get notified faster when I have replied and make the cleaning process faster.

In order for me to see the status of the infection I will need a new set of logs to start with.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

DeFogger:

Please download DeFogger to your desktop.

Double click DeFogger to run the tool.

• The application window will appear
  
• Click the Disable button to disable your CD Emulation drivers
  
• Click Yes to continue
  
• A 'Finished!' message will appear
  
• Click OK
  
• DeFogger may ask you to reboot the machine, if it does - click OK

Do not re-enable these drivers until otherwise instructed.

Download DDS:

Please download DDS by sUBs from one of the links below and save it to your desktop:


Download DDS and save it to your desktop

Link1
Link2
Link3

Please disable any anti-malware program that will block scripts from running before running DDS.


• Double-Click on dds.scr and a command window will appear. This is normal.
  
• Shortly after two logs will appear:
  
  • DDS.txt
    
  • Attach.txt
  
  
• A window will open instructing you save & post the logs
  
• Save the logs to a convenient place such as your desktop
  
• Copy the contents of both logs & post in your next reply

Scan With RKUnHooker

• Please Download Rootkit Unhooker Save it to your desktop.
  
• Now double-click on RKUnhookerLE.exe to run it.
  
• Click the Report tab, then click Scan.
  
• Check (Tick) Drivers, Stealth,. Uncheck the rest. then Click OK.
  
• Wait till the scanner has finished and then click File, Save Report.
  
• Save the report somewhere where you can find it. Click Close.

Copy the entire contents of the report and paste it in a reply here.

Note** you may get this warning it is ok, just ignore

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

"just click on Cancel, then Accept".

information and logs:

In your next post I need the following


• .logs from DDS
  
• log from RKUnHooker
  
• let me know of any problems you may have had

Gringo

Good afternoon to you, Gringo.

I'm delighted to receive your kind offer of assistance.

Inline below are the results of the prodecures you requested.

DeFogger:


DDS:


RKUnHooker:


Since my origninal post, I have encountered one addition Malware event. Avira spotted and quarantined EXP/Pidief.aik.1 within c:\D&S\%user%\L S\T\plugtemp-27\.

Kind regards


Brawgates

Hello

I Would like you to do the following.

Please print out or make a copy in notpad of any instructions given, as sometimes it is necessary to go offline and you will lose access to them.

Run Combofix:

You may be asked to install or update the Recovery Console (Win XP Only) if this happens please allow it to do so (you will need to be connected to the internet for this)

Before you run Combofix I will need you to turn off any security software you have running, If you do not know how to do this you can find out >here< or >here<

Combofix may need to reboot your computer more than once to do its job this is normal.

You can download Combofix from one of these links. I want you to save it to the desktop and run it from there.

Link 1
Link 2
Link 3

1. Close any open browsers or any other programs that are open.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.

Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall

Note 2: If you recieve an error "Illegal operation attempted on a registery key that has been marked for deletion." Please restart the computer

"information and logs"

In your next post I need the following


• Log from Combofix
  
• let me know of any problems you may have had
  
• How is the computer doing now?

Gringo

Gringo

Thanks for your very quick response.

I've now downloaded Combofix to the desktop and run it to a successful conclusion. I was not asked to reboot during the Combofix run, and have not rebooted since.

I checked for redirects in a Firefox/Bing envirnoment and found that they continue. Usually Back from a redirect returns the screen to the Bing searchlist, but with the colour of the selected item in the search list unchanged. Occasionally Back results in a Popup asking "Are you sure you want to navigate away from this page?"

Regards

Brawgates

Hello

I want you to run this tool for me next.

tdsskiller:

Please read carefully and follow these steps.

• Download TDSSKiller and save it to your Desktop.
  
• doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
  
• If an infected file is detected, the default action will be Cure, click on Continue.
  
• If a suspicious file is detected, the default action will be Skip, click on Continue.
  
• It may ask you to reboot the computer to complete the process. Click on Reboot Now.
  
• If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
  
• If a reboot is required, the report can also be found in your root directory, (usually C:\ folder) in the form of "TDSSKiller.[Version]_[Date]_[Time]_log.txt". Please copy and paste the contents of that file here.

Gringo

Gringo

TDSSKiller downloaded to Desktop and run as requested.

Regards

Brawgates

Hello

This is the tool I would like you to try and run next.

Please download aswMBR ( 511KB ) to your desktop.

• Double click the aswMBR.exe icon to run it
  
• Click the Scan button to start the scan
  
• On completion of the scan, click the save log button, save it to your desktop and post it in your next reply.

Gringo

Gringo

When I started aswMBR, a popup suggested downloading AVAST! for better detection. Is this a YES?

Regards

Peter

yes that is fine


gringo

Gringo

Peter

Hello

Lets get a deeper look into the system and see if something shows up.

Download and run OTL

Download OTL by Old Timer and save it to your Desktop.

• Double click on OTL.exe to run it.
  
• Under Output, ensure that Minimal Output is selected.
  
• Under Extra Registry section, select Use SafeList.
  
• Click the Scan All Users checkbox.
  
• Click on Run Scan at the top left hand corner.
  
• When done, two Notepad files will open.
  
  • OTL.txt <-- Will be opened and the that I need posted back here
    
  • Extra.txt <-- Will be minimized - save this one on your desktop in case I ask for it later
  
  
• Please post the contents of OTListIt.txt in your next reply.

Gringo

Gringo

OTL downloaded and options set as you specified before running from the desktop.

A copy of OTL.txt follows below:

Regards

Peter

---

OTL logfile created on: 28/11/2011 23:01:58 - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\BCWork\Desktop
Windows XP Professional Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000809 | Country: United Kingdom | Language: ENG | Date Format: dd/MM/yyyy

511.46 Mb Total Physical Memory | 255.91 Mb Available Physical Memory | 50.03% Memory free
1.22 Gb Paging File | 0.73 Gb Available in Paging File | 59.43% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 37.26 Gb Total Space | 21.83 Gb Free Space | 58.60% Space Free | Partition Type: NTFS
Drive D: | 58.59 Gb Total Space | 27.97 Gb Free Space | 47.73% Space Free | Partition Type: NTFS
Drive E: | 55.90 Gb Total Space | 45.16 Gb Free Space | 80.79% Space Free | Partition Type: NTFS

Computer Name: PAVILION | User Name: BCWork | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\BCWork\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
PRC - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
PRC - C:\Program Files\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging)
PRC - C:\Documents and Settings\Peter\Local Settings\Application Data\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe (Nokia)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe (Nokia)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\Microsoft Office\Office\WINWORD.EXE ()


========== Modules (No Company Name) ==========

MOD - C:\Program Files\Mozilla Firefox\js3250.dll ()
MOD - C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
MOD - C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll ()
MOD - C:\Program Files\Microsoft Office\Office\MSO97.DLL ()
MOD - C:\Program Files\Common Files\Microsoft Shared\VBA\VBE.DLL ()
MOD - C:\Program Files\Microsoft Office\Office\DISTMON.DLL ()
MOD - C:\Program Files\Microsoft Office\Office\WINWORD.EXE ()
MOD - C:\Program Files\Microsoft Office\Office\WWINTL32.DLL ()
MOD - C:\Program Files\Common Files\Microsoft Shared\Proof\MSSP232.DLL ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- File not found
SRV - (Lavasoft Ad-Aware Service) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft Limited)
SRV - (!SASCORE) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ServiceLayer) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe (Nokia)
SRV - (EPSON_PM_RPCV4_01) EPSON V3 Service4(01) -- C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S30RP1.EXE (SEIKO EPSON CORPORATION)


========== Driver Services (SafeList) ==========

DRV - (Lbd) -- C:\WINDOWS\system32\DRIVERS\Lbd.sys (Lavasoft AB)
DRV - (Lavasoft Kernexplorer) -- C:\Program Files\Lavasoft\Ad-Aware\kernexplorer.sys ()
DRV - (SASDIFSV) -- C:\Program Files\SUPERAntiSpyware\sasdifsv.sys (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (SASKUTIL) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SUPERAdBlocker.com and SUPERAntiSpyware.com)
DRV - (avipbb) -- C:\WINDOWS\system32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\WINDOWS\system32\drivers\avgntflt.sys (Avira GmbH)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (Nbf) -- C:\WINDOWS\system32\drivers\NBF.SYS (Microsoft Corporation)
DRV - (RTL8023xp) -- C:\WINDOWS\system32\drivers\Rtnicxp.sys (Realtek Semiconductor Corporation )
DRV - (TotRec8) -- C:\WINDOWS\system32\drivers\TotRec8.sys (High Criteria inc.)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (ssmdrv) -- C:\WINDOWS\system32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (pccsmcfd) -- C:\WINDOWS\system32\drivers\pccsmcfd.sys (Nokia)
DRV - (gameenum) -- C:\WINDOWS\system32\drivers\gameenum.sys (Microsoft Corporation)
DRV - (rtl8139) Realtek RTL8139(A/B/C) -- C:\WINDOWS\system32\drivers\RTL8139.sys (Realtek Semiconductor Corporation)
DRV - (es1371) Creative AudioPCI (ES1371,ES1373) (WDM) -- C:\WINDOWS\system32\drivers\es1371mp.sys (Creative Technology Ltd.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/cs/*http://uk.docs.yahoo.com/info/bt_side.html


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-823518204-1202660629-1900996195-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-823518204-1202660629-1900996195-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = en-gb
IE - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 20 75 59 C8 4D A9 CC 01 [binary data]
IE - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: bkmrksync@nokia.com:1.0.0.736

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Motive, Inc.)
FF - HKLM\Software\MozillaPlugins\@yverinfo.yahoo.com/YahooVersionInfoPlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYVerInfo.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: C:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2011/03/19 08:04:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/11/22 16:34:13 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.24\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/11/21 00:45:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010/12/29 19:56:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 3.1.7\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins

[2011/11/22 16:34:22 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\BCWork\Application Data\Mozilla\Extensions
[2011/11/28 15:44:01 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\BCWork\Application Data\Mozilla\Firefox\Profiles\1yqjv1s9.default\extensions
[2011/11/28 12:25:21 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\BCWork\Application Data\Mozilla\Firefox\Profiles\1yqjv1s9.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/12/27 11:28:36 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/03/19 08:04:31 | 000,000,000 | ---D | M] (PC Sync 2 Synchronisation Extension) -- C:\PROGRAM FILES\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC
[2011/10/27 16:17:24 | 000,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
[2011/10/27 16:17:25 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
[2011/10/27 16:17:26 | 000,000,769 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
[2011/10/27 16:17:26 | 000,001,135 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml

O1 HOSTS File: ([2011/11/28 17:58:48 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O3 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003\..\Toolbar\WebBrowser: (no name) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No CLSID value found.
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003..\Run: [{6FA87BC6-C067-83E6-FD5E-C4C61205DD86}] C:\Documents and Settings\Peter\Application Data\Enab\argyka.exe ()
O4 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003..\Run: [advEventmm] C:\Documents and Settings\Peter\Local Settings\Application Data\DRMmappnp\advEventmm.dll ()
O4 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background File not found
O4 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003..\Run: [PC Suite Tray] C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe (Nokia)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-823518204-1202660629-1900996195-1071\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8E0E0E42-A93E-4E1E-9BF5-68F530998DC9}: DhcpNameServer = 192.168.1.254
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/05/11 00:10:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/11/28 22:59:05 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\BCWork\Desktop\OTL.exe
[2011/11/28 22:11:25 | 001,916,416 | ---- | C] (AVAST Software) -- C:\Documents and Settings\BCWork\Desktop\aswMBR.exe
[2011/11/28 21:23:21 | 000,000,000 | -HSD | C] -- C:\RECYCLER
[2011/11/28 21:22:49 | 001,566,512 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\BCWork\Desktop\tdsskiller.exe
[2011/11/28 18:04:06 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/11/28 17:40:37 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/11/28 17:37:20 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/11/28 17:37:20 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/11/28 17:37:20 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/11/28 17:37:20 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/11/28 17:37:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/11/28 17:36:53 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/11/28 17:32:14 | 004,310,219 | R--- | C] (Swearware) -- C:\Documents and Settings\BCWork\Desktop\ComboFix.exe
[2011/11/28 15:04:21 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Application Data\Avira
[2011/11/28 12:32:24 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\BCWork\Desktop\dds.scr
[2011/11/22 19:35:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Application Data\Macromedia
[2011/11/22 19:34:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Application Data\Adobe
[2011/11/22 19:34:44 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\BCWork\PrivacIE
[2011/11/22 16:49:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Desktop\gmer
[2011/11/22 16:38:16 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\My Documents\My Videos
[2011/11/22 16:38:16 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\Start Menu\Programs\Administrative Tools
[2011/11/22 16:34:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\My Documents\Downloads
[2011/11/22 16:34:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Local Settings\Application Data\Mozilla
[2011/11/22 16:34:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Application Data\Mozilla
[2011/11/22 16:30:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Application Data\Identities
[2011/11/22 16:29:55 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\My Documents\My Music
[2011/11/22 16:29:53 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\BCWork\IETldCache
[2011/11/22 16:29:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Application Data\PC Suite
[2011/11/22 16:29:42 | 000,000,000 | --SD | C] -- C:\Documents and Settings\BCWork\Application Data\Microsoft
[2011/11/22 16:29:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\BCWork\SendTo
[2011/11/22 16:29:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\BCWork\Recent
[2011/11/22 16:29:42 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\BCWork\Application Data
[2011/11/22 16:29:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\Start Menu\Programs\Startup
[2011/11/22 16:29:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\Start Menu
[2011/11/22 16:29:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\My Documents\My Pictures
[2011/11/22 16:29:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\My Documents
[2011/11/22 16:29:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\Favorites
[2011/11/22 16:29:42 | 000,000,000 | R--D | C] -- C:\Documents and Settings\BCWork\Start Menu\Programs\Accessories
[2011/11/22 16:29:42 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\BCWork\Cookies
[2011/11/22 16:29:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\BCWork\Templates
[2011/11/22 16:29:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\BCWork\PrintHood
[2011/11/22 16:29:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\BCWork\NetHood
[2011/11/22 16:29:42 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\BCWork\Local Settings
[2011/11/22 16:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Local Settings\Application Data\Microsoft
[2011/11/22 16:29:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\BCWork\Desktop
[2011/11/22 16:19:03 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\BCWork\Desktop\dds.1st.scr
[2011/11/21 23:30:42 | 000,064,512 | ---- | C] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2011/11/21 23:30:05 | 000,000,000 | ---D | C] -- C:\Program Files\Lavasoft
[2011/11/19 22:05:55 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates
[2011/11/19 21:57:52 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8
[2011/11/19 21:52:22 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll
[2011/11/17 18:09:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2011/11/17 18:09:10 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2011/11/17 18:08:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Google
[2011/11/17 18:07:23 | 000,000,000 | ---D | C] -- C:\Program Files\Google
[2011/11/15 13:07:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Application Data\Adobe
[2011/11/02 09:34:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2011/11/28 22:59:05 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\BCWork\Desktop\OTL.exe
[2011/11/28 22:42:50 | 000,008,536 | ---- | M] () -- C:\WINDOWS\BCWork8.xlb
[2011/11/28 22:39:19 | 000,000,512 | ---- | M] () -- C:\Documents and Settings\BCWork\Desktop\MBR.dat
[2011/11/28 22:11:34 | 001,916,416 | ---- | M] (AVAST Software) -- C:\Documents and Settings\BCWork\Desktop\aswMBR.exe
[2011/11/28 21:22:52 | 001,566,512 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\BCWork\Desktop\tdsskiller.exe
[2011/11/28 17:58:48 | 000,000,027 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2011/11/28 17:40:50 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/11/28 17:32:15 | 004,310,219 | R--- | M] (Swearware) -- C:\Documents and Settings\BCWork\Desktop\ComboFix.exe
[2011/11/28 15:41:02 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/11/28 15:41:00 | 536,379,392 | -HS- | M] () -- C:\hiberfil.sys
[2011/11/28 12:58:59 | 000,139,264 | ---- | M] () -- C:\Documents and Settings\BCWork\Desktop\RKUnhookerLE.EXE
[2011/11/28 12:32:24 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\BCWork\Desktop\dds.scr
[2011/11/28 12:29:08 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\BCWork\defogger_reenable
[2011/11/28 12:27:52 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\BCWork\Desktop\Defogger.exe
[2011/11/28 12:23:54 | 000,035,262 | ---- | M] () -- C:\WINDOWS\BCWork.acl
[2011/11/28 09:46:11 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/11/23 00:40:44 | 000,000,486 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/11/22 16:48:26 | 000,294,216 | ---- | M] () -- C:\Documents and Settings\BCWork\Desktop\gmer.zip
[2011/11/22 16:30:36 | 000,000,815 | ---- | M] () -- C:\Documents and Settings\BCWork\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/22 16:30:31 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\BCWork\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/11/22 16:19:04 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\BCWork\Desktop\dds.1st.scr
[2011/11/22 09:27:27 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/11/21 23:38:17 | 000,101,720 | ---- | M] (Sunbelt Software) -- C:\WINDOWS\System32\drivers\SBREDrv.sys
[2011/11/21 23:06:31 | 000,008,536 | ---- | M] () -- C:\WINDOWS\Admin8.xlb
[2011/11/21 00:56:20 | 000,001,678 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/11/19 22:02:49 | 000,001,393 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/11/07 01:18:28 | 002,207,744 | ---- | M] () -- C:\WINDOWS\System32\HomePlanet.scr
[2011/11/03 12:06:56 | 000,064,512 | ---- | M] (Lavasoft AB) -- C:\WINDOWS\System32\drivers\Lbd.sys
[2011/10/30 10:44:28 | 000,472,562 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/10/30 10:44:28 | 000,075,530 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2011/11/28 22:42:50 | 000,008,536 | ---- | C] () -- C:\WINDOWS\BCWork8.xlb
[2011/11/28 22:39:19 | 000,000,512 | ---- | C] () -- C:\Documents and Settings\BCWork\Desktop\MBR.dat
[2011/11/28 17:40:50 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/11/28 17:40:45 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/11/28 17:37:20 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/11/28 17:37:20 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/11/28 17:37:20 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/11/28 17:37:20 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/11/28 17:37:20 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/11/28 12:58:59 | 000,139,264 | ---- | C] () -- C:\Documents and Settings\BCWork\Desktop\RKUnhookerLE.EXE
[2011/11/28 12:29:08 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\BCWork\defogger_reenable
[2011/11/28 12:27:50 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\BCWork\Desktop\Defogger.exe
[2011/11/28 12:23:54 | 000,035,262 | ---- | C] () -- C:\WINDOWS\BCWork.acl
[2011/11/22 16:48:24 | 000,294,216 | ---- | C] () -- C:\Documents and Settings\BCWork\Desktop\gmer.zip
[2011/11/22 16:30:36 | 000,000,815 | ---- | C] () -- C:\Documents and Settings\BCWork\Application Data\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
[2011/11/22 16:30:36 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\BCWork\Start Menu\Programs\Internet Explorer.lnk
[2011/11/22 16:30:31 | 000,000,079 | ---- | C] () -- C:\Documents and Settings\BCWork\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf
[2011/11/22 16:30:14 | 000,000,738 | ---- | C] () -- C:\Documents and Settings\BCWork\Start Menu\Programs\Outlook Express.lnk
[2011/11/22 16:29:42 | 000,001,599 | ---- | C] () -- C:\Documents and Settings\BCWork\Start Menu\Programs\Remote Assistance.lnk
[2011/11/22 16:29:42 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\BCWork\Start Menu\Programs\Windows Media Player.lnk
[2011/11/21 23:31:00 | 000,000,486 | ---- | C] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
[2011/11/21 00:56:20 | 000,001,678 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\SUPERAntiSpyware Free Edition.lnk
[2011/11/19 22:02:35 | 000,001,393 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2011/11/07 01:22:04 | 002,207,744 | ---- | C] () -- C:\WINDOWS\System32\HomePlanet.scr
[2011/10/14 11:39:30 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\YCRWin32.dll
[2011/10/14 11:36:40 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2011/03/05 19:37:35 | 000,000,707 | ---- | C] () -- C:\WINDOWS\System32\updater.ini
[2011/03/05 19:37:31 | 000,000,142 | ---- | C] () -- C:\WINDOWS\System32\platform.ini
[2011/03/05 19:37:27 | 001,016,280 | ---- | C] () -- C:\WINDOWS\System32\js3250.dll
[2011/03/05 19:37:25 | 000,003,803 | ---- | C] () -- C:\WINDOWS\System32\crashreporter.ini
[2011/03/05 19:37:25 | 000,000,583 | ---- | C] () -- C:\WINDOWS\System32\crashreporter-override.ini
[2011/03/05 19:37:20 | 000,002,129 | ---- | C] () -- C:\WINDOWS\System32\application.ini
[2010/12/27 11:29:03 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/08/13 23:17:08 | 000,000,419 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2010/08/13 23:17:08 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2010/08/13 23:16:05 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf08a.dat
[2010/08/13 23:15:51 | 000,106,496 | ---- | C] () -- C:\WINDOWS\System32\BrMuSNMP.dll
[2010/05/14 23:14:05 | 000,061,440 | ---- | C] () -- C:\WINDOWS\SSEUninstaller.exe
[2010/05/14 22:56:30 | 000,027,136 | ---- | C] () -- C:\WINDOWS\System32\QTUninst.dll
[2010/05/14 22:09:02 | 000,000,120 | ---- | C] () -- C:\WINDOWS\MSMAIL32.INI
[2010/05/13 07:11:47 | 000,000,037 | ---- | C] () -- C:\WINDOWS\QTW.INI
[2010/05/13 07:09:50 | 000,000,252 | ---- | C] () -- C:\WINDOWS\ADAM.INI
[2010/05/13 07:09:50 | 000,000,198 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2010/05/13 07:09:50 | 000,000,116 | ---- | C] () -- C:\WINDOWS\cap_pi.ini
[2010/05/13 07:09:24 | 000,001,392 | ---- | C] () -- C:\WINDOWS\ACROCAT.INI
[2010/05/13 07:09:07 | 000,210,944 | ---- | C] () -- C:\WINDOWS\System32\MSVCRT10.DLL
[2010/05/13 07:09:05 | 000,000,192 | ---- | C] () -- C:\WINDOWS\ACROEXCH.INI
[2010/05/13 00:14:42 | 000,000,022 | ---- | C] () -- C:\WINDOWS\exchng.ini
[2010/05/12 23:59:16 | 000,000,864 | ---- | C] () -- C:\WINDOWS\ACROREAD.INI
[2010/05/12 09:05:51 | 000,000,061 | ---- | C] () -- C:\WINDOWS\fpstart.ini
[2010/05/12 08:34:09 | 000,004,793 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2010/05/12 08:34:09 | 000,000,482 | ---- | C] () -- C:\WINDOWS\lotus.ini
[2010/05/12 08:34:07 | 000,004,758 | ---- | C] () -- C:\WINDOWS\ORG2.INI
[2010/05/11 10:03:45 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll
[2010/05/11 07:59:17 | 000,111,932 | ---- | C] () -- C:\WINDOWS\System32\EPPICPrinterDB.dat
[2010/05/11 07:59:17 | 000,031,053 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern131.dat
[2010/05/11 07:59:17 | 000,027,417 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern121.dat
[2010/05/11 07:59:17 | 000,026,154 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern1.dat
[2010/05/11 07:59:17 | 000,024,903 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern3.dat
[2010/05/11 07:59:17 | 000,021,390 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern5.dat
[2010/05/11 07:59:17 | 000,020,148 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern2.dat
[2010/05/11 07:59:17 | 000,011,811 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern4.dat
[2010/05/11 07:59:17 | 000,004,943 | ---- | C] () -- C:\WINDOWS\System32\EPPICPattern6.dat
[2010/05/11 07:59:17 | 000,001,146 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_DU.dat
[2010/05/11 07:59:17 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_PT.dat
[2010/05/11 07:59:17 | 000,001,139 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_BP.dat
[2010/05/11 07:59:17 | 000,001,136 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_ES.dat
[2010/05/11 07:59:17 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_FR.dat
[2010/05/11 07:59:17 | 000,001,129 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_CF.dat
[2010/05/11 07:59:17 | 000,001,120 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_IT.dat
[2010/05/11 07:59:17 | 000,001,107 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_GE.dat
[2010/05/11 07:59:17 | 000,001,104 | ---- | C] () -- C:\WINDOWS\System32\EPPICPresetData_EN.dat
[2010/05/11 07:59:17 | 000,000,097 | ---- | C] () -- C:\WINDOWS\System32\PICSDK.ini
[2010/05/11 07:55:13 | 000,000,027 | ---- | C] () -- C:\WINDOWS\CDE SPR265DEFGIPS.ini
[2010/05/11 00:44:22 | 000,004,822 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/05/11 00:42:44 | 000,153,176 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010/05/11 00:15:22 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/05/11 00:04:51 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/04 00:07:22 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2004/08/02 13:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2001/08/23 03:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 03:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 03:00:00 | 000,472,562 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 03:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 03:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 03:00:00 | 000,075,530 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 03:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 03:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 03:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 03:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[1998/04/27 00:23:00 | 006,150,961 | ---- | C] () -- C:\WINDOWS\System32\jre116.exe
[1998/04/06 23:00:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\ODBCMON.DLL
[1996/11/20 23:00:00 | 000,047,104 | ---- | C] () -- C:\WINDOWS\System32\WRKGADM.EXE
[1996/11/20 23:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\ODBCSTF.DLL
[1996/11/20 23:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL
[1996/11/20 23:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL
[1994/07/25 00:23:00 | 000,014,928 | ---- | C] () -- C:\WINDOWS\System32\wingen.drv
[1994/04/07 00:23:00 | 000,000,462 | ---- | C] () -- C:\WINDOWS\lodbf13.ini
[1994/04/07 00:23:00 | 000,000,462 | ---- | C] () -- C:\WINDOWS\lodbf09.ini

< End of report >

Hello

Run this custom script and when it is complete I need to know how the computer is doing

Run OTL Script

• Double-click OTL.exe to start the program.
  
• Copy and Paste the following code into the textbox. Do not include the word Code
  

    
  :otl
  FF - HKLM\Software\MozillaPlugins\@yverinfo.yahoo.com/YahooVersionInfoPlugin;version=1.0.0.1: C:\Program Files\Yahoo!\Shared\npYVerInfo.dll File not found
  O3 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003\..\Toolbar\WebBrowser: (no name) - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - No CLSID value found.
  O4 - HKU\S-1-5-21-823518204-1202660629-1900996195-1003..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background File not found
  O16 - DPF: Microsoft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab (Reg Error: Key error.)
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/sb/*http://uk.docs.yahoo.com/info/bt_side.html
  IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomSearch = http://uk.red.clientapps.yahoo.com/customize/btyahoo/defaults/cs/*http://uk.docs.yahoo.com/info/bt_side.html
  [2011/10/27 16:17:24 | 000,001,538 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazon-en-GB.xml
  [2011/10/27 16:17:25 | 000,000,947 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\chambers-en-GB.xml
  [2011/10/27 16:17:26 | 000,000,769 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-en-GB.xml
  [2011/10/27 16:17:26 | 000,001,135 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-en-GB.xml
  :Files
  ipconfig /flushdns /c
  :Commands
  [PURITY]
  [EMPTYTEMP]
  [emptyjava]
  [EMPTYFLASH]
  [RESETHOSTS]
  

  
  
• Then click the Run Fix button at the top.
  
• Click .
  
• OTL may ask to reboot the machine. Please do so if asked.
  
• The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Let me know How things are doing

Gringo

Gringo

OTL Run Fix with Script completed. Required reboot.

You may well have cracked it!! I tried about a dozen FF/Bing searches. No redirects.

With an early start in the morning, I need to go offline right now. Will check more thoroughly tomorrow and include IE. Looks like good news.

Many thanks for you extraordinary assistance so far.

Best wishes

Peter

---

Copy of OTL report

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@yverinfo.yahoo.com/YahooVersionInfoPlugin;version=1.0.0.1\ deleted successfully.
Registry key HKEY_USERS\S-1-5-21-823518204-1202660629-1900996195-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EE5D279F-081B-4404-994D-C6B60AAEBA6D}\ not found.
Registry key HKEY_USERS\S-1-5-21-823518204-1202660629-1900996195-1003\Software\Microsoft\Windows\CurrentVersion\Run not found.
File oft XML Parser for Java file:///C:/WINDOWS/Java/classes/xmldso.cab not found.
Starting removal of ActiveX control Microsoft XML Parser for Java
Registry error reading value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\DownloadInformation\\INF .
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\Microsoft XML Parser for Java\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\Microsoft XML Parser for Java\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKLM\SOFTWARE\Microsoft\Internet Explorer\Search\\CustomSearch| /E : value set successfully!
C:\Program Files\Mozilla Firefox\searchplugins\amazon-en-GB.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\chambers-en-GB.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\eBay-en-GB.xml moved successfully.
C:\Program Files\Mozilla Firefox\searchplugins\yahoo-en-GB.xml moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Could not flush the DNS Resolver Cache: Function failed during execution.
C:\Documents and Settings\BCWork\Desktop\cmd.bat deleted successfully.
C:\Documents and Settings\BCWork\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Admin
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Java cache emptied: 95052 bytes
->FireFox cache emptied: 89310065 bytes
->Flash cache emptied: 487 bytes

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: All Users

User: BCWork
->Temp folder emptied: 49860965 bytes
->Temporary Internet Files folder emptied: 48173815 bytes
->FireFox cache emptied: 55046203 bytes
->Flash cache emptied: 456 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes

User: LocalService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 49219 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes

User: Peter
->Temp folder emptied: 252225534 bytes
->Temporary Internet Files folder emptied: 502470112 bytes
->Java cache emptied: 1376668 bytes
->FireFox cache emptied: 77203591 bytes
->Flash cache emptied: 17227319 bytes

User: temp2
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 78991 bytes
->Flash cache emptied: 3811 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 2142714 bytes
%systemroot%\System32 .tmp files removed: 2577 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 0 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 1566512 bytes

Total Files Cleaned = 1,046.00 mb


[EMPTYJAVA]

User: Admin
->Java cache emptied: 0 bytes

User: Administrator

User: All Users

User: BCWork

User: Default User

User: LocalService

User: NetworkService

User: Peter
->Java cache emptied: 0 bytes

User: temp2

Total Java Files Cleaned = 0.00 mb


[EMPTYFLASH]

User: Admin
->Flash cache emptied: 0 bytes

User: Administrator

User: All Users

User: BCWork
->Flash cache emptied: 0 bytes

User: Default User

User: LocalService

User: NetworkService

User: Peter
->Flash cache emptied: 0 bytes

User: temp2
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 11292011_003924

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...