I ran Rkill and got the following:
Ran as Administrator on 04/10/2010 at 6:38:48.
Processes terminated by Rkill or while it was running:
C:\Documents and Settings\Administrator\Local Settings\Application Data\KRHPHHBN\StartService.exe
Rkill completed on 04/10/2010 at 6:38:51.
Everytime I run RKill it comes up with this and I received a window that mIRC has encountered a problem and needs to close. When I click "to see what data this error report contains, click here" it tells me the appname is "Startservice.exe"
I uninstalled IRC and still see this message when running Rkill.
Please note that i can not manually see the \KRHPHHBN directory in windows, only in a command prompt, and am unable to delete it.
Additionally in my startup tab under System Configuration Utility, there are two listings for "StartService" with the command located at " C:\documents and settings\administrator\local settings\application data\KRHPHHBN\StartService.exe"
Additionally When I boot up, once windows loads, I immediately get the following warning a warning that Startservice can not load properly. Its a "Startservice.exe - Application Error" stating:"
"The instruction at "0x7c910ef4" referenced memory at "0x00e11520". The memory could not be "read".
Click on OK to terminate the program
If i Remove "startservice" from my startup config by unchecking it, once I reboot, it is rechecked.
I forgot to mention a big part:
Im also getting redirects of google search results.
When searching in google, if I click on a result, it directs me to various other sites.
EDIT: Added info from second post to initial post by OP, moved thread to Am I Infected as more appropriate forum ~ Hamluis.
Edited by hamluis, 10 April 2010 - 07:36 AM.