malcolm22
2010-06-11, 15:44
:fear:
hi there, GREAT forum. Keep up the good work.
I have been noticing SERPS hijacked and redirection to other sites... as well as when i right click on files, i am prompted to remove my anti-virus !!
So after trying a couple of malware scanners, HiJackthis, CCleaner, Malware bytes & Spybot.
Thanks in advanced.
Here is my DDS report below:
******************************
DDS.txt
******************************
DDS (Ver_10-03-17.01) - NTFSx86
Run by Owner at 9:38:20.40 on Fri 06/11/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_10
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2208 [GMT -4:00]
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Visual Web Ripper\WebRipperService.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Ericsson\Mobile4\Sync Manager\syncindicator.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\WINDOWS\TEMP\khqjec.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Owner.Elite\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://www.google.com/ie
uStart Page = hxxp://www.google.ca/
uSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: ADC PlugIn: {149256d5-e103-4523-bb43-2cfb066839d6} - c:\program files\adc_w32.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: CmjBrowserHelperObject Object: {ac41d38f-b56d-40ad-94e0-b493d130c959} - c:\program files\mindjet\mindmanager 6\Mm6InternetExplorer.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [Qvutij] rundll32.exe "c:\windows\mlexmoc.dll",Startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - {AC41D38F-B56D-40AD-94E0-B493D130C959} - c:\program files\mindjet\mindmanager 6\Mm6InternetExplorer.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: intuit.com\ttlc
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
Handler: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - c:\windows\wc98pp.dll
Handler: intu-qt2008 - {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} -
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SEH: WinFax PRO IShellExecuteHook: {a213b520-c6c2-11d0-af9d-008029e1027e} - c:\program files\winfax\WfxSeh32.Dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner~1.eli\applic~1\mozilla\firefox\profiles\rcdlpkur.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.montrealgazette.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\owner.elite\application data\mozilla\firefox\profiles\rcdlpkur.default\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\XpcomOpusConnector.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: XULRunner: {04EDE889-EC3F-46D7-98C9-B9F1BEA942A0} - c:\documents and settings\owner.elite\local settings\application data\{04EDE889-EC3F-46D7-98C9-B9F1BEA942A0}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
============= SERVICES / DRIVERS ===============
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2005-2-4 324232]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2005-2-4 53896]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2005-4-8 185968]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2005-4-8 161392]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2005-4-17 1706176]
R2 VisualWebRipper;Visual Web Ripper;c:\program files\visual web ripper\WebRipperService.exe [2010-3-29 11776]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100606.003\naveng.sys [2010-6-6 85552]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100606.003\navex15.sys [2010-6-6 1347504]
S0 lnxdfn;lnxdfn;c:\windows\system32\drivers\tqxgjhu.sys --> c:\windows\system32\drivers\tqxgjhu.sys [?]
S1 vcdrom;Virtual CD-ROM Device Driver;\??\f:\tobuy\turbotax home & business 2009\winxpvirtualcdcontrolpanel_21\vcdrom.sys --> f:\tobuy\turbotax home & business 2009\winxpvirtualcdcontrolpanel_21\VCdRom.sys [?]
S2 Ip6Fwq;Ip6Fwq;\??\c:\windows\system32\drivers\ip6fwq.sys --> c:\windows\system32\drivers\Ip6Fwq.sys [?]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2005-4-8 83568]
S3 PEEK5;PEEK5 Protocol Driver;\??\c:\docume~1\owner~1.eli\desktop\window~1\window~1\aircra~1.1_w\peek5.sys --> c:\docume~1\owner~1.eli\desktop\window~1\window~1\aircra~1.1_w\PEEK5.SYS [?]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2005-4-17 124608]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-10-25 24652]
=============== Created Last 30 ================
2010-06-10 17:47:57 0 d-----w- c:\program files\trend micro
2010-06-10 12:28:54 0 d-----w- c:\windows\SxsCaPendDel
2010-06-08 16:56:19 89 ----a-w- c:\windows\wininit.ini
2010-06-08 15:42:01 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-06-08 15:42:01 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-06-06 02:02:37 1580 ----a-w- C:\Sysinternals Antivirus.lnk
2010-06-06 02:02:37 0 d-----w- C:\Sysinternals Antivirus
2010-06-06 01:58:19 120 ----a-w- c:\windows\Pnozezorijegozux.dat
2010-06-06 01:58:19 0 ----a-w- c:\windows\Gjadejupecej.bin
2010-06-06 01:56:46 225792 ----a-w- c:\program files\adc_w32.dll
2010-06-04 16:25:33 0 d-----w- c:\windows\CtDrvInstall
2010-06-04 16:24:27 0 d-----w- c:\program files\common files\Reallusion
2010-06-04 16:23:41 0 d-----w- c:\program files\Creative Live! Cam
2010-06-04 15:51:37 0 d-----w- c:\program files\Optimal Product Finder
2010-06-03 13:14:03 0 d-----w- C:\Juz30
2010-06-03 13:01:51 0 d-----w- C:\flashquran
2010-06-01 16:14:27 0 d-----w- c:\windows\Hot Item Finder
2010-06-01 16:14:27 0 d-----w- c:\program files\HotItemFinder
2010-06-01 15:38:48 0 d-----w- c:\program files\BumbleSoft
2010-06-01 15:38:07 0 d-----w- c:\windows\system32\Visual Web Ripper
2010-06-01 15:38:07 0 d-----w- c:\docume~1\alluse~1\applic~1\Visual Web Ripper
2010-06-01 15:37:52 0 d-----w- c:\program files\Visual Web Ripper
2010-06-01 13:42:08 1495040 ----a-w- c:\windows\system32\ChilkatFtp2.dll
2010-06-01 13:40:24 0 d-----w- c:\program files\OpenVPN
2010-05-29 23:14:11 0 d-----w- c:\program files\The Guide
2010-05-27 20:56:46 180224 ----a-w- c:\windows\system32\ijl11.dll
2010-05-27 20:56:46 1310720 ----a-w- c:\windows\system32\ChilkatUpload.dll
2010-05-26 17:51:40 0 d-----w- c:\docume~1\owner~1.eli\applic~1\FaceWizard
2010-05-26 15:31:05 0 d-----w- c:\program files\Affiliate Elite
2010-05-24 02:09:33 0 d-----w- c:\temp\dvd-tmp
2010-05-24 02:09:33 0 d-----w- c:\temp\dvd-out
2010-05-24 02:02:04 0 d-----w- c:\temp\dvd-cache
2010-05-24 02:02:04 0 d-----w- C:\Temp
2010-05-24 02:02:04 0 d-----w- c:\documents and settings\owner.elite\.thumb
2010-05-24 02:01:55 0 d-----w- c:\program files\DVDStyler
2010-05-24 01:53:10 0 d-----w- c:\docume~1\owner~1.eli\applic~1\Canneverbe Limited
2010-05-24 01:53:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Canneverbe Limited
2010-05-16 17:13:21 0 d-----w- c:\docume~1\owner~1.eli\applic~1\TweetGlide.4C2CA0B91861599E32033FE57CA969D1117C4915.1
==================== Find3M ====================
2010-04-30 13:24:12 140996 ----a-w- c:\windows\hpoins14.dat
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 12:04:52 69120 ---ha-w- c:\windows\system32\mlfcache.dat
2010-04-18 17:43:03 720896 ----a-w- c:\windows\iun6002ev.exe
2010-04-08 17:01:16 70984 ----a-w- c:\documents and settings\owner.elite\g2mdlhlpx.exe
2010-03-15 23:04:27 737280 ----a-w- c:\windows\iun6002.exe
============= FINISH: 9:39:09.03 ===============
***********************************
ATTACH.txt
***********************************
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 9/24/2009 7:08:20 PM
System Uptime: 6/11/2010 8:56:37 AM (1 hours ago)
Motherboard: Gateway | |
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz | uFCPGA2 | 1663/667mhz
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz | uFCPGA2 | 1663/667mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 43 GiB total, 13.51 GiB free.
D: is FIXED (FAT32) - 5 GiB total, 1.646 GiB free.
E: is CDROM ()
F: is FIXED (NTFS) - 63 GiB total, 6.546 GiB free.
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP267: 5/31/2010 9:57:14 AM - System Checkpoint
RP268: 5/31/2010 11:36:14 AM - Removed FaceWizard
RP269: 6/1/2010 11:37:51 AM - Installed Visual Web Ripper
RP270: 6/1/2010 11:38:48 AM - Installed YellaBot
RP271: 6/4/2010 11:51:36 AM - Installed Optimal Product Finder
RP272: 6/4/2010 12:23:36 PM - Installed Integrated Webcam
RP273: 6/4/2010 12:24:26 PM - Installed Live! Cam Avatar Creator
RP274: 6/4/2010 12:25:43 PM - Installed Integrated Webcam
RP275: 6/4/2010 2:16:38 PM - Removed Live! Cam Avatar Creator
RP276: 6/5/2010 3:19:21 PM - System Checkpoint
RP277: 6/7/2010 12:12:39 PM - Removed Dell Webcam Central
RP278: 6/7/2010 12:14:06 PM - Removed HPSU306Stub
RP279: 6/7/2010 12:14:11 PM - Removed HP Update
RP280: 6/7/2010 12:15:02 PM - Removed HPSSupply
RP281: 6/10/2010 8:27:48 AM - Removed QuickTax 2009.
RP282: 6/10/2010 8:33:38 AM - Removed QuickTax 2008.
RP283: 6/10/2010 8:40:47 AM - Removed TweetGlide
RP284: 6/10/2010 2:25:12 PM - Restore Operation
RP285: 6/10/2010 2:31:53 PM - Restore Operation
==== Installed Programs ======================
2007 Microsoft Office Suite Service Pack 2 (SP2)
32 Bit HP CIO Components Installer
7-Zip 4.65
Adobe Acrobat 6.0 Professional - English, Français, Deutsch
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0
Advanced Audio FX Engine
Advanced Email Extractor PRO
Advanced SystemCare 3
AIM 7
AIO_Scan
Alleycode HTML Editor 2.2.1
AoA Audio Extractor
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AutoYahoo
BitComet 1.05
BitTorrent
Bonjour
BufferChm
CamStudio
CCleaner
Compatibility Pack for the 2007 Office system
Competition Dominator
Concord WinFax Plugin v3.0
Content Bully
Copy
Core FTP LE 2.1
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
Directory Submitter Full
DivX
DivX Player
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
DVD Solution
DVDStyler v1.8.0.3
ERUNT 1.1j
eSupportQFolder
F4100
F4100_doccd
F4100_Help
gKeywordTool 1.0
Google AdWords Editor
GoToMeeting 4.5.0.452
GYC Automator Beta
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hot Item Finder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB893357)
Hotfix for Windows XP (KB895953)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB909095)
Hotfix for Windows XP (KB910728)
Hotfix for Windows XP (KB912024)
Hotfix for Windows XP (KB914906)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotspot Shield 1.34
HP Customer Participation Program 9.0
HP Deskjet All-In-One Software 9.0
HP Imaging Device Functions 9.0
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Solution Center 9.0
HPProductAssistant
Hypnotic Writer's Swipe File 1.0
Hypnotic Writing Wizard 2.0
InfraRecorder
Intel Matrix Storage Manager
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
J2SE Runtime Environment 5.0 Update 2
Java(TM) 6 Update 10
LiveReg (Symantec Corporation)
LiveUpdate 2.6 (Symantec Corporation)
Malwarebytes' Anti-Malware
Market Samurai
MarketResearch
mCore
mDriver
mDrWiFi
MetaTrader 4 at FOREX.com 4.00
mHelp
Microsoft .NET Framework 1.0 Hotfix (KB930494)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Standard 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Mindjet MindManager Pro 6
mIWA
mLogView
mMHouse
Motorola SM56 Data Fax Modem
Mozilla Firefox (3.5.9)
mPfMgr
mPfWiz
mProSafe
MSVCRT
mWlsSafe
mXML
mZConfig
Napster Burn Engine
OpenVPN 2.1.1
Optimal Product Finder
Pdf995
Phoenix Twitter Desktop
PowerDVD
PSSWCORE
QuickTime
RealPlayer
Recovery Software Suite Gateway
RevenueWire Keyword Manager
S3 Ripper 1.3
Samsung ML-1710 Series
Scan
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917537)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Segoe UI
SigmaTel Audio
Skype™ 4.1
SolutionCenter
Sonic Encoders
Sony Ericsson PC Suite for Smartphones
Sony Ericsson Symbian 9 Drivers
SpeedPPC Campaign Builder
Spybot - Search & Destroy
Status
Symantec AntiVirus
Symantec WinFax PRO
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515/xx12 drivers.
The Authority Loophole
The Guide
The Logo Creator v5
TIPCI
Toolbox
TrayApp
UnloadSupport
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Update Rollup 2 for Windows XP Media Center Edition 2005
VideoToolkit01
Viewpoint Media Player
Visual Web Ripper
VLC media player 1.0.2
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Upload Tool
Windows Media Format Runtime
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Media Center Edition 2005 KB914548
Windows XP Media Center Edition 2005 KB973768
WinHTTrack Website Copier 3.43-7
Yahoo! Messenger
YellaBot
==== Event Viewer Messages From Past Week ========
6/9/2010 2:50:52 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
6/9/2010 2:50:52 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
6/6/2010 12:27:47 PM, error: Service Control Manager [7034] - The Adobe Update Service service terminated unexpectedly. It has done this 1 time(s).
6/6/2010 10:19:44 AM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
6/5/2010 10:28:25 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
6/5/2010 10:27:43 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
6/5/2010 10:02:54 PM, error: Service Control Manager [7034] - The Visual Web Ripper service terminated unexpectedly. It has done this 1 time(s).
6/4/2010 12:32:43 PM, error: Service Control Manager [7000] - The USBest Service Zero service failed to start due to the following error: %1 is not a valid Win32 application.
6/4/2010 12:32:43 PM, error: Service Control Manager [7000] - The Ip6Fwq service failed to start due to the following error: The system cannot find the file specified.
==== End Of File ===========================
Thanks
hi there, GREAT forum. Keep up the good work.
I have been noticing SERPS hijacked and redirection to other sites... as well as when i right click on files, i am prompted to remove my anti-virus !!
So after trying a couple of malware scanners, HiJackthis, CCleaner, Malware bytes & Spybot.
Thanks in advanced.
Here is my DDS report below:
******************************
DDS.txt
******************************
DDS (Ver_10-03-17.01) - NTFSx86
Run by Owner at 9:38:20.40 on Fri 06/11/2010
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_10
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3062.2208 [GMT -4:00]
AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}
============== Running Processes ===============
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Hotspot Shield\bin\openvpnas.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Hotspot Shield\HssWPR\hsssrv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Visual Web Ripper\WebRipperService.exe
C:\WINDOWS\system32\WFXSVC.EXE
C:\Program Files\WinFax\WFXMOD32.EXE
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Sony Ericsson\Mobile4\Sync Manager\syncindicator.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\VideoLAN\VLC\vlc.exe
C:\WINDOWS\TEMP\khqjec.exe
C:\Program Files\Microsoft Office\Office12\EXCEL.EXE
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\Documents and Settings\Owner.Elite\My Documents\Downloads\dds.scr
============== Pseudo HJT Report ===============
uSearch Bar = hxxp://www.google.com/ie
uStart Page = hxxp://www.google.ca/
uSearch Page = hxxp://www.google.com
uInternet Settings,ProxyOverride = *.local
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\acrobat\activex\AcroIEHelper.dll
BHO: ADC PlugIn: {149256d5-e103-4523-bb43-2cfb066839d6} - c:\program files\adc_w32.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: CmjBrowserHelperObject Object: {ac41d38f-b56d-40ad-94e0-b493d130c959} - c:\program files\mindjet\mindmanager 6\Mm6InternetExplorer.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
uRun: [Qvutij] rundll32.exe "c:\windows\mlexmoc.dll",Startup
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {531B9DC0-D8EE-4c76-A6EE-6C1E50569655} - {AC41D38F-B56D-40AD-94E0-B493D130C959} - c:\program files\mindjet\mindmanager 6\Mm6InternetExplorer.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
Trusted Zone: intuit.com\ttlc
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_10-windows-i586.cab
Handler: ic32pp - {BBCA9F81-8F4F-11D2-90FF-0080C83D3571} - c:\windows\wc98pp.dll
Handler: intu-qt2008 - {05E53CE9-66C8-4a9e-A99F-FDB7A8E7B596} -
Handler: intu-qt2009 - {03947252-2355-4e9b-B446-8CCC75C43370} -
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SEH: WinFax PRO IShellExecuteHook: {a213b520-c6c2-11d0-af9d-008029e1027e} - c:\program files\winfax\WfxSeh32.Dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\owner~1.eli\applic~1\mozilla\firefox\profiles\rcdlpkur.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.montrealgazette.com/
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\documents and settings\owner.elite\application data\mozilla\firefox\profiles\rcdlpkur.default\extensions\{81bf1d23-5f17-408d-ac6b-bd6df7caf670}\components\XpcomOpusConnector.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npRLCT4Player.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll
FF - HiddenExtension: XULRunner: {04EDE889-EC3F-46D7-98C9-B9F1BEA942A0} - c:\documents and settings\owner.elite\local settings\application data\{04EDE889-EC3F-46D7-98C9-B9F1BEA942A0}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0010-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - false);user_pref(yahoo.ytff.general.dontshowhpoffer, truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
============= SERVICES / DRIVERS ===============
R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2005-2-4 324232]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2005-2-4 53896]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2005-4-8 185968]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2005-4-8 161392]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2005-4-17 1706176]
R2 VisualWebRipper;Visual Web Ripper;c:\program files\visual web ripper\WebRipperService.exe [2010-3-29 11776]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20100606.003\naveng.sys [2010-6-6 85552]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20100606.003\navex15.sys [2010-6-6 1347504]
S0 lnxdfn;lnxdfn;c:\windows\system32\drivers\tqxgjhu.sys --> c:\windows\system32\drivers\tqxgjhu.sys [?]
S1 vcdrom;Virtual CD-ROM Device Driver;\??\f:\tobuy\turbotax home & business 2009\winxpvirtualcdcontrolpanel_21\vcdrom.sys --> f:\tobuy\turbotax home & business 2009\winxpvirtualcdcontrolpanel_21\VCdRom.sys [?]
S2 Ip6Fwq;Ip6Fwq;\??\c:\windows\system32\drivers\ip6fwq.sys --> c:\windows\system32\drivers\Ip6Fwq.sys [?]
S3 ccPwdSvc;Symantec Password Validation;c:\program files\common files\symantec shared\ccPwdSvc.exe [2005-4-8 83568]
S3 PEEK5;PEEK5 Protocol Driver;\??\c:\docume~1\owner~1.eli\desktop\window~1\window~1\aircra~1.1_w\peek5.sys --> c:\docume~1\owner~1.eli\desktop\window~1\window~1\aircra~1.1_w\PEEK5.SYS [?]
S3 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2005-4-17 124608]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2008-5-6 11520]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2009-10-25 24652]
=============== Created Last 30 ================
2010-06-10 17:47:57 0 d-----w- c:\program files\trend micro
2010-06-10 12:28:54 0 d-----w- c:\windows\SxsCaPendDel
2010-06-08 16:56:19 89 ----a-w- c:\windows\wininit.ini
2010-06-08 15:42:01 0 d-----w- c:\program files\Spybot - Search & Destroy
2010-06-08 15:42:01 0 d-----w- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2010-06-06 02:02:37 1580 ----a-w- C:\Sysinternals Antivirus.lnk
2010-06-06 02:02:37 0 d-----w- C:\Sysinternals Antivirus
2010-06-06 01:58:19 120 ----a-w- c:\windows\Pnozezorijegozux.dat
2010-06-06 01:58:19 0 ----a-w- c:\windows\Gjadejupecej.bin
2010-06-06 01:56:46 225792 ----a-w- c:\program files\adc_w32.dll
2010-06-04 16:25:33 0 d-----w- c:\windows\CtDrvInstall
2010-06-04 16:24:27 0 d-----w- c:\program files\common files\Reallusion
2010-06-04 16:23:41 0 d-----w- c:\program files\Creative Live! Cam
2010-06-04 15:51:37 0 d-----w- c:\program files\Optimal Product Finder
2010-06-03 13:14:03 0 d-----w- C:\Juz30
2010-06-03 13:01:51 0 d-----w- C:\flashquran
2010-06-01 16:14:27 0 d-----w- c:\windows\Hot Item Finder
2010-06-01 16:14:27 0 d-----w- c:\program files\HotItemFinder
2010-06-01 15:38:48 0 d-----w- c:\program files\BumbleSoft
2010-06-01 15:38:07 0 d-----w- c:\windows\system32\Visual Web Ripper
2010-06-01 15:38:07 0 d-----w- c:\docume~1\alluse~1\applic~1\Visual Web Ripper
2010-06-01 15:37:52 0 d-----w- c:\program files\Visual Web Ripper
2010-06-01 13:42:08 1495040 ----a-w- c:\windows\system32\ChilkatFtp2.dll
2010-06-01 13:40:24 0 d-----w- c:\program files\OpenVPN
2010-05-29 23:14:11 0 d-----w- c:\program files\The Guide
2010-05-27 20:56:46 180224 ----a-w- c:\windows\system32\ijl11.dll
2010-05-27 20:56:46 1310720 ----a-w- c:\windows\system32\ChilkatUpload.dll
2010-05-26 17:51:40 0 d-----w- c:\docume~1\owner~1.eli\applic~1\FaceWizard
2010-05-26 15:31:05 0 d-----w- c:\program files\Affiliate Elite
2010-05-24 02:09:33 0 d-----w- c:\temp\dvd-tmp
2010-05-24 02:09:33 0 d-----w- c:\temp\dvd-out
2010-05-24 02:02:04 0 d-----w- c:\temp\dvd-cache
2010-05-24 02:02:04 0 d-----w- C:\Temp
2010-05-24 02:02:04 0 d-----w- c:\documents and settings\owner.elite\.thumb
2010-05-24 02:01:55 0 d-----w- c:\program files\DVDStyler
2010-05-24 01:53:10 0 d-----w- c:\docume~1\owner~1.eli\applic~1\Canneverbe Limited
2010-05-24 01:53:09 0 d-----w- c:\docume~1\alluse~1\applic~1\Canneverbe Limited
2010-05-16 17:13:21 0 d-----w- c:\docume~1\owner~1.eli\applic~1\TweetGlide.4C2CA0B91861599E32033FE57CA969D1117C4915.1
==================== Find3M ====================
2010-04-30 13:24:12 140996 ----a-w- c:\windows\hpoins14.dat
2010-04-29 19:39:38 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39:26 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 12:04:52 69120 ---ha-w- c:\windows\system32\mlfcache.dat
2010-04-18 17:43:03 720896 ----a-w- c:\windows\iun6002ev.exe
2010-04-08 17:01:16 70984 ----a-w- c:\documents and settings\owner.elite\g2mdlhlpx.exe
2010-03-15 23:04:27 737280 ----a-w- c:\windows\iun6002.exe
============= FINISH: 9:39:09.03 ===============
***********************************
ATTACH.txt
***********************************
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 9/24/2009 7:08:20 PM
System Uptime: 6/11/2010 8:56:37 AM (1 hours ago)
Motherboard: Gateway | |
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz | uFCPGA2 | 1663/667mhz
Processor: Intel(R) Core(TM)2 CPU T5500 @ 1.66GHz | uFCPGA2 | 1663/667mhz
==== Disk Partitions =========================
C: is FIXED (NTFS) - 43 GiB total, 13.51 GiB free.
D: is FIXED (FAT32) - 5 GiB total, 1.646 GiB free.
E: is CDROM ()
F: is FIXED (NTFS) - 63 GiB total, 6.546 GiB free.
==== Disabled Device Manager Items =============
==== System Restore Points ===================
RP267: 5/31/2010 9:57:14 AM - System Checkpoint
RP268: 5/31/2010 11:36:14 AM - Removed FaceWizard
RP269: 6/1/2010 11:37:51 AM - Installed Visual Web Ripper
RP270: 6/1/2010 11:38:48 AM - Installed YellaBot
RP271: 6/4/2010 11:51:36 AM - Installed Optimal Product Finder
RP272: 6/4/2010 12:23:36 PM - Installed Integrated Webcam
RP273: 6/4/2010 12:24:26 PM - Installed Live! Cam Avatar Creator
RP274: 6/4/2010 12:25:43 PM - Installed Integrated Webcam
RP275: 6/4/2010 2:16:38 PM - Removed Live! Cam Avatar Creator
RP276: 6/5/2010 3:19:21 PM - System Checkpoint
RP277: 6/7/2010 12:12:39 PM - Removed Dell Webcam Central
RP278: 6/7/2010 12:14:06 PM - Removed HPSU306Stub
RP279: 6/7/2010 12:14:11 PM - Removed HP Update
RP280: 6/7/2010 12:15:02 PM - Removed HPSSupply
RP281: 6/10/2010 8:27:48 AM - Removed QuickTax 2009.
RP282: 6/10/2010 8:33:38 AM - Removed QuickTax 2008.
RP283: 6/10/2010 8:40:47 AM - Removed TweetGlide
RP284: 6/10/2010 2:25:12 PM - Restore Operation
RP285: 6/10/2010 2:31:53 PM - Restore Operation
==== Installed Programs ======================
2007 Microsoft Office Suite Service Pack 2 (SP2)
32 Bit HP CIO Components Installer
7-Zip 4.65
Adobe Acrobat 6.0 Professional - English, Français, Deutsch
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 7.0
Advanced Audio FX Engine
Advanced Email Extractor PRO
Advanced SystemCare 3
AIM 7
AIO_Scan
Alleycode HTML Editor 2.2.1
AoA Audio Extractor
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AutoUpdate
AutoYahoo
BitComet 1.05
BitTorrent
Bonjour
BufferChm
CamStudio
CCleaner
Compatibility Pack for the 2007 Office system
Competition Dominator
Concord WinFax Plugin v3.0
Content Bully
Copy
Core FTP LE 2.1
CustomerResearchQFolder
Destination Component
DeviceDiscovery
DeviceManagementQFolder
Directory Submitter Full
DivX
DivX Player
DJ_AIO_ProductContext
DJ_AIO_Software
DJ_AIO_Software_min
DVD Solution
DVDStyler v1.8.0.3
ERUNT 1.1j
eSupportQFolder
F4100
F4100_doccd
F4100_Help
gKeywordTool 1.0
Google AdWords Editor
GoToMeeting 4.5.0.452
GYC Automator Beta
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hot Item Finder
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB888795)
Hotfix for Windows XP (KB891593)
Hotfix for Windows XP (KB893357)
Hotfix for Windows XP (KB895953)
Hotfix for Windows XP (KB895961)
Hotfix for Windows XP (KB896256)
Hotfix for Windows XP (KB896344)
Hotfix for Windows XP (KB899337)
Hotfix for Windows XP (KB899510)
Hotfix for Windows XP (KB902841)
Hotfix for Windows XP (KB906569)
Hotfix for Windows XP (KB909095)
Hotfix for Windows XP (KB910728)
Hotfix for Windows XP (KB912024)
Hotfix for Windows XP (KB914906)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB970653-v3)
Hotspot Shield 1.34
HP Customer Participation Program 9.0
HP Deskjet All-In-One Software 9.0
HP Imaging Device Functions 9.0
HP Photosmart Essential 2.01
HP Photosmart Essential2.01
HP Solution Center 9.0
HPProductAssistant
Hypnotic Writer's Swipe File 1.0
Hypnotic Writing Wizard 2.0
InfraRecorder
Intel Matrix Storage Manager
Intel(R) Graphics Media Accelerator Driver
Intel(R) PROSet/Wireless Software
iTunes
J2SE Runtime Environment 5.0 Update 2
Java(TM) 6 Update 10
LiveReg (Symantec Corporation)
LiveUpdate 2.6 (Symantec Corporation)
Malwarebytes' Anti-Malware
Market Samurai
MarketResearch
mCore
mDriver
mDrWiFi
MetaTrader 4 at FOREX.com 4.00
mHelp
Microsoft .NET Framework 1.0 Hotfix (KB930494)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Office Excel MUI (English) 2007
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Professional Edition 2003
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Standard 2007
Microsoft Office Word MUI (English) 2007
Microsoft Software Update for Web Folders (English) 12
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Mindjet MindManager Pro 6
mIWA
mLogView
mMHouse
Motorola SM56 Data Fax Modem
Mozilla Firefox (3.5.9)
mPfMgr
mPfWiz
mProSafe
MSVCRT
mWlsSafe
mXML
mZConfig
Napster Burn Engine
OpenVPN 2.1.1
Optimal Product Finder
Pdf995
Phoenix Twitter Desktop
PowerDVD
PSSWCORE
QuickTime
RealPlayer
Recovery Software Suite Gateway
RevenueWire Keyword Manager
S3 Ripper 1.3
Samsung ML-1710 Series
Scan
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899589)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB916281)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917537)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB944338-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971032)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Segoe UI
SigmaTel Audio
Skype™ 4.1
SolutionCenter
Sonic Encoders
Sony Ericsson PC Suite for Smartphones
Sony Ericsson Symbian 9 Drivers
SpeedPPC Campaign Builder
Spybot - Search & Destroy
Status
Symantec AntiVirus
Symantec WinFax PRO
Synaptics Pointing Device Driver
Texas Instruments PCIxx21/x515/xx12 drivers.
The Authority Loophole
The Guide
The Logo Creator v5
TIPCI
Toolbox
TrayApp
UnloadSupport
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB910437)
Update for Windows XP (KB912945)
Update for Windows XP (KB916595)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB973815)
Update Rollup 2 for Windows XP Media Center Edition 2005
VideoToolkit01
Viewpoint Media Player
Visual Web Ripper
VLC media player 1.0.2
WebFldrs XP
WebReg
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Messenger
Windows Live Upload Tool
Windows Media Format Runtime
Windows XP Hotfix - KB834707
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888239
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
Windows XP Media Center Edition 2005 KB914548
Windows XP Media Center Edition 2005 KB973768
WinHTTrack Website Copier 3.43-7
Yahoo! Messenger
YellaBot
==== Event Viewer Messages From Past Week ========
6/9/2010 2:50:52 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
6/9/2010 2:50:52 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
6/6/2010 12:27:47 PM, error: Service Control Manager [7034] - The Adobe Update Service service terminated unexpectedly. It has done this 1 time(s).
6/6/2010 10:19:44 AM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
6/5/2010 10:28:25 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: abp480n5 adpu160m agp440 agpCPQ Aha154x aic78u2 aic78xx AliIde alim1541 amdagp amsint asc asc3350p asc3550 cbidf cd20xrnt CmdIde Cpqarray dac2w2k dac960nt dpti2o hpn i2omp ini910u IntelIde mraid35x perc2 perc2hib ql1080 Ql10wnt ql12160 ql1240 ql1280 sisagp Sparrow symc810 symc8xx sym_hi sym_u3 TosIde ultra viaagp ViaIde
6/5/2010 10:27:43 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume1'. It has stopped monitoring the volume.
6/5/2010 10:02:54 PM, error: Service Control Manager [7034] - The Visual Web Ripper service terminated unexpectedly. It has done this 1 time(s).
6/4/2010 12:32:43 PM, error: Service Control Manager [7000] - The USBest Service Zero service failed to start due to the following error: %1 is not a valid Win32 application.
6/4/2010 12:32:43 PM, error: Service Control Manager [7000] - The Ip6Fwq service failed to start due to the following error: The system cannot find the file specified.
==== End Of File ===========================
Thanks