Sorry for the delay, did not see your reply
The symptoms:
When I open my web Browser (I use FireFox but this also happens with Internet Explorer), it does not open with the Firefox start-up page-instead it re-directs and opens in random advertisement pages. I also get a lot of pop-ups. This started after my bf went on some questionable websites and ads just started popping up all over the background.
I used Spybot S&D, which cleared quite a few viruses and stopped the errors I was getting upon start-up, but the web browser is still re-directing.
Here is the ComboFix log and new DDS
Here you go-thanks again for all your help!
ComboFix 09-10-30.01 - cristy 11/01/2009 10:16.1.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.1.1033.18.2036.1207 [GMT -7:00]
Running from: c:\users\cristy\Downloads\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Outdated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\$recycle.bin\S-1-5-21-1516005676-1222019494-700852110-1001
c:\$recycle.bin\S-1-5-21-1516005676-1222019494-700852110-1002
c:\$recycle.bin\S-1-5-21-1516005676-1222019494-700852110-500
c:\$recycle.bin\S-1-5-21-184066353-4097103777-3015266722-500
c:\$recycle.bin\S-1-5-21-3825229910-1993345530-2331226967-1000
.
((((((((((((((((((((((((( Files Created from 2009-10-01 to 2009-11-01 )))))))))))))))))))))))))))))))
.
2009-11-01 17:23 . 2009-11-01 17:23 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-11-01 17:22 . 2009-11-01 17:22 -------- d-----w- c:\users\Jason\AppData\Local\temp
2009-11-01 17:22 . 2009-11-01 17:22 -------- d-----w- c:\users\cass\AppData\Local\temp
2009-11-01 17:16 . 2008-01-21 02:23 21560 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-10-28 11:51 . 2009-09-10 15:21 310784 ----a-w- c:\windows\system32\unregmp2.exe
2009-10-28 11:51 . 2009-09-10 15:21 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-10-27 13:56 . 2009-08-07 02:24 44768 ----a-w- c:\windows\system32\wups2.dll
2009-10-27 13:56 . 2009-08-07 02:24 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-10-27 13:56 . 2009-08-07 02:23 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-10-27 13:56 . 2009-08-07 01:45 2421760 ----a-w- c:\windows\system32\wucltux.dll
2009-10-27 13:55 . 2009-08-07 02:24 35552 ----a-w- c:\windows\system32\wups.dll
2009-10-27 13:55 . 2009-08-07 02:23 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-10-27 13:55 . 2009-08-07 01:44 87552 ----a-w- c:\windows\system32\wudriver.dll
2009-10-27 13:55 . 2009-08-07 01:23 171608 ----a-w- c:\windows\system32\wuwebv.dll
2009-10-27 13:55 . 2009-08-07 00:44 33792 ----a-w- c:\windows\system32\wuapp.exe
2009-10-24 20:30 . 2009-10-24 20:30 -------- d-----w- c:\program files\Trend Micro
2009-10-24 20:28 . 2009-10-24 20:28 -------- d-----w- c:\program files\ERUNT
2009-10-24 15:16 . 2009-10-24 17:04 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-10-24 15:16 . 2009-10-24 17:04 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-10-13 20:05 . 2009-08-05 14:22 3597896 ----a-w- c:\windows\system32\ntkrnlpa.exe
2009-10-13 20:05 . 2009-08-05 14:22 3546184 ----a-w- c:\windows\system32\ntoskrnl.exe
2009-10-13 20:03 . 2009-08-31 13:55 428544 ----a-w- c:\windows\system32\EncDec.dll
2009-10-13 20:03 . 2009-08-31 13:55 293376 ----a-w- c:\windows\system32\psisdecd.dll
2009-10-13 20:03 . 2009-09-04 12:24 61440 ----a-w- c:\windows\system32\msasn1.dll
2009-10-13 19:54 . 2009-09-14 09:44 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2009-10-13 19:53 . 2009-04-02 12:37 604672 ----a-w- c:\windows\system32\WMSPDMOD.DLL
2009-10-05 23:36 . 2009-10-05 23:36 -------- d-----w- c:\users\cass\AppData\Roaming\Yahoo!
2009-10-05 23:30 . 2009-10-05 23:31 -------- d-----w- c:\users\cass\AppData\Local\Adobe
2009-10-03 15:47 . 2009-10-01 16:29 195440 ------w- c:\windows\system32\MpSigStub.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-24 17:33 . 2009-07-16 00:27 98 ----a-w- c:\users\Jason\AppData\Roaming\wklnhst.dat
2009-10-14 09:10 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-29 17:38 . 2009-09-29 17:38 -------- d-----w- c:\program files\Citrix
2009-09-25 02:42 . 2009-04-04 04:49 -------- d-----w- c:\users\Jason\AppData\Roaming\LimeWire
2009-09-22 22:12 . 2009-08-25 22:09 -------- d-----w- c:\programdata\Sukoku
2009-09-21 23:25 . 2009-08-25 22:09 -------- d-----w- c:\program files\Sukoku
2009-09-15 10:59 . 2009-02-12 04:30 1279968 ----a-w- c:\windows\system32\aswBoot.exe
2009-09-15 10:55 . 2009-02-12 04:30 114768 ----a-w- c:\windows\system32\drivers\aswSP.sys
2009-09-15 10:55 . 2009-02-12 04:30 20560 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2009-09-15 10:55 . 2009-02-12 04:30 53328 ----a-w- c:\windows\system32\drivers\aswMonFlt.sys
2009-09-15 10:54 . 2009-02-12 04:30 52368 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2009-09-15 10:54 . 2009-02-12 04:30 23152 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2009-09-15 10:53 . 2009-02-12 04:30 97480 ----a-w- c:\windows\system32\AvastSS.scr
2009-09-10 23:14 . 2009-02-13 05:11 -------- d-----w- c:\program files\Microsoft Silverlight
2009-09-10 17:30 . 2009-10-13 20:06 213504 ----a-w- c:\windows\system32\msv1_0.dll
2009-09-09 21:47 . 2009-09-09 21:47 -------- d-----w- c:\users\cristy\AppData\Roaming\vlc
2009-08-28 12:39 . 2009-09-03 00:26 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-08-28 10:15 . 2009-09-03 00:26 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-27 13:32 . 2009-10-13 20:06 833024 ----a-w- c:\windows\system32\wininet.dll
2009-08-27 13:29 . 2009-10-13 20:06 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-08-27 10:58 . 2009-10-13 20:06 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-08-14 17:07 . 2009-09-09 12:10 897608 ----a-w- c:\windows\system32\drivers\tcpip.sys
2009-08-14 16:29 . 2009-09-09 12:10 104960 ----a-w- c:\windows\system32\netiohlp.dll
2009-08-14 16:29 . 2009-09-09 12:10 17920 ----a-w- c:\windows\system32\netevent.dll
2009-08-14 14:16 . 2009-09-09 12:10 9728 ----a-w- c:\windows\system32\TCPSVCS.EXE
2009-08-14 14:16 . 2009-09-09 12:10 17920 ----a-w- c:\windows\system32\ROUTE.EXE
2009-08-14 14:16 . 2009-09-09 12:10 11264 ----a-w- c:\windows\system32\MRINFO.EXE
2009-08-14 14:16 . 2009-09-09 12:10 27136 ----a-w- c:\windows\system32\NETSTAT.EXE
2009-08-14 14:16 . 2009-09-09 12:10 19968 ----a-w- c:\windows\system32\ARP.EXE
2009-08-14 14:16 . 2009-09-09 12:10 10240 ----a-w- c:\windows\system32\finger.exe
2009-08-14 14:16 . 2009-09-09 12:10 8704 ----a-w- c:\windows\system32\HOSTNAME.EXE
2009-08-03 20:10 . 2009-08-03 20:10 721912 ----a-w- c:\users\cristy\gotomypc_428.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-21 1233920]
"HPADVISOR"="c:\program files\Hewlett-Packard\HP Advisor\HPAdvisor.exe" [2008-01-19 942080]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"WindowsWelcomeCenter"="oobefldr.dll" - c:\windows\System32\oobefldr.dll [2008-01-21 2153472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"hpsysdrv"="c:\hp\support\hpsysdrv.exe" [2007-04-18 65536]
"OsdMaestro"="c:\program files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe" [2007-02-15 118784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_01\bin\jusched.exe" [2007-04-07 132760]
"DT HPW"="c:\program files\Portrait Displays\HP My Display\DTHtml.exe" [2007-06-30 278528]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2008-03-26 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2008-03-26 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [2008-03-26 133656]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-09-15 81000]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-06-05 292136]
"WPCUMI"="c:\windows\system32\WpcUmi.exe" [2006-11-02 176128]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2008-07-03 6266880]
c:\users\Jason\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
R1 aswSP;avast! Self Protection;c:\windows\System32\drivers\aswSP.sys [2/11/2009 9:30 PM 114768]
R2 aswFsBlk;aswFsBlk;c:\windows\System32\drivers\aswFsBlk.sys [2/11/2009 9:30 PM 20560]
R2 aswMonFlt;aswMonFlt;c:\windows\System32\drivers\aswMonFlt.sys [2/11/2009 9:30 PM 53328]
R2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [10/24/2009 8:16 AM 1153368]
--- Other Services/Drivers In Memory ---
*NewlyCreated* - MBR
*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder
2009-11-01 c:\windows\Tasks\User_Feed_Synchronization-{75F4A956-7178-4257-A9AE-BB2C68A6FF0E}.job
- c:\windows\system32\msfeedssync.exe [2008-01-21 02:24]
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=81&bd=Presario&pf=desktop
LSP: c:\windows\system32\wpclsp.dll
FF - ProfilePath - c:\users\cristy\AppData\Roaming\Mozilla\Firefox\Profiles\yvllnam8.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.theprizeday.com/today.php|www.msn.com
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-HP Health Check Scheduler - [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
AddRemove-{16B6279B-9FF5-41fb-8BF9-404324F5DD1F}}_is1 - c:\program files\Media Access Startup\1.5.6.910\unins000.exe
AddRemove-{C5096216-7703-409E-B85A-8A6EE7395128}}_is1 - c:\program files\System Search Dispatcher\1.4.0.970\unins000.exe
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-01 10:23
Windows 6.0.6001 Service Pack 1 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A4\4&2d4f67a9&0&UID16843008\Device Parameters\MODES]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A4\4&2d4f67a9&0&UID16843008\Properties\{83da6326-97a6-4088-9453-a1923f573b29}]
@DACL=(02 0000)
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\DISPLAY\HWP26A4\4&2d4f67a9&0&UID16843008\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}]
@DACL=(02 0000)
.
Completion time: 2009-11-01 10:25
ComboFix-quarantined-files.txt 2009-11-01 17:25
Pre-Run: 266,597,756,928 bytes free
Post-Run: 266,574,319,616 bytes free
- - End Of File - - ACAF0D585D26C562F96B970878D514FD