Google Redirect Virus

December 30, 2009 at 13:58:00
Specs: Windows Vista
I have the Google Redirect Virus and it shows up in IE7. PLEASE HELP!!!! =/

See More: Google Redirect Virus

Report •

December 30, 2009 at 18:36:10
Please run RSIT.exe by random/random and post its logs.

Download random's system information tool (RSIT) by random/random from the following link and save it to your desktop.


1. Double click on RSIT.exe to launch program.
2.(Vista Users Only) Right click on the RSIT.exe icon and select "Run as Administrator" to run the program.
3. Click Continue at the disclaimer screen.
4. Your firewall may alert you that RSIT is requesting Internet access. Please allow it.
5.Once it has finished, two logs will open: log.txt<-- this will be maximized and info.txt<-- this will be minimized. Both logs will be located at C:\RSIT.exe.

Please download Malwarebytes' Anti-Malware from one of these sites:



Rename the setup file, mbam-setup.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename mbam-setup.exe to tool.exe> click save.

1. Double Click tool.exe to install the application.
2. Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
3. If an update is found, it will download and install the latest version.
4. Once the program has loaded, select "Perform Quick Scan", then click Scan. The scan may take some time to finish,so please be patient.
5. When the scan is complete, click OK, then Show Results to view the results.
6. Make sure that everything found is checked, and click Remove Selected.
7. When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.
8. The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
9. Copy&Paste the entire report in your next reply.

Report •

December 30, 2009 at 19:10:25
info.txt logfile of random's system information tool 1.06 2009-12-30 21:57:47

======Uninstall list======

-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}>msiexec /qb /x {77DCDCE3-2DED-62F3-8154-05E745472D07}>MsiExec.exe /I{77DCDCE3-2DED-62F3-8154-05E745472D07}
Adobe AIR-->C:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 ActiveX-->MsiExec.exe /X{3A6829EF-0791-4FDD-9382-C690DD0821B9}
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{03DEEAD2-F3B7-45BF-9006-A25D015F00D2}
Adobe Flash Player Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flex Builder 3-->"C:\Program Files\Adobe\Flex Builder 3\Uninstall Adobe Flex Builder 3\Uninstall Adobe Flex Builder 3.exe"
Adobe Illustrator CS2-->msiexec /I {B2F5D08C-7E79-4FCD-AAF4-57AD35FF0601}
Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 9.1.3-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
Adobe SVG Viewer 3.0-->C:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Winstall.exe -u -fC:\Program Files\Common Files\Adobe\SVG Viewer 3.0\Uninstall\Install.log
Banctec Service Agreement-->MsiExec.exe /X{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}
Broadcom Management Programs-->MsiExec.exe /X{C99C0593-3B48-41D9-B42F-6E035B320449}
Browser Address Error Redirector-->MsiExec.exe /I{62230596-37E5-4618-A329-0D21F529A86F}
Chinese Traditional Fonts Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-2448-0000-900000000003}
Cisco Systems VPN Client>MsiExec.exe /X{A7091E1D-36A4-47F1-A739-173CC341414F}
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0409-0000-0000000FF1CE}
Conexant HDA D330 MDC V.92 Modem-->C:\Program Files\CONEXANT\CNXT_MODEM_HDAUDIO_VEN_14F1&DEV_2C06&SUBSYS_14F1000F\HXFSETUP.EXE -U -Idel000fz.inf
Dell DataSafe Online-->MsiExec.exe /I{4D3C9F4B-4B7D-4E5D-99B9-0123AB0D51ED}
Dell Getting Started Guide-->MsiExec.exe /I{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}
Dell Support Center-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}
Dell Touchpad-->C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE
Dell Wireless WLAN Card-->"C:\Program Files\Dell\Dell Wireless WLAN Card\bcmwlu00.exe" verbose /rootkey="Software\Broadcom\802.11\UninstallInfo" /rootdir="C:\Program Files\Dell\Dell Wireless WLAN Card"
Digital Line Detect-->C:\Program Files\InstallShield Installation Information\{E646DCF0-5A68-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
Google Talk Plugin-->MsiExec.exe /I{EC59BF9E-39D5-3108-A34B-12FB60ECAF8B}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
HP Customer Participation Program 9.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP OCR Software 9.0-->C:\Program Files\HP\Digital Imaging\OCR\hpzscr01.exe -datfile hpqbud11.dat
HP Photosmart All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{B09BCBF6-87EE-4403-A336-3A9510856535}\setup\hpzscr01.exe -datfile hposcr15.dat
HP Photosmart Essential 2.01-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Smart Web Printing-->MsiExec.exe /X{415CDA53-9100-476F-A7B2-476691E117C7}
HP Solution Center 9.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}
HPSSupply-->MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
Japanese Fonts Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5760-0000-900000000003}
Java DB>MsiExec.exe /X{998D6972-F58E-479D-9248-8F179E55AE38}
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216012FF}
Java(TM) SE Development Kit 6 Update 10-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160100}
Java(TM) SE Runtime Environment 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160000}
JBuilder 2008-->"C:\JBuilder2008\Uninstall_JBuilder\Uninstaller.exe"
LimeWire PRO 4.10.0-->"C:\Program Files\LimeWire\uninstall.exe"
LiveUpdate 3.2 (Symantec Corporation)-->"C:\Program Files\Symantec\LiveUpdate\LSETUP.EXE" /U
LiveUpdate Notice (Symantec Corporation)-->MsiExec.exe /X{DBA4DB9D-EE51-4944-A419-98AB1F1249C8}
Lotus SmartSuite - English-->MsiExec.exe /I{536D6172-7453-7569-7465-392E38300409}
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
MATLAB R2008a-->C:\Program Files\MATLAB\R2008a\uninstall\uninstall.exe C:\Program Files\MATLAB\R2008a\
MediaDirect-->C:\Program Files\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0009 -cluninstall
Microsoft .NET Framework 3.5 SP1-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office Standard Edition 2003-->MsiExec.exe /I{91120409-6000-11D3-8CFE-0150048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Works-->MsiExec.exe /I{6D52C408-B09A-4520-9B18-475B81D393F1}
Modem Diagnostic Tool-->MsiExec.exe /I{F63A3748-B93D-4360-9AD4-B064481A5C7B}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 4.0 SP2 and SOAP Toolkit 3.0-->MsiExec.exe /I{32343DB6-9A52-40C9-87E4-5E7C79791C87}
Music, Photos & Videos Launcher-->MsiExec.exe /I{D7769185-9A7C-48D4-8874-5388743A1DE2}
NetWaiting-->C:\Program Files\InstallShield Installation Information\{3F92ABBB-6BBF-11D5-B229-002078017FBF}\setup.exe -runfromtemp -l0x0009 -removeonly
NJStar Chinese WP-->C:\Program Files\NJStar Chinese WP\uninst.exe
NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI
OutlookAddinSetup-->MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}
PrimoPDF-->"C:\Windows\PrimoPDF4\uninstall.exe" "/U:C:\Program Files\activePDF\PrimoPDF\Uninstall\uninstallPrimoPDF4.xml"
Product Documentation Launcher-->MsiExec.exe /I{89CEAE14-DD0F-448E-9554-15781EC9DB24}
Python 2.5 form-0.1-->"C:\Python25\Removeform.exe" -u "C:\Python25\form-wininst.log"
Python 2.5 soar-3-237-->"C:\Python25\Removesoar.exe" -u "C:\Python25\soar-wininst.log"
Python 2.5.1-->MsiExec.exe /I{31800004-6386-4999-A519-518F2D78D8F0}
Python 2.6 numpy-1.3.0-->"C:\Python26\Removenumpy.exe" -u "C:\Python26\numpy-wininst.log"
Python 2.6.2-->MsiExec.exe /I{24AAB420-4E30-4496-9739-3E216F3DE6AE}
QuickSet-->MsiExec.exe /I{0F95AA42-0FF6-4D48-9CA1-64C8D0777500}
RealPlayer-->C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Rhapsody Player Engine-->MsiExec.exe /I{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}
Roxio Creator Audio-->MsiExec.exe /I{83FFCFC7-88C6-41c6-8752-958A45325C82}
Roxio Creator BDAV Plugin-->MsiExec.exe /I{880AF49C-34F7-4285-A8AD-8F7A3D1C33DC}
Roxio Creator Copy-->MsiExec.exe /I{619CDD8A-14B6-43a1-AB6C-0F4EE48CE048}
Roxio Creator Data-->MsiExec.exe /I{0D397393-9B50-4c52-84D5-77E344289F87}
Roxio Creator DE-->MsiExec.exe /I{C8B0680B-CDAE-4809-9F91-387B6DE00F7C}
Roxio Creator Tools-->MsiExec.exe /I{0394CDC8-FABD-4ed8-B104-03393876DFDF}
Roxio Express Labeler-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio MyDVD DE-->MsiExec.exe /I{D639085F-4B6E-4105-9F37-A0DBB023E2FB}
Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
Sonic Activation Module-->MsiExec.exe /I{35E1EC43-D4FC-4E4A-AAB3-20DDA27E8BB0}
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Spy Sweeper Core-->MsiExec.exe /I{3F5B6210-0903-4DC6-8034-8F488AA3A782}
Sun Java (TM) Wireless Toolkit 2.5.2 for CLDC-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D75CD1E7-E341-45D5-975D-78477A517375}\setup.exe" -l0x9 -removeonly
TextPad 5-->MsiExec.exe /X{B6EC7388-E277-4A5B-8C8F-71067A41BA64}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
User's Guides-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{5CD29180-A95E-11D3-A4EB-00C04F7BDB2C}\setup.exe"
VideoLAN VLC media player 0.8.6h-->C:\Program Files\VideoLAN\VLC\uninstall.exe
Webroot AntiVirus with AntiSpyware-->"C:\Program Files\Webroot\Spy Sweeper\unins000.exe" /Log="C:\Users\Kimberly\AppData\Local\Temp\Uninstall.txt"
WinRAR archiver-->C:\Program Files\WinRAR\uninstall.exe
wxPython (ansi) for Python 2.6-->"C:\Python26\Lib\site-packages\wx-2.8-msw-ansi\unins000.exe"

======Security center information======

AV: Norton Internet Security
AV: Webroot AntiVirus with AntiSpyware
FW: Norton Internet Security
AS: Webroot AntiVirus with AntiSpyware
AS: Webroot AntiVirus with AntiSpyware (disabled) (outdated)
AS: Windows Defender
AS: Norton Internet Security
AS: Webroot AntiVirus with AntiSpyware

======System event log======

Computer Name:
Event Code: 26
Record Number: 303878
Source Name: ssidrv
Time Written: 20091231025259.325863-000
Event Type: Error

Computer Name:
Event Code: 4001
Message: WLAN AutoConfig service has successfully stopped.

Record Number: 303897
Source Name: Microsoft-Windows-WLAN-AutoConfig
Time Written: 20091231025326.765800-000
Event Type: Warning

Computer Name:
Event Code: 2511
Message: The server service was unable to recreate the share labeled because the directory C:\wamp\www\VidL_Flex\bin-debug\labelers\meme\labeled no longer exists. Please run "net share labeled /delete" to delete the share, or recreate the directory C:\wamp\www\VidL_Flex\bin-debug\labelers\meme\labeled.
Record Number: 303909
Source Name: Server
Time Written: 20091231025434.000000-000
Event Type: Warning

Computer Name:
Event Code: 11166
Message: The system failed to register host (A or AAAA) resource records (RRs) for network adapter
with settings:

Adapter Name : {CE3B1E0F-F5C2-484C-8698-E9D756968CCC}
Host Name : Kimberly-PC
Primary Domain Suffix :
DNS server list :
Sent update to server :
IP Address(es) :

The reason the system could not register these RRs was because of a security related problem. The cause of this could be (a) your computer does not have permissions to register and update the specific DNS domain name set for this adapter, or (b) there might have been a problem negotiating valid credentials with the DNS server during the processing of the update request.

You can manually retry DNS registration of the network adapter and its settings by typing "ipconfig /registerdns" at the command prompt. If problems still persist, contact your DNS server or network systems administrator. For specific error code, see the record data displayed below.
Record Number: 303914
Source Name: DnsApi
Time Written: 20091231025445.000000-000
Event Type: Warning

Computer Name:
Event Code: 7000
Message: The adfs service failed to start due to the following error:
The system cannot find the file specified.
Record Number: 303955
Source Name: Service Control Manager
Time Written: 20091231025523.000000-000
Event Type: Error

=====Application event log=====

Computer Name:
Event Code: 1530
Message: Windows detected your registry file is still in use by other applications or services. The file will be unloaded now. The applications or services that hold your registry file may not function properly afterwards.

2 user registry handles leaked from \Registry\User\S-1-5-21-3435808843-4141092854-47772454-1000_Classes:
Process 968 (\Device\HarddiskVolume3\Windows\System32\svchost.exe) has opened key \REGISTRY\USER\S-1-5-21-3435808843-4141092854-47772454-1000_CLASSES
Process 1876 (\Device\HarddiskVolume3\Windows\System32\spoolsv.exe) has opened key \REGISTRY\USER\S-1-5-21-3435808843-4141092854-47772454-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache

Record Number: 45245
Source Name: Microsoft-Windows-User Profiles Service
Time Written: 20091230235139.000000-000
Event Type: Warning

Computer Name:
Event Code: 1000
Message: Faulting application f.exe, version, time stamp 0x4b38c5a4, faulting module mshtml.dll_unloaded, version, time stamp 0x4ae70c16, exception code 0xc0000005, fault offset 0x6efed8c7, process id 0x318, application start time 0x01ca89ab4bd4a5b8.
Record Number: 45260
Source Name: Application Error
Time Written: 20091230235340.000000-000
Event Type: Error

Computer Name:
Event Code: 1000
Message: Faulting application f.exe, version, time stamp 0x4b38c5a4, faulting module mshtml.dll_unloaded, version, time stamp 0x4ae70c16, exception code 0xc0000005, fault offset 0x6ee5d8c7, process id 0xedc, application start time 0x01ca89ab6d0801a8.
Record Number: 45275
Source Name: Application Error
Time Written: 20091230235431.000000-000
Event Type: Error

Computer Name:
Event Code: 3012
Message: The performance strings in the Performance registry value is corrupted when process Performance extension counter provider. The BaseIndex value from the Performance registry is the first DWORD in the Data section, LastCounter value is the second DWORD in the Data section, and LastHelp value is the third DWORD in the Data section.
Record Number: 45281
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20091230235956.000000-000
Event Type: Error

Computer Name:
Event Code: 3011
Message: Unloading the performance counter strings for service WmiApRpl (WmiApRpl) failed. The first DWORD in the Data section contains the error code.
Record Number: 45282
Source Name: Microsoft-Windows-LoadPerf
Time Written: 20091230235956.000000-000
Event Type: Error

=====Security event log=====

Computer Name:
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\ssidrv.sys
Record Number: 97840
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091231025748.270257-000
Event Type: Audit Failure

Computer Name:
Event Code: 5038
Message: Code integrity determined that the image hash of a file is not valid. The file could be corrupt due to unauthorized modification or the invalid hash could indicate a potential disk device error.

File Name: \Device\HarddiskVolume3\Windows\System32\drivers\ssidrv.sys
Record Number: 97841
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091231025748.348257-000
Event Type: Audit Failure

Computer Name:
Event Code: 4648
Message: A logon was attempted using explicit credentials.

Security ID: S-1-5-18
Account Name: KIMBERLY-PC$
Account Domain: WWWJQKA
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Account Whose Credentials Were Used:
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon GUID: {00000000-0000-0000-0000-000000000000}

Target Server:
Target Server Name: localhost
Additional Information: localhost

Process Information:
Process ID: 0x298
Process Name: C:\Windows\System32\services.exe

Network Information:
Network Address: -
Port: -

This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Record Number: 97842
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091231025842.761057-000
Event Type: Audit Success

Computer Name:
Event Code: 4624
Message: An account was successfully logged on.

Security ID: S-1-5-18
Account Name: KIMBERLY-PC$
Account Domain: WWWJQKA
Logon ID: 0x3e7

Logon Type: 5

New Logon:
Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7
Logon GUID: {00000000-0000-0000-0000-000000000000}

Process Information:
Process ID: 0x298
Process Name: C:\Windows\System32\services.exe

Network Information:
Workstation Name:
Source Network Address: -
Source Port: -

Detailed Authentication Information:
Logon Process: Advapi
Authentication Package: Negotiate
Transited Services: -
Package Name (NTLM only): -
Key Length: 0

This event is generated when a logon session is created. It is generated on the computer that was accessed.

The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe.

The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network).

The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on.

The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases.

The authentication information fields provide detailed information about this specific logon request.
- Logon GUID is a unique identifier that can be used to correlate this event with a KDC event.
- Transited services indicate which intermediate services have participated in this logon request.
- Package name indicates which sub-protocol was used among the NTLM protocols.
- Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Record Number: 97843
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091231025842.761057-000
Event Type: Audit Success

Computer Name:
Event Code: 4672
Message: Special privileges assigned to new logon.

Security ID: S-1-5-18
Account Name: SYSTEM
Account Domain: NT AUTHORITY
Logon ID: 0x3e7

Privileges: SeAssignPrimaryTokenPrivilege
Record Number: 97844
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20091231025842.761057-000
Event Type: Audit Success

======Environment variables======

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\DLLShared\;C:\Program Files\Common Files\Roxio Shared\9.0\DLLShared\;C:\Program Files\MATLAB\R2008a\bin;C:\Program Files\MATLAB\R2008a\bin\win32
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel
"RoxioCentral"=C:\Program Files\Common Files\Roxio Shared\9.0\Roxio Central33\


Report •

December 30, 2009 at 19:10:58
Logfile of random's system information tool 1.06 (written by random/random)
Run by Kimberly at 2009-12-30 21:57:21
Microsoft® Windows Vista™ Home Premium
System drive C: has 138 GB (61%) free of 226 GB
Total RAM: 2045 MB (53% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:57:45 PM, on 12/30/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16945)
Boot mode: Normal

Running processes:
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\DellTPad\Apoint.exe
C:\Program Files\Sigmatel\C-Major Audio\WDM\sttray.exe
C:\Program Files\Dell\MediaDirect\PCMService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HP\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\DellTPad\ApMsgFwd.exe
C:\Program Files\DellTPad\HidFind.exe
C:\Program Files\DellTPad\Apntex.exe
C:\Program Files\trend micro\Kimberly.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer provided by Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] "%ProgramFiles%\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\DellTPad\Apoint.exe"
O4 - HKLM\..\Run: [SigmatelSysTrayApp] "%ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe"
O4 - HKLM\..\Run: [NvSvc] "RUNDLL32.EXE" C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NVHotkey] "rundll32.exe" C:\Windows\system32\nvHotkey.dll,Start
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] "C:\Windows\system32\WLTRAY.exe"
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\MediaDirect\PCMService.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [pdfw] "C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [ehTray.exe] "C:\Windows\ehome\ehTray.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Kimberly\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe
O4 - Global Startup: Lotus Organizer EasyClip.lnk = ?
O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe
O4 - Global Startup: VPN Client.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: HP Clipbook - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: HP Smart Select - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) -
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) -
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain =
O17 - HKLM\Software\..\Telephony: DomainName =
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain =
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\system32\aestsrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\system32\STacSV.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. ( - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\Windows\System32\WLTRYSVC.EXE
O23 - Service: Webroot Client Service (WRConsumerService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

End of file - 8970 bytes

======Scheduled tasks folder======


======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3049C3E9-B461-4BC5-8870-4C09146192CA}]
RealPlayer Download and Record Plugin for Internet Explorer - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll [2008-02-27 370296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}]
CBrowserHelperObject Object - C:\Program Files\Dell\BAE\BAE.dll [2006-11-09 98304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-02-19 1006264]
"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-09-24 159744]
"SigmatelSysTrayApp"=C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [2007-09-07 405504]
"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-09-25 86016]
"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-09-25 8478720]
"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-09-25 81920]
"NVHotkey"=C:\Windows\system32\nvHotkey.dll [2007-09-25 81920]
"Broadcom Wireless Manager UI"=C:\Windows\system32\WLTRAY.exe [2007-03-21 1548288]
"ISUSScheduler"=C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [2006-10-03 81920]
""= []
"PCMService"=C:\Program Files\Dell\MediaDirect\PCMService.exe [2007-11-01 189736]
"TkBellExe"=C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2008-02-27 185896]
"Symantec PIF AlertEng"=C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
"pdfw"=C:\Program Files\Amic Utilities\PDF Writer Pro\pdfwload.exe [2004-03-24 32768]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]
"Malwarebytes Anti-Malware (reboot)"=C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe [2009-12-30 1389904]
"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-10-11 149280]
"SpySweeper"=C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2009-05-13 6345840]

"ehTray.exe"=C:\Windows\ehome\ehTray.exe [2006-11-02 125440]
"Google Update"=C:\Users\Kimberly\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-01 133104]

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe
Lotus Organizer EasyClip.lnk - C:\lotus\organize\easyclip.exe
QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe
VPN Client.lnk - C:\Windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico










shell\AutoRun\command - F:\WD_Windows_Tools\Setup.exe

shell\AutoRun\command - G:\WDSetup.exe

======List of files/folders created in the last 1 months======

2009-12-30 21:57:22 ----D---- C:\Program Files\trend micro
2009-12-30 21:57:21 ----D---- C:\rsit
2009-12-10 03:02:45 ----A---- C:\Windows\system32\nshhttp.dll
2009-12-10 03:02:37 ----A---- C:\Windows\system32\httpapi.dll
2009-12-09 07:45:14 ----A---- C:\Windows\system32\winhttp.dll
2009-12-09 07:44:50 ----A---- C:\Windows\system32\mshtml.dll
2009-12-09 07:44:48 ----A---- C:\Windows\system32\wininet.dll
2009-12-09 07:44:47 ----A---- C:\Windows\system32\urlmon.dll
2009-12-09 07:44:47 ----A---- C:\Windows\system32\ieframe.dll
2009-12-09 07:44:44 ----A---- C:\Windows\system32\mstime.dll
2009-12-09 07:44:44 ----A---- C:\Windows\system32\ieapfltr.dll
2009-12-09 07:44:43 ----A---- C:\Windows\system32\occache.dll
2009-12-09 07:44:43 ----A---- C:\Windows\system32\iertutil.dll
2009-12-09 07:44:43 ----A---- C:\Windows\system32\iedkcs32.dll
2009-12-09 07:44:43 ----A---- C:\Windows\system32\dxtmsft.dll
2009-12-09 07:44:42 ----A---- C:\Windows\system32\mshtmled.dll
2009-12-09 07:44:42 ----A---- C:\Windows\system32\msfeeds.dll
2009-12-09 07:44:42 ----A---- C:\Windows\system32\ieaksie.dll
2009-12-09 07:44:42 ----A---- C:\Windows\system32\icardie.dll
2009-12-09 07:44:42 ----A---- C:\Windows\system32\dxtrans.dll
2009-12-09 07:44:41 ----A---- C:\Windows\system32\jsproxy.dll
2009-12-09 07:44:41 ----A---- C:\Windows\system32\ieencode.dll
2009-12-09 07:44:41 ----A---- C:\Windows\system32\admparse.dll
2009-12-09 07:44:40 ----A---- C:\Windows\system32\ieui.dll
2009-12-09 07:44:40 ----A---- C:\Windows\system32\advpack.dll
2009-12-09 07:44:39 ----A---- C:\Windows\system32\iesetup.dll
2009-12-09 07:44:39 ----A---- C:\Windows\system32\iernonce.dll
2009-12-09 07:44:39 ----A---- C:\Windows\system32\ie4uinit.exe
2009-12-09 07:44:38 ----A---- C:\Windows\system32\pngfilt.dll
2009-12-09 07:44:38 ----A---- C:\Windows\system32\mshtmler.dll
2009-12-09 07:44:38 ----A---- C:\Windows\system32\ieUnatt.exe
2009-12-09 07:44:38 ----A---- C:\Windows\system32\ieakui.dll
2009-12-09 07:42:58 ----A---- C:\Windows\system32\rastls.dll
2009-12-09 07:42:58 ----A---- C:\Windows\system32\raschap.dll
2009-12-02 21:35:33 ----D---- C:\Users\Kimberly\AppData\Roaming\Move Networks
2009-12-02 07:30:18 ----A---- C:\Windows\system32\javaws.exe
2009-12-02 07:30:18 ----A---- C:\Windows\system32\javaw.exe
2009-12-02 07:30:18 ----A---- C:\Windows\system32\java.exe

======List of files/folders modified in the last 1 months======

2009-12-30 21:57:30 ----D---- C:\Windows\Temp
2009-12-30 21:57:22 ----RD---- C:\Program Files
2009-12-30 21:54:12 ----D---- C:\Windows
2009-12-30 21:54:08 ----D---- C:\Windows\Minidump
2009-12-30 21:54:07 ----D---- C:\Windows\system32\drivers
2009-12-30 21:51:54 ----D---- C:\Windows\Tasks
2009-12-30 21:51:54 ----D---- C:\Windows\System32
2009-12-30 21:35:00 ----D---- C:\Windows\system32\Tasks
2009-12-30 19:56:01 ----D---- C:\ProgramData\Roxio
2009-12-30 19:00:00 ----A---- C:\Windows\system32\PerfStringBackup.INI
2009-12-30 18:54:58 ----D---- C:\Windows\Prefetch
2009-12-30 18:53:07 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2009-12-30 17:25:14 ----SHD---- C:\Windows\Installer
2009-12-29 22:21:25 ----SD---- C:\Windows\Downloaded Program Files
2009-12-28 19:19:21 ----SHD---- C:\System Volume Information
2009-12-21 22:59:52 ----HD---- C:\ProgramData
2009-12-13 17:59:32 ----D---- C:\Windows\system32\Adobe
2009-12-10 03:25:45 ----D---- C:\Windows\winsxs
2009-12-10 03:25:35 ----D---- C:\Windows\system32\catroot
2009-12-10 03:22:48 ----D---- C:\Windows\system32\migration
2009-12-10 03:22:48 ----D---- C:\Program Files\Internet Explorer
2009-12-10 03:22:41 ----D---- C:\Windows\system32\en-US
2009-12-10 03:22:41 ----D---- C:\Windows\AppPatch
2009-12-10 03:22:39 ----D---- C:\Program Files\Windows Mail
2009-12-10 03:04:02 ----D---- C:\Windows\system32\catroot2
2009-12-02 07:30:26 ----HD---- C:\Config.Msi
2009-12-02 07:30:06 ----D---- C:\Program Files\Java

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\Windows\system32\Drivers\CVPNDRVA.sys [2008-06-19 306299]
R2 mdmxsdk;mdmxsdk; C:\Windows\system32\DRIVERS\mdmxsdk.sys [2006-06-19 12672]
R2 PMEM;PMEM; \??\C:\Windows\system32\drivers\pmemnt.sys [1999-03-08 7168]
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2006-11-27 32256]
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2006-11-27 43520]
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-27 37376]
R2 XAudio;XAudio; C:\Windows\system32\DRIVERS\xaudio.sys [2006-08-04 8192]
R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-09-24 155136]
R3 BCM43XX;Dell Wireless WLAN Card Driver; C:\Windows\system32\DRIVERS\bcmwl6.sys [2007-03-21 534016]
R3 CmBatt;Microsoft ACPI Control Method Battery Driver; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-02-19 14208]
R3 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne2000.sys [2008-03-29 125328]
R3 HSF_DPV;HSF_DPV; C:\Windows\system32\DRIVERS\HSX_DPV.sys [2006-11-02 986624]
R3 HSXHWAZL;HSXHWAZL; C:\Windows\system32\DRIVERS\HSXHWAZL.sys [2006-11-02 206848]
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-09-25 7617600]
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2008-02-19 82432]
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2007-09-07 330240]
R3 winachsf;winachsf; C:\Windows\system32\DRIVERS\HSX_CNXT.sys [2006-11-02 659968]
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-02-19 11264]
S2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys []
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60x.sys [2007-05-21 179712]
S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 Dot4;MS IEEE-1284.4 Driver; C:\Windows\system32\DRIVERS\Dot4.sys [2006-11-02 131584]
S3 Dot4Print;Print Class Driver for IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [2006-11-02 16384]
S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [2006-11-02 36864]
S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [2006-11-02 5632]
S3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\Windows\system32\DRIVERS\e1e6032.sys [2006-11-02 200704]
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2006-11-02 8192]
S3 MSPCLOCK;Microsoft Streaming Clock Proxy; C:\Windows\system32\drivers\MSPCLOCK.sys [2006-11-02 5888]
S3 MSPQM;Microsoft Streaming Quality Manager Proxy; C:\Windows\system32\drivers\MSPQM.sys [2006-11-02 5504]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink Converter; C:\Windows\system32\drivers\MSTEE.sys [2006-11-02 6016]
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys [2006-11-02 2028032]
S3 usbscan;USB Scanner Driver; C:\Windows\system32\DRIVERS\usbscan.sys [2006-11-02 35328]
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2006-11-02 82560]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\aestsrv.exe [2007-08-29 73728]
R2 Automatic LiveUpdate Scheduler;Automatic LiveUpdate Scheduler; C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe [2007-09-12 554352]
R2 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2008-06-19 1528608]
R2 hpqddsvc;HP CUE DeviceDiscovery Service; C:\Windows\system32\svchost.exe [2006-11-02 22016]
R2 LiveUpdate Notice Service;LiveUpdate Notice Service; C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe [2008-01-29 583048]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2006-11-02 22016]
R2 RoxWatch9;Roxio Hard Drive Watcher 9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe [2006-11-05 159744]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV.exe [2007-09-07 102400]
R2 WebrootSpySweeperService;Webroot Spy Sweeper Engine; C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe [2009-04-21 4048240]
R2 wltrysvc;Dell Wireless WLAN Tray Service; C:\Windows\System32\WLTRYSVC.EXE [2007-03-21 24064]
R2 WRConsumerService;Webroot Client Service; C:\Program Files\Webroot\Spy Sweeper\WRConsumerService.exe [2009-05-27 1205760]
R2 XAudioService;XAudioService; C:\Windows\system32\DRIVERS\xaudio.exe [2006-08-04 386560]
R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2006-11-02 22016]
S2 LiveUpdate Notice Ex;LiveUpdate Notice Service Ex; C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe /h ccCommon []
S3 Adobe LM Service;Adobe LM Service; C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-09-01 72704]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 LiveUpdate;LiveUpdate; C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE [2007-09-12 2999664]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 RoxMediaDB9;RoxMediaDB9; C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe [2006-11-05 880640]
S3 stllssvr;stllssvr; C:\Program Files\Common Files\SureThing Shared\stllssvr.exe [2006-09-14 73728]


Report •

Related Solutions

December 30, 2009 at 19:11:20
Malwarebytes' Anti-Malware 1.43
Database version: 3460
Windows 6.0.6000
Internet Explorer 7.0.6000.16945

12/30/2009 9:51:54 PM
mbam-log-2009-12-30 (21-51-54).txt

Scan type: Full Scan (C:\|)
Objects scanned: 382414
Time elapsed: 1 hour(s), 53 minute(s), 12 second(s)

Memory Processes Infected: 2
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 12

Memory Processes Infected:
C:\Windows\msb.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Users\Kimberly\AppData\Local\Temp\f.exe (Trojan.Dropper) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\XML (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Handle (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\PUT2VIDQLG (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\B1RQJ7YJ0U (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Users\Kimberly\AppData\Local\Temp\a.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Kimberly\AppData\Local\Temp\d.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Windows\msa.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\msb.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Users\Kimberly\AppData\Local\Temp\b.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\Kimberly\AppData\Local\Temp\c.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\Kimberly\AppData\Local\Temp\e.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Users\Kimberly\AppData\Local\Temp\f.exe (Trojan.Dropper) -> Delete on reboot.
C:\Windows\System32\sshnas.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Users\Kimberly\AppData\Local\Temp\sshnas.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Just a question:
In MBAM, I clicked "Remove selected" and all the malicious items went to the quarantine section. Does this render them harmless? Or do I need to click on "Delete All" in the quarantine tab?

Report •

December 30, 2009 at 19:13:36
sorry for the -1 rating. it was a misclick =/

Report •

December 30, 2009 at 19:36:34
It appears that you have two antivirus programs, Norton's and SpySweeper, they may conflict and cause you should uninstall one of them.

Go to add/remove programs and uninstall these programs:

Browser Address Error Redirector (worthless)
Java(TM) SE Development Kit 6 Update 10(older version)
Java(TM) SE Runtime Environment 6 (older version)
LimeWire (harbors spyware)

Navigate to and uninstall this folder:

C:\Program Files\Dell\BAE

Remember..your Nortons antivirus, Windows Defender, and SpySweeper must be turned off or disabled before running ComboFix. The clickable link "This Link" in the ComboFix tutorial will help you get them disabled.

Please download ComboFix to the desktop from one of the following links:


Link 2

Link 3

Rename the setup file, combofix.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename combofix.exe to to Combo-Fix> click save.
Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved and renamed following this process directly to your desktop.
If you are using Firefox, make sure that your download settings are as follows:
Tools->Options->Main tab
Set to "Always ask me where to Save the files".

Please do not rename Combofix to other names, but only to the one indicated.
Close any open browsers.
Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
Double click on Combo-Fix.exe & follow the prompts.
Install the recovery console when asked.
When finished, it will produce a report for you.
Please post the "C:\Combo-Fix.txt" .
Note: Do not mouseclick combo-fix's window while it's running. That may cause it to hang.

Note: ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.
Note: Combofix prevents autorun of ALL CDs, floppies and USB devices to assist with malware removal & increase security.

Please do not install any new programs or update anything unless told to do so while we are fixing your problem.

Report •

December 30, 2009 at 19:53:16
I can't seem to find the "C:\Program Files\Dell\BAE" through Windows Explorer. Is there another way to locate it? Also, by "uninstall," do you mean to delete it?

Report •

December 30, 2009 at 19:56:27
Yes delete it, If you uninstalled "Browser Address Error Redirector" then it may have already been removed.

Just continue.

Report •

December 30, 2009 at 20:24:46
I supposedly uninstalled Norton from my computer using the control panel. C:\Program Files\Symantec no longer exists. However, through my security center, it still says that norton is still under both "virus protection" and "spyware and other malware protection." I have rebooted my computer but that did not make a difference. Do I still have Norton on my computer? If so, how do I get rid of it or at least disable it before I run ComboFix? Thanks

Report •

December 30, 2009 at 20:45:47
Do a google search for "Norton removal tool", download it and run it. That will uninstall Norton.

Report •

December 31, 2009 at 06:18:09
ComboFix 09-12-30.01 - Kimberly 12/31/2009 9:08.1.2 - x86
Microsoft® Windows Vista™ Home Premium 6.0.6000.0.1252.1.1033.18.2045.1420 [GMT -5:00]
Running from: c:\users\Kimberly\Desktop\Combo-Fix.exe
SP: Webroot AntiVirus with AntiSpyware *disabled* (Outdated) {00000000-E9D0-004F-D859-4D0000000000}
SP: Webroot AntiVirus with AntiSpyware *disabled* (Updated) {00000000-E9D0-004F-D859-4D0001000000}
SP: Webroot AntiVirus with AntiSpyware *enabled* (Updated) {00000000-0000-0000-0000-000000000000}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


((((((((((((((((((((((((( Files Created from 2009-11-28 to 2009-12-31 )))))))))))))))))))))))))))))))

2009-12-31 14:15 . 2009-12-31 14:15 -------- d-----w- c:\users\Kimberly\AppData\Local\temp
2009-12-31 14:05 . 2009-12-31 14:07 -------- d-----w- C:\32788R22FWJFW
2009-12-31 02:57 . 2009-12-31 02:57 -------- d-----w- c:\program files\trend micro
2009-12-31 02:57 . 2009-12-31 02:57 -------- d-----w- C:\rsit
2009-12-25 03:49 . 2009-12-25 03:49 658184 ----a-w- c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-12-10 08:02 . 2009-11-09 13:34 24064 ----a-w- c:\windows\system32\nshhttp.dll
2009-12-10 08:02 . 2009-11-09 11:17 396800 ----a-w- c:\windows\system32\drivers\http.sys
2009-12-10 08:02 . 2009-11-09 13:30 31232 ----a-w- c:\windows\system32\httpapi.dll
2009-12-09 12:45 . 2009-08-24 12:47 378368 ----a-w- c:\windows\system32\winhttp.dll
2009-12-09 12:42 . 2009-10-07 12:47 232960 ----a-w- c:\windows\system32\rastls.dll
2009-12-09 12:42 . 2009-10-07 12:47 274432 ----a-w- c:\windows\system32\raschap.dll
2009-12-04 15:03 . 2009-12-04 15:03 251376 ----a-w- c:\users\Kimberly\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll
2009-12-03 02:36 . 2009-12-03 02:36 143976 ----a-w- c:\users\Kimberly\AppData\Roaming\Move Networks\uninstall.exe
2009-12-03 02:35 . 2009-12-03 02:36 -------- d-----w- c:\users\Kimberly\AppData\Roaming\Move Networks

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2009-12-31 13:21 . 2008-02-19 11:07 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-31 03:51 . 2008-08-10 14:05 -------- d-----w- c:\program files\LimeWire
2009-12-31 03:51 . 2008-02-19 10:56 -------- d-----w- c:\program files\Java
2009-12-31 03:44 . 2008-02-19 10:58 -------- d-----w- c:\program files\Dell
2009-12-31 00:56 . 2008-02-19 11:06 -------- d-----w- c:\programdata\Roxio
2009-12-30 23:53 . 2009-09-12 23:35 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-30 19:55 . 2009-09-12 23:35 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-30 19:54 . 2009-09-12 23:35 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-30 02:41 . 2008-05-21 23:20 1356 ----a-w- c:\users\Kimberly\AppData\Local\d3d9caps.dat
2009-12-23 19:30 . 2009-11-21 08:47 439816 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\setup.exe
2009-12-10 08:22 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-12-05 19:07 . 2008-05-21 23:21 131676 ----a-w- c:\users\Kimberly\AppData\Roaming\nvModes.dat
2009-12-03 02:35 . 2009-10-15 00:50 5642688 ----a-w- c:\users\Kimberly\AppData\Roaming\Move Networks\plugins\npqmp071701000002.dll
2009-11-21 16:50 . 2009-11-21 16:49 17237488 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\rp\RealPlayerSPGold.exe
2009-11-21 16:49 . 2009-11-21 16:49 8405312 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\gtb\GOOGLE_TOOLBAR\GoogleToolbarInstaller.exe
2009-11-21 16:48 . 2009-11-21 16:48 149000 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\chr_helper\LaunchHelper.exe
2009-11-21 16:48 . 2009-11-21 16:48 10309448 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\chr\ChromeInstaller.exe
2009-11-21 16:47 . 2009-11-21 16:47 79368 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\RUP\vista.exe
2009-11-21 16:47 . 2009-11-21 16:47 52288 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\RUP\inst_config\gtapi.dll
2009-11-21 16:47 . 2009-11-21 16:47 64000 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\RUP\inst_config\gcapi_dll.dll
2009-11-21 16:47 . 2009-11-21 16:47 50688 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\RUP\inst_config\fftbapi.dll
2009-11-21 16:47 . 2009-11-21 16:47 118784 ----a-w- c:\users\Kimberly\AppData\Roaming\Real\Update\setup3.09\RUP\inst_config\compat.dll
2009-11-03 01:42 . 2009-10-03 00:19 195456 ------w- c:\windows\system32\MpSigStub.exe
2009-10-29 07:59 . 2009-11-26 04:48 2048 ----a-w- c:\windows\system32\tzres.dll
2009-10-27 15:05 . 2009-12-09 12:44 832512 ----a-w- c:\windows\system32\wininet.dll
2009-10-27 15:01 . 2009-12-09 12:44 56320 ----a-w- c:\windows\system32\iesetup.dll
2009-10-27 15:01 . 2009-12-09 12:44 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-10-27 15:01 . 2009-12-09 12:44 52736 ----a-w- c:\windows\AppPatch\iebrshim.dll
2009-10-27 14:59 . 2009-12-09 12:44 72704 ----a-w- c:\windows\system32\admparse.dll
2009-10-27 12:27 . 2009-12-09 12:44 26624 ----a-w- c:\windows\system32\ieUnatt.exe
2009-10-27 10:56 . 2009-12-09 12:44 48128 ----a-w- c:\windows\system32\mshtmler.dll
2009-10-15 00:50 . 2009-10-15 00:50 97216 ----a-w- c:\users\Kimberly\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-10-11 09:17 . 2008-10-31 02:53 411368 ----a-w- c:\windows\system32\deploytk.dll
2008-02-19 18:39 . 2008-02-19 18:25 8192 --sha-w- c:\windows\Users\Default\NTUSER.DAT

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown

"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2006-11-02 125440]
"Google Update"="c:\users\Kimberly\AppData\Local\Google\Update\GoogleUpdate.exe" [2009-02-02 133104]

"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-02-19 1006264]
"Apoint"="c:\program files\DellTPad\Apoint.exe" [2007-09-24 159744]
"SigmatelSysTrayApp"="c:\program files\SigmaTel\C-Major Audio\WDM\sttray.exe" [2007-09-07 405504]
"NvSvc"="c:\windows\system32\nvsvc.dll" [2007-09-25 86016]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-09-25 8478720]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-09-25 81920]
"NVHotkey"="c:\windows\system32\nvHotkey.dll" [2007-09-25 81920]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-03-21 1548288]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-11-01 189736]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-02-28 185896]
"pdfw"="c:\program files\Amic Utilities\PDF Writer Pro\pdfwload.exe" [2004-03-25 32768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-12-30 1389904]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-2-19 50688]
Lotus Organizer EasyClip.lnk - c:\lotus\organize\easyclip.exe [2002-8-8 87040]
QuickSet.lnk - c:\program files\Dell\QuickSet\quickset.exe [2007-7-20 1180952]
VPN Client.lnk - c:\windows\Installer\{A7091E1D-36A4-47F1-A739-173CC341414F}\Icon3E5562ED7.ico [2008-11-27 6144]



[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

R2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\AEstSrv.exe [2/19/2008 5:45 AM 73728]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [2/19/2008 1:40 PM 179712]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
Contents of the 'Scheduled Tasks' folder

2009-12-30 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3435808843-4141092854-47772454-1000Core.job
- c:\users\Kimberly\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-02 00:44]

2009-12-31 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3435808843-4141092854-47772454-1000UA.job
- c:\users\Kimberly\AppData\Local\Google\Update\GoogleUpdate.exe [2009-02-02 00:44]
------- Supplementary Scan -------
uStart Page = hxxp://
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
Trusted Zone:\ca
Trusted Zone:\ca2
- - - - ORPHANS REMOVED - - - -

AddRemove-Floating Coil Simulation - c:\windows\system32\javaws.exe


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
Rootkit scan 2009-12-31 09:15
Windows 6.0.6000 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

--------------------- LOCKED REGISTRY KEYS ---------------------

@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
Completion time: 2009-12-31 09:17:25
ComboFix-quarantined-files.txt 2009-12-31 14:17

Pre-Run: 145,802,158,080 bytes free
Post-Run: 147,087,745,024 bytes free

- - End Of File - - D8AED67EA27448B433E6B15712C7328E

Report •

December 31, 2009 at 14:12:07
Are you still being redirected?

Report •

December 31, 2009 at 17:28:08
no more redirects! thank you so much.

is there anything else i need to do?

Report •

December 31, 2009 at 18:07:16
A little clean-up to do.

Delete RSIT from your desktop. Keep Malwarebytes and run it weekly...update it before you run it.

Go to start> run> type in ComboFix /Uninstall (note the space after ComboFix) then press enter> run. This will uninstall combofix so give the uninstaller a minute to run.

Download ATF Cleaner from this link:
Run ATF-Cleaner
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Next create a new restore point. Go to start> run> type in msconfig> ok> click launch system restore> check the circle beside "create a restore point> next> name it today's date> create > click home > exit the system configuration utility> restart the computer.

You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster

Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

Glad we could help.

Report •

Ask Question