Like so many others, I have the search engine redirect problem. My searches appear to redirect through 7.7.7.0. My Norton Antivirus 2009 doesn't show anything, nor did the TrendMicro online scan (which I knew about through work), nor did a MalwareBytes Quick Scan (which I knew about through this site). However: in reading another thread, I saw that in the end, the file "wdmaud.sys" was deleted by ComboFix. Interestingly, my NAV 09 security history shows that c:\windows\system32\~.exe modified c:\windows\system32\wdmaud.sys on 1/11/09, which is about when my search redirect issue began. Thus I'm wondering if my problem might be the same as that individual's problem. To echo what others have said, this site appears to "get results," and I'm hopeful the same will hold true for me. Thanks in advance for your assistance! Craig

Please download and install the latest version of HijackThis v2.0.2: Download the "HijackThis" Installer from this link: Hijack This Rename the setup file, HJTInstall.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename HJTInstall.exe to tools.exe> click save. 1. Save " tools.exe" to your desktop. 2. Double click on tools.exe to run the program. 3. By default it will install to C:\Program Files\Trend Micro\HijackThis. 4. Accept the license agreement by clicking the "I Accept" button. 5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log. 6. Click "Save log" to save the log file and then the log will open in Notepad. 7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log. 8. Paste the log in your next reply. 9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Here's the HijackThis log file: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:26:33 PM, on 1/24/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\CTsvcCDA.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\System32\MsPMSPSv.exe C:\WINDOWS\BCMSMMSG.exe C:\WINDOWS\System32\DSentry.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe C:\WINDOWS\System32\hphmon04.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\DellSupport\DSAgnt.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe C:\WINDOWS\System32\HPHipm11.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Craig\My Documents\My Downloads\toolsh.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?Lin... R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?Lin... R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.local N1 - Netscape 4: user_pref("browser.startup.homepage", "http://www.wrh.noaa.gov/lox/"); (C:\Program Files\Netscape\Users\ckward479\prefs.js) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\IPSBHO.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file) O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [HPHmon04] C:\WINDOWS\System32\hphmon04.exe O4 - HKLM\..\Run: [HPHUPD04] "C:\Program Files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Adobe Gamma Loader.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?lin... O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.exe O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe O23 - Service: Norton AntiVirus - Symantec Corporation - C:\Program Files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe O23 - Service: Pml Driver HPH11 - HP - C:\WINDOWS\System32\HPHipm11.exe O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe -- End of file - 8384 bytes

Please download ComboFix to the desktop from one of the following links: Link1 Link 2 Link 3 Rename the setup file, combofix.exe, before you download it. To do that once the "enter name of file to save to" box appears as the download begins in the filename box rename combofix.exe to toolb.exe> click save. Combofix is a powerful tool so follow the instructions exactly or you could damage your computer. Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with Combofix and remove some of its embedded files which may cause "unpredictable results". Click on This Link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask. In your case to run Combofix do the following: 1. Go offline turn off your Norton antivirus, Spybot and any other antispyware that you may have. 2. Run Combofix and save its log. 3. Restart the computer to get the antivirus running again but leave the antispyware programs off until we get the computer cleaned. 4. Post the Combofix log. Remember to re-enable the protection again afterwards before connecting to the Internet. Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running or move the mouse, it will cause your system to hang.) Please post the log it produces.

ComboFix 09-01-21.04 - Craig 2009-01-25 12:03:38.1 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2047.1600 [GMT -8:00] Running from: c:\documents and settings\Craig\My Documents\My Downloads\toolb.exe AV: Norton AntiVirus *On-access scanning disabled* (Updated) * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\wdmaud.sys . ((((((((((((((((((((((((( Files Created from 2008-12-25 to 2009-01-25 ))))))))))))))))))))))))))))))) . 2009-01-24 10:45 . 2009-01-24 10:45 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware 2009-01-24 10:45 . 2009-01-24 10:45 <DIR> d-------- c:\documents and settings\Craig\Application Data\Malwarebytes 2009-01-24 10:45 . 2009-01-24 10:45 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes 2009-01-24 10:45 . 2009-01-14 16:11 38,496 --a------ c:\windows\SYSTEM32\DRIVERS\mbamswissarmy.sys 2009-01-24 10:45 . 2009-01-14 16:11 15,504 --a------ c:\windows\SYSTEM32\DRIVERS\mbam.sys 2009-01-15 12:03 . 2009-01-15 18:38 <DIR> d-------- c:\program files\Spybot - Search & Destroy 2009-01-15 10:37 . 2009-01-15 10:37 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy) 2009-01-15 10:37 . 2009-01-15 10:37 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy) 2009-01-15 10:37 . 2009-01-15 10:37 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy) 2009-01-15 10:37 . 2009-01-15 10:37 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy) 2009-01-14 21:34 . 2009-01-15 10:28 <DIR> d-------- c:\documents and settings\Craig\.housecall6.6 2009-01-11 11:22 . 2009-01-11 11:22 43,520 --a------ c:\windows\SYSTEM32\CmdLineExt03.dll 2008-12-30 17:37 . 2008-12-30 17:37 <DIR> d-------- c:\program files\iTunes 2008-12-30 17:37 . 2008-12-30 17:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} 2008-12-30 17:35 . 2008-12-30 17:35 <DIR> d-------- c:\program files\Bonjour 2008-12-30 17:34 . 2008-12-30 17:35 <DIR> d-------- c:\program files\QuickTime 2008-12-30 17:32 . 2008-12-30 17:37 <DIR> d----c--- c:\windows\SYSTEM32\DRVSTORE 2008-12-30 17:32 . 2008-12-30 17:37 <DIR> d-------- c:\program files\Common Files\Apple 2008-12-30 17:32 . 2008-11-07 14:23 32,000 --a------ c:\windows\SYSTEM32\DRIVERS\usbaapl.sys 2008-12-30 17:28 . 2008-12-30 17:28 <DIR> d-------- c:\program files\Apple Software Update 2008-12-30 17:28 . 2008-12-30 17:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple 2008-12-30 17:13 . 2008-12-30 17:13 124,464 --a------ c:\windows\SYSTEM32\DRIVERS\SYMEVENT.SYS 2008-12-30 17:13 . 2008-12-30 17:13 60,808 --a------ c:\windows\SYSTEM32\S32EVNT1.DLL 2008-12-30 17:13 . 2008-12-11 19:08 36,272 -ra------ c:\windows\SYSTEM32\DRIVERS\SymIM.sys 2008-12-30 17:13 . 2008-12-30 17:13 10,635 --a------ c:\windows\SYSTEM32\DRIVERS\SYMEVENT.CAT 2008-12-30 17:13 . 2008-12-30 17:13 806 --a------ c:\windows\SYSTEM32\DRIVERS\SYMEVENT.INF 2008-12-30 17:12 . 2008-12-31 13:13 <DIR> d-------- c:\windows\SYSTEM32\DRIVERS\NAV 2008-12-30 17:12 . 2008-12-30 17:12 <DIR> d-------- c:\program files\Windows Sidebar 2008-12-30 17:06 . 2008-12-30 17:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\PCSettings 2008-12-30 17:06 . 2008-12-30 17:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\Norton 2008-12-30 17:05 . 2008-12-30 17:05 <DIR> d-------- c:\program files\NortonInstaller 2008-12-30 17:05 . 2008-12-30 17:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\NortonInstaller 2008-12-30 17:03 . 2008-12-30 17:03 <DIR> d-------- c:\documents and settings\All Users\Symantec Temporary Files . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-20 01:20 80,472 ----a-w c:\documents and settings\Katie\Application Data\GDIPFONTCACHEV1.DAT 2009-01-15 20:07 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy 2008-12-31 01:37 --------- d-----w c:\program files\iPod 2008-12-31 01:15 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec 2008-12-31 01:13 --------- d-----w c:\program files\Symantec 2008-12-31 01:13 --------- d-----w c:\program files\Common Files\Symantec Shared 2008-12-31 01:12 --------- d-----w c:\program files\Norton AntiVirus 2008-12-31 01:11 --------- d-----w c:\documents and settings\Craig\Application Data\Symantec 2008-12-31 01:06 --------- d-----w c:\documents and settings\Katie\Application Data\Symantec 2008-12-31 01:06 --------- d-----w c:\documents and settings\Chris_2\Application Data\Symantec 2008-12-31 01:06 --------- d-----w c:\documents and settings\Chris\Application Data\Symantec 2008-12-19 08:12 410,984 ----a-w c:\windows\SYSTEM32\deploytk.dll 2008-12-19 08:12 --------- d-----w c:\program files\Java 2008-12-13 06:40 3,593,216 ------w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 10:57 333,952 ------w c:\windows\SYSTEM32\DLLCACHE\srv.sys 2008-12-02 18:15 --------- d-----w c:\program files\Windows Media Connect 2 2008-10-22 04:24 80,472 ----a-w c:\documents and settings\Chris\Application Data\GDIPFONTCACHEV1.DAT 2008-08-03 04:23 80,472 ----a-w c:\documents and settings\Craig\Application Data\GDIPFONTCACHEV1.DAT 2008-03-18 01:25 76,584 ----a-w c:\documents and settings\Chris_2\Application Data\GDIPFONTCACHEV1.DAT 2008-03-15 17:57 774,144 ----a-w c:\program files\RngInterstitial.dll 2008-12-19 17:09 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll 2008-12-19 17:09 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll 2008-12-19 17:09 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll 2008-12-19 17:09 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll 2008-12-19 17:09 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-02-20 315392] "UpdReg"="c:\windows\UpdReg.exe" [2000-05-10 90112] "DVDSentry"="c:\windows\System32\DSentry.exe" [2002-08-14 28672] "HPDJ Taskbar Utility"="c:\windows\System32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-22 188416] "HPHmon04"="c:\windows\System32\hphmon04.exe" [2002-11-22 348160] "HPHUPD04"="c:\program files\HP Photosmart 11\hphinstall\UniPatch\hphupd04.exe" [2002-11-22 49152] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-19 136600] "Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-16 28672] "Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768] "QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-11-04 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088] "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 c:\windows\SYSTEM32\Ati2mdxx.exe] "BCMSMMSG"="BCMSMMSG.exe" [2003-08-29 c:\windows\BCMSMMSG.exe] c:\documents and settings\All Users\Start Menu\Programs\Startup\ Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2003-11-27 113664] Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696] Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.exe [2001-02-12 83360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ctmp3"= c:\windows\System32\ctmp3.acm "aux"= wdmaud.sys [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD] --a------ 2002-12-17 09:28 684032 c:\program files\Roxio\Easy CD Creator 5\DirectCD\Directcd.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\diagent] --a------ 2002-04-02 22:01 135264 c:\program files\Creative\SBLive\Diagnostics\diagent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-11-20 13:20 290088 c:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-11-04 10:30 413696 c:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Share-to-Web Namespace Daemon] --a------ 2002-04-17 10:42 69632 c:\program files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= R0 SymEFA;Symantec Extended File Attributes;\SystemRoot\\SystemRoot\System32\Drivers\NAV\1002000.007\SYMEFA.SYS --> \SystemRoot\\SystemRoot\System32\Drivers\NAV\1002000.007\SYMEFA.SYS [?] R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\SYSTEM32\DRIVERS\NAV\1002000.007\BHDrvx86.sys [2008-12-30 255536] R1 ccHP;Symantec Hash Provider;c:\windows\SYSTEM32\DRIVERS\NAV\1002000.007\cchpx86.sys [2008-12-30 362544] R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090115.001\IDSxpx86.sys [2009-01-15 274808] R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-12-30 99376] R4 Norton AntiVirus;Norton AntiVirus;c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe [2008-12-30 115560] S3 gel90xne;gel90xne;\??\c:\docume~1\Craig\LOCALS~1\Temp\gel90xne.sys --> c:\docume~1\Craig\LOCALS~1\Temp\gel90xne.sys [?] . Contents of the 'Scheduled Tasks' folder 2008-12-31 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34] . - - - - ORPHANS REMOVED - - - - HKCU-Run-Start WingMan Profiler - (no file) . ------- Supplementary Scan ------- . uStart Page = hxxp://www.dell.com/ mStart Page = hxxp://www.dellnet.com uInternet Connection Wizard,ShellNext = hxxp://www.dellnet.com/ uInternet Settings,ProxyOverride = 127.0.0.1;*.local Trusted Zone: aol.com\free DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab FF - ProfilePath - c:\documents and settings\Craig\Application Data\Mozilla\Firefox\Profiles\lk7usoh8.default\ FF - prefs.js: browser.search.selectedEngine - Yahoo FF - prefs.js: browser.startup.homepage - hxxp://www.wrh.noaa.gov/lox/ FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll FF - component: c:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-25 12:11:03 Windows 5.1.2600 Service Pack 3 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton AntiVirus] "ImagePath"="\"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\ccSvcHst.exe\" /s \"Norton AntiVirus\" /m \"c:\program files\Norton AntiVirus\Norton AntiVirus\Engine\16.2.0.7\diMaster.dll\" /prefetch:1" . Completion time: 2009-01-25 12:17:30 ComboFix-quarantined-files.txt 2009-01-25 20:16:22 Pre-Run: 68,380,561,408 bytes free Post-Run: 68,539,518,976 bytes free 172 --- E O F --- 2009-01-14 21:22:45

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Download ATF Cleaner from this link: http://www.majorgeeks.com/ATF_Cleaner_d4949.html Run ATF-Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. Open Notepad and copy/paste everything between the X's into it and make sure the first word (such as KILLALL, File, Folder, Registry etc.) is at the very top of the page. XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX KILLALL:: File:: c:\docume~1\Craig\LOCALS~1\Temp\gel90xne.sys Driver:: gel90xne Registry:: [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "aux"=- XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop. Then drag/drop the CFScript.txt onto ComboFix.exe (the red symbol on your desktop) if combofix does not auto start click "run". Post a new Combofix log following the previous directions.

Do I go offline, turn off AV, etc. before dropping the CFScript file onto Combofix?