Active Another Google Redirect

[Active] Another Google Redirect

Hi, I have been following threads on the forum regarding the Google redirect virus, but can't seem to beat this one myself.

Have already attempted to run Combofix several times, however it doesn't seem to do much after reboot and has never produced a log file (to my knowledge).

Looking forward to your help and thank you in advance.

Dennis

DDS.txt


DDS (Ver_09-07-30.01) - NTFSx86
Run by DennisM at 15:32:25.84 on Wed 02/09/2009
Internet Explorer: 8.0.6001.18813
Microsoft® Windows Vistaâ„¢ Home Premium 6.0.6001.1.1252.61.1033.18.3066.2176 [GMT 10:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
c:\Program Files\Acer Bio Protection\CompPtcVUI.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\agrsmsvc.exe
C:\Windows\system32\svchost.exe -k apphost
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
c:\Program Files\Acer Bio Protection\BASVC.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
C:\Program Files\Sophos\Remote Management System\RouterNT.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\DennisM\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\wermgr.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\DennisM\Desktop\dds.pif
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = go.microsoft.com/fwlink/?LinkId=69157
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&s=2&o=vp32&d=0409&m=aspire_5738
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common

files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Sophos Web Content Scanner: {39ea7695-b3f2-4c44-a4bc-297ada8fd235} - c:\program files\sophos\sophos anti-

virus\SophosBHO.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement

pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft

shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6

\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows

live\toolbar\wltcore.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows

live\toolbar\wltcore.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe
mRun: [Skytel] c:\program files\realtek\audio\hda\Skytel.exe
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer bio protection\PwdBank.exe
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows

live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12

\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} -

hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} - hxxp://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-

2.2.5.0.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_16-windows-i586.cab
AppInit_DLLs: c:\progra~1\sophos\sophos~1\SOPHOS~1.DLL

============= SERVICES / DRIVERS ===============

R0 AlfaFF;AlfaFF;c:\windows\system32\drivers\AlfaFF.sys [2008-7-11 42608]
R1 SAVOnAccess;SAVOnAccess;c:\windows\system32\drivers\savonaccess.sys [2009-8-27 93192]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2009-4-8 666144]
R2 IGBASVC;EgisTec Service;c:\program files\acer bio protection\BASVC.exe [2009-2-19 3440128]
R2 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2008-10-10 19504]
R2 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2008-10-10 16432]
R2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2008-10-10 59952]
R2 MWLService;MyWinLocker Service;c:\program files\egistec\mywinlocker 3\x86\MWLService.exe [2008-10-28 306736]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe

[2009-2-18 44800]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5

\SchedulerSvc.exe [2008-9-24 144632]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\sophos\sophos anti-virus\SAVAdminService.exe

[2009-8-27 80936]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-5-19 240512]
R2 SSPORT;SSPORT;c:\windows\system32\drivers\SSPORT.sys [2007-1-8 5120]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60x.sys [2008-9-4

223232]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32

\drivers\NETw5v32.sys [2009-4-8 3666432]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-4-8 45600]
S2 SAVService;Sophos Anti-Virus;c:\program files\sophos\sophos anti-virus\SavService.exe [2009-8-27 98304]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2008-1-21

179712]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe

[2008-9-24 50424]
S4 SophosBootDriver;SophosBootDriver;c:\windows\system32\drivers\SophosBootDriver.sys [2009-8-27 20288]

=============== Created Last 30 ================

2009-09-02 15:03 318,976 a------- c:\windows\system32\CF611.exe
2009-09-02 14:33 318,976 a------- c:\windows\system32\CF28791.exe
2009-09-02 14:04 318,976 a------- c:\windows\system32\CF3378.exe
2009-09-02 13:23 318,976 a------- c:\windows\system32\CF14512.exe
2009-09-02 12:56 318,976 a------- c:\windows\system32\CF26665.exe
2009-09-02 12:37 318,976 a------- c:\windows\system32\CF27893.exe
2009-09-02 12:35 1,115 a------- c:\windows\system32\RegBho0A
2009-09-02 12:35 368 a------- c:\windows\system32\ToolB-00
2009-09-02 12:35 280 a------- c:\windows\system32\RegBho0B
2009-09-02 12:35 0 a------- c:\windows\system32\RegBho0C
2009-09-02 12:35 0 a------- c:\windows\system32\mToolbar01
2009-09-02 11:52 <DIR> --d----- c:\users\dennism\appdata\roaming\Malwarebytes
2009-09-02 11:27 318,976 a------- c:\windows\system32\CF19229.exe
2009-09-02 10:53 318,976 a------- c:\windows\system32\CF26483.exe
2009-09-02 10:05 318,976 a------- c:\windows\system32\CF32412.exe
2009-09-02 06:24 732 a------- c:\windows\system32\Ahmbed.gz
2009-09-01 22:36 <DIR> --d----- c:\windows\pss
2009-09-01 21:20 <DIR> --d----- c:\users\dennism\DoctorWeb
2009-09-01 18:11 <DIR> --d----- c:\users\dennism\appdata\roaming\SUPERAntiSpyware.com
2009-09-01 18:11 <DIR> --d----- c:\program files\SUPERAntiSpyware
2009-09-01 18:08 <DIR> --d----- c:\program files\common files\Wise Installation Wizard
2009-09-01 15:55 <DIR> --d----- c:\program files\Trend Micro
2009-09-01 15:14 <DIR> --d----- c:\program files\Enigma Software Group
2009-09-01 14:04 <DIR> --d----- c:\programdata\WindowsSearch
2009-09-01 13:44 318,976 a------- c:\windows\system32\CF9254.exe
2009-09-01 13:21 3,650,336 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-09-01 13:21 49,964 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-09-01 13:20 2,503 a------- C:\rollback.ini
2009-09-01 13:08 <DIR> --d----- c:\program files\common files\ParetoLogic
2009-09-01 12:32 318,976 a------- c:\windows\system32\CF22640.exe
2009-09-01 12:13 318,976 a------- c:\windows\system32\CF15702.exe
2009-09-01 12:00 411,368 a------- c:\windows\system32\deploytk.dll
2009-08-31 12:23 <DIR> --d----- c:\programdata\FLEXnet
2009-08-27 10:26 130,104 a------- c:\windows\system32\sdccoinstaller.dll
2009-08-27 10:25 <DIR> --d----- c:\program files\common files\Cisco Systems
2009-08-27 10:25 23,552 a------- c:\windows\system32\sophosboottasks.exe
2009-08-27 10:23 20,288 a------- c:\windows\system32\drivers\SophosBootDriver.sys
2009-08-27 10:23 93,192 a------- c:\windows\system32\drivers\savonaccess.sys
2009-08-27 10:22 <DIR> --d----- c:\programdata\Sophos
2009-08-27 10:22 <DIR> --d----- c:\progra~2\Sophos
2009-08-27 10:21 <DIR> --d----- c:\program files\Sophos
2009-08-27 08:22 2,048 a------- c:\windows\system32\tzres.dll
2009-08-26 08:51 28,672 a------- c:\windows\system32\Apphlpdm.dll
2009-08-26 08:51 4,240,384 a------- c:\windows\system32\GameUXLegacyGDFs.dll
2009-08-12 08:29 71,680 a------- c:\windows\system32\atl.dll
2009-08-12 08:29 160,256 a------- c:\windows\system32\wkssvc.dll
2009-08-12 08:29 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-08-12 08:29 91,136 a------- c:\windows\system32\avifil32.dll
2009-08-12 08:29 313,344 a------- c:\windows\system32\wmpdxm.dll
2009-08-12 08:29 7,680 a------- c:\windows\system32\spwmp.dll
2009-08-12 08:29 4,096 a------- c:\windows\system32\msdxm.ocx
2009-08-12 08:29 4,096 a------- c:\windows\system32\dxmasf.dll
2009-08-12 08:29 8,147,456 a------- c:\windows\system32\wmploc.DLL
2009-08-12 08:29 43,520 a------- c:\windows\system32\msdxm.tlb
2009-08-12 08:29 18,432 a------- c:\windows\system32\amcompat.tlb
2009-08-07 13:20 <DIR> --d----- c:\program files\IncredibleCharts
2009-08-04 14:43 <DIR> --d----- C:\inetpub

==================== Find3M ====================

2009-09-02 14:31 32,061 a------- c:\programdata\nvModes.dat
2009-09-02 14:31 32,061 a------- c:\progra~2\nvModes.dat
2009-07-22 07:52 915,456 a------- c:\windows\system32\wininet.dll
2009-07-22 07:47 109,056 a------- c:\windows\system32\iesysprep.dll
2009-07-22 07:47 71,680 a------- c:\windows\system32\iesetup.dll
2009-07-22 06:13 133,632 a------- c:\windows\system32\ieUnatt.exe
2009-07-07 08:56 86,016 a------- c:\windows\inf\infstrng.dat
2009-07-07 08:56 86,016 a------- c:\windows\inf\infstor.dat
2009-07-07 08:56 51,200 a------- c:\windows\inf\infpub.dat
2009-07-03 10:16 249,856 -------- c:\windows\Setup1.exe
2009-07-03 10:16 73,216 a------- c:\windows\ST6UNST.EXE
2009-07-03 10:11 6,656 a------- c:\windows\system32\haspvdd.dll
2009-06-16 01:24 156,672 a------- c:\windows\system32\t2embed.dll
2009-06-16 01:20 72,704 a------- c:\windows\system32\fontsub.dll
2009-06-16 01:20 10,240 a------- c:\windows\system32\dciman32.dll
2009-06-15 22:52 289,792 a------- c:\windows\system32\atmfd.dll
2009-02-14 06:33 665,600 a------- c:\windows\inf\drvindex.dat
2008-01-21 12:43 174 a--sh--- c:\program files\desktop.ini
2006-11-02 22:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 22:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 22:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 22:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 19:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 19:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 19:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 19:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 15:32:51.95 ===============

Attach.txt


UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-07-30.01)

Microsoft® Windows Vistaâ„¢ Home Premium
Boot Device: \Device\HarddiskVolume2
Install Date: 8/04/2009 11:09:13 PM
System Uptime: 9/02/2009 3:20:03 PM (4920 hours ago)

Motherboard: Acer | | JV50
Processor: Intel(R) Core(TM)2 Duo CPU T6400 @ 2.00GHz | U2E1 | 1200/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 456 GiB total, 297.754 GiB free.
D: is CDROM ()

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP84: 21/07/2009 10:26:56 AM - Installed WinZip 12.1
RP85: 21/07/2009 10:35:54 AM - Removed WinZip 12.1
RP86: 23/07/2009 8:29:24 AM - Windows Update
RP87: 23/07/2009 8:36:36 AM - Windows Update
RP88: 24/07/2009 8:24:10 AM - Windows Update
RP89: 27/07/2009 2:11:30 PM - Scheduled Checkpoint
RP90: 28/07/2009 8:21:46 AM - Windows Update
RP91: 30/07/2009 8:19:09 AM - Windows Update
RP92: 1/08/2009 11:25:32 AM - Windows Update
RP93: 1/08/2009 1:03:25 PM - Windows Update
RP94: 4/08/2009 8:29:10 AM - Windows Update
RP95: 4/08/2009 1:51:14 PM - Installed Microsoft Web Platform Installer 2.0 RC
RP96: 4/08/2009 2:42:11 PM - Windows Modules Installer
RP97: 5/08/2009 9:20:06 AM - Scheduled Checkpoint
RP98: 6/08/2009 9:58:33 AM - Scheduled Checkpoint
RP99: 7/08/2009 12:00:01 AM - Scheduled Checkpoint
RP100: 7/08/2009 2:22:04 AM - Windows Update
RP101: 11/08/2009 8:27:18 AM - Windows Update
RP102: 12/08/2009 9:39:22 AM - Scheduled Checkpoint
RP103: 12/08/2009 1:20:10 PM - Windows Update
RP104: 16/08/2009 11:24:33 AM - Windows Update
RP105: 18/08/2009 8:39:59 AM - Windows Update
RP106: 19/08/2009 12:19:28 PM - Scheduled Checkpoint
RP107: 21/08/2009 7:40:30 AM - Windows Update
RP108: 25/08/2009 9:17:31 AM - Windows Update
RP109: 27/08/2009 8:18:19 AM - Windows Update
RP110: 27/08/2009 10:21:24 AM - Installed Sophos AutoUpdate
RP111: 28/08/2009 10:00:09 AM - Windows Update
RP112: 29/08/2009 4:39:45 PM - Scheduled Checkpoint
RP113: 30/08/2009 4:35:08 PM - Scheduled Checkpoint
RP114: 1/09/2009 8:19:27 AM - Windows Update
RP116: 1/09/2009 9:17:26 AM - Windows Defender Checkpoint
RP118: 1/09/2009 9:31:08 AM - Windows Defender Checkpoint
RP120: 1/09/2009 11:59:28 AM - Installed Java(TM) 6 Update 16
RP122: 1/09/2009 1:07:35 PM - Installed ParetoLogic Anti-Virus PLUS.
RP124: 1/09/2009 6:11:09 PM - Installed SUPERAntiSpyware Free Edition
RP126: 1/09/2009 10:21:26 PM - Removed Acrobat.com
RP128: 2/09/2009 1:45:53 PM - Removed ParetoLogic Anti-Virus PLUS.

==== Installed Programs ======================

Acer Backup Manager
Acer Bio Protection
Acer Crystal Eye webcam Ver:1.1.74.216
Acer eRecovery Management
Acer GridVista
Acer PowerSmart Manager
Acer ScreenSaver
Acrobat.com
Adobe AIR
Adobe Dreamweaver CS4
Adobe Flash Player 10 ActiveX
Adobe Media Player
Adobe Reader 9.1
Adobe Setup
Agere Systems HDA Modem
AuthenTec Fingerprint Sensor Minimum Install
Backup Manager Basic
Better Homes and Gardens Home Designer Pro 7.0
Better Homes and Gardens Home Designer Pro 7.0 Tutorial Videos
Broadcom Gigabit NetLink Controller
Choice Guard
Compatibility Pack for the 2007 Office system
CutePDF Writer 2.7
Fingerprint Solution
HDCustomiser
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Java(TM) 6 Update 16
Junk Mail filter update
Launch Manager
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Office 2003 Web Components
Microsoft Office 2007 Primary Interop Assemblies
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Live Add-in 1.3
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Small Business Connectivity Components
Microsoft Office Standard 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft SQL Server Native Client
Microsoft SQL Server Setup Support Files (English)
Microsoft SQL Server VSS Writer
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Runtime v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Sync Framework Services v1.0 (x86)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Web Platform Installer 2.0 RC
Microsoft Works
MSVCRT
MSXML 4.0 SP2 (KB954430)
MyWinLocker
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
NVIDIA Drivers
OGA Notifier 1.7.0105.35.0
Readiris Pro 10
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Samsung SCX-4x21 Series
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
SmarThru 4
SmarThru PC Fax
Sophos Anti-Virus
Sophos AutoUpdate
Sophos Remote Management System
SuperProNet Combo Installer
Synaptics Pointing Device Driver
SyncToy 2.0 (x86)
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Outlook 2007 (KB969907)
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
Update for Outlook 2007 Junk Email Filter (kb972691)
WIDCOMM Bluetooth Software 6.0.1.6400
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Live Writer

==== Event Viewer Messages From Past Week ========

2/09/2009 9:10:02 AM, Error: netbt [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.14.56. The computer with the IP address 192.168.50.4 did not allow the name to be claimed by this computer.
2/09/2009 6:23:51 AM, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
2/09/2009 6:18:46 AM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the Windows Media Player Network Sharing Service service to connect.
2/09/2009 6:18:46 AM, Error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
2/09/2009 6:08:00 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service WSearch with arguments " " in order to run the server: {9E175B6D-F52A-11D8-B9A5-505054503030}
2/09/2009 6:07:38 AM, Error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD DfsC KLIF NetBIOS netbt nsiproxy PSched RasAcd rdbss SAVOnAccess Smb spldr Tcpip tdx Wanarpv6
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The Workstation service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The WebDav Client Redirector Driver service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The WebClient service depends on the WebDav Client Redirector Driver service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The TCP/IP Registry Compatibility service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The SMB MiniRedirector Wrapper and Engine service depends on the Redirected Buffering Sub Sysytem service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The SMB 2.0 MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The SMB 1.x MiniRedirector service depends on the SMB MiniRedirector Wrapper and Engine service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The Network Store Interface Service service depends on the NSI proxy service service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The Network Location Awareness service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The Network List Service service depends on the Network Location Awareness service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The Network Connections service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The IP Helper service depends on the Network Store Interface Service service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The DNS Client service depends on the NetIO Legacy TDI Support Driver service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The DHCP Client service depends on the Ancilliary Function Driver for Winsock service which failed to start because of the following error: A device attached to the system is not functioning.
2/09/2009 6:07:38 AM, Error: Service Control Manager [7001] - The Computer Browser service depends on the Server service which failed to start because of the following error: The dependency service or group failed to start.
2/09/2009 6:07:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netprofm with arguments " " in order to run the server: {A47979D2-C419-11D9-A5B4-001185AD2B89}
2/09/2009 6:07:22 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
2/09/2009 6:07:21 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1068" attempting to start the service fdPHost with arguments " " in order to run the server: {145B4335-FE2A-4927-A040-7C35AD3180EF}
2/09/2009 6:07:18 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/09/2009 6:07:05 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1084" attempting to start the service ShellHWDetection with arguments " " in order to run the server: {DD522ACC-F821-461A-A407-50B198B896DC}
2/09/2009 2:53:44 PM, Error: EventLog [6008] - The previous system shutdown at 2:51:08 PM on 2/09/2009 was unexpected.
2/09/2009 2:51:08 PM, Error: EventLog [6008] - The previous system shutdown at 2:48:28 PM on 2/09/2009 was unexpected.
2/09/2009 2:48:28 PM, Error: EventLog [6008] - The previous system shutdown at 2:45:54 PM on 2/09/2009 was unexpected.
2/09/2009 2:45:54 PM, Error: EventLog [6008] - The previous system shutdown at 2:43:20 PM on 2/09/2009 was unexpected.
2/09/2009 2:43:55 PM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "1726" attempting to start the service netman with arguments " " in order to run the server: {BA126AD1-2166-11D1-B1D0-00805FC1270E}
2/09/2009 2:34:07 PM, Error: Service Control Manager [7031] - The Windows Modules Installer service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
2/09/2009 2:28:01 PM, Error: EventLog [6008] - The previous system shutdown at 2:25:23 PM on 2/09/2009 was unexpected.
2/09/2009 11:28:47 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Search service, but this action failed with the following error: An instance of the service is already running.
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The Sophos AutoUpdate Service service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The Sophos Anti-Virus status reporter service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The SeaPort service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The NVIDIA Display Driver Service service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The NTI Backup Now 5 Scheduler Service service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The MyWinLocker Service service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The EgisTec Service service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The Agere Modem Call Progress Audio service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7034] - The Acer ePower Service service terminated unexpectedly. It has done this 1 time(s).
2/09/2009 10:53:52 AM, Error: Service Control Manager [7031] - The Windows Media Player Network Sharing Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
2/09/2009 10:53:52 AM, Error: Service Control Manager [7031] - The Sophos Message Router service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
2/09/2009 10:53:52 AM, Error: Service Control Manager [7031] - The Sophos Agent service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
2/09/2009 10:53:52 AM, Error: Service Control Manager [7031] - The Software Licensing service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
2/09/2009 10:53:52 AM, Error: Service Control Manager [7031] - The Print Spooler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
2/09/2009 10:53:52 AM, Error: Service Control Manager [7031] - The Bluetooth Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
2/09/2009 1:54:02 PM, Error: Service Control Manager [7000] - The adfs service failed to start due to the following error: The system cannot find the file specified.
1/09/2009 9:48:30 PM, Error: Service Control Manager [7034] - The NTI IScheduleSvc service terminated unexpectedly. It has done this 1 time(s).
1/09/2009 9:47:52 PM, Error: Service Control Manager [7031] - The Windows Search service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 30000 milliseconds: Restart the service.
1/09/2009 9:43:27 PM, Error: Server [2505] - The server could not bind to the transport \Device\NetbiosSmb because another computer on the network has the same name. The server could not start.
1/09/2009 9:42:45 AM, Error: Service Control Manager [7034] - The Sophos Anti-Virus service terminated unexpectedly. It has done this 1 time(s).
1/09/2009 9:42:45 AM, Error: Service Control Manager [7000] - The Sophos Anti-Virus service failed to start due to the following error: Access is denied.
1/09/2009 9:42:45 AM, Error: SAVOnAccess [37] - Driver threads still active when driver is being shutdown.
1/09/2009 9:42:45 AM, Error: Microsoft-Windows-DistributedCOM [10005] - DCOM got error "5" attempting to start the service SAVService with arguments " " in order to run the server: {D2B7A809-15DC-40B4-A1E1-C61EA97191DB}
1/09/2009 9:18:37 AM, Error: Microsoft-Windows-DistributedCOM [10016] - The machine-default permission settings do not grant Local Activation permission for the COM Server application with CLSID {9BA05972-F6A8-11CF-A442-00A0C90A8F39} to the user DennisM-PC\DennisM SID (S-1-5-21-472461358-3027469337-644064219-1000) from address LocalHost (Using LRPC). This security permission can be modified using the Component Services administrative tool.
1/09/2009 9:12:56 AM, Error: Service Control Manager [7000] - The Sentinel service failed to start due to the following error: The system cannot find the device specified.
1/09/2009 9:12:56 AM, Error: Service Control Manager [7000] - The Parallel port driver service failed to start due to the following error: The service cannot be started, either because it is disabled or because it has no enabled devices associated with it.
1/09/2009 9:12:56 AM, Error: Service Control Manager [7000] - The DgiVecp service failed to start due to the following error: The system cannot find the device specified.
1/09/2009 3:06:09 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the NTI IScheduleSvc service to connect.
1/09/2009 3:06:09 PM, Error: Service Control Manager [7000] - The NTI IScheduleSvc service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/09/2009 3:01:58 PM, Error: Service Control Manager [7034] - The plasservice service terminated unexpectedly. It has done this 1 time(s).
1/09/2009 12:43:38 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the EgisTec Service service to connect.
1/09/2009 12:27:46 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the MyWinLocker Service service to connect.
1/09/2009 12:27:46 PM, Error: Service Control Manager [7000] - The MyWinLocker Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
1/09/2009 12:14:19 PM, Error: Service Control Manager [7030] - The PEVSystemStart service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
1/09/2009 12:14:19 PM, Error: Service Control Manager [7009] - A timeout was reached (30000 milliseconds) while waiting for the PEVSystemStart service to connect.

==== End Of File ===========================

 

Internet Explorer 8 Ver 8.0.6001.18813
Sophos Antivirus - it seems Sophos has somehow been disabled by the virus

 

ComboFix 09-09-02.02 - DennisM 03/09/2009 11:16.14.2 - NTFSx86
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.61.1033.18.3066.2291 [GMT 10:00]
Running from: c:\users\DennisM\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Installer\f481b.msi


.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226ED}
-------\Legacy_{79007602-0CDB-4405-9DBF-1257BB3226EE}


((((((((((((((((((((((((( Files Created from 2009-08-03 to 2009-09-03 )))))))))))))))))))))))))))))))
.

2009-09-03 01:26 . 2009-09-03 01:29 -------- d-----w- c:\users\DennisM\AppData\Local\temp
2009-09-03 01:26 . 2009-09-03 01:26 -------- d-----w- c:\users\Default\AppData\Local\temp
2009-09-02 19:36 . 2009-08-28 12:39 28672 ----a-w- c:\windows\system32\Apphlpdm.dll
2009-09-02 19:36 . 2009-08-28 10:15 4240384 ----a-w- c:\windows\system32\GameUXLegacyGDFs.dll
2009-09-01 11:20 . 2009-09-01 11:20 -------- d-----w- c:\users\DennisM\DoctorWeb
2009-09-01 08:08 . 2009-09-02 13:59 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-09-01 05:14 . 2009-09-01 20:23 -------- d-----w- c:\program files\Enigma Software Group
2009-09-01 04:04 . 2009-09-01 04:04 -------- d-----w- c:\programdata\WindowsSearch
2009-09-01 03:21 . 2009-09-02 03:52 3650336 --sha-w- c:\windows\system32\drivers\fidbox.dat
2009-09-01 03:08 . 2009-09-02 03:48 -------- d-----w- c:\program files\Common Files\ParetoLogic
2009-09-01 03:07 . 2009-09-01 03:07 -------- d-----w- c:\users\DennisM\AppData\Local\Downloaded Installations
2009-09-01 02:05 . 2009-09-01 02:05 -------- d-----w- c:\windows\Sun
2009-09-01 02:00 . 2009-09-01 01:59 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-09-01 01:59 . 2009-09-01 01:59 -------- d-----w- c:\program files\Java
2009-08-31 02:23 . 2009-08-31 02:23 -------- d-----w- c:\programdata\FLEXnet
2009-08-31 02:01 . 2009-08-31 02:01 -------- d-----w- c:\program files\Adobe Media Player
2009-08-31 01:55 . 2009-09-02 13:57 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-08-31 01:00 . 2009-08-31 03:47 -------- d-----w- c:\users\DennisM\AppData\Roaming\Download Manager
2009-08-27 00:28 . 2009-08-27 00:28 -------- d-----w- c:\users\DennisM\AppData\Local\Sophos
2009-08-27 00:26 . 2009-08-27 00:23 130104 ----a-w- c:\windows\system32\sdccoinstaller.dll
2009-08-27 00:25 . 2009-08-27 00:25 -------- d-----w- c:\program files\Common Files\Cisco Systems
2009-08-27 00:25 . 2009-08-27 00:23 23552 ----a-w- c:\windows\system32\sophosboottasks.exe
2009-08-27 00:23 . 2009-08-27 00:23 20288 ----a-w- c:\windows\system32\drivers\SophosBootDriver.sys
2009-08-27 00:23 . 2009-08-27 00:23 93192 ----a-w- c:\windows\system32\drivers\savonaccess.sys
2009-08-27 00:22 . 2009-08-27 00:25 -------- d-----w- c:\programdata\Sophos
2009-08-27 00:21 . 2009-08-27 00:25 -------- d-----w- c:\program files\Sophos
2009-08-26 22:22 . 2009-06-22 10:22 2048 ----a-w- c:\windows\system32\tzres.dll
2009-08-11 22:29 . 2009-07-17 14:35 71680 ----a-w- c:\windows\system32\atl.dll
2009-08-11 22:29 . 2009-06-10 12:12 160256 ----a-w- c:\windows\system32\wkssvc.dll
2009-08-11 22:29 . 2009-06-04 12:34 2066432 ----a-w- c:\windows\system32\mstscax.dll
2009-08-11 22:29 . 2009-06-10 12:07 91136 ----a-w- c:\windows\system32\avifil32.dll
2009-08-11 22:29 . 2009-07-14 13:00 313344 ----a-w- c:\windows\system32\wmpdxm.dll
2009-08-11 22:29 . 2009-07-14 12:58 7680 ----a-w- c:\windows\system32\spwmp.dll
2009-08-11 22:29 . 2009-07-14 12:59 4096 ----a-w- c:\windows\system32\dxmasf.dll
2009-08-11 22:29 . 2009-07-14 10:59 8147456 ----a-w- c:\windows\system32\wmploc.DLL
2009-08-07 03:20 . 2009-09-02 05:27 -------- d-----w- c:\program files\IncredibleCharts
2009-08-04 04:43 . 2009-08-04 04:43 -------- d-----w- C:\inetpub

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-09-03 01:27 . 2009-04-08 13:12 12 ----a-w- c:\windows\bthservsdp.dat
2009-09-03 01:13 . 2009-09-03 01:13 32061 ----a-w- c:\programdata\nvModes.dat
2009-09-02 20:16 . 2009-02-13 20:50 -------- d-----w- c:\program files\NewTech Infosystems
2009-09-02 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-09-02 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-09-02 13:59 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-09-02 13:59 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-09-02 13:59 . 2009-07-06 23:00 -------- d-----w- c:\program files\Readiris10
2009-09-02 03:52 . 2009-09-01 03:21 49964 --sha-w- c:\windows\system32\drivers\fidbox.idx
2009-09-02 03:43 . 2009-02-13 21:01 -------- d-----w- c:\program files\Common Files\Adobe
2009-08-31 22:39 . 2009-07-02 05:07 70952 ----a-w- c:\users\DennisM\AppData\Local\GDIPFONTCACHEV1.DAT
2009-08-12 03:23 . 2009-02-13 20:52 -------- d-----w- c:\programdata\Microsoft Help
2009-08-04 03:51 . 2009-02-13 21:05 -------- d-----w- c:\program files\Microsoft
2009-08-01 03:06 . 2009-07-03 20:56 -------- d-----w- c:\program files\Microsoft Silverlight
2009-07-21 21:52 . 2009-07-28 22:25 915456 ----a-w- c:\windows\system32\wininet.dll
2009-07-21 21:47 . 2009-07-28 22:25 109056 ----a-w- c:\windows\system32\iesysprep.dll
2009-07-21 21:47 . 2009-07-28 22:25 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-07-21 20:13 . 2009-07-28 22:25 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2009-07-21 00:39 . 2009-07-21 00:39 -------- d-----w- c:\program files\GPLGS
2009-07-21 00:38 . 2009-07-21 00:38 -------- d-----w- c:\program files\Acro Software
2009-07-08 04:30 . 2009-07-08 04:30 -------- d-----w- c:\programdata\Office Genuine Advantage
2009-07-06 23:02 . 2009-07-06 23:02 -------- d-----w- c:\users\DennisM\AppData\Roaming\SmarThru4
2009-07-06 23:02 . 2009-07-06 23:00 -------- d-----w- c:\program files\SmarThru 4
2009-07-06 23:02 . 2009-07-06 23:02 -------- d-----w- c:\program files\Common Files\SRC Shared
2009-07-06 23:01 . 2009-02-11 20:16 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-07-06 22:55 . 2009-07-06 22:55 -------- d-----w- c:\program files\Samsung
2009-07-03 00:16 . 2009-07-03 00:16 249856 ------w- c:\windows\Setup1.exe
2009-07-03 00:16 . 2009-07-03 00:16 73216 ----a-w- c:\windows\ST6UNST.EXE
2009-07-03 00:11 . 2009-07-03 00:11 6656 ----a-w- c:\windows\system32\haspvdd.dll
2009-07-03 00:11 . 2009-07-03 00:11 47616 ----a-w- c:\windows\system32\drivers\Haspnt.sys
2009-07-03 00:11 . 2009-07-03 00:11 383 ----a-w- c:\windows\system32\haspdos.sys
2009-06-15 15:24 . 2009-07-14 22:39 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-06-15 15:20 . 2009-07-14 22:39 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-06-15 15:20 . 2009-07-14 22:39 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-06-15 12:52 . 2009-07-14 22:39 289792 ----a-w- c:\windows\system32\atmfd.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@= "{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} "
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2008-10-27 19:05 40496 ----a-w- c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe "= "c:\windows\ehome\ehTray.exe" [2008-01-21 125952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2008-12-16 13605408]
"NvMediaCenter "= "c:\windows\system32\NvMcTray.dll" [2008-12-16 92704]
"RtHDVCpl "= "c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-02-14 6814240]
"Skytel "= "c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-02-14 1833504]
"SynTPEnh "= "c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-05 1410344]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle "= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=c:\progra~1\Sophos\SOPHOS~1\sophos_detoured.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"mixer3 "=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
@= "service "

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@= "Service "

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^AutoUpdate Monitor.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\AutoUpdate Monitor.lnk
backup=c:\windows\pss\AutoUpdate Monitor.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
backup=c:\windows\pss\Bluetooth.lnk.CommonStartup
backupExtension=.CommonStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SophosAntiVirus]
"DisableMonitoring "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{10B57119-C566-4610-9DE0-B4301C2C769B} "= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{BAC0A239-A31C-4466-ABAB-436F1851815C} "= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe:BackupSvc.exe
"{1DD57858-637C-4D2E-93BC-020A8B7B851B} "= UDP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{EBD50295-5B33-4706-8488-C8A25AF6C335} "= TCP:c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe:SchedulerSvc.exe
"{BDE81C9E-475C-4610-83C3-566394F30009} "= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{1580F0EC-BC1E-47B9-9A72-740CE5C48382} "= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{14D9C086-6F18-420E-8620-D454E32B0BCF} "= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{6B126201-2BBD-4AF7-825E-2E877CA02838} "= c:\program files\Windows Live\Sync\WindowsLiveSync.exe:Windows Live Sync
"{1FA4989A-67D7-4EA4-8C98-3B78DB14DB03} "= UDP:c:\program files\IncredibleCharts\IncredibleCharts.exe:IncredibleCharts Pro
"{D47A4A48-2438-4A6C-85B6-26EFA3645AB0} "= TCP:c:\program files\IncredibleCharts\IncredibleCharts.exe:IncredibleCharts Pro
"{4843DA64-2FED-4875-934A-3764DE7117AD} "= UDP:5353:Adobe CSI CS4
"{C16D11ED-57EF-4B7D-A7AE-FFD62851B391} "= UDP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4
"{AA6C26D5-F529-441C-9ACD-F9B312E30DC6} "= TCP:c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:Adobe CSI CS4

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall "= 0 (0x0)

R0 AlfaFF;AlfaFF;c:\windows\System32\drivers\AlfaFF.sys [11/07/2008 2:25 PM 42608]
R1 SAVOnAccess;SAVOnAccess;c:\windows\System32\drivers\savonaccess.sys [27/08/2009 10:23 AM 93192]
R2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [8/04/2009 11:23 PM 666144]
R2 IGBASVC;EgisTec Service;c:\program files\Acer Bio Protection\BASVC.exe [19/02/2009 12:33 PM 3440128]
R2 mwlPSDFilter;mwlPSDFilter;c:\windows\System32\drivers\mwlPSDFilter.sys [10/10/2008 9:47 AM 19504]
R2 mwlPSDNServ;mwlPSDNServ;c:\windows\System32\drivers\mwlPSDNserv.sys [10/10/2008 9:47 AM 16432]
R2 mwlPSDVDisk;mwlPSDVDisk;c:\windows\System32\drivers\mwlPSDVDisk.sys [10/10/2008 9:47 AM 59952]
R2 MWLService;MyWinLocker Service;c:\program files\EgisTec\MyWinLocker 3\x86\MWLService.exe [28/10/2008 5:05 AM 306736]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [18/02/2009 3:36 AM 44800]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [24/09/2008 8:11 AM 144632]
R2 SAVAdminService;Sophos Anti-Virus status reporter;c:\program files\Sophos\Sophos Anti-Virus\SAVAdminService.exe [27/08/2009 10:23 AM 80936]
R2 SSPORT;SSPORT;c:\windows\System32\drivers\SSPORT.sys [8/01/2007 11:10 PM 5120]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\k57nd60x.sys [4/09/2008 2:12 PM 223232]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [8/04/2009 11:03 PM 3666432]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\System32\drivers\nvhda32v.sys [8/04/2009 11:02 PM 45600]
S2 SAVService;Sophos Anti-Virus;c:\program files\Sophos\Sophos Anti-Virus\SavService.exe [27/08/2009 10:23 AM 98304]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\System32\drivers\b57nd60x.sys [21/01/2008 12:23 PM 179712]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [24/09/2008 8:11 AM 50424]
S4 SophosBootDriver;SophosBootDriver;c:\windows\System32\drivers\SophosBootDriver.sys [27/08/2009 10:23 AM 20288]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll ",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-02 c:\windows\Tasks\User_Feed_Synchronization-{6FDD700A-C72A-461D-A3AC-C56726FC6EBF}.job
- c:\windows\system32\msfeedssync.exe [2009-07-28 20:13]
.
.
------- Supplementary Scan -------
.
uStart Page = go.microsoft.com/fwlink/?LinkId=69157
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&s=2&o=vp32&d=0409&m=aspire_5738
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-03 11:29
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\Sophos Message Router]
"ImagePath "= "\ "c:\program files\Sophos\Remote Management System\RouterNT.exe\" -service -name Router -ORBListenEndpoints iiop://:8193/ssl_port=8194 "
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\system\ControlSet003\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial "=dword:00000000
"MSCurrentCountry "=dword:000000b5
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(1780)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlUI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\GDIExtendCtrl.dll
c:\program files\EgisTec\MyWinLocker 3\x86\mwlOP.dll
c:\program files\EgisTec\MyWinLocker 3\x86\CryptoAPI.dll
c:\program files\EgisTec\MyWinLocker 3\x86\ShowErrMsg.dll
c:\windows\system32\btncopy.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Acer Bio Protection\CompPtcVUI.exe
c:\windows\System32\agrsmsvc.exe
c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\Sophos\Remote Management System\ManagementAgentNT.exe
c:\program files\Sophos\AutoUpdate\ALsvc.exe
c:\program files\Sophos\Remote Management System\RouterNT.exe
c:\windows\System32\wbem\unsecapp.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2009-09-03 11:34 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-03 01:34

Pre-Run: 319,435,935,744 bytes free
Post-Run: 319,158,673,408 bytes free

236 --- E O F --- 2009-09-02 19:40


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:44:17 AM, on 3/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\DennisM\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&s=2&o=vp32&d=0409&m=aspire_5738
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\sophos_detoured.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
O23 - Service: EgisTec Service (IGBASVC) - Egis Technology Inc. - c:\Program Files\Acer Bio Protection\BASVC.exe
O23 - Service: MyWinLocker Service (MWLService) - EgisTec Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Unknown owner - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos Agent - Sophos Plc - C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Sophos Message Router - Sophos Plc - C:\Program Files\Sophos\Remote Management System\RouterNT.exe

--
End of file - 6249 bytes

 

Successfuly downloaded Superantispyware and installed.

Computer won't reboot into safe mode.

When computer restarts and F8 is pressed, I am able to select Safe Mode. Computer commences loading windows files, Please wait... appears at bottom of screen, a black screen with large mouse pointer appears, then the computer automatically restarts again. I have tried to press F8 and select Safe Mode several times in a loop with no success.

If computer is allowed to reboot without pressing F8, it continues to normal login screen, but not safe mode.

I prefered not to follow any other steps until I received your direction.

 

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 09/04/2009 at 00:17 AM

Application Version : 4.27.1002

Core Rules Database Version : 4040
Trace Rules Database Version: 1980

Scan type : Complete Scan
Total Scan Time : 08:21:13

Memory items scanned : 569
Memory threats detected : 0
Registry items scanned : 6961
Registry threats detected : 0
File items scanned : 702714
File threats detected : 0

Will post next log when completed.

 

Malwarebytes' Anti-Malware 1.40
Database version: 2737
Windows 6.0.6001 Service Pack 1

4/09/2009 10:22:25 AM
mbam-log-2009-09-04 (10-22-25).txt

Scan type: Full Scan (C:\|)
Objects scanned: 216045
Time elapsed: 1 hour(s), 5 minute(s), 26 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


NB: If you are wondering why there is a discrepency in number of files scanned, I deleted a backup of another drive to save time scanning

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:37:26 AM, on 4/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\DennisM\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&s=2&o=vp32&d=0409&m=aspire_5738
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\sophos_detoured.dll,C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
O23 - Service: EgisTec Service (IGBASVC) - Egis Technology Inc. - c:\Program Files\Acer Bio Protection\BASVC.exe
O23 - Service: MyWinLocker Service (MWLService) - EgisTec Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Unknown owner - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos Agent - Sophos Plc - C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Sophos Message Router - Sophos Plc - C:\Program Files\Sophos\Remote Management System\RouterNT.exe

--
End of file - 6594 bytes

Redirection is no longer an issue.

 

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:31:02 PM, on 4/09/2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18813)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\System32\rundll32.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Users\DennisM\AppData\Local\Temp\RtkBtMnt.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0c09&s=2&o=vp32&d=0409&m=aspire_5738
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Program Files\Sophos\Sophos Anti-Virus\SophosBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra 'Tools' menuitem: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\Program Files\Acer Bio Protection\PwdBank.exe
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4871A87A-BFDD-4106-8153-FFDE2BAC2967} (DLM Control) - http://dlm.tools.akamai.com/dlmanager/versions/activex/dlm-activex-2.2.5.0.cab
O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\sophos_detoured.dll,C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL
O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe
O23 - Service: Acer ePower Service (ePowerSvc) - Acer Incorporated - C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
O23 - Service: EgisTec Service (IGBASVC) - Egis Technology Inc. - c:\Program Files\Acer Bio Protection\BASVC.exe
O23 - Service: MyWinLocker Service (MWLService) - EgisTec Inc. - C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
O23 - Service: NTI IScheduleSvc - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
O23 - Service: NTI Backup Now 5 Backup Service (NTIBackupSvc) - NewTech InfoSystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
O23 - Service: NTI Backup Now 5 Scheduler Service (NTISchedulerSvc) - NewTech Infosystems, Inc. - C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Sophos Anti-Virus status reporter (SAVAdminService) - Sophos Plc - C:\Program Files\Sophos\Sophos Anti-Virus\SAVAdminService.exe
O23 - Service: Sophos Anti-Virus (SAVService) - Unknown owner - C:\Program Files\Sophos\Sophos Anti-Virus\SavService.exe
O23 - Service: Sophos Agent - Sophos Plc - C:\Program Files\Sophos\Remote Management System\ManagementAgentNT.exe
O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Program Files\Sophos\AutoUpdate\ALsvc.exe
O23 - Service: Sophos Message Router - Sophos Plc - C:\Program Files\Sophos\Remote Management System\RouterNT.exe

--
End of file - 5982 bytes

 

Computer is doing great apart from 2 issues still.

1. Cannot start in Safe Mode
2. Cannot get Sophos to run again. When i click on Sophos, it says the Sophos service is not started, so I click start, then get a message stating: You are not a member of any of the Sophos groups. To launch this application, you must be a member of the SophosAdministrator, SophosPowerUser or SophosUser group.

Your assistance has been fantastic. Are you able to help me with these issues also?