Active Google redirect; I can't load AVG; Run GMER

[Active] Google redirect; I can't load AVG; Run GMER

Our Computer has been acting funny for about two weeks. When we open firefox and go to our home( which is Google) another window pops up. When we do Google searches and link to the site the window pops up as:

"Reported Attack Site!

This web site at c.ppcxml.net has been reported as an attack site and has been blocked based on your security preferences.

Attack sites try to install programs that steal private information, use your computer to attack others, or damage your system.

Some attack sites intentionally distribute harmful software, but many are compromised without the knowledge or permission of their owners. "

I tried to load AVG serveral time but the farthest I got was:

"Local machine: Installation failed
Installation: Error: Action failed for file avgfx86.sys starting service...
Specified file was not found. "

After some research on AVG site I was directed to run a program called gmer. I downloaded and renamed as directed. I ran the program as test and after several hours the last line had:

"C:\WINDOWS\system32\drivers\atapi.sys suspicious modification "

Now I think io am suppose to delete this file and run GMER again but I am concerned that I may delete a file that is required for my operating system.

Any help would appreciated.

DDS (Ver_09-12-01.01) - NTFSx86
Run by Cyril at 19:34:51.13 on Sun 01/03/2010
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.408 [GMT -4:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
C:\WINDOWS\Explorer.EXE
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATICEA.EXE
C:\WINDOWS\system32\qtplugin.exe
C:\DOCUME~1\Cyril\APPLIC~1\GameNIR.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Cyril\My Documents\Downloads\test.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\Program Files\Microsoft Office\Office12\WINWORD.EXE
C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Documents and Settings\Cyril\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uInternet Settings,ProxyOverride = *.local
uURLSearchHooks: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
mWinlogon: Userinit=c:\windows\system32\userinit.exe,c:\windows\system32\twex.exe,
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AVG Security Toolbar BHO: {a3bc75a2-1f87-4686-aa43-5347d756017c} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: AVG Security Toolbar: {ccc7a320-b3ca-4199-b1a6-9f516dd69829} - c:\program files\avg\avg9\toolbar\IEToolbar.dll
TB: {90B8B761-DF2B-48AC-BBE0-BCC03A819B3B} - No File
TB: {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - No File
EB: {2AA2FBF8-9C76-4E97-A226-25C5F4AB6358} - No File
uRun: [MessengerPlus3] "c:\program files\messengerplus! 3\MsgPlus.exe" /WinStart
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [DriverCure] c:\program files\paretologic\drivercure\DriverCure.exe -scan
uRun: [EPSON Stylus CX8400 Series] c:\windows\system32\spool\drivers\w32x86\3\e_faticea.exe /fu "c:\windows\temp\E_SE6.tmp" /EF "HKCU "
uRun: [RegistryMonitor1] "c:\windows\system32\qtplugin.exe "
uRun: [StartGame] "c:\docume~1\cyril\applic~1\GameNIR.exe "
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
mRun: [AudioDeck] c:\program files\via\viaudioi\sbadeck\ADeck.exe 1
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [EPSON Stylus CX4600 Series] c:\windows\system32\spool\drivers\w32x86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600 "
mRun: [MessengerPlus3] "c:\program files\messengerplus! 3\MsgPlus.exe "
mRun: [MyWebSearch Email Plugin] c:\progra~1\mywebs~1\bar\1.bin\mwsoemon.exe
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [spywareguard] c:\program files\spyware guard 2009\spywareguard.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [HPUsageTracking] "c:\program files\hp\hp ut\bin\hppusg.exe" "c:\program files\hp\HP UT "
mRun: [hpbdfawep] c:\program files\hp\dfawep\bin\hpbdfawep.exe 1
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [net] "c:\windows\system32\net.net "
mRun: [lsdefrag] c:\docume~1\cyril\locals~1\temp\owasermxcn.tmp
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [Hsibafawiwi] rundll32.exe "c:\windows\enonukifaso.dll ",Startup
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [RegistryMonitor1] c:\windows\system32\qtplugin.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
StartupFolder: c:\docume~1\cyril\startm~1\programs\startup\limewi~1.lnk - c:\program files\limewire\LimeWire.exe
StartupFolder: c:\docume~1\cyril\startm~1\programs\startup\openof~1.lnk - c:\program files\openoffice.org 3\program\quickstart.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\audibl~1.lnk - c:\program files\audible\bin\AudibleDownloadHelper.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZLfox000
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\windows live toolbar\components\en-ca\msntabres.dll.mui/229?cbc0ed3a631848a19403c79c89e1f1c2
IE: Open in new foreground tab - c:\program files\windows live toolbar\components\en-ca\msntabres.dll.mui/230?cbc0ed3a631848a19403c79c89e1f1c2
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~2\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office12\REFIEBAR.DLL
DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} - hxxp://www.worldwinner.com/games/v51/bejeweledtwist/bejeweledtwist.cab
DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} - hxxp://www.worldwinner.com/games/v46/monopoly/monopoly.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} - file://c:\program files\risk\images\armhelper.ocx
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab
DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} - hxxps://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SSODL: crash_report - {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - c:\windows\system32\crash_report.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Notification Packages = scecli rontut.dll
Hosts: 74.125.45.100 4-open-davinci.com
Hosts: 74.125.45.100 securitysoftwarepayments.com
Hosts: 74.125.45.100 privatesecuredpayments.com
Hosts: 74.125.45.100 secure.privatesecuredpayments.com
Hosts: 74.125.45.100 getantivirusplusnow.com

Note: multiple HOSTS entries found. Please refer to Attach.txt

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\cyril\applic~1\mozilla\firefox\profiles\twq68gr9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\documents and settings\cyril\application data\mozilla\firefox\profiles\twq68gr9.default\extensions\{0fc64d74-ea76-49a3-b606-7801b5013798}\components\FFExternalAlert.dll
FF - component: c:\program files\real\realplayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\cyril\application data\mozilla\firefox\profiles\twq68gr9.default\extensions\{38ab6a6c-cc4c-4f9e-a3dd-3c5681ef18a1}\plugins\npsoe.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npclntax_ZangoSA.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPMyWebS.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npOGAPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Internal security: No Registry Reference - c:\program files\mozilla firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - truec:\program files\mozilla firefox\greprefs\security-prefs.js - pref( "security.ssl3.rsa_seed_sha ", true);

============= SERVICES / DRIVERS ===============

R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\SASDIFSV.SYS [2008-12-22 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2008-12-22 74480]
R1 unpr;Unprotector;c:\windows\system32\drivers\unpr.sys [2009-12-14 4096]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2008-12-22 7408]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-12-29 30104]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-12-29 30104]

=============== Created Last 30 ================

2010-01-03 15:31:51 0 d-----w- c:\docume~1\alluse~1\applic~1\AVG Security Toolbar
2009-12-29 21:08:18 0 d-----w- c:\program files\AVG
2009-12-29 20:58:26 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-12-29 20:58:26 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-12-29 20:23:29 1409 ----a-w- c:\windows\system32\tmp15463.FOT
2009-12-29 20:23:21 1409 ----a-w- c:\windows\system32\tmpBB343.FOT
2009-12-29 20:23:15 1409 ----a-w- c:\windows\system32\tmpDEC23.FOT
2009-12-29 20:06:13 0 d-----w- c:\docume~1\cyril\applic~1\AVG8
2009-12-28 14:29:00 0 d-----w- c:\docume~1\cyril\applic~1\PeggleDeluxe
2009-12-26 14:17:35 47778 ----a-w- c:\windows\hpiins01.dat
2009-12-26 14:17:03 1409 ----a-w- c:\windows\system32\tmp12923.FOT
2009-12-26 14:16:58 1409 ----a-w- c:\windows\system32\tmpD9313.FOT
2009-12-26 14:16:50 1409 ----a-w- c:\windows\system32\tmp605F2.FOT
2009-12-26 14:16:35 1409 ----a-w- c:\windows\system32\tmp58BB2.FOT
2009-12-26 14:16:17 1409 ----a-w- c:\windows\system32\tmpED672.FOT
2009-12-26 14:15:40 1409 ----a-w- c:\windows\system32\tmp4E5E1.FOT
2009-12-26 13:41:36 1409 ----a-w- c:\windows\system32\tmp79526.FOT
2009-12-26 13:41:29 1409 ----a-w- c:\windows\system32\tmp5DA06.FOT
2009-12-26 13:41:23 1409 ----a-w- c:\windows\system32\tmp433F5.FOT
2009-12-26 13:41:17 1409 ----a-w- c:\windows\system32\tmp48CD5.FOT
2009-12-26 13:41:11 1409 ----a-w- c:\windows\system32\tmp344C5.FOT
2009-12-26 13:40:54 1409 ----a-w- c:\windows\system32\tmp1D285.FOT
2009-12-26 13:40:49 1409 ----a-w- c:\windows\system32\tmpFCD65.FOT
2009-12-25 14:05:26 0 d-----w- c:\docume~1\cyril\applic~1\Luxor
2009-12-24 07:01:15 166912 ----a-w- c:\docume~1\cyril\applic~1\GameNIR.exe
2009-12-24 07:00:40 0 d-----w- c:\docume~1\cyril\applic~1\Abundante
2009-12-24 06:58:34 0 d-----w- c:\docume~1\cyril\applic~1\MyGames
2009-12-24 06:57:09 20 ----a-w- c:\windows\system32\crash_report.ini
2009-12-24 06:57:08 0 d-----w- c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}
2009-12-23 20:23:38 0 d--h--w- c:\windows\PIF
2009-12-20 14:05:47 489984 ----a-w- c:\windows\system32\qtplugin.exe
2009-12-17 04:37:09 0 d-----w- c:\program files\common files\xing shared
2009-12-17 04:36:48 0 d-----w- c:\program files\common files\Real
2009-12-15 00:46:27 0 ----a-w- c:\windows\Phifomobu.bin
2009-12-15 00:46:22 120 ----a-w- c:\windows\Jgiquno.dat
2009-12-15 00:42:05 77 ----a-w- c:\windows\system32\uses32.dat
2009-12-15 00:42:05 100 ----a-w- c:\windows\system32\flags.ini
2009-12-15 00:38:23 120 ----a-w- c:\windows\system32\112179.exe
2009-12-15 00:38:15 0 d-sh--w- c:\docume~1\cyril\applic~1\SystemProc
2009-12-15 00:38:00 4096 ----a-w- c:\windows\system32\drivers\unpr.sys
2009-12-15 00:37:46 0 d-sh--w- c:\docume~1\alluse~1\applic~1\WSVLWBD_APDM
2009-12-15 00:36:26 0 d-----w- c:\docume~1\alluse~1\applic~1\625554e
2009-12-15 00:35:59 36246 ----a-w- c:\windows\system32\net.net
2009-12-11 09:37:56 536576 ----a-w- c:\windows\system32\crash_report.dll
2009-12-05 17:08:57 0 d-----w- c:\docume~1\cyril\applic~1\Sony Online Entertainment

==================== Find3M ====================

2010-01-02 04:24:43 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-04 20:55:17 178 ----a-w- C:\handle.dat
2009-10-29 07:45:38 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38:36 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38:36 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-13 10:30:16 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38:19 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38:18 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-11 08:17:27 411368 ----a-w- c:\windows\system32\deploytk.dll
2008-12-01 11:26:51 56 -csh--r- c:\windows\system32\51494BB995.sys
2008-12-01 11:26:51 1682 -csha-w- c:\windows\system32\KGyGaAvL.sys

============= FINISH: 19:37:39.07 ===============

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-12-01.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 9/23/2008 5:06:25 PM
System Uptime: 1/3/2010 11:18:53 AM (8 hours ago)

Motherboard: | | VT8367-8235
Processor: AMD Duron(tm) processor | Socket A | 1347/100mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 76 GiB total, 56.332 GiB free.
D: is CDROM (CDFS)
E: is CDROM ()
F: is FIXED (FAT32) - 373 GiB total, 336.841 GiB free.
G: is Removable

==== Disabled Device Manager Items =============

Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Network Controller
Device ID: PCI\VEN_104C&DEV_9066&SUBSYS_9067104C&REV_00\3&61AAA01&0&48
Manufacturer:
Name: Network Controller
PNP Device ID: PCI\VEN_104C&DEV_9066&SUBSYS_9067104C&REV_00\3&61AAA01&0&48
Service:

==== System Restore Points ===================

RP1: 12/14/2009 8:47:18 PM - System Checkpoint
RP2: 12/15/2009 9:25:00 PM - System Checkpoint
RP3: 12/17/2009 12:10:16 AM - System Checkpoint
RP4: 12/18/2009 12:50:55 AM - System Checkpoint
RP5: 12/19/2009 4:45:20 AM - System Checkpoint
RP6: 12/20/2009 5:30:59 AM - System Checkpoint
RP7: 12/21/2009 5:57:36 AM - System Checkpoint
RP8: 12/22/2009 6:14:20 AM - System Checkpoint
RP9: 12/23/2009 10:21:51 AM - System Checkpoint
RP10: 12/24/2009 11:12:51 AM - System Checkpoint
RP11: 12/25/2009 12:20:12 PM - Installed Java(TM) 6 Update 17
RP12: 12/28/2009 2:25:11 AM - Removed Microsoft .NET Framework 1.1
RP13: 12/28/2009 5:04:06 AM - System Checkpoint
RP14: 12/29/2009 6:27:56 AM - System Checkpoint
RP15: 12/29/2009 4:58:53 PM - Installed AVG 9.0
RP16: 12/29/2009 5:08:59 PM - Installed AVG Free 9.0
RP17: 12/30/2009 5:49:00 PM - System Checkpoint
RP18: 12/31/2009 6:35:40 PM - System Checkpoint
RP19: 1/1/2010 7:45:42 PM - System Checkpoint
RP20: 1/2/2010 8:35:47 PM - System Checkpoint
RP21: 1/3/2010 11:32:08 AM - Installed AVG Free 9.0

==== Hosts File Hijack ======================

Hosts: 74.125.45.100 4-open-davinci.com
Hosts: 74.125.45.100 securitysoftwarepayments.com
Hosts: 74.125.45.100 privatesecuredpayments.com
Hosts: 74.125.45.100 secure.privatesecuredpayments.com
Hosts: 74.125.45.100 getantivirusplusnow.com
Hosts: 74.125.45.100 secure-plus-payments.com
Hosts: 74.125.45.100 www.getantivirusplusnow.com
Hosts: 74.125.45.100 www.secure-plus-payments.com
Hosts: 74.125.45.100 www.getavplusnow.com
Hosts: 74.125.45.100 safebrowsing-cache.google.com
Hosts: 74.125.45.100 urs.microsoft.com
Hosts: 74.125.45.100 www.securesoftwarebill.com
Hosts: 74.125.45.100 secure.paysecuresystem.com

==== Installed Programs ======================

32 Bit HP CIO Components Installer
Acrobat.com
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Adobe Shockwave Player 11.5
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Audible Download Manager
Bonjour
BufferChm
Coupon Printer for Windows
CreativeProjects
CreativeProjectsTemplates
Critical Update for Windows Media Player 11 (KB959772)
CueTour
Director
Driver Detective
EPSON Printer Software
EPSON Scan
HomeWorks
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
HP Color LaserJet CP1210 Series
HP Image Zone 4.5
HP Update
HPCarePackCore
HPCarePackProducts
hppusgCP1215
HPSSupply
HPSystemDiagnostics
InstantShare
Interactive User’s Guide
iTunes
Java(TM) 6 Update 17
Java(TM) 6 Update 7
Junk Mail filter update
LimeWire 4.18.8
Map Button (Windows Live Toolbar)
MarketResearch
Messenger Plus! 3
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Live Add-in 1.3
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Search Enhancement Pack
Microsoft Silverlight
Microsoft Software Update for Web Folders (English) 12
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.5.6)
MrvlUsgTracking
MSN
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB954459)
MSXML4 Parser
Musicnotes Player V1.23.2 and Viewer
OneCare Advisor (Windows Live Toolbar)
OpenOffice.org 3.0
PanoStandAlone
Platform
Popup Blocker (Windows Live Toolbar)
QuickTime
RealPlayer
Rhapsody Player Engine
Rise of Nations
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB973704)
Security Update for Microsoft Office Excel 2007 (KB973593)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (972581)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office system 2007 (KB974234)
Security Update for Microsoft Office Visio Viewer 2007 (KB973709)
Security Update for Microsoft Office Word 2007 (KB969604)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958215)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960714)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB963027)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969897)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Segoe UI
SkinsHP1
Smart Menus (Windows Live Toolbar)
SmartDraw 2009
Spelling Dictionaries Support For Adobe Reader 9
Spyware Guard 2009
SUPERAntiSpyware Free Edition
Tabbed Browsing (Windows Live Toolbar)
TEFView 2.64
TrayApp
Unload
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft Office InfoPath 2007 (KB976416)
Update for Windows Internet Explorer 8 (KB971930)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VIA Platform Device Manager
VIA Rhine-Family Fast Ethernet Adapter
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Imaging Component
Windows Internet Explorer 8
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Favorites for Windows Live Toolbar
Windows Live Mail
Windows Live Messenger
Windows Live Outlook Toolbar (Windows Live Toolbar)
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Live Upload Tool
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

12/29/2009 5:08:55 PM, error: Service Control Manager [7000] - The AVG Free On-access Scanner Minifilter Driver x86 service failed to start due to the following error: The system cannot find the file specified.
12/29/2009 4:58:46 PM, error: Service Control Manager [7000] - The AVG Network Redirector service failed to start due to the following error: The system cannot find the file specified.
12/29/2009 4:20:49 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
12/29/2009 4:20:48 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
12/27/2009 4:24:43 PM, error: Print [6161] - The document Microsoft Word - Doc2 owned by Cyril failed to print on printer EPSON Stylus CX8400 Series. Data type: NT EMF 1.008. Size of the spool file in bytes: 0. Number of bytes printed: 0. Total number of pages in the document: 0. Number of pages printed: 0. Client machine: \\CYRIL-FF4E1E768. Win32 error code returned by the print processor: 259 (0x103).
12/27/2009 12:33:33 PM, error: Dhcp [1002] - The IP address lease 192.168.2.10 for the Network Card with network address 00115B510975 has been denied by the DHCP server 192.168.2.1 (The DHCP Server sent a DHCPNACK message).
1/3/2010 9:40:30 AM, error: Service Control Manager [7000] - The SASDIFSV service failed to start due to the following error: Cannot create a file when that file already exists.

==== End Of File ===========================

 

HijackTHis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:10 PM, on 1/4/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\HP UT\bin\hppusg.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\DOCUME~1\Cyril\APPLIC~1\GameNIR.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (file missing)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar BHO - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: AVG Security Toolbar - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
O4 - HKLM\..\Run: [EPSON Stylus CX4600 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE /P26 "EPSON Stylus CX4600 Series" /O6 "USB001" /M "Stylus CX4600 "
O4 - HKLM\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe "
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [HPUsageTracking] "C:\Program Files\HP\HP UT\bin\hppusg.exe" "C:\Program Files\HP\HP UT "
O4 - HKLM\..\Run: [hpbdfawep] C:\Program Files\HP\Dfawep\bin\hpbdfawep.exe 1
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
O4 - HKCU\..\Run: [MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" /WinStart
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [StartGame] "C:\DOCUME~1\Cyril\APPLIC~1\GameNIR.exe "
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Global Startup: Audible Download Manager.lnk = C:\Program Files\Audible\Bin\AudibleDownloadHelper.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZLfox000
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?cbc0ed3a631848a19403c79c89e1f1c2
O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?cbc0ed3a631848a19403c79c89e1f1c2
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file:///C:/Program%20Files/Monopoly/Images/stg_drm.ocx
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} (Wwlaunch Control) - http://www.worldwinner.com/games/shared/wwlaunch.cab
O16 - DPF: {95A311CD-EC8E-452A-BCEC-B844EB616D03} (BejeweledTwist Control) - http://www.worldwinner.com/games/v51/bejeweledtwist/bejeweledtwist.cab
O16 - DPF: {BA35B9B8-DE9E-47C9-AFA7-3C77E3DDFD39} (Monopoly Control) - http://www.worldwinner.com/games/v46/monopoly/monopoly.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Risk\Images\armhelper.ocx
O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://signin9.valueactive.eu/Register/Branding/olr3313/OCX/v1018/flashax.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (file missing)
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O21 - SSODL: crash_report - {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - C:\WINDOWS\system32\crash_report.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: EPSON V3 Service4(01) (EPSON_PM_RPCV4_01) - SEIKO EPSON CORPORATION - C:\Documents and Settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

--
End of file - 9833 bytes

 

Combo log

I thought I posted the Combo log file. Here it is. I ran it yesterday and then the Hijack. I posted the hijack log.

ComboFix 10-01-04.01 - Cyril 01/04/2010 20:16:23.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.774 [GMT -4:00]
Running from: c:\documents and settings\Cyril\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\2ACA5CC3-0F83-453D-A079-1076FE1A8B65
c:\documents and settings\All Users\Application Data\Microsoft\Internet Explorer\DLLs\c.cgm
c:\documents and settings\All Users\Application Data\Microsoft\Protect\track.sys
c:\documents and settings\All Users\Application Data\ZangoSA
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAau.dat
c:\documents and settings\All Users\Application Data\ZangoSA\ZangoSAEula.mht
c:\documents and settings\Cyril\Application Data\FunWebProducts
c:\documents and settings\Cyril\Application Data\SystemProc
c:\documents and settings\Cyril\Application Data\SystemProc\lsass.exe
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\chrome\content\timer.xul
c:\program files\Mozilla Firefox\extensions\{8CE11043-9A15-4207-A565-0C94C42D590D}\install.rdf
c:\program files\Spyware Guard 2009
c:\program files\Spyware Guard 2009\conf.cfg
c:\program files\Spyware Guard 2009\mbase.vdb
c:\program files\Spyware Guard 2009\quarantine.vdb
c:\program files\Spyware Guard 2009\queue.vdb
c:\program files\Spyware Guard 2009\uninstall.exe
c:\program files\Spyware Guard 2009\vbase.vdb
c:\windows\COUPON~1.OCX
c:\windows\CouponPrinter.ocx
c:\windows\enonukifaso.dll
c:\windows\rontut.dll
c:\windows\system32\112179.exe
c:\windows\system32\curslib.dll
c:\windows\system32\drivers\unpr.sys
c:\windows\system32\flags.ini
c:\windows\system32\net.net
c:\windows\system32\qtplugin.exe
c:\windows\system32\twain32
c:\windows\system32\twain32\local.ds
c:\windows\system32\twain32\user.ds
c:\windows\system32\uses32.dat
c:\windows\system32\wincert.dll
c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
F:\autorun.inf

Infected copy of c:\windows\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_UNPR
-------\Service_unpr


((((((((((((((((((((((((( Files Created from 2009-12-05 to 2010-01-05 )))))))))))))))))))))))))))))))
.

2010-01-03 15:31 . 2010-01-03 15:31 -------- d-----w- c:\documents and settings\All Users\Application Data\AVG Security Toolbar
2009-12-29 21:08 . 2009-12-29 21:08 -------- d-----w- c:\program files\AVG
2009-12-29 20:58 . 2009-12-29 20:58 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-12-29 20:58 . 2009-12-29 20:58 30104 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-12-29 20:06 . 2009-12-29 20:06 -------- d-----w- c:\documents and settings\Cyril\Application Data\AVG8
2009-12-28 14:29 . 2009-12-03 01:23 329216 ----a-w- c:\documents and settings\Cyril\Application Data\PeggleDeluxe\PeggleDeluxe.exe
2009-12-28 14:29 . 2006-04-11 16:53 94208 ----a-w- c:\documents and settings\Cyril\Application Data\PeggleDeluxe\j2k-codec.dll
2009-12-28 14:29 . 2007-02-28 23:47 4229104 ----a-w- c:\documents and settings\Cyril\Application Data\PeggleDeluxe\cgp.dll
2009-12-28 14:29 . 2006-07-18 18:45 92216 ----a-w- c:\documents and settings\Cyril\Application Data\PeggleDeluxe\bass.dll
2009-12-28 14:29 . 2009-12-28 14:29 -------- d-----w- c:\documents and settings\Cyril\Application Data\PeggleDeluxe
2009-12-26 14:17 . 2009-12-26 14:19 47778 ----a-w- c:\windows\hpiins01.dat
2009-12-25 16:17 . 2009-12-25 16:17 152576 ----a-w- c:\documents and settings\Cyril\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-25 16:17 . 2009-12-25 16:17 79488 ----a-w- c:\documents and settings\Cyril\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-25 14:05 . 2006-12-28 18:48 90112 ----a-w- c:\documents and settings\Cyril\Application Data\Luxor\crash.dll
2009-12-25 14:05 . 2006-12-28 18:48 57406 ----a-w- c:\documents and settings\Cyril\Application Data\Luxor\core.dll
2009-12-25 14:05 . 2005-05-05 13:04 196608 ----a-r- c:\documents and settings\Cyril\Application Data\Luxor\cgp.dll
2009-12-25 14:05 . 2009-10-24 01:52 -------- d-----w- c:\documents and settings\Cyril\Application Data\Luxor
2009-12-24 07:01 . 2007-04-01 15:57 294912 ----a-w- c:\documents and settings\Cyril\Application Data\Abundante\prog.dll
2009-12-24 07:01 . 2007-04-01 15:57 180224 ----a-w- c:\documents and settings\Cyril\Application Data\Abundante\image_tool.dll
2009-12-24 07:01 . 2009-12-03 00:59 329728 ----a-w- c:\documents and settings\Cyril\Application Data\Abundante\Abundante.exe
2009-12-24 07:01 . 2007-04-01 21:15 274432 ----a-w- c:\documents and settings\Cyril\Application Data\Abundante\cgp.dll
2009-12-24 07:01 . 2009-12-28 14:29 166912 ----a-w- c:\documents and settings\Cyril\Application Data\GameNIR.exe
2009-12-24 07:00 . 2009-12-24 07:05 -------- d-----w- c:\documents and settings\Cyril\Application Data\Abundante
2009-12-24 06:58 . 2009-12-28 14:28 27519488 ----a-w- c:\documents and settings\Cyril\Application Data\MyGames\SetupGame.dll
2009-12-24 06:58 . 2009-12-28 14:29 -------- d-----w- c:\documents and settings\Cyril\Application Data\MyGames
2009-12-24 06:57 . 2009-12-24 06:57 -------- d-----w- c:\windows\system32\{1361570A-7A05-4FE0-B657-E2B1D167B03D}
2009-12-24 05:34 . 2009-12-24 05:34 -------- d-----w- c:\windows\system32\config\systemprofile\Local Settings\Application Data\Adobe
2009-12-24 02:44 . 2009-12-26 11:38 52224 ----a-w- c:\documents and settings\Cyril\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
2009-12-23 20:23 . 2009-12-23 20:23 -------- d--h--w- c:\windows\PIF
2009-12-17 04:49 . 2009-12-17 04:49 -------- d-----w- c:\documents and settings\Cyril\Local Settings\Application Data\Temp
2009-12-17 04:49 . 2009-12-17 04:49 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Google
2009-12-17 04:37 . 2009-12-17 04:37 -------- d-----w- c:\documents and settings\Cyril\Local Settings\Application Data\Real
2009-12-17 04:37 . 2009-12-17 04:37 -------- d-----w- c:\program files\Common Files\xing shared
2009-12-17 04:36 . 2009-12-17 04:37 -------- d-----w- c:\program files\Common Files\Real
2009-12-17 04:35 . 2009-12-17 04:35 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Google
2009-12-17 04:35 . 2009-12-25 16:26 -------- d-----w- c:\documents and settings\Cyril\Local Settings\Application Data\Google
2009-12-17 04:35 . 2009-12-25 16:26 -------- d-----w- c:\program files\Google
2009-12-15 00:46 . 2010-01-05 00:16 0 ----a-w- c:\windows\Phifomobu.bin
2009-12-15 00:46 . 2010-01-05 00:16 120 ----a-w- c:\windows\Jgiquno.dat
2009-12-15 00:46 . 2009-12-15 00:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-12-15 00:37 . 2009-12-15 00:37 -------- d-sh--w- c:\documents and settings\All Users\Application Data\WSVLWBD_APDM
2009-12-15 00:37 . 2009-11-06 13:18 722392 ----a-w- c:\documents and settings\All Users\Application Data\625554e\mozcrt19.dll
2009-12-15 00:37 . 2009-11-06 13:19 457688 ----a-w- c:\documents and settings\All Users\Application Data\625554e\sqlite3.dll
2009-12-15 00:36 . 2009-12-24 06:53 -------- d-----w- c:\documents and settings\All Users\Application Data\625554e
2009-12-11 09:37 . 2009-12-11 09:37 536576 ----a-w- c:\windows\system32\crash_report.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 00:31 . 2008-10-18 01:21 -------- d-----w- c:\documents and settings\Cyril\Application Data\LimeWire
2010-01-03 13:40 . 2009-01-15 21:21 -------- d-----w- c:\program files\SUPERAntiSpyware
2010-01-03 13:33 . 2008-09-27 03:25 -------- d-----w- c:\program files\Hewlett-Packard
2010-01-02 04:24 . 2004-08-12 13:17 96512 ----a-w- c:\windows\system32\drivers\atapi.sys
2009-12-26 13:29 . 2008-09-27 03:20 -------- d-----w- c:\program files\HP
2009-12-26 13:26 . 2008-09-27 03:25 -------- d-----w- c:\program files\Common Files\HP
2009-12-26 11:37 . 2009-04-19 21:47 117760 ----a-w- c:\documents and settings\Cyril\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
2009-12-25 16:24 . 2009-12-05 17:09 205113 ----a-w- c:\documents and settings\Cyril\Application Data\Sony Online Entertainment\npsoeact.dll
2009-12-25 16:24 . 2009-12-05 17:08 -------- d-----w- c:\documents and settings\Cyril\Application Data\Sony Online Entertainment
2009-12-25 16:22 . 2008-10-18 01:20 -------- d-----w- c:\program files\Java
2009-12-20 16:37 . 2009-12-20 16:54 171102 ----a-w- c:\windows\pchealth\helpctr\Config\Cache\Professional_32_1033.dat
2009-12-17 04:36 . 2008-10-09 23:17 -------- d-----w- c:\program files\Real
2009-12-09 10:04 . 2008-12-01 11:57 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-12-04 20:55 . 2009-12-04 20:53 178 ----a-w- C:\handle.dat
2009-12-04 02:00 . 2009-12-04 02:00 -------- d-----w- c:\program files\QuickTime
2009-12-04 01:59 . 2008-10-30 03:05 -------- d-----w- c:\program files\Common Files\Apple
2009-12-03 01:18 . 2009-12-25 14:06 326656 ----a-w- c:\documents and settings\Cyril\Application Data\Luxor\Luxor.exe
2009-11-28 20:33 . 2009-11-28 20:33 -------- d-----w- c:\documents and settings\All Users\Application Data\Messenger Plus!
2009-11-23 01:46 . 2009-11-23 01:46 608 --sha-w- c:\windows\system32\winzvprt5.sys
2009-11-11 15:23 . 2009-11-11 15:23 -------- d-----w- c:\documents and settings\All Users\Application Data\EPSON
2009-11-11 15:17 . 2009-11-11 15:11 -------- d-----w- c:\documents and settings\Cyril\Application Data\GetRightToGo
2009-11-11 15:14 . 2008-09-23 20:58 -------- d-----w- c:\program files\InstallShield Installation Information
2009-11-11 15:13 . 2009-11-11 15:13 -------- d-----w- c:\program files\PC Drivers HeadQuarters
2009-11-11 15:13 . 2009-11-11 15:13 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-11-11 15:02 . 2008-09-27 03:38 48240 -c--a-w- c:\documents and settings\Cyril\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-09 10:04 . 2008-12-01 12:02 -------- d-----w- c:\program files\Microsoft Works
2009-11-08 20:44 . 2008-09-23 20:01 87263 ----a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-29 07:45 . 2004-08-12 13:33 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-21 05:38 . 2004-08-12 13:30 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-12 13:19 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-12 13:19 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-20 00:15 . 2009-12-05 17:08 127800 ----a-w- c:\documents and settings\Cyril\Application Data\Mozilla\Firefox\Profiles\twq68gr9.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}\plugins\npsoe.dll
2009-10-13 10:30 . 2004-08-12 13:25 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:38 . 2004-08-12 13:27 149504 ----a-w- c:\windows\system32\rastls.dll
2009-10-12 13:38 . 2004-08-12 13:26 79872 ----a-w- c:\windows\system32\raschap.dll
2009-10-11 08:17 . 2009-02-26 11:22 411368 ----a-w- c:\windows\system32\deploytk.dll
2008-12-01 11:26 . 2008-09-29 01:12 56 -csh--r- c:\windows\system32\51494BB995.sys
2008-12-01 11:26 . 2008-09-29 01:12 1682 -csha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 17:01 1230080 ----a-w- c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829} "= "c:\program files\AVG\AVG9\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MessengerPlus3 "= "c:\program files\MessengerPlus! 3\MsgPlus.exe" [2008-10-09 190024]
"MSMSGS "= "c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
"SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2010-01-03 2002160]
"StartGame "= "c:\docume~1\Cyril\APPLIC~1\GameNIR.exe" [2009-12-28 166912]
"msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2009-07-26 3883856]
"ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AudioDeck "= "c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe" [2007-08-09 528384]
"ISUSPM Startup "= "c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 221184]
"ISUSScheduler "= "c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-06-16 81920]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"EPSON Stylus CX4600 Series "= "c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATI9AA.EXE" [2004-03-04 98304]
"MessengerPlus3 "= "c:\program files\MessengerPlus! 3\MsgPlus.exe" [2008-10-09 190024]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"HPUsageTracking "= "c:\program files\HP\HP UT\bin\hppusg.exe" [2007-11-02 36864]
"hpbdfawep "= "c:\program files\HP\Dfawep\bin\hpbdfawep.exe" [2007-04-25 954368]
"QuickTime Task "= "c:\program files\QuickTime\qttask.exe" [2009-11-11 417792]
"TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2009-12-17 198160]
"SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]

c:\documents and settings\Cyril\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-9-18 147456]
OpenOffice.org 3.0.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2008-9-12 384000]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Audible Download Manager.lnk - c:\program files\Audible\Bin\AudibleDownloadHelper.exe [2008-12-9 1783128]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-4 258048]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"crash_report "= {495FE683-6249-4A05-8D1A-8F7CD8DF5A6D} - c:\windows\system32\crash_report.dll [2009-12-11 536576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2009-10-31 18:18 548352 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Messenger\\msmsgs.exe "=
"c:\\Program Files\\LimeWire\\LimeWire.exe "=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE "=
"f:\\Program Files\\Microsoft Games\\Rise of Nations\\Thrones.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"f:\\Program Files\\Microsoft Games\\Rise of Nations\\patriots.exe "=

R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV.SYS [12/22/2008 11:06 AM 9968]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [12/22/2008 11:05 AM 74480]
R3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [12/22/2008 11:06 AM 7408]
S3 Avgfwdx;Avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [12/29/2009 4:58 PM 30104]
S3 Avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [12/29/2009 4:58 PM 30104]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
Contents of the 'Scheduled Tasks' folder

2009-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-01-05 c:\windows\Tasks\SDMsgUpdate (SD).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2009-01-05 11:29]
.
.
------- Supplementary Scan -------
.
uInternet Settings,ProxyOverride = *.local
IE: &Search - http://edits.mywebsearch.com/toolbaredits/menusearch.jhtml?p=ZLfox000
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: Open in new background tab - c:\program files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/229?cbc0ed3a631848a19403c79c89e1f1c2
IE: Open in new foreground tab - c:\program files\Windows Live Toolbar\Components\en-ca\msntabres.dll.mui/230?cbc0ed3a631848a19403c79c89e1f1c2
FF - ProfilePath - c:\documents and settings\Cyril\Application Data\Mozilla\Firefox\Profiles\twq68gr9.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ca/
FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=IEFM1&q=
FF - component: c:\documents and settings\Cyril\Application Data\Mozilla\Firefox\Profiles\twq68gr9.default\extensions\{0fc64d74-ea76-49a3-b606-7801b5013798}\components\FFExternalAlert.dll
FF - component: c:\program files\Real\RealPlayer\browserrecord\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\Cyril\Application Data\Mozilla\Firefox\Profiles\twq68gr9.default\extensions\{38AB6A6C-CC4C-4f9e-A3DD-3C5681EF18A1}\plugins\npsoe.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmusicn.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPMyWebS.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npOGAPlugin.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-DriverCure - c:\program files\ParetoLogic\DriverCure\DriverCure.exe
HKLM-Run-spywareguard - c:\program files\Spyware Guard 2009\spywareguard.exe
HKLM-Run-Hsibafawiwi - c:\windows\enonukifaso.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-04 20:31
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
AudioDeck = c:\program files\VIA\VIAudioi\SBADeck\ADeck.exe 1????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
@DACL=(02 0000)
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
@DACL=(02 0000)
"NoChange "= "1 "
"Installed "= "1 "
@=" "

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
@DACL=(02 0000)
"Installed "= "1 "
@=" "
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2108)
c:\windows\system32\WININET.dll
c:\program files\MessengerPlus! 3\MsgPlusLoader.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\crash_report.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Bonjour\mdnsNSP.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\documents and settings\All Users\Application Data\EPSON\EPW!3 SSRP\E_S40RP7.EXE
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
c:\program files\OpenOffice.org 3\program\soffice.exe
c:\program files\OpenOffice.org 3\program\soffice.bin
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-01-04 20:37:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-05 00:37
Here is the Combo log file I ran yesterday. I thought I posted it as well as the Hijack
Pre-Run: 60,349,923,328 bytes free
Post-Run: 61,869,674,496 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Professional" /noexecute=optin /fastdetect

- - End Of File - - 49EC49D92005EC53EF7FD7D214FC745A

 

I don't remember having any redirects lately. Maybe it was fixed? I will try loading AVG again.

 

I already did AVG Can I still run Combofix as shown above? Every thing seems to be fine.

 

Haven't had any problems in a week. Thank you for your help!

 

How do I post that this problem has been resolved? It looks to me by running Combo fix fixed the problem.