Inactive IE-Only Redirect to Ask.com/qbyrd

[Inactive] IE-Only Redirect to Ask.com/qbyrd

Hello Arie, and others,
I recently went to a site which apparently was hijacked, as it used to be a reputable site, and I came across a very active popup which tried to install a program, it prompted to download it though which was strange (this was about 2 days ago). I thought I had adverted the problem (scanned with AVG, found nothing), however I tried using Internet Explorer today (use Firefox usually) and the default homepage was getting redirected to ask.com and I think I saw Qbyrd in there somewhere. I googled this problem and saw this thread and thought you would be able to help me like you did him.

I am willing to do anything and have already followed the instructions in the sticky.

Malware Bytes log

Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org

Database version: 6101

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

3/18/2011 5:50:22 PM
mbam-log-2011-03-18 (17-50-22).txt

Scan type: Quick scan
Objects scanned: 137294
Time elapsed: 2 minute(s), 19 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)


GMER Log

GMER 1.0.15.15565 - http://www.gmer.net
Rootkit quick scan 2011-03-18 17:40:18
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\0000005d WDC_WD1200JD-00GBB0 rev.02.05D02
Running: 6rhtzpl1.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\fwlcrfog.sys


---- System - GMER 1.0.15 ----

Code BA794C9C ZwRequestPort
Code BA794D3C ZwRequestWaitReplyPort
Code BA794BFC ZwTraceEvent
Code BA794C9B NtRequestPort
Code BA794D3B NtRequestWaitReplyPort
Code BA794BFB NtTraceEvent

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

---- EOF - GMER 1.0.15 ----


MBRCheck
MBRCheck, version 1.2.3
(c) 2010, AD

Command-line:
Windows Version: Windows XP Professional
Windows Information: Service Pack 3 (build 2600)
Logical Drives Mask: 0x00000005

Kernel Drivers (total 131):
0x804D7000 \WINDOWS\system32\ntkrnlpa.exe
0x806E5000 \WINDOWS\system32\hal.dll
0xBA5A8000 \WINDOWS\system32\KDCOM.DLL
0xBA4B8000 \WINDOWS\system32\BOOTVID.dll
0xB9F79000 ACPI.sys
0xBA5AA000 \WINDOWS\system32\DRIVERS\WMILIB.SYS
0xB9F68000 pci.sys
0xBA0A8000 isapnp.sys
0xBA0B8000 ohci1394.sys
0xBA0C8000 \WINDOWS\system32\DRIVERS\1394BUS.SYS
0xBA670000 pciide.sys
0xBA328000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS
0xBA0D8000 MountMgr.sys
0xB9F49000 ftdisk.sys
0xBA5AC000 dmload.sys
0xB9F23000 dmio.sys
0xBA330000 PartMgr.sys
0xBA0E8000 VolSnap.sys
0xB9F0B000 atapi.sys
0xB9EF1000 nvata.sys
0xBA0F8000 disk.sys
0xBA108000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS
0xB9ED1000 fltmgr.sys
0xB9EBF000 sr.sys
0xB9EA8000 KSecDD.sys
0xB9E1B000 Ntfs.sys
0xB9DEE000 NDIS.sys
0xB9DD4000 Mup.sys
0xBA2A8000 \SystemRoot\system32\DRIVERS\nic1394.sys
0xBA208000 \SystemRoot\system32\DRIVERS\processr.sys
0xBA4A0000 \SystemRoot\system32\DRIVERS\fdc.sys
0xBA218000 \SystemRoot\system32\DRIVERS\serial.sys
0xBA578000 \SystemRoot\system32\DRIVERS\serenum.sys
0xB9D62000 \SystemRoot\system32\DRIVERS\parport.sys
0xBA228000 \SystemRoot\system32\DRIVERS\i8042prt.sys
0xBA4A8000 \SystemRoot\system32\DRIVERS\kbdclass.sys
0xBA4B0000 \SystemRoot\system32\DRIVERS\usbohci.sys
0xB9D3E000 \SystemRoot\system32\DRIVERS\USBPORT.SYS
0xBA340000 \SystemRoot\system32\DRIVERS\usbehci.sys
0xB9D19000 \SystemRoot\system32\DRIVERS\HDAudBus.sys
0xBA238000 \SystemRoot\system32\DRIVERS\nvnetbus.sys
0xB9BFD000 \SystemRoot\system32\DRIVERS\NVNRM.SYS
0xB9646000 \SystemRoot\system32\DRIVERS\ati2mtag.sys
0xB9632000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS
0xBA779000 \SystemRoot\system32\DRIVERS\audstub.sys
0xBA278000 \SystemRoot\system32\DRIVERS\rasl2tp.sys
0xBA57C000 \SystemRoot\system32\DRIVERS\ndistapi.sys
0xB961B000 \SystemRoot\system32\DRIVERS\ndiswan.sys
0xBA288000 \SystemRoot\system32\DRIVERS\raspppoe.sys
0xBA298000 \SystemRoot\system32\DRIVERS\raspptp.sys
0xBA370000 \SystemRoot\system32\DRIVERS\TDI.SYS
0xB960A000 \SystemRoot\system32\DRIVERS\psched.sys
0xBA2B8000 \SystemRoot\system32\DRIVERS\msgpc.sys
0xBA378000 \SystemRoot\system32\DRIVERS\ptilink.sys
0xBA380000 \SystemRoot\system32\DRIVERS\raspti.sys
0xB95DA000 \SystemRoot\system32\DRIVERS\rdpdr.sys
0xBA2C8000 \SystemRoot\system32\DRIVERS\termdd.sys
0xBA388000 \SystemRoot\system32\DRIVERS\mouclass.sys
0xBA5E2000 \SystemRoot\system32\DRIVERS\swenum.sys
0xB958F000 \SystemRoot\system32\DRIVERS\ks.sys
0xB9531000 \SystemRoot\system32\DRIVERS\update.sys
0xBA598000 \SystemRoot\system32\DRIVERS\mssmbios.sys
0xB915F000 \SystemRoot\system32\drivers\RtKHDMI.sys
0xB913B000 \SystemRoot\system32\drivers\portcls.sys
0xBA2D8000 \SystemRoot\system32\drivers\drmk.sys
0xBA2E8000 \SystemRoot\System32\Drivers\NDProxy.SYS
0xBA390000 \SystemRoot\system32\DRIVERS\flpydisk.sys
0xBA138000 \SystemRoot\system32\DRIVERS\usbhub.sys
0xBA5E6000 \SystemRoot\system32\DRIVERS\USBD.SYS
0xAC964000 \SystemRoot\system32\drivers\RtkHDAud.sys
0xBA5EE000 \SystemRoot\System32\Drivers\Fs_Rec.SYS
0xBA7A5000 \SystemRoot\System32\Drivers\Null.SYS
0xBA5F0000 \SystemRoot\System32\Drivers\Beep.SYS
0xBA3A0000 \SystemRoot\System32\drivers\vga.sys
0xBA5F2000 \SystemRoot\System32\Drivers\mnmdd.SYS
0xBA5F4000 \SystemRoot\System32\DRIVERS\RDPCDD.sys
0xBA3A8000 \SystemRoot\System32\Drivers\Msfs.SYS
0xBA3B0000 \SystemRoot\System32\Drivers\Npfs.SYS
0xBA570000 \SystemRoot\system32\DRIVERS\rasacd.sys
0xAC909000 \SystemRoot\system32\DRIVERS\ipsec.sys
0xAC8B0000 \SystemRoot\system32\DRIVERS\tcpip.sys
0xAC84E000 \SystemRoot\System32\Drivers\avgtdix.sys
0xAC828000 \SystemRoot\system32\DRIVERS\ipnat.sys
0xBA178000 \SystemRoot\system32\DRIVERS\wanarp.sys
0xBA188000 \SystemRoot\system32\DRIVERS\arp1394.sys
0xAC800000 \SystemRoot\system32\DRIVERS\netbt.sys
0xAC7DE000 \SystemRoot\System32\drivers\afd.sys
0xBA198000 \SystemRoot\system32\DRIVERS\netbios.sys
0xAC713000 \SystemRoot\system32\DRIVERS\rdbss.sys
0xAC6A3000 \SystemRoot\system32\DRIVERS\mrxsmb.sys
0xBA1C8000 \SystemRoot\System32\Drivers\Fips.SYS
0xBA3B8000 \SystemRoot\System32\Drivers\avgmfx86.sys
0xAC66F000 \SystemRoot\System32\Drivers\avgldx86.sys
0xBA3C0000 \SystemRoot\System32\Drivers\LUsbFilt.Sys
0xAC78E000 \SystemRoot\System32\Drivers\WDFLDR.SYS
0xAC5FE000 \SystemRoot\System32\Drivers\wdf01000.sys
0xB95BA000 \SystemRoot\system32\DRIVERS\hidusb.sys
0xAC76E000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS
0xBA3D0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS
0xBA3D8000 \SystemRoot\system32\DRIVERS\LHidFilt.Sys
0xB95B6000 \SystemRoot\system32\DRIVERS\mouhid.sys
0xBA3E0000 \SystemRoot\system32\DRIVERS\LMouFilt.Sys
0xAC5E4000 \SystemRoot\System32\Drivers\dump_nvata.sys
0xBA602000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS
0xBF800000 \SystemRoot\System32\win32k.sys
0xAD005000 \SystemRoot\System32\drivers\Dxapi.sys
0xBA3F8000 \SystemRoot\System32\watchdog.sys
0xBF000000 \SystemRoot\System32\drivers\dxg.sys
0xBA6E3000 \SystemRoot\System32\drivers\dxgthk.sys
0xBF012000 \SystemRoot\System32\ati2dvag.dll
0xBF060000 \SystemRoot\System32\ati2cqag.dll
0xBF130000 \SystemRoot\System32\atikvmag.dll
0xBF1DF000 \SystemRoot\System32\atiok3x2.dll
0xBF256000 \SystemRoot\System32\ati3duag.dll
0xBF9C5000 \SystemRoot\System32\ativvaxx.dll
0xBF62C000 \SystemRoot\System32\ATMFD.DLL
0xA9A9F000 \SystemRoot\system32\DRIVERS\ndisuio.sys
0xA9736000 \SystemRoot\system32\drivers\wdmaud.sys
0xA9B03000 \SystemRoot\system32\drivers\sysaudio.sys
0xA91E1000 \SystemRoot\system32\DRIVERS\mrxdav.sys
0xBA62A000 \SystemRoot\System32\Drivers\ParVdm.SYS
0xBA6B7000 \SystemRoot\System32\Drivers\LBeepKE.sys
0xA9071000 \SystemRoot\system32\DRIVERS\srv.sys
0xA8F38000 \??\C:\Program Files\Sandboxie\SbieDrv.sys
0xA9B73000 \SystemRoot\system32\DRIVERS\secdrv.sys
0xA8C94000 \SystemRoot\System32\Drivers\Fastfat.SYS
0xA8B3B000 \SystemRoot\System32\Drivers\HTTP.sys
0xA87B2000 \??\C:\DOCUME~1\Owner\LOCALS~1\Temp\fwlcrfog.sys
0xA8787000 \SystemRoot\system32\drivers\kmixer.sys
0xBA158000 \SystemRoot\system32\DRIVERS\NVENETFD.sys
0x7C900000 \WINDOWS\system32\ntdll.dll

Processes (total 41):
0 System Idle Process
4 System
664 C:\WINDOWS\system32\smss.exe
716 csrss.exe
748 C:\WINDOWS\system32\winlogon.exe
796 C:\WINDOWS\system32\services.exe
808 C:\WINDOWS\system32\lsass.exe
984 C:\WINDOWS\system32\ati2evxx.exe
1016 C:\WINDOWS\system32\svchost.exe
1064 svchost.exe
1168 C:\WINDOWS\system32\svchost.exe
1288 svchost.exe
1368 svchost.exe
1492 C:\WINDOWS\system32\spoolsv.exe
1560 C:\WINDOWS\system32\ati2evxx.exe
1572 C:\Program Files\AVG\AVG9\avgchsvx.exe
1580 C:\Program Files\AVG\AVG9\avgrsx.exe
1684 C:\Program Files\AVG\AVG9\avgcsrvx.exe
1908 C:\WINDOWS\explorer.exe
548 C:\PROGRA~1\AVG\AVG9\avgtray.exe
560 C:\Program Files\Logitech\SetPointP\SetPoint.exe
572 C:\Program Files\iTunes\iTunesHelper.exe
628 C:\Program Files\VIA\VIAudioi\EnvyADeck\EnMixCPL.exe
640 C:\WINDOWS\RTHDCPL.EXE
692 C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
812 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
1452 C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
2144 svchost.exe
2304 C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
2332 C:\Program Files\AVG\AVG9\avgwdsvc.exe
2564 C:\WINDOWS\system32\PnkBstrA.exe
2776 C:\Program Files\Sandboxie\SbieSvc.exe
2908 C:\WINDOWS\system32\svchost.exe
3376 C:\Program Files\iPod\bin\iPodService.exe
3576 C:\Program Files\AVG\AVG9\avgnsx.exe
4076 alg.exe
3164 C:\WINDOWS\system32\svchost.exe
2276 C:\Program Files\Mozilla Firefox\firefox.exe
568 C:\Program Files\Mozilla Firefox\plugin-container.exe
3648 C:\Documents and Settings\Owner\Desktop\6rhtzpl1.exe
772 C:\Documents and Settings\Owner\Desktop\MBRCheck.exe

\\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS)

PhysicalDrive0 Model Number: WDCWD1200JD-00GBB0, Rev: 02.05D02

Size Device Name MBR Status
--------------------------------------------
111 GB \\.\PhysicalDrive0 Windows XP MBR code detected
SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A


Done!

DDS


DDS.txt

DDS (Ver_11-03-05.01) - NTFSx86
Run by Owner at 17:43:46.60 on Fri 03/18/2011
Internet Explorer: 6.0.2900.5512
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3583.2888 [GMT -5:00]
.
AV: AVG Anti-Virus Free *Enabled/Updated* {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG9\avgtray.exe
C:\Program Files\Logitech\SetPointP\SetPoint.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\VIA\VIAudioi\EnvyADeck\EnMixCPL.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Sandboxie\SbieSvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\plugin-container.exe
C:\Documents and Settings\Owner\Desktop\6rhtzpl1.exe
C:\Documents and Settings\Owner\Desktop\dds.scr
.
============== Pseudo HJT Report ===============
.
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
TB: {D4027C7F-154A-4066-A1AD-4243D8127440} - No File
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRun: [EvtMgr6] c:\program files\logitech\setpointp\SetPoint.exe /launchGaming
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
mRun: [EnvyHFCPL] c:\program files\via\viaudioi\envyadeck\EnMixCPL.exe 1
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe" MSRun
mRun: [RTHDCPL] RTHDCPL.EXE
dRunOnce: [nltide3] cmd.exe /C rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Notify: AtiExtEvent - Ati2evxx.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\docume~1\owner\applic~1\mozilla\firefox\profiles\qjvot4n3.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - component: c:\program files\avg\avg9\firefox\components\avgssff.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: AVG Safe Search: {3f963a5b-e555-4543-90e2-c3908898db71} - c:\program files\avg\avg9\Firefox
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
.
============= SERVICES / DRIVERS ===============
.
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-3-13 216400]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-3-13 29584]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-3-13 243024]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-7-15 308136]
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-7-22 10448]
R3 SbieDrv;SbieDrv;c:\program files\sandboxie\SbieDrv.sys [2010-10-17 124648]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2011-3-11 1691480]
S3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;c:\windows\system32\drivers\Envy24HF.sys [2010-12-3 673600]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
.
=============== Created Last 30 ================
.
2011-03-18 21:45:56 -------- d-----w- c:\docume~1\owner\applic~1\Malwarebytes
2011-03-18 21:45:48 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-18 21:45:47 -------- d-----w- c:\docume~1\alluse~1\applic~1\Malwarebytes
2011-03-18 21:45:45 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-18 21:45:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-18 21:42:09 -------- d-----w- c:\windows\system32\wbem\repository\FS
2011-03-18 21:42:09 -------- d-----w- c:\windows\system32\wbem\Repository
2011-03-17 01:09:45 270848 -c----w- c:\windows\system32\dllcache\sbe.dll
2011-03-17 01:09:42 2067456 -c----w- c:\windows\system32\dllcache\lhmstscx.dll
2011-03-15 13:33:55 -------- d-----w- c:\docume~1\alluse~1\applic~1\Common Files
2011-03-11 08:08:02 -------- d-----w- c:\windows\system32\Lang
2011-03-04 21:04:17 -------- d-----w- c:\program files\MSECache
2011-02-23 15:05:08 -------- d-----w- c:\docume~1\owner\applic~1\Auslogics
2011-02-23 15:05:04 -------- d-----w- c:\program files\Auslogics
.
==================== Find3M ====================
.
2011-02-09 13:53:52 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53:52 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58:35 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57:06 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44:37 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09:02 290048 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 03:13:02 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-01-05 03:12:52 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-01-05 03:11:42 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2011-01-05 03:11:14 17084416 ----a-w- c:\windows\system32\atioglxx.dll
2011-01-05 03:00:30 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-01-05 02:59:24 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2011-01-05 02:53:36 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-01-05 02:53:16 4021984 ----a-w- c:\windows\system32\ati3duag.dll
2011-01-05 02:46:12 1112576 ----a-w- c:\windows\system32\ativvamv.dll
2011-01-05 02:39:46 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-01-05 02:39:32 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-01-05 02:39:22 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-01-05 02:39:14 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-01-05 02:39:02 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-01-05 02:37:32 638976 ----a-w- c:\windows\system32\ati2evxx.exe
2011-01-05 02:36:54 2670464 ----a-w- c:\windows\system32\ativvaxx.dll
2011-01-05 02:36:00 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-01-05 02:35:12 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2011-01-05 02:31:10 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-01-05 02:29:18 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2011-01-05 02:28:52 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-01-05 02:28:18 471040 ----a-w- c:\windows\system32\atiok3x2.dll
2011-01-05 02:22:50 851968 ----a-w- c:\windows\system32\ati2cqag.dll
2011-01-05 02:20:56 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-01-05 02:20:56 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2010-12-31 13:10:33 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34:28 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 22:15:52 667136 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 22:15:52 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-12-20 22:15:51 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-12-20 17:26:00 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 15:30:29 369664 ----a-w- c:\windows\system32\html.iec
.
============= FINISH: 17:44:13.79 ===============


Attach.txt

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_11-03-05.01)
.
Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume1
Install Date: 2/24/2010 2:05:29 AM
System Uptime: 3/18/2011 5:28:59 PM (0 hours ago)
.
Motherboard: Gigabyte Technology Co., Ltd. | | M61P-S3
Processor: AMD Athlon(tm) 64 X2 Dual Core Processor 3600+ | Socket M2 | 2369/250mhz
.
==== Disk Partitions =========================
.
A: is Removable
C: is FIXED (NTFS) - 112 GiB total, 39.527 GiB free.
.
==== Disabled Device Manager Items =============
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Multimedia Video Controller
Device ID: PCI\VEN_14F1&DEV_8800&SUBSYS_00F91002&REV_05\4&72ACDAA&0&3820
Manufacturer:
Name: Multimedia Video Controller
PNP Device ID: PCI\VEN_14F1&DEV_8800&SUBSYS_00F91002&REV_05\4&72ACDAA&0&3820
Service:
.
Class GUID: {4D36E96C-E325-11CE-BFC1-08002BE10318}
Description: Envy24 Family Audio Controller WDM
Device ID: PCI\VEN_1412&DEV_1724&SUBSYS_17241412&REV_01\4&72ACDAA&0&4820
Manufacturer: VIA - IC Ensemble, Inc.
Name: Envy24 Family Audio Controller WDM
PNP Device ID: PCI\VEN_1412&DEV_1724&SUBSYS_17241412&REV_01\4&72ACDAA&0&4820
Service: Envy24HFS
.
==== System Restore Points ===================
.
RP327: 1/23/2011 4:32:50 PM - System Checkpoint
RP328: 1/25/2011 1:01:30 PM - System Checkpoint
RP329: 1/26/2011 10:35:14 PM - System Checkpoint
RP330: 1/27/2011 11:13:06 PM - System Checkpoint
RP331: 1/30/2011 2:44:54 PM - System Checkpoint
RP332: 2/1/2011 6:11:11 PM - System Checkpoint
RP333: 2/3/2011 6:38:14 AM - System Checkpoint
RP334: 2/4/2011 7:16:03 AM - System Checkpoint
RP335: 2/5/2011 8:14:57 AM - System Checkpoint
RP336: 2/6/2011 8:55:03 AM - System Checkpoint
RP337: 2/8/2011 3:27:22 AM - System Checkpoint
RP338: 2/9/2011 7:13:13 AM - System Checkpoint
RP339: 2/10/2011 3:00:16 AM - Software Distribution Service 3.0
RP340: 2/11/2011 3:03:29 AM - System Checkpoint
RP341: 2/12/2011 6:52:40 AM - System Checkpoint
RP342: 2/13/2011 7:03:29 AM - System Checkpoint
RP343: 2/14/2011 3:00:14 AM - Software Distribution Service 3.0
RP344: 2/15/2011 5:28:51 AM - System Checkpoint
RP345: 2/17/2011 5:27:46 AM - System Checkpoint
RP346: 2/18/2011 7:30:24 AM - System Checkpoint
RP347: 2/20/2011 9:04:25 AM - System Checkpoint
RP348: 2/21/2011 10:23:02 AM - System Checkpoint
RP349: 2/22/2011 10:57:55 AM - System Checkpoint
RP350: 2/23/2011 2:20:46 PM - System Checkpoint
RP351: 2/24/2011 3:16:01 PM - System Checkpoint
RP352: 2/26/2011 7:37:23 AM - System Checkpoint
RP353: 2/27/2011 7:09:50 PM - System Checkpoint
RP354: 3/1/2011 2:33:32 AM - System Checkpoint
RP355: 3/2/2011 3:00:05 AM - System Checkpoint
RP356: 3/3/2011 4:09:10 PM - System Checkpoint
RP357: 3/4/2011 3:04:39 PM - Installed Microsoft Office Excel Viewer
RP358: 3/4/2011 3:08:12 PM - Removed Call of Duty(R) 4 - Modern Warfare(TM)
RP359: 3/6/2011 3:50:08 AM - System Checkpoint
RP360: 3/7/2011 3:00:15 AM - Software Distribution Service 3.0
RP361: 3/7/2011 9:16:47 AM - Avg Update
RP362: 3/8/2011 9:36:22 AM - System Checkpoint
RP363: 3/9/2011 10:36:23 AM - System Checkpoint
RP364: 3/10/2011 11:36:23 AM - System Checkpoint
RP365: 3/11/2011 1:09:28 AM - Installed Platform
RP366: 3/11/2011 2:04:11 AM - Installed Realtek High Definition Audio Driver
RP367: 3/12/2011 6:23:54 AM - System Checkpoint
RP368: 3/13/2011 8:11:33 AM - System Checkpoint
RP369: 3/14/2011 9:11:33 AM - System Checkpoint
RP370: 3/15/2011 8:32:16 AM - Avg Update
RP371: 3/15/2011 8:33:32 AM - Avg Update
RP372: 3/15/2011 8:34:26 AM - Avg Update
RP373: 3/16/2011 9:11:23 AM - System Checkpoint
RP374: 3/16/2011 8:10:09 PM - Software Distribution Service 3.0
RP375: 3/18/2011 7:56:07 AM - System Checkpoint
RP376: 3/18/2011 4:38:16 PM - Software Distribution Service 3.0
RP377: 3/18/2011 4:41:06 PM - Restore Operation
RP378: 3/18/2011 4:46:03 PM - Software Distribution Service 3.0
RP379: 3/18/2011 4:52:10 PM - Avg Update
RP380: 3/18/2011 5:26:12 PM - Removed Bonjour
.
==== Installed Programs ======================
.
Acrobat.com
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9.4.1
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Install Manager
Auslogics Disk Defrag
AVG Free 9.0
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
ccc-core-static
ccc-utility
CCC Help English
eReg
foobar2000 v1.0
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB979306)
iTunes
League of Legends
Logitech Harmony Remote Software 7
Logitech SetPoint 6.15
Malwarebytes' Anti-Malware
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
Microsoft Office Excel Viewer
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Mozilla Firefox (3.6.15)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 6 Service Pack 2 (KB973686)
NVIDIA Drivers
Platform
QuickTime
Realtek HDMI Audio Driver for ATI
Realtek High Definition Audio Driver
Remote Control USB Driver
Sandboxie 3.50
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
Security Update for Microsoft .NET Framework 4 Extended (KB2416472)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2183461)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360131)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2416400)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2482017)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981349)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Software Update for Web Folders
UnInstall Envy24 Family Audio Device Driver
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Update for Windows XP (KB978207)
Ventrilo Client
VIA Platform Device Manager
WebFldrs XP
Windows Imaging Component
Windows XP Service Pack 3
WinRAR archiver
World of Warcraft
World of Warcraft Public Test
Xfire (remove only)
.
==== Event Viewer Messages From Past Week ========
.
3/18/2011 5:27:33 PM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
3/18/2011 5:27:33 PM, error: Service Control Manager [7031] - The AVG Free WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
3/18/2011 5:27:32 PM, error: Service Control Manager [7034] - The Sandboxie Service service terminated unexpectedly. It has done this 1 time(s).
3/18/2011 5:27:32 PM, error: Service Control Manager [7034] - The PnkBstrA service terminated unexpectedly. It has done this 1 time(s).
3/18/2011 5:27:32 PM, error: Service Control Manager [7034] - The Ati HotKey Poller service terminated unexpectedly. It has done this 1 time(s).
3/18/2011 5:27:32 PM, error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
3/18/2011 5:06:46 PM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
.
==== End Of File ===========================




Thanks Arie and Friends, hope I did it right.

 

I installed Appremover, uninstalled AVG with it, rebooted, ran combofix. The IE address is set to this for the homepage however instead of the ask.com redirects and Qbyrd stuff, it's just a Page Cannot Be Displayed. I don't have access to another computer at my house, but is that link working? However even if it didn't work, it wouldn't have redirected me to ask.com or the Qbyrd junk this morning. Kinda confused.

However here is the combofix log, sorry for the code tags, thought it would look cleaner, and maybe be more helpful.

ComboFix 11-03-18.01 - Owner 03/18/2011 19:49:43.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3583.3130 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
.
.
((((((((((((((((((((((((( Files Created from 2011-02-19 to 2011-03-19 )))))))))))))))))))))))))))))))
.
.
2011-03-18 21:45 . 2011-03-18 21:45 -------- d-----w- c:\documents and settings\Owner\Application Data\Malwarebytes
2011-03-18 21:45 . 2010-12-20 23:09 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2011-03-18 21:45 . 2011-03-18 21:45 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2011-03-18 21:45 . 2011-03-18 21:45 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2011-03-18 21:45 . 2010-12-20 23:08 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2011-03-18 21:42 . 2011-03-18 21:42 -------- d-----w- c:\windows\system32\wbem\Repository
2011-03-17 01:09 . 2011-02-09 13:53 270848 -c----w- c:\windows\system32\dllcache\sbe.dll
2011-03-17 01:09 . 2011-02-02 07:58 2067456 -c----w- c:\windows\system32\dllcache\lhmstscx.dll
2011-03-15 13:33 . 2011-03-18 21:50 -------- d-----w- c:\documents and settings\All Users\Application Data\Common Files
2011-03-11 08:08 . 2011-03-11 08:08 -------- d-----w- c:\windows\system32\Lang
2011-03-04 21:04 . 2011-03-04 21:04 -------- d-----w- c:\program files\MSECache
2011-02-23 15:05 . 2011-02-23 15:05 -------- d-----w- c:\documents and settings\Owner\Application Data\Auslogics
2011-02-23 15:05 . 2011-02-23 15:05 -------- d-----w- c:\program files\Auslogics
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2011-02-09 13:53 . 2004-08-03 21:56 270848 ----a-w- c:\windows\system32\sbe.dll
2011-02-09 13:53 . 2004-08-03 21:56 186880 ----a-w- c:\windows\system32\encdec.dll
2011-02-02 07:58 . 2010-02-24 07:59 2067456 ----a-w- c:\windows\system32\mstscax.dll
2011-01-27 11:57 . 2010-02-24 07:59 677888 ----a-w- c:\windows\system32\mstsc.exe
2011-01-21 14:44 . 2004-08-03 21:56 439296 ----a-w- c:\windows\system32\shimgvw.dll
2011-01-07 14:09 . 2004-08-03 21:56 290048 ----a-w- c:\windows\system32\atmfd.dll
2011-01-05 03:34 . 2010-02-24 08:16 5656576 ----a-w- c:\windows\system32\drivers\ati2mtag.sys
2011-01-05 03:13 . 2010-02-24 08:16 57344 ----a-w- c:\windows\system32\aticalrt.dll
2011-01-05 03:12 . 2010-02-24 08:16 53248 ----a-w- c:\windows\system32\aticalcl.dll
2011-01-05 03:11 . 2010-02-24 08:16 4489216 ----a-w- c:\windows\system32\aticaldd.dll
2011-01-05 03:11 . 2010-02-24 08:16 17084416 ----a-w- c:\windows\system32\atioglxx.dll
2011-01-05 03:00 . 2010-02-24 08:16 462848 ----a-w- c:\windows\system32\ATIDEMGX.dll
2011-01-05 02:59 . 2010-02-24 08:16 302080 ----a-w- c:\windows\system32\ati2dvag.dll
2011-01-05 02:53 . 2010-02-24 08:16 311296 ----a-w- c:\windows\system32\atiiiexx.dll
2011-01-05 02:53 . 2010-02-24 08:16 4021984 ----a-w- c:\windows\system32\ati3duag.dll
2011-01-05 02:46 . 2011-02-03 09:04 1112576 ----a-w- c:\windows\system32\ativvamv.dll
2011-01-05 02:39 . 2010-02-24 08:16 212992 ----a-w- c:\windows\system32\atipdlxx.dll
2011-01-05 02:39 . 2010-02-24 08:16 155648 ----a-w- c:\windows\system32\Oemdspif.dll
2011-01-05 02:39 . 2010-02-24 08:16 26112 ----a-w- c:\windows\system32\Ati2mdxx.exe
2011-01-05 02:39 . 2010-02-24 08:16 43520 ----a-w- c:\windows\system32\ati2edxx.dll
2011-01-05 02:39 . 2010-02-24 08:16 188416 ----a-w- c:\windows\system32\ati2evxx.dll
2011-01-05 02:37 . 2010-02-24 08:16 638976 ----a-w- c:\windows\system32\ati2evxx.exe
2011-01-05 02:36 . 2010-02-24 08:16 2670464 ----a-w- c:\windows\system32\ativvaxx.dll
2011-01-05 02:36 . 2010-02-24 08:16 53248 ----a-w- c:\windows\system32\ATIDDC.DLL
2011-01-05 02:35 . 2010-02-24 08:16 143360 ----a-w- c:\windows\system32\atiapfxx.exe
2011-01-05 02:31 . 2010-02-24 08:16 651264 ----a-w- c:\windows\system32\atikvmag.dll
2011-01-05 02:29 . 2010-02-24 08:16 196608 ----a-w- c:\windows\system32\atiadlxx.dll
2011-01-05 02:28 . 2010-02-24 08:16 17408 ----a-w- c:\windows\system32\atitvo32.dll
2011-01-05 02:28 . 2010-02-24 08:16 471040 ----a-w- c:\windows\system32\atiok3x2.dll
2011-01-05 02:22 . 2010-02-24 08:16 851968 ----a-w- c:\windows\system32\ati2cqag.dll
2011-01-05 02:20 . 2010-02-24 08:16 64512 ----a-w- c:\windows\system32\atimpc32.dll
2011-01-05 02:20 . 2010-02-24 08:16 64512 ----a-w- c:\windows\system32\amdpcom32.dll
2011-01-05 02:19 . 2010-02-24 08:16 53248 ----a-w- c:\windows\system32\drivers\ati2erec.dll
2010-12-31 13:10 . 2006-11-20 06:50 1854976 ----a-w- c:\windows\system32\win32k.sys
2010-12-22 12:34 . 2006-11-20 06:48 301568 ----a-w- c:\windows\system32\kerberos.dll
2010-12-20 22:15 . 2006-11-20 06:50 667136 ----a-w- c:\windows\system32\wininet.dll
2010-12-20 22:15 . 2004-08-03 19:59 61952 ----a-w- c:\windows\system32\tdc.ocx
2010-12-20 22:15 . 2004-08-03 21:56 81920 ----a-w- c:\windows\system32\ieencode.dll
2010-12-20 17:26 . 2006-11-20 06:48 730112 ----a-w- c:\windows\system32\lsasrv.dll
2010-12-20 15:30 . 2004-08-03 19:59 369664 ----a-w- c:\windows\system32\html.iec
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EvtMgr6 "= "c:\program files\Logitech\SetPointP\SetPoint.exe" [2010-06-26 1311312]
"QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-09-23 35760]
"Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 932288]
"iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2010-11-11 421160]
"EnvyHFCPL "= "c:\program files\VIA\VIAudioi\EnvyADeck\EnMixCPL.exe" [2009-08-21 532480]
"StartCCC "= "c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-01-05 98304]
"RTHDCPL "= "RTHDCPL.EXE" [2010-11-02 19580520]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
2010-05-06 09:29 64592 ----a-w- c:\program files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@= "Driver "
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride "=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe "=
"%windir%\\system32\\sessmgr.exe "=
"c:\\Program Files\\Ventrilo\\Ventrilo.exe "=
"c:\\WINDOWS\\system32\\PnkBstrA.exe "=
"c:\\WINDOWS\\system32\\PnkBstrB.exe "=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.3.0.10522-enUS-ptr-downloader.exe "=
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe "=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe "=
"c:\\Program Files\\Xfire\\Xfire.exe "=
"c:\\Program Files\\World of Warcraft\\Launcher.exe "=
"c:\\Program Files\\Logitech\\Logitech Harmony Remote Software 7\\HarmonyRemote.exe "=
"c:\\Riot Games\\League of Legends\\air\\LolClient.exe "=
"c:\\Riot Games\\League of Legends\\game\\League of Legends.exe "=
"c:\\Program Files\\World of Warcraft\\Blizzard Downloader.exe "=
"c:\\Program Files\\iTunes\\iTunes.exe "=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3724:TCP "= 3724:TCP:Blizzard Downloader: 3724
"8380:TCP "= 8380:TCP:League of Legends Launcher
"8380:UDP "= 8380:UDP:League of Legends Launcher
"6969:TCP "= 6969:TCP:League of Legends Launcher
"6969:UDP "= 6969:UDP:League of Legends Launcher
"8381:TCP "= 8381:TCP:League of Legends Launcher
"8381:UDP "= 8381:UDP:League of Legends Launcher
"6964:TCP "= 6964:TCP:League of Legends Launcher
"6964:UDP "= 6964:UDP:League of Legends Launcher
"6899:TCP "= 6899:TCP:League of Legends Launcher
"6899:UDP "= 6899:UDP:League of Legends Launcher
.
R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [7/22/2010 1:22 AM 10448]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 2:16 PM 130384]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [3/11/2011 3:04 AM 1691480]
S3 Envy24HFS;ICE Envy24 Family Audio Controller WDM;c:\windows\system32\drivers\Envy24HF.sys [12/3/2010 7:13 AM 673600]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 2:16 PM 753504]
.
.
------- Supplementary Scan -------
.
FF - ProfilePath - c:\documents and settings\Owner\Application Data\Mozilla\Firefox\Profiles\qjvot4n3.default\
FF - prefs.js: keyword.URL - hxxp://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q=
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Adblock Plus: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} - %profile%\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
- - - - ORPHANS REMOVED - - - -
.
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKU-Default-RunOnce-nltide3 - rundll32 advpack.dll
Notify-avgrsstarter - (no file)
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2011-03-18 19:53
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
EnvyHFCPL = c:\program files\VIA\VIAudioi\EnvyADeck\EnMixCPL.exe 1?????????????????????????????????????????????????????
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
.
- - - - - - - > 'winlogon.exe'(724)
c:\windows\system32\Ati2evxx.dll
c:\windows\system32\atiadlxx.dll
c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
.
Completion time: 2011-03-18 19:55:14
ComboFix-quarantined-files.txt 2011-03-19 00:55
.
Pre-Run: 42,777,243,648 bytes free
Post-Run: 42,769,117,184 bytes free
.
- - End Of File - - F223B04DD3ECDCFBB28846D89B9E559F






Thanks for the help in advance )

 

OTL logfile created on: 3/18/2011 9:50:51 PM - Run 2
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Owner\Desktop
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 85.00% Memory free
5.00 Gb Paging File | 5.00 Gb Available in Paging File | 94.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 111.78 Gb Total Space | 39.74 Gb Free Space | 35.55% Space Free | Partition Type: NTFS

Computer Name: OWNER-07008EBA8 | User Name: Owner | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/03/18 17:04:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
PRC - [2010/10/17 17:42:38 | 000,075,496 | ---- | M] (SANDBOXIE L.T.D) -- C:\Program Files\Sandboxie\SbieSvc.exe
PRC - [2010/06/25 19:15:32 | 001,311,312 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Logitech\SetPointP\SetPoint.exe
PRC - [2010/06/22 14:09:20 | 000,112,208 | ---- | M] (Logitech, Inc.) -- C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.exe
PRC - [2009/08/21 17:07:00 | 000,532,480 | ---- | M] (VIA TECH) -- C:\Program Files\VIA\VIAudioi\EnvyADeck\EnMixCPL.exe
PRC - [2008/04/13 19:12:19 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/03/18 17:04:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
MOD - [2010/08/23 11:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- -- (HidServ)
SRV - [2010/10/17 17:42:38 | 000,075,496 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2010/05/06 04:29:12 | 000,293,456 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ)
SRV - [2005/10/06 19:12:30 | 000,855,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Media Connect 2\wmccds.exe -- (WMConnectCDS)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Running] -- -- (catchme)
DRV - [2011/01/04 22:34:28 | 005,656,576 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2010/11/02 06:36:26 | 006,188,648 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2010/10/17 17:42:34 | 000,124,648 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2010/05/24 22:09:28 | 004,003,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtKHDMI.sys -- (RTHDMIAzAudService)
DRV - [2010/03/26 14:07:02 | 000,032,768 | ---- | M] (AnchorFree Inc) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\taphss.sys -- (taphss)
DRV - [2010/03/18 04:02:32 | 000,028,624 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LUsbFilt.sys -- (LUsbFilt)
DRV - [2010/03/18 04:02:08 | 000,037,328 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LMouFilt.Sys -- (LMouFilt)
DRV - [2010/03/18 04:01:52 | 000,038,864 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\LHidFilt.Sys -- (LHidFilt)
DRV - [2010/03/18 04:01:12 | 000,010,448 | ---- | M] (Logitech, Inc.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\LBeepKE.sys -- (LBeepKE)
DRV - [2009/11/17 18:17:00 | 001,395,800 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2009/11/17 18:16:00 | 001,691,480 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2008/06/04 18:29:00 | 000,673,600 | ---- | M] (VIA - IC Ensemble, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Envy24HF.sys -- (Envy24HFS)
DRV - [2006/08/14 15:51:28 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata)
DRV - [2006/07/11 08:38:30 | 000,020,480 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus)
DRV - [2006/07/11 08:38:28 | 000,057,856 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes

IE - HKU\S-1-5-21-1390067357-1767777339-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,AlwaysUseDefaultPrinter = yes
IE - HKU\S-1-5-21-1390067357-1767777339-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3
FF - prefs.js..keyword.URL: "http://www.google.com/search?ie=UTF-8&oe=UTF-8&sourceid=navclient&gfns=1&q= "

FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/05 16:38:56 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.15\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/05 16:38:56 | 000,000,000 | ---D | M]

[2010/02/24 03:23:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Extensions
[2011/03/18 21:07:03 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\qjvot4n3.default\extensions
[2011/01/05 12:53:07 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\qjvot4n3.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2011/01/05 12:53:07 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Owner\Application Data\Mozilla\Firefox\Profiles\qjvot4n3.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010/02/24 03:23:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010/10/06 03:00:24 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION

O1 HOSTS File: ([2001/08/23 05:00:00 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O4 - HKLM..\Run: [EnvyHFCPL] C:\Program Files\VIA\VIAudioi\EnvyADeck\EnMixCPL.exe (VIA TECH)
O4 - HKLM..\Run: [EvtMgr6] C:\Program Files\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1390067357-1767777339-682003330-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-1390067357-1767777339-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-1390067357-1767777339-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-1390067357-1767777339-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O20 - Winlogon\Notify\LBTWlgn: DllName - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll - c:\Program Files\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.)
O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010/02/24 03:03:41 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

NetSvcs: 6to4 - File not found
NetSvcs: HidServ - File not found
NetSvcs: Ias - File not found
NetSvcs: Iprip - File not found
NetSvcs: Irmon - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: WmdmPmSp - File not found

Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
Drivers32: VIDC.XFR1 - C:\WINDOWS\System32\xfcodec.dll ()

CREATERESTOREPOINT
Restore point Set: OTL Restore Point (16902109354000384)

========== Files/Folders - Created Within 30 Days ==========

[2011/03/18 20:13:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Local Settings\Application Data\PMB Files
[2011/03/18 20:13:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2011/03/18 19:55:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp
[2011/03/18 19:47:47 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2011/03/18 19:45:19 | 000,000,000 | RHSD | C] -- C:\cmdcons
[2011/03/18 19:44:10 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe
[2011/03/18 19:44:10 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe
[2011/03/18 19:44:10 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe
[2011/03/18 19:44:10 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe
[2011/03/18 19:44:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/03/18 19:40:41 | 006,225,384 | ---- | C] (OPSWAT, Inc.) -- C:\Documents and Settings\Owner\Desktop\AppRemover.exe
[2011/03/18 19:38:08 | 000,000,000 | ---D | C] -- C:\Qoobox
[2011/03/18 17:27:11 | 000,446,464 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\TFC.exe
[2011/03/18 17:04:10 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/03/18 16:45:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Malwarebytes
[2011/03/18 16:45:48 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2011/03/18 16:45:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Malwarebytes' Anti-Malware
[2011/03/18 16:45:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/03/18 16:45:45 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2011/03/18 16:45:45 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011/03/18 16:45:14 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2011/03/18 16:41:41 | 000,000,000 | ---D | C] -- C:\Config.Msi
[2011/03/15 08:33:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/03/11 03:08:02 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Lang
[2011/03/11 03:04:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RTCOM
[2011/03/11 03:04:20 | 000,359,016 | ---- | C] (Realtek Semiconductor Crop.) -- C:\WINDOWS\vncutil.exe
[2011/03/11 03:04:16 | 000,129,640 | ---- | C] (Realtek Semiconductor) -- C:\WINDOWS\RtkAudioService.exe
[2011/03/11 03:04:11 | 002,815,592 | ---- | C] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE
[2011/03/11 03:04:11 | 001,691,480 | ---- | C] (Creative) -- C:\WINDOWS\System32\drivers\Ambfilt.sys
[2011/03/11 03:04:11 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek
[2011/03/11 03:03:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\HD_Audio
[2011/03/04 16:04:42 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Office
[2011/03/04 16:04:17 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache
[2011/02/23 10:05:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Application Data\Auslogics
[2011/02/23 10:05:04 | 000,000,000 | ---D | C] -- C:\Program Files\Auslogics
[2011/02/23 10:05:04 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Auslogics
[2011/02/23 10:04:14 | 004,646,264 | ---- | C] (Auslogics Software Pty Ltd ) -- C:\Documents and Settings\Owner\Desktop\disk-defrag-setup.exe
[2011/02/17 05:17:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Owner\Desktop\Leatrix Latency Fix 1.23
[2010/12/03 07:13:47 | 000,254,000 | ---- | C] ( ) -- C:\WINDOWS\System32\Audio3D.dll
[2010/02/24 03:37:02 | 000,254,000 | ---- | C] ( ) -- C:\WINDOWS\System32\A3D.dll

========== Files - Modified Within 30 Days ==========

[2011/03/18 20:13:30 | 002,257,408 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\LeagueofLegends.exe
[2011/03/18 19:47:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/03/18 19:45:24 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2011/03/18 19:40:47 | 006,225,384 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Owner\Desktop\AppRemover.exe
[2011/03/18 19:33:34 | 004,290,189 | R--- | M] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/03/18 17:43:36 | 000,625,664 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/03/18 17:42:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\MBRCheck.exe
[2011/03/18 17:35:40 | 000,301,568 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\6rhtzpl1.exe
[2011/03/18 17:27:11 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\TFC.exe
[2011/03/18 17:04:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/03/18 16:47:34 | 000,000,584 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2011/03/18 16:45:48 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/18 16:45:16 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2011/03/18 16:45:06 | 000,458,162 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2011/03/18 16:45:06 | 000,076,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2011/03/18 16:43:28 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/03/12 06:51:55 | 000,350,166 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\sinswow.JPG
[2011/03/11 03:08:03 | 000,940,794 | ---- | M] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2011/03/11 03:08:03 | 000,146,650 | ---- | M] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2011/03/11 02:58:27 | 070,836,585 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\motherboard_driver_audio_realtek_azalia.exe
[2011/03/07 13:48:04 | 000,581,295 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\DBM-4.74-r5279-Core-and-Cataclysm-Mods.zip
[2011/03/06 04:28:48 | 000,117,360 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2011/03/04 23:50:45 | 000,151,630 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ArchaeologyHelper0.91.zip
[2011/03/03 18:57:25 | 000,004,096 | ---- | M] () -- C:\WINDOWS\System32\crash
[2011/02/25 16:54:37 | 000,109,232 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\ErrorMonster-r88.zip
[2011/02/23 10:04:14 | 004,646,264 | ---- | M] (Auslogics Software Pty Ltd ) -- C:\Documents and Settings\Owner\Desktop\disk-defrag-setup.exe
[2011/02/18 00:21:00 | 000,573,725 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\DBM-svn-4.73-r5206-alpha.zip
[2011/02/18 00:20:14 | 000,220,397 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\v2.64.zip
[2011/02/18 00:19:49 | 003,328,758 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\AuctioneerSuite-5.9.4961.zip
[2011/02/18 00:19:11 | 000,359,261 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Recount-v4.0.1e_release.zip
[2011/02/18 00:18:44 | 000,718,423 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\XPerl-3.1.2_Release.zip
[2011/02/18 00:17:53 | 000,148,848 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\GridStatusRaidDebuff-r290.zip
[2011/02/18 00:17:34 | 000,327,863 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Grid-1.40000.1403.zip
[2011/02/17 05:17:32 | 000,006,132 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\Leatrix Latency Fix 1.23.zip

========== Files Created - No Company Name ==========

[2011/03/18 20:13:30 | 002,257,408 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\LeagueofLegends.exe
[2011/03/18 19:45:24 | 000,000,211 | ---- | C] () -- C:\Boot.bak
[2011/03/18 19:45:20 | 000,260,272 | RHS- | C] () -- C:\cmldr
[2011/03/18 19:44:10 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe
[2011/03/18 19:44:10 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe
[2011/03/18 19:44:10 | 000,089,088 | ---- | C] () -- C:\WINDOWS\MBR.exe
[2011/03/18 19:44:10 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe
[2011/03/18 19:44:10 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe
[2011/03/18 19:33:30 | 004,290,189 | R--- | C] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/03/18 17:43:34 | 000,625,664 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\dds.scr
[2011/03/18 17:42:20 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\MBRCheck.exe
[2011/03/18 17:35:40 | 000,301,568 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\6rhtzpl1.exe
[2011/03/18 16:45:48 | 000,000,784 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
[2011/03/16 20:09:45 | 000,270,848 | ---- | C] () -- C:\WINDOWS\System32\dllcache\sbe.dll
[2011/03/12 06:51:55 | 000,350,166 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\sinswow.JPG
[2011/03/11 03:08:03 | 000,940,794 | ---- | C] () -- C:\WINDOWS\System32\LoopyMusic.wav
[2011/03/11 03:08:03 | 000,146,650 | ---- | C] () -- C:\WINDOWS\System32\BuzzingBee.wav
[2011/03/11 02:54:19 | 070,836,585 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\motherboard_driver_audio_realtek_azalia.exe
[2011/03/11 02:09:52 | 000,000,938 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Envy24HF AudioDeck Control Panel.lnk
[2011/03/07 13:48:03 | 000,581,295 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\DBM-4.74-r5279-Core-and-Cataclysm-Mods.zip
[2011/03/04 23:50:45 | 000,151,630 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ArchaeologyHelper0.91.zip
[2011/03/04 16:04:50 | 000,001,904 | ---- | C] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Microsoft Office Excel Viewer.lnk
[2011/02/25 16:54:37 | 000,109,232 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\ErrorMonster-r88.zip
[2011/02/18 00:21:00 | 000,573,725 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\DBM-svn-4.73-r5206-alpha.zip
[2011/02/18 00:20:14 | 000,220,397 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\v2.64.zip
[2011/02/18 00:19:47 | 003,328,758 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\AuctioneerSuite-5.9.4961.zip
[2011/02/18 00:19:11 | 000,359,261 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Recount-v4.0.1e_release.zip
[2011/02/18 00:18:44 | 000,718,423 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\XPerl-3.1.2_Release.zip
[2011/02/18 00:17:53 | 000,148,848 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\GridStatusRaidDebuff-r290.zip
[2011/02/18 00:17:33 | 000,327,863 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Grid-1.40000.1403.zip
[2011/02/17 05:17:32 | 000,006,132 | ---- | C] () -- C:\Documents and Settings\Owner\Desktop\Leatrix Latency Fix 1.23.zip
[2011/02/13 21:46:39 | 000,073,758 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-S-1-5-21-1390067357-1767777339-682003330-1003-0.dat
[2011/02/13 21:46:38 | 000,073,758 | ---- | C] () -- C:\Documents and Settings\LocalService\Local Settings\Application Data\WPFFontCache_v0400-System.dat
[2010/12/03 07:15:04 | 000,057,344 | ---- | C] () -- C:\WINDOWS\System32\UnEnvyNT.dll
[2010/07/09 14:04:40 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2010/05/17 19:23:36 | 000,002,338 | ---- | C] () -- C:\WINDOWS\Sandboxie.ini
[2010/05/11 20:31:50 | 000,138,592 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010/05/11 20:31:50 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
[2010/05/11 20:31:34 | 000,219,128 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe
[2010/05/11 20:31:32 | 000,075,064 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe
[2010/05/11 20:31:29 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini
[2010/03/25 10:33:24 | 000,011,028 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2010/02/24 03:43:12 | 000,000,262 | ---- | C] () -- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/02/24 03:23:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2010/02/24 03:16:23 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin
[2010/02/24 03:16:14 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat
[2010/02/24 03:16:14 | 000,226,857 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat
[2010/02/24 03:16:14 | 000,000,003 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat
[2010/02/24 03:05:33 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2010/02/24 03:00:27 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2010/02/23 20:54:25 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2010/02/23 20:51:20 | 000,117,360 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/03 17:07:22 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/08/02 06:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2001/08/23 05:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2001/08/23 05:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2001/08/23 05:00:00 | 000,458,162 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2001/08/23 05:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2001/08/23 05:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2001/08/23 05:00:00 | 000,076,576 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2001/08/23 05:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2001/08/23 05:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2001/08/23 05:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2001/08/23 05:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat

========== LOP Check ==========

[2011/03/18 19:43:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
[2011/03/18 16:50:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Common Files
[2011/03/18 20:14:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PMB Files
[2010/05/07 22:31:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2010/03/25 10:19:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
[2011/02/23 10:05:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Auslogics
[2011/03/18 21:49:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\foobar2000
[2010/07/22 01:23:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Leadertech
[2010/10/08 00:35:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\LolClient
[2010/06/04 19:27:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Owner\Application Data\Octoshape

========== Purity Check ==========



========== Custom Scans ==========


< %SYSTEMDRIVE%\*.* >
[2010/02/24 03:03:41 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT
[2010/02/24 02:58:07 | 000,000,211 | ---- | M] () -- C:\Boot.bak
[2011/03/18 19:45:24 | 000,000,327 | RHS- | M] () -- C:\boot.ini
[2004/08/03 23:00:00 | 000,260,272 | RHS- | M] () -- C:\cmldr
[2011/03/18 19:55:14 | 000,010,882 | ---- | M] () -- C:\ComboFix.txt
[2010/02/24 03:03:41 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS
[2010/02/24 03:11:03 | 000,000,086 | ---- | M] () -- C:\CSB.LOG
[2010/02/24 03:03:41 | 000,000,000 | RHS- | M] () -- C:\IO.SYS
[2010/02/24 03:03:41 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS
[2004/08/03 14:38:34 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM
[2010/10/04 17:02:40 | 000,250,048 | RHS- | M] () -- C:\ntldr
[2011/03/18 19:47:43 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys
[2011/02/06 23:21:53 | 000,003,643 | ---- | M] () -- C:\pathping.txt'

< %systemroot%\Fonts\*.com >
[2006/04/18 15:39:28 | 000,026,040 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalMonospace.CompositeFont
[2006/06/29 14:53:56 | 000,026,489 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSansSerif.CompositeFont
[2006/04/18 15:39:28 | 000,029,779 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalSerif.CompositeFont
[2006/06/29 14:58:52 | 000,030,808 | ---- | M] () -- C:\WINDOWS\Fonts\GlobalUserInterface.CompositeFont

< %systemroot%\Fonts\*.dll >

< %systemroot%\Fonts\*.ini >
[2010/02/24 03:03:11 | 000,000,067 | -HS- | M] () -- C:\WINDOWS\Fonts\desktop.ini

< %systemroot%\Fonts\*.ini2 >

< %systemroot%\Fonts\*.exe >

< %systemroot%\system32\spool\prtprocs\w32x86\*.* >
[2008/07/06 07:06:10 | 000,089,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\filterpipelineprintproc.dll
[2008/07/06 05:50:03 | 000,597,504 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spool\prtprocs\w32x86\printfilterpipelinesvc.exe

< %systemroot%\REPAIR\*.bak1 >

< %systemroot%\REPAIR\*.ini >

< %systemroot%\system32\*.jpg >

< %systemroot%\*.jpg >

< %systemroot%\*.png >

< %systemroot%\*.scr >

< %systemroot%\*._sy >

< %APPDATA%\Adobe\Update\*.* >

< %ALLUSERSPROFILE%\Favorites\*.* >

< %APPDATA%\Microsoft\*.* >

< %PROGRAMFILES%\*.* >

< %APPDATA%\Update\*.* >

< %systemroot%\*. /mp /s >

< %systemroot%\System32\config\*.sav >
[2010/02/23 20:50:40 | 000,094,208 | ---- | M] () -- C:\WINDOWS\system32\config\default.sav
[2010/02/23 20:50:40 | 000,655,360 | ---- | M] () -- C:\WINDOWS\system32\config\software.sav
[2010/02/23 20:50:40 | 000,897,024 | ---- | M] () -- C:\WINDOWS\system32\config\system.sav

< %PROGRAMFILES%\bak. /s >

< %systemroot%\system32\bak. /s >

< %ALLUSERSPROFILE%\Start Menu\*.lnk /x >
[2010/10/04 17:06:39 | 000,000,272 | -HS- | M] () -- C:\Documents and Settings\All Users\Start Menu\desktop.ini

< %systemroot%\system32\config\systemprofile\*.dat /x >

< %systemroot%\*.config >

< %systemroot%\system32\*.db >

< %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x >
[2010/10/05 00:49:00 | 000,000,119 | -HS- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\desktop.ini
[2010/02/24 03:07:19 | 000,000,079 | ---- | M] () -- C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\Show Desktop.scf

< %USERPROFILE%\Desktop\*.exe >
[2011/02/03 04:02:09 | 053,997,360 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Documents and Settings\Owner\Desktop\11-1_xp32_dd_ccc_ocl.exe
[2011/03/18 17:35:40 | 000,301,568 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\6rhtzpl1.exe
[2011/03/18 19:40:47 | 006,225,384 | ---- | M] (OPSWAT, Inc.) -- C:\Documents and Settings\Owner\Desktop\AppRemover.exe
[2011/03/18 19:33:34 | 004,290,189 | R--- | M] () -- C:\Documents and Settings\Owner\Desktop\ComboFix.exe
[2011/02/23 10:04:14 | 004,646,264 | ---- | M] (Auslogics Software Pty Ltd ) -- C:\Documents and Settings\Owner\Desktop\disk-defrag-setup.exe
[2011/02/13 15:16:12 | 000,889,416 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner\Desktop\dotNetFx40_Full_setup.exe
[2011/03/04 16:02:08 | 077,738,888 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Owner\Desktop\ExcelViewer.exe
[2010/02/24 06:16:30 | 001,663,664 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Owner\Desktop\InstallWoW.exe
[2011/03/02 21:31:50 | 002,832,544 | ---- | M] (Adobe Systems, Inc.) -- C:\Documents and Settings\Owner\Desktop\install_flash_player.exe
[2011/03/18 20:13:30 | 002,257,408 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\LeagueofLegends.exe
[2011/03/18 16:45:16 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Owner\Desktop\mbam-setup.exe
[2011/03/18 17:42:20 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\MBRCheck.exe
[2011/03/11 02:58:27 | 070,836,585 | ---- | M] () -- C:\Documents and Settings\Owner\Desktop\motherboard_driver_audio_realtek_azalia.exe
[2011/03/18 17:04:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\OTL.exe
[2011/01/08 19:35:32 | 002,646,978 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Owner\Desktop\PTR-Installer-4.0.0.12824-enUS-downloader(2).exe
[2010/09/12 18:42:12 | 002,646,978 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Owner\Desktop\PTR-Installer-4.0.0.12824-enUS-downloader.exe
[2011/01/08 19:23:29 | 002,646,978 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Owner\Desktop\PTR-Installer-en_US.exe
[2011/03/18 17:27:11 | 000,446,464 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Owner\Desktop\TFC.exe
[2010/05/11 23:44:53 | 001,081,088 | ---- | M] (Blizzard Entertainment) -- C:\Documents and Settings\Owner\Desktop\WoW-3.0.1.8874-PTR-US-Installer-downloader.exe

< %PROGRAMFILES%\Common Files\*.* >

< %systemroot%\*.src >

< %systemroot%\install\*.* >

< %systemroot%\system32\DLL\*.* >

< %systemroot%\system32\HelpFiles\*.* >

< %systemroot%\system32\rundll\*.* >

< %systemroot%\winn32\*.* >

< %systemroot%\Java\*.* >

< %systemroot%\system32\test\*.* >

< %systemroot%\system32\Rundll32\*.* >

< %systemroot%\AppPatch\Custom\*.* >

< %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x >

< %PROGRAMFILES%\PC-Doctor\Downloads\*.* >

< %PROGRAMFILES%\Internet Explorer\*.tmp >

< %PROGRAMFILES%\Internet Explorer\*.dat >

< %USERPROFILE%\My Documents\*.exe >

< %USERPROFILE%\*.exe >

< %systemroot%\ADDINS\*.* >

< %systemroot%\assembly\*.bak2 >

< %systemroot%\Config\*.* >

< %systemroot%\REPAIR\*.bak2 >

< %systemroot%\SECURITY\Database\*.sdb /x >

< %systemroot%\SYSTEM\*.bak2 >

< %systemroot%\Web\*.bak2 >

< %systemroot%\Driver Cache\*.* >

< %PROGRAMFILES%\Mozilla Firefox\0*.exe >

< %ProgramFiles%\Microsoft Common\*.* >

< %ProgramFiles%\TinyProxy. >

< %USERPROFILE%\Favorites\*.url /x >
[2010/10/05 00:49:00 | 000,000,122 | -HS- | M] () -- C:\Documents and Settings\Owner\Favorites\Desktop.ini

< %systemroot%\system32\*.bk >

< %systemroot%\*.te >

< %systemroot%\system32\system32\*.* >

< %ALLUSERSPROFILE%\*.dat /x >

< %systemroot%\system32\drivers\*.rmv >

< dir /b "%systemroot%\system32\*.exe" | find /i " " /c >

< dir /b "%systemroot%\*.exe" | find /i " " /c >

< %PROGRAMFILES%\Microsoft\*.* >

< %systemroot%\System32\Wbem\proquota.exe >

< %PROGRAMFILES%\Mozilla Firefox\*.dat >

< %USERPROFILE%\Cookies\*.txt /x >
[2011/03/18 21:19:14 | 000,049,152 | ---- | M] () -- C:\Documents and Settings\Owner\Cookies\index.dat

< %SystemRoot%\system32\fonts\*.* >

< %systemroot%\system32\winlog\*.* >

< %systemroot%\system32\Language\*.* >

< %systemroot%\system32\Settings\*.* >

< %systemroot%\system32\*.quo >

< %SYSTEMROOT%\AppPatch\*.exe >

< %SYSTEMROOT%\inf\*.exe >
[2006/11/20 01:50:59 | 000,192,512 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\inf\unregmp2.exe

< %SYSTEMROOT%\Installer\*.exe >
[2011/01/10 03:02:47 | 000,811,776 | ---- | M] (SANDBOXIE L.T.D) -- C:\WINDOWS\Installer\SandboxieInstall32.exe

< %systemroot%\system32\config\*.bak2 >

< %systemroot%\system32\Computers\*.* >

< %SystemRoot%\system32\Sound\*.* >

< %SystemRoot%\system32\SpecialImg\*.* >

< %SystemRoot%\system32\code\*.* >

< %SystemRoot%\system32\draft\*.* >

< %SystemRoot%\system32\MSSSys\*.* >

< %ProgramFiles%\Javascript\*.* >

< %systemroot%\pchealth\helpctr\System\*.exe /s >

< %systemroot%\Web\*.exe >

< %systemroot%\system32\msn\*.* >

< %systemroot%\system32\*.tro >

< %AppData%\Microsoft\Installer\msupdates\*.* >

< %ProgramFiles%\Messenger\*.* >
[2008/04/13 19:11:51 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\custsat.dll
[2007/04/02 13:07:22 | 000,007,047 | ---- | M] () -- C:\Program Files\Messenger\lvback.gif
[2008/05/02 09:01:49 | 000,083,968 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgsc.dll
[2008/04/13 12:30:28 | 000,180,224 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msgslang.dll
[2008/04/13 19:12:28 | 001,695,232 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Messenger\msmsgs.exe
[2007/04/02 13:07:23 | 000,002,882 | ---- | M] () -- C:\Program Files\Messenger\newalert.wav
[2007/04/02 13:07:23 | 000,006,156 | ---- | M] () -- C:\Program Files\Messenger\newemail.wav
[2007/04/02 13:07:24 | 000,006,160 | ---- | M] () -- C:\Program Files\Messenger\online.wav
[2007/04/02 13:07:27 | 000,004,454 | ---- | M] () -- C:\Program Files\Messenger\type.wav
[2007/04/02 13:04:01 | 000,115,981 | ---- | M] () -- C:\Program Files\Messenger\xpmsgr.chm

< %systemroot%\system32\systhem32\*.* >

< %systemroot%\system\*.exe >

< HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU >

< HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\ Auto Update\Results\Install|LastSuccessTime /rs >


< End of report >

 

Forgot to mention when posting that OTL log, the issue with the homepage in IE seems to be resolved, and the default homepage now goes to MSN.com, like I think its supposed to. It was never a problem in Firefox, just IE, and it started happening when I opened up IE today after about a week and the popup issue in the original message happened about 2 days ago. The default homepage link wasn't opening up in FF or in IE earlier, but the only difference is in IE it was going to ask.com and putting in "Microsoft Home" or something and I think one of the links in the address bar was Qbyrd. Also I couldn't set the homepage to google.com or anything of the sort but I could go to those pages. Now I can set the homepage properly.

I don't know what fixed or if the problem is actually gone, but as of right now it works properly.

I'll keep answering questions though and see if you see any problems in that last OTL log.

 

I am not getting an extra.txt file on my desktop or after running OTL. I am also doing as asked to copy your text and paste it into the whitebox at the bottom. However it is not opening nor saving the extras.txt file.

 

Just wanted to keep you updated, I am still here, yesterday was busy, I'll get you the Virus Scan, let's hope its clean xD.

 

Don't kill me, been super busy xD

Results of online scan(had hotspot shield for like a year and didn't have this problem before, they must have updated it and messed with my IE?):

C:\System Volume Information\_restore{C6379785-92E6-4CF0-9C26-B7DF053BF174}\RP327\A0042559.exe a variant of Win32/HotSpotShield application
C:\System Volume Information\_restore{C6379785-92E6-4CF0-9C26-B7DF053BF174}\RP379\A0047891.exe a variant of Win32/HotSpotShield application





Results of Security Check:

Results of screen317's Security Check version 0.99.7
Windows XP Service Pack 3
Internet Explorer 6 Out of date!
``````````````````````````````
Antivirus/Firewall Check:
Windows Firewall Disabled!
AVG 2011
ESET Online Scanner v3
Antivirus up to date!
```````````````````````````````
Anti-malware/Other Utilities Check:
Malwarebytes' Anti-Malware
Adobe Flash Player 10.2.152.32
Adobe Reader 9.4.1
Out of date Adobe Reader installed!
Mozilla Firefox (3.6.16)
````````````````````````````````
Process Check:
objlist.exe by Laurent
AVG avgwdsvc.exe
AVG avgtray.exe
AVG avgrsx.exe
AVG avgnsx.exe
AVG avgemc.exe
``````````End of Log````````````

 

Sorry, yes. Been very busy at work and haven't had time to get all of this done at home yet. Should be able to do it during the weekend.