Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

Author Topic: Google Search Redirection  (Read 13823 times)

0 Members and 1 Guest are viewing this topic.

Deckfitz

    Topic Starter


    Rookie

    Google Search Redirection
    « on: January 28, 2010, 12:53:16 PM »
    Hi

    I'm new to this forum and I joined because I believe my PC has become infected and maybe somebody here can help me.  It started a few days ago.  Sometimes, when I do a search in Google, instead of taking me to the site I clicked on "search-netinfo.com" appears for a moment in the address bar and then I am taken somewhere completely different.  I have already scanned my system using Spybot, Avast, Ad-Aware, Microsoft Security Essentials and Panda online activescan.  Nothing was picked up by any of these.  Can anyone help me track down the virus or spyware on my machine?

    Thanks

    Declan

    Dr Jay

    • Malware Removal Specialist


    • Specialist
    • Moderator emeritus
    • Thanked: 119
    • Experience: Guru
    • OS: Windows 10
    Re: Google Search Redirection
    « Reply #1 on: January 28, 2010, 01:20:37 PM »
    Hi

    Download OTL  to your Desktop
    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Under the Custom Scan box paste this in
    netsvcs
    msconfig
    safebootminimal
    safebootnetwork
    activex
    drivers32
    %SYSTEMDRIVE%\*.exe
    %systemroot%\*. /mp /s
    c:\$recycle.bin\*.* /s
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    eventlog.dll
    scecli.dll
    netlogon.dll
    cngaudit.dll
    sceclt.dll
    ntelogon.dll
    logevent.dll
    iaStor.sys
    nvstor.sys
    nvstor32.sys
    atapi.sys
    IdeChnDr.sys
    viasraid.sys
    AGP440.sys
    vaxscsi.sys
    nvatabus.sys
    viamraid.sys
    nvata.sys
    nvgts.sys
    iastorv.sys
    ViPrt.sys
    eNetHook.dll
    explorer.exe
    svchost.exe
    userinit.exe
    qmgr.dll
    ws2_32.dll
    proquota.exe
    imm32.dll
    kernel32.dll
    ndis.sys
    autochk.exe
    spoolsv.exe
    xmlprov.dll
    ntmssvc.dll
    mswsock.dll
    Beep.SYS
    ntfs.sys
    termsrv.dll
    sfcfiles.dll
    st3shark.sys
    ahcix86.sys
    srsvc.dll
    nvrd32.sys
    /md5stop
    %systemroot%\system32\*.dll /lockedfiles
    %systemroot%\Tasks\*.job /lockedfiles

    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
      • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
      • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time
    ~Dr Jay

    Deckfitz

      Topic Starter


      Rookie

      Re: Google Search Redirection
      « Reply #2 on: January 28, 2010, 02:21:09 PM »
      Hi

      The files were too big to paste here, so I have attached them both (hopefully)

      Thanks

      [Saving space, attachment deleted by admin]

      Dr Jay

      • Malware Removal Specialist


      • Specialist
      • Moderator emeritus
      • Thanked: 119
      • Experience: Guru
      • OS: Windows 10
      Re: Google Search Redirection
      « Reply #3 on: January 28, 2010, 02:28:02 PM »
      Post 2 for OTL did not attach.

      Try to paste it here, but do two or three posts.
      ~Dr Jay

      Deckfitz

        Topic Starter


        Rookie

        Re: Google Search Redirection
        « Reply #4 on: January 28, 2010, 03:10:53 PM »
        OTL logfile created on: 28/01/2010 20:36:16 - Run 1
        OTL by OldTimer - Version 3.1.27.0     Folder = C:\Documents and Settings\Declan Fitzpatrick\Desktop
        Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
        Internet Explorer (Version = 8.0.6001.18702)
        Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy
         
        2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 53.00% Memory free
        4.00 Gb Paging File | 3.00 Gb Available in Paging File | 73.00% Paging File free
        Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
         
        %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
        Drive C: | 460.96 Gb Total Space | 34.36 Gb Free Space | 7.45% Space Free | Partition Type: NTFS
        D: Drive not present or media not loaded
        E: Drive not present or media not loaded
        F: Drive not present or media not loaded
        G: Drive not present or media not loaded
        H: Drive not present or media not loaded
        I: Drive not present or media not loaded
         
        Computer Name: DECLAN
        Current User Name: Declan Fitzpatrick
        Logged in as Administrator.
         
        Current Boot Mode: Normal
        Scan Mode: Current user
        Company Name Whitelist: On
        Skip Microsoft Files: On
        File Age = 14 Days
        Output = Standard
        Quick Scan
         
        ========== Processes (SafeList) ==========
         
        PRC - [2010/01/28 20:31:48 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
        PRC - [2009/12/17 17:14:11 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
        PRC - [2009/11/24 23:51:40 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
        PRC - [2009/11/24 23:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
        PRC - [2009/11/24 23:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
        PRC - [2009/11/24 23:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
        PRC - [2009/11/24 23:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
        PRC - [2009/10/28 20:21:26 | 00,141,600 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
        PRC - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
        PRC - [2009/10/25 16:36:07 | 01,217,808 | ---- | M] (Valve Corporation) -- C:\Program Files\Steam\Steam.exe
        PRC - [2009/10/12 01:16:18 | 00,520,024 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
        PRC - [2009/10/12 01:16:17 | 01,028,432 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
        PRC - [2009/09/13 18:52:50 | 01,048,392 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
        PRC - [2009/07/02 17:36:52 | 00,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
        PRC - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        PRC - [2009/05/21 09:55:32 | 00,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
        PRC - [2009/04/16 22:53:11 | 00,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
        PRC - [2009/03/05 16:07:20 | 02,260,480 | ---- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
        PRC - [2009/02/06 17:07:48 | 00,027,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Contacts\wlcomm.exe
        PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
        PRC - [2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
        PRC - [2008/08/13 17:32:40 | 00,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
        PRC - [2008/05/08 08:01:50 | 00,681,424 | ---- | M] () -- C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
        PRC - [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
        PRC - [2007/12/01 23:10:48 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
        PRC - [2007/08/27 17:12:28 | 01,082,664 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
        PRC - [2007/08/27 15:36:34 | 00,111,912 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe
        PRC - [2006/08/28 20:57:12 | 00,395,776 | ---- | M] (Gteko Ltd.) -- C:\Program Files\Dell Support\DSAgnt.exe
        PRC - [2006/08/17 11:32:04 | 00,017,920 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\CTHELPER.EXE
        PRC - [2006/08/17 11:28:14 | 00,729,600 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTXFISPI.EXE
        PRC - [2006/08/14 13:20:26 | 00,462,336 | ---- | M] (Corel, Inc.) -- C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
        PRC - [2006/07/06 06:15:00 | 00,151,552 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
        PRC - [2006/07/06 06:14:30 | 00,090,112 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
        PRC - [2006/03/02 12:00:18 | 00,018,944 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTXFIHLP.EXE
        PRC - [2005/11/04 17:07:56 | 00,049,152 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
        PRC - [2005/10/14 10:01:06 | 00,122,880 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
        PRC - [2005/10/05 02:12:00 | 00,094,208 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
        PRC - [2005/09/08 04:20:00 | 00,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
        PRC - [2005/08/11 14:30:30 | 00,081,920 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
        PRC - [2004/08/10 04:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
        PRC - [2003/06/18 00:00:00 | 00,045,056 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.exe
        PRC - [2003/06/02 18:50:58 | 00,053,248 | ---- | M] (Dell Computer Corporation) -- C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
        PRC - [2003/06/02 18:25:24 | 00,270,336 | ---- | M] (Dell Computer Corporation) -- C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
        PRC - [2003/06/02 16:01:26 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE
        PRC - [2003/06/02 15:56:02 | 00,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXPPS.EXE
        PRC - [1999/12/12 17:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTSVCCDA.EXE
         
         
        ========== Modules (SafeList) ==========
         
        MOD - [2010/01/28 20:31:48 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
        MOD - [2009/04/16 22:53:42 | 00,008,704 | ---- | M] () -- C:\Program Files\Real\RealPlayer\rpchromebrowserrecordhelper.dll
        MOD - [2006/08/17 11:32:04 | 00,007,168 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTAGENT.DLL
        MOD - [2006/07/11 17:35:38 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcr71.dll
         
         
        ========== Win32 Services (SafeList) ==========
         
        SRV - [2009/12/17 17:14:11 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
        SRV - [2009/11/24 23:51:35 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
        SRV - [2009/11/24 23:51:21 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
        SRV - [2009/11/24 23:48:48 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
        SRV - [2009/11/24 23:43:56 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
        SRV - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
        SRV - [2009/10/12 01:16:17 | 01,028,432 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
        SRV - [2009/08/05 21:48:42 | 00,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
        SRV - [2009/07/02 17:36:52 | 00,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
        SRV - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
        SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
        SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
        SRV - [2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
        SRV - [2008/08/13 17:32:40 | 00,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
        SRV - [2008/02/20 09:42:38 | 00,354,816 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
        SRV - [2007/12/01 23:10:48 | 00,066,872 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
        SRV - [2007/08/27 15:36:34 | 00,111,912 | ---- | M] (SingleClick Systems) [Auto | Running] -- C:\Program Files\Dell Network Assistant\hnm_svc.exe -- (hnmsvc)
        SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
        SRV - [2006/07/06 06:14:30 | 00,090,112 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
        SRV - [2003/06/02 16:01:26 | 00,303,104 | ---- | M] (Lexmark International, Inc.) [Auto | Running] -- C:\WINDOWS\system32\LEXBCES.EXE -- (LexBceS)
        SRV - [1999/12/12 17:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\WINDOWS\system32\CTSVCCDA.EXE -- (Creative Service for CDROM Access)
         
         
        ========== Standard Registry (SafeList) ==========
         
         
        ========== Internet Explorer ==========
         
        IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=3070605
        IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
        IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=3070605
         
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.msn.com/
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.live.com/ [binary data]
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
        IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/ig?hl=en&source=iglk
        IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
        IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
        IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
         
        ========== FireFox ==========
         
        FF - prefs.js..browser.search.defaultenginen ame: "Fast Browser Search"
        FF - prefs.js..browser.search.defaultthis.en gineName: "Fast Browser Search"
        FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
        FF - prefs.js..browser.search.order.1: "Fast Browser Search"
        FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
        FF - prefs.js..browser.search.update: false
        FF - prefs.js..browser.search.useDBForOrder: true
        FF - prefs.js..browser.startup.homepage: "http://www.google.ie/ig?hl=en&source=iglk"
        FF - prefs.js..extensions.enabledItems: {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}:2.0.0.66311
        FF - prefs.js..extensions.enabledItems: [email protected]:1.0
        FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:1.5.3.20080730
        FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={8E8334DA-2042-A904-66EA-9D4F1286A756}&q="
         
         
        FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/04/16 22:53:43 | 00,000,000 | ---D | M]
         
        [2009/06/18 23:22:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Extensions
        [2009/06/18 23:22:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Extensions\[email protected]
        [2010/01/04 21:42:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\extensions
        [2010/01/03 08:28:53 | 00,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
        [2010/01/03 08:28:53 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
        [2008/12/09 01:34:33 | 00,000,682 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\searchplugins\ask.xml
        [2010/01/03 08:28:55 | 00,005,413 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\searchplugins\fast-browser-search.xml
         
        O1 HOSTS File: ([2010/01/27 18:52:47 | 00,377,755 | R--- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
        O1 - Hosts: 127.0.0.1       localhost
        O1 - Hosts: 127.0.0.1   www.007guard.com
        O1 - Hosts: 127.0.0.1   007guard.com
        O1 - Hosts: 127.0.0.1   008i.com
        O1 - Hosts: 127.0.0.1   www.008k.com
        O1 - Hosts: 127.0.0.1   008k.com
        O1 - Hosts: 127.0.0.1   www.00hq.com
        O1 - Hosts: 127.0.0.1   00hq.com
        O1 - Hosts: 127.0.0.1   010402.com
        O1 - Hosts: 127.0.0.1   www.032439.com
        O1 - Hosts: 127.0.0.1   032439.com
        O1 - Hosts: 127.0.0.1   www.0scan.com
        O1 - Hosts: 127.0.0.1   0scan.com
        O1 - Hosts: 127.0.0.1   1000gratisproben.com
        O1 - Hosts: 127.0.0.1   www.1000gratisproben.com
        O1 - Hosts: 127.0.0.1   1001namen.com
        O1 - Hosts: 127.0.0.1   www.1001namen.com
        O1 - Hosts: 127.0.0.1   100888290cs.com
        O1 - Hosts: 127.0.0.1   www.100888290cs.com
        O1 - Hosts: 127.0.0.1   www.100sexlinks.com
        O1 - Hosts: 127.0.0.1   100sexlinks.com
        O1 - Hosts: 127.0.0.1   10sek.com
        O1 - Hosts: 127.0.0.1   www.10sek.com
        O1 - Hosts: 127.0.0.1   www.1-2005-search.com
        O1 - Hosts: 127.0.0.1   1-2005-search.com
        O1 - Hosts: 13022 more lines...
        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
        O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
        O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
        O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
        O2 - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
        O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
        O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll File not found
        O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
        O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
        O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
        O3 - HKLM\..\Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
        O3 - HKLM\..\Toolbar: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll File not found
        O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
        O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
        O3 - HKCU\..\Toolbar\WebBrowser: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll File not found
        O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
        O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
        O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
        O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
        O4 - HKLM..\Run: [CTDVDDET] C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE (Creative Technology Ltd)
        O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
        O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\CTXFIHLP.EXE (Creative Technology Ltd)
        O4 - HKLM..\Run: [Dell AIO Printer A920] C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe (Dell Computer Corporation)
        O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
        O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
        O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
        O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
        O4 - HKLM..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe File not found
        O4 - HKLM..\Run: [fssui] C:\Program Files\Windows Live\Family Safety\fsui.exe (Microsoft Corporation)
        O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
        O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation)
        O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
        O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
        O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
        O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe ()
        O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
        O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
        O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
        O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
        O4 - HKLM..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe File not found
        O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
        O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
        O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
        O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe (Creative Technology Ltd)
        O4 - HKCU..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
        O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
        O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
        O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
        O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk = C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe ()
        O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Nokia Nseries PC Suite.lnk = C:\Program Files\Nokia\NNPCS\RunLauncher.exe ()
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
        O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
        O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
        O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
        O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
        O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
        O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
        O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
        O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
        O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
        O15 - HKLM\..Trusted Domains: 63 domain(s) and sub-domain(s) not assigned to a zone.
        O15 - HKCU\..Trusted Domains: 63 domain(s) and sub-domain(s) not assigned to a zone.
        O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.euro.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
        O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.1.4.cab (Bebo Uploader Control)
        O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
        O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
        O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.srtest.com/srl_bin/sysreqlab_srl.cab (System Requirements Lab Class)
        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
        O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx (get_atlcom Class)
        O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1190059001203 (MUWebControl Class)
        O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
        O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
        O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
        O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
        O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab (IWinAmpActiveX Class)
        O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
        O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
        O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
        O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
        O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5155/mcfscan.cab (McFreeScan Class)
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
        O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
        O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
        O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
        O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
        O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
        O24 - Desktop WallPaper: C:\Documents and Settings\Declan Fitzpatrick\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
        O24 - Desktop BackupWallPaper: C:\Documents and Settings\Declan Fitzpatrick\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
        O32 - HKLM CDRom: AutoRun - 1
        O32 - AutoRun File - [2005/08/16 03:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
        O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
        O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
        O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe -- File not found
        O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
        O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
        O35 - comfile [open] -- "%1" %*
        O35 - exefile [open] -- "%1" %*
         
        NetSvcs: 6to4 -  File not found
        NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/08/16 03:22:48 | 00,000,000 | ---D | M]
        NetSvcs: Iprip -  File not found
        NetSvcs: Irmon -  File not found
        NetSvcs: NWCWorkstation -  File not found
        NetSvcs: Nwsapagent -  File not found
        NetSvcs: WmdmPmSp -  File not found
         
        MsConfig - StartUpReg: MSN Messenger - hkey= - key= -  File not found
        MsConfig - State: "system.ini" - 0
        MsConfig - State: "win.ini" - 0
        MsConfig - State: "bootini" - 0
        MsConfig - State: "services" - 0
        MsConfig - State: "startup" - 2
         
        SafeBootMin: Base - Driver Group
        SafeBootMin: Boot Bus Extender - Driver Group
        SafeBootMin: Boot file system - Driver Group
        SafeBootMin: File system - Driver Group
        SafeBootMin: Filter - Driver Group
        SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
        SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
        SafeBootMin: PCI Configuration - Driver Group
        SafeBootMin: PNP Filter - Driver Group
        SafeBootMin: Primary disk - Driver Group
        SafeBootMin: SCSI Class - Driver Group
        SafeBootMin: sermouse.sys - Driver
        SafeBootMin: System Bus Extender - Driver Group
        SafeBootMin: vds - Service
        SafeBootMin: vga.sys - Driver
        SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
        SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
        SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
        SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
        SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
        SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
        SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
        SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
        SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
        SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
        SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
        SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
        SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
        SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
         
        SafeBootNet: Base - Driver Group
        SafeBootNet: Boot Bus Extender - Driver Group
        SafeBootNet: Boot file system - Driver Group
        SafeBootNet: File system - Driver Group
        SafeBootNet: Filter - Driver Group
        SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
        SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
        SafeBootNet: NDIS Wrapper - Driver Group
        SafeBootNet: NetBIOSGroup - Driver Group
        SafeBootNet: NetDDEGroup - Driver Group
        SafeBootNet: Network - Driver Group
        SafeBootNet: NetworkProvider - Driver Group
        SafeBootNet: PCI Configuration - Driver Group
        SafeBootNet: PNP Filter - Driver Group
        SafeBootNet: PNP_TDI - Driver Group
        SafeBootNet: Primary disk - Driver Group
        SafeBootNet: SCSI Class - Driver Group
        SafeBootNet: sermouse.sys - Driver
        SafeBootNet: Streams Drivers - Driver Group
        SafeBootNet: System Bus Extender - Driver Group
        SafeBootNet: TDI - Driver Group
        SafeBootNet: vga.sys - Driver
        SafeBootNet: vsmon - Service
        SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
        SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
        SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
        SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
        SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
        SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
        SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
        SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
        SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
        SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
        SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
        SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
        SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
        SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
        SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
        SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
        SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
         
        ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
        ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
        ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
        ActiveX: {1BC46932-21B2-4130-86E0-B4EB4F7A7A7B} - Microsoft .NET Framework 1.0 Hotfix (KB887998)
        ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
        ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
        ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
        ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
        ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
        ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
        ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
        ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
        ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
        ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
        ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
        ActiveX: {407408d4-94ed-4d86-ab69-a7f649d112ee} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf
        ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
        ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
        ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
        ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
        ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
        ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
        ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
        ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
        ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
        ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
        ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
        ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
        ActiveX: {5CA109D3-A084-47E8-A9CB-D497322E3F50} - Silverlight 2.0
        ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
        ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
        ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
        ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
        ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
        ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
        ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
        ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
        ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
        ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
        ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
        ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
        ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
        ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
        ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
        ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
        ActiveX: {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - Microsoft .NET Framework 1.0 Hotfix (KB930494)
        ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
        ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
        ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
        ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
        ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
        ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
        ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
        ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
        ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
        ActiveX: {E8EA5BD6-D931-4001-ABF6-81BAA500360A} - Microsoft .NET Framework 1.0 Hotfix (KB953295)
        ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
        ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3
        ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework
        ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
        ActiveX: >{1b5ce4e5-0b1e-4e64-9d91-3829ccb2414e} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
        ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
        ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
        ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
        ActiveX: KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall
         
        Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
        Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
        Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
        Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
        Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
        Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
        Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
        Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
        Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
        Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
        Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
        Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
        Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
        Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
         
        ========== Files/Folders - Created Within 14 Days ==========
         
        [2010/01/28 20:31:42 | 00,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
        [2010/01/28 20:03:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
        [2010/01/27 19:52:12 | 00,028,552 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\pavboot.sys
        [2010/01/27 19:52:04 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security
        [2010/01/27 18:37:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
        [2010/01/27 18:18:55 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
        [2010/01/26 23:39:59 | 00,050,968 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgfwdx.dll
        [2010/01/26 23:39:59 | 00,030,104 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgfwdx.sys
        [2010/01/26 23:36:02 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
        [2010/01/26 23:36:02 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
        [2010/01/26 23:36:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
        [2010/01/26 23:36:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
        [2010/01/26 21:47:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
        [2010/01/26 21:47:08 | 00,000,000 | ---D | C] -- C:\Program Files\Free Window Registry Repair
        [2010/01/26 21:37:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\AVG8
        [2010/01/23 22:33:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\vlc
        [2010/01/23 22:31:49 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN
        [2010/01/18 06:12:36 | 00,000,000 | ---D | C] -- C:\Program Files\Netopia
        [2010/01/18 01:12:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\swvypg
        [2009/12/08 22:57:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
        [2009/12/08 22:57:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Help
        [2009/02/07 17:21:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\SupportSoft
        [2007/11/23 23:12:21 | 00,033,792 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
        [2007/10/05 20:38:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
        [2007/10/05 20:33:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
        [2007/10/05 20:33:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Google
        [2007/08/15 22:08:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
        [2005/09/01 01:33:54 | 00,092,672 | ---- | C] ( ) -- C:\WINDOWS\System32\DVDRead.dll
        [8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
        [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
         
        ========== Files - Modified Within 14 Days ==========
         

        Deckfitz

          Topic Starter


          Rookie

          Re: Google Search Redirection
          « Reply #5 on: January 28, 2010, 03:11:29 PM »
          [2010/01/28 20:31:48 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
          [2010/01/28 19:51:00 | 00,001,030 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3329145560-1003980739-774479982-1005UA.job
          [2010/01/28 19:29:05 | 00,000,448 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{642F835B-E188-4E72-943B-FC527F25C4DA}.job
          [2010/01/28 19:14:45 | 00,002,333 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
          [2010/01/28 19:13:20 | 00,192,017 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
          [2010/01/28 19:07:49 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
          [2010/01/28 19:07:10 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
          [2010/01/28 19:07:03 | 21,453,04576 | -HS- | M] () -- C:\hiberfil.sys
          [2010/01/28 13:04:45 | 19,136,512 | -H-- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\NTUSER.DAT
          [2010/01/28 13:04:44 | 00,064,980 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000004-00000000-00000004-00001102-00000005-10031102}.rfx
          [2010/01/28 13:04:44 | 00,055,172 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000004-00001102-00000005-10031102}.rfx
          [2010/01/28 13:04:44 | 00,055,172 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000004-00000000-00000004-00001102-00000005-10031102}.rfx
          [2010/01/28 13:04:44 | 00,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
          [2010/01/28 13:04:44 | 00,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
          [2010/01/28 02:51:00 | 00,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3329145560-1003980739-774479982-1005Core.job
          [2010/01/28 02:16:10 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
          [2010/01/27 18:56:35 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
          [2010/01/27 18:53:40 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\ntuser.ini
          [2010/01/27 18:52:47 | 00,377,755 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
          [2010/01/27 18:46:04 | 00,000,933 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Spybot - Search & Destroy.lnk
          [2010/01/27 18:18:56 | 00,000,820 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
          [2010/01/27 18:10:01 | 00,112,640 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
          [2010/01/27 17:38:51 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\iTunes.lnk
          [2010/01/27 16:56:36 | 00,021,059 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Thingy.xlsx
          [2010/01/27 02:12:28 | 11,741,42865 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\24.s08e05.720p.hdtv.x264-immerse.mkv
          [2010/01/27 00:59:53 | 00,025,088 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Covering Letter 01.doc
          [2010/01/26 23:39:59 | 00,050,968 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgfwdx.dll
          [2010/01/26 23:39:59 | 00,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgfwdx.sys
          [2010/01/26 21:47:25 | 00,000,718 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Free Window Registry Repair.lnk
          [2010/01/26 15:49:08 | 36,749,8630 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\24.S08E05.800PM-900PM.HDTV.XviD-FQM.avi
          [2010/01/26 15:00:19 | 00,000,165 | -H-- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\~$Thingy.xlsx
          [2010/01/25 18:39:46 | 00,000,279 | ---- | M] () -- C:\WINDOWS\dellstat.ini
          [2010/01/24 13:06:31 | 02,120,678 | -H-- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\IconCache.db
          [2010/01/24 02:47:38 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
          [2010/01/23 22:32:13 | 00,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
          [2010/01/23 08:29:13 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
          [2010/01/22 15:47:55 | 00,025,600 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Covering Letter.doc
          [2010/01/18 06:12:36 | 00,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\eircom broadband connection.url
          [8 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
          [1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
           
          ========== Files Created - No Company Name ==========
           
          [2010/01/27 18:46:04 | 00,000,933 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Spybot - Search & Destroy.lnk
          [2010/01/27 18:18:56 | 00,000,820 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
          [2010/01/26 21:47:25 | 00,000,718 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Free Window Registry Repair.lnk
          [2010/01/26 15:27:49 | 36,749,8630 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\24.S08E05.800PM-900PM.HDTV.XviD-FQM.avi
          [2010/01/26 15:23:09 | 11,741,42865 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\24.s08e05.720p.hdtv.x264-immerse.mkv
          [2010/01/26 15:00:19 | 00,000,165 | -H-- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\~$Thingy.xlsx
          [2010/01/24 02:47:38 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
          [2010/01/23 22:32:13 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
          [2010/01/22 15:19:12 | 00,025,088 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Covering Letter 01.doc
          [2010/01/18 06:12:35 | 00,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\eircom broadband connection.url
          [2009/06/29 21:21:22 | 00,076,407 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Smiley.ico
          [2009/03/15 18:47:01 | 00,002,516 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
          [2009/03/15 18:47:01 | 00,000,088 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\26D3307CAE.sys
          [2009/03/15 18:34:56 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
          [2009/01/09 19:47:13 | 00,000,187 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\G-Force Prefs (WindowsMediaPlayer).txt
          [2008/09/11 21:08:06 | 00,010,273 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
          [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
          [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
          [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
          [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
          [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
          [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
          [2008/06/11 09:02:32 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
          [2008/06/11 09:02:32 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
          [2008/06/11 09:02:32 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
          [2008/06/05 08:58:26 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
          [2008/04/23 02:21:37 | 01,490,661 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\NMM-MetaData.db
          [2007/12/24 16:12:32 | 00,278,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
          [2007/12/24 16:12:32 | 00,025,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
          [2007/11/27 20:48:29 | 00,000,319 | ---- | C] () -- C:\WINDOWS\game.ini
          [2007/11/24 00:02:03 | 00,087,403 | ---- | C] () -- C:\WINDOWS\System32\instwdm.ini
          [2007/11/23 23:13:10 | 00,003,072 | ---- | C] () -- C:\WINDOWS\CTXFIRES.DLL
          [2007/11/22 12:17:27 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
          [2007/11/22 12:17:27 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\PnkBstrK.sys
          [2007/10/31 20:25:36 | 00,000,049 | ---- | C] () -- C:\WINDOWS\lexstat.ini
          [2007/10/04 17:14:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
          [2007/10/04 17:14:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
          [2007/10/04 17:14:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
          [2007/10/04 17:14:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
          [2007/10/04 17:14:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
          [2007/08/07 19:22:22 | 00,141,180 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
          [2007/06/27 21:59:46 | 00,000,152 | ---- | C] () -- C:\WINDOWS\CoolPlay.ini
          [2007/06/20 22:37:22 | 00,003,764 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
          [2007/06/20 22:37:22 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\FD98559E90.sys
          [2007/06/20 16:20:59 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
          [2007/06/19 20:25:42 | 00,000,091 | ---- | C] () -- C:\WINDOWS\CIV.INI
          [2007/06/19 19:54:34 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
          [2007/06/12 21:39:18 | 00,000,279 | ---- | C] () -- C:\WINDOWS\dellstat.ini
          [2007/06/12 21:39:07 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbkvs.dll
          [2007/06/12 21:38:45 | 00,000,255 | ---- | C] () -- C:\WINDOWS\System32\dlbkcoin.ini
          [2007/06/10 21:09:28 | 00,112,640 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
          [2007/06/10 20:41:30 | 00,011,776 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\dvd.bmk
          [2007/06/09 19:16:41 | 00,000,141 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\fusioncache.dat
          [2007/06/05 20:39:48 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
          [2007/06/05 20:35:44 | 00,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
          [2007/06/05 20:06:18 | 00,000,190 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
          [2007/06/05 20:06:12 | 00,050,432 | ---- | C] () -- C:\WINDOWS\System32\claptn.ini
          [2007/06/05 19:58:04 | 00,001,206 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
          [2006/09/27 16:47:40 | 00,000,307 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI
          [2006/08/17 11:33:54 | 00,037,888 | ---- | C] () -- C:\WINDOWS\System32\CTBURST.DLL
          [2005/12/07 10:31:00 | 00,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
          [2005/11/10 00:56:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
          [2005/08/16 03:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
          [2005/08/16 03:35:21 | 00,057,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\redbook.sys
          [2005/08/05 13:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
          [2005/06/07 21:10:50 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\CTMMACTL.DLL
           
          ========== LOP Check ==========
           
          [2009/07/01 22:50:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\1219D
          [2010/01/26 23:40:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
          [2008/04/23 02:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
          [2009/06/11 22:12:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
          [2009/08/26 20:29:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
          [2007/09/21 16:20:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
          [2008/04/23 01:50:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nokia
          [2008/04/23 02:04:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
          [2007/06/05 20:32:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SingleClick Systems
          [2007/11/05 17:31:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
          [2010/01/28 19:15:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
          [2007/07/14 22:49:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
          [2009/03/28 13:12:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
          [2009/11/04 01:31:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
          [2009/04/29 22:44:17 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
          [2009/06/18 23:08:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
          [2010/01/27 18:37:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
          [2009/12/03 21:39:57 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
          [2008/02/03 01:47:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\.BitTornado
          [2007/12/24 14:43:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Bioshock
          [2010/01/27 02:12:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\BitTorrent
          [2008/04/19 21:38:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Datalayer
          [2009/01/12 08:01:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\DNA
          [2007/06/20 22:39:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Leadertech
          [2009/06/23 00:54:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\LimeWire
          [2007/07/06 21:12:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\My Games
          [2009/06/11 21:04:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Nokia
          [2009/06/12 21:44:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\NSeries
          [2008/04/22 21:50:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\PC Suite
          [2009/04/20 22:38:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
          [2008/09/14 19:07:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\vghd
          [2010/01/28 02:16:10 | 00,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
          [2010/01/28 19:29:05 | 00,000,448 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{642F835B-E188-4E72-943B-FC527F25C4DA}.job
           
          ========== Purity Check ==========
           
           
           
          ========== Custom Scans ==========
           
           
          < %SYSTEMDRIVE%\*.exe >
           
          < %systemroot%\*. /mp /s >
           
          < c:\$recycle.bin\*.* /s >
           
          < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
          HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-01-22 02:29:23
           
           
          < MD5 for: AGP440.SYS  >
          [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
          [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
          [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
          [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
          [2008/04/13 18:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
          [2008/04/13 18:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
          [2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\i386\AGP440.SYS
          [2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
           
          < MD5 for: ATAPI.SYS  >
          [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
          [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
          [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
          [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
          [2008/04/13 18:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
          [2008/04/13 18:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
          [2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\i386\atapi.sys
          [2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
           
          < MD5 for: AUTOCHK.EXE  >
          [2008/04/14 00:12:12 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\ServicePackFiles\i386\autochk.exe
          [2008/04/14 00:12:12 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\system32\autochk.exe
          [2004/08/10 04:00:00 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=B3415B9D6026F65E43089ABED096C38C -- C:\i386\autochk.exe
          [2004/08/10 04:00:00 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=B3415B9D6026F65E43089ABED096C38C -- C:\WINDOWS\$NtServicePackUninstall$\autochk.exe
           
          < MD5 for: BEEP.SYS  >
          [2004/08/10 04:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\i386\beep.sys
          [2004/08/10 04:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\system32\drivers\beep.sys
           
          < MD5 for: EVENTLOG.DLL  >
          [2008/04/14 00:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
          [2008/04/14 00:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
          [2004/08/10 04:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\i386\eventlog.dll
          [2004/08/10 04:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
           
          < MD5 for: EXPLORER.EXE  >
          [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
          [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
          [2007/06/13 11:26:03 | 01,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
          [2007/06/13 10:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
          [2004/08/10 04:00:00 | 01,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
           
          < MD5 for: IASTOR.SYS  >
          [2006/10/10 12:03:48 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\drivers\storage\R130118\iastor.sys
          [2006/07/06 05:59:42 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\i386\iaStor.sys
          [2006/07/06 05:59:42 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
          [2006/07/06 05:59:42 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\WINDOWS\system32\drivers\iaStor.sys
          [2006/10/10 12:03:48 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\iaStor.sys
          [2006/07/06 06:01:32 | 00,484,864 | ---- | M] (Intel Corporation) MD5=6A3C354BFC163B81F6EF2FC421280DB5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
           
          < MD5 for: IMM32.DLL  >
          [2008/04/14 00:11:54 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\ServicePackFiles\i386\imm32.dll
          [2008/04/14 00:11:54 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\system32\imm32.dll
          [2004/08/10 04:00:00 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=87CA7CE6469577F059297B9D6556D66D -- C:\i386\imm32.dll
          [2004/08/10 04:00:00 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=87CA7CE6469577F059297B9D6556D66D -- C:\WINDOWS\$NtServicePackUninstall$\imm32.dll
           
          < MD5 for: KERNEL32.DLL  >
          [2007/04/16 16:07:27 | 00,986,112 | ---- | M] (Microsoft Corporation) MD5=09F7CB3687F86EDAA4CA081F7AB66C03 -- C:\WINDOWS\$hf_mig$\KB935839\SP2QFE\kernel32.dll
          [2006/07/05 10:57:10 | 00,985,088 | ---- | M] (Microsoft Corporation) MD5=0FDD84928A5DDE2510761B7EC76CCEC9 -- C:\WINDOWS\$hf_mig$\KB917422\SP2QFE\kernel32.dll
          [2007/04/16 15:52:53 | 00,984,576 | ---- | M] (Microsoft Corporation) MD5=A01F9CA902A88F7CED06884174D6419D -- C:\WINDOWS\$NtServicePackUninstall$\kernel32.dll
          [2009/03/21 14:06:58 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\system32\dllcache\kernel32.dll
          [2009/03/21 14:06:58 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\system32\kernel32.dll
          [2008/04/14 00:11:56 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\$NtUninstallKB959426$\kernel32.dll
          [2008/04/14 00:11:56 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\ServicePackFiles\i386\kernel32.dll
          [2006/07/05 10:55:01 | 00,984,064 | ---- | M] (Microsoft Corporation) MD5=D8DB5397DE07577C1CB50BA6D23B3AD4 -- C:\i386\kernel32.dll
          [2006/07/05 10:55:01 | 00,984,064 | ---- | M] (Microsoft Corporation) MD5=D8DB5397DE07577C1CB50BA6D23B3AD4 -- C:\WINDOWS\$NtUninstallKB935839$\kernel32.dll
          [2009/03/21 13:59:23 | 00,991,744 | ---- | M] (Microsoft Corporation) MD5=DA11D9D6ECBDF0F93436A4B7C13F7BEC -- C:\WINDOWS\$hf_mig$\KB959426\SP3QFE\kernel32.dll
           
          < MD5 for: MSWSOCK.DLL  >
          [2008/06/20 17:41:10 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=097722F235A1FB698BF9234E01B52637 -- C:\WINDOWS\$NtServicePackUninstall$\mswsock.dll
          [2008/06/20 17:36:11 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=1DFCA7713EA5A70D5D93B436AEA0317A -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
          [2004/08/10 04:00:00 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\i386\mswsock.dll
          [2004/08/10 04:00:00 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
          [2008/06/20 17:46:57 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
          [2008/06/20 17:46:57 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\system32\dllcache\mswsock.dll
          [2008/06/20 17:46:57 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\system32\mswsock.dll
          [2008/04/14 00:12:01 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
          [2008/04/14 00:12:01 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
          [2008/06/20 17:43:05 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=FCEE5FCB99F7C724593365C706D28388 -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
           
          < MD5 for: NDIS.SYS  >
          [2008/04/13 19:20:37 | 00,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
          [2008/04/13 19:20:37 | 00,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
          [2004/08/10 04:00:00 | 00,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\i386\ndis.sys
          [2004/08/10 04:00:00 | 00,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys
           
          < MD5 for: NETLOGON.DLL  >
          [2008/04/14 00:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
          [2008/04/14 00:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
          [2004/08/10 04:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\i386\netlogon.dll
          [2004/08/10 04:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
           
          < MD5 for: NTFS.SYS  >
          [2007/02/09 11:23:36 | 00,574,976 | ---- | M] (Microsoft Corporation) MD5=05AB81909514BFD69CBB1F2C147CF6B9 -- C:\WINDOWS\$hf_mig$\KB930916\SP2QFE\ntfs.sys
          [2007/02/09 11:10:35 | 00,574,464 | ---- | M] (Microsoft Corporation) MD5=19A811EF5F1ED5C926A028CE107FF1AF -- C:\WINDOWS\$NtServicePackUninstall$\ntfs.sys
          [2008/04/13 19:15:53 | 00,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\ServicePackFiles\i386\ntfs.sys
          [2008/04/13 19:15:53 | 00,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\system32\drivers\ntfs.sys
          [2004/08/10 04:00:00 | 00,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\i386\ntfs.sys
          [2004/08/10 04:00:00 | 00,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\WINDOWS\$NtUninstallKB930916$\ntfs.sys
           
          < MD5 for: NTMSSVC.DLL  >
          [2008/04/14 00:12:02 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\ServicePackFiles\i386\ntmssvc.dll
          [2008/04/14 00:12:02 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\system32\ntmssvc.dll
          [2004/08/10 04:00:00 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=B62F29C00AC55A761B2E45877D85EA0F -- C:\i386\ntmssvc.dll
          [2004/08/10 04:00:00 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=B62F29C00AC55A761B2E45877D85EA0F -- C:\WINDOWS\$NtServicePackUninstall$\ntmssvc.dll
           
          < MD5 for: PROQUOTA.EXE  >
          [2004/08/10 04:00:00 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=4D9D45A4370E0C2AD00C362B7118E2A4 -- C:\i386\proquota.exe
          [2004/08/10 04:00:00 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=4D9D45A4370E0C2AD00C362B7118E2A4 -- C:\WINDOWS\$NtServicePackUninstall$\proquota.exe
          [2008/04/14 00:12:32 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\ServicePackFiles\i386\proquota.exe
          [2008/04/14 00:12:32 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\system32\proquota.exe
           
          < MD5 for: QMGR.DLL  >
          [2004/08/10 04:00:00 | 00,382,464 | ---- | M] (Microsoft Corporation) MD5=2C69EC7E5A311334D10DD95F338FCCEA -- C:\i386\qmgr.dll
          [2004/08/10 04:00:00 | 00,382,464 | ---- | M] (Microsoft Corporation) MD5=2C69EC7E5A311334D10DD95F338FCCEA -- C:\WINDOWS\$NtServicePackUninstall$\qmgr.dll
          [2008/04/14 00:12:03 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\ServicePackFiles\i386\qmgr.dll
          [2008/04/14 00:12:03 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\system32\bits\qmgr.dll
          [2008/04/14 00:12:03 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\system32\qmgr.dll
           
          < MD5 for: SCECLI.DLL  >
          [2004/08/10 04:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\i386\scecli.dll
          [2004/08/10 04:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
          [2008/04/14 00:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
          [2008/04/14 00:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
           
          < MD5 for: SFCFILES.DLL  >
          [2004/08/10 04:00:00 | 01,580,544 | ---- | M] (Microsoft Corporation) MD5=30A609E00BD1D4FFC49D6B5A432BE7F2 -- C:\i386\sfcfiles.dll
          [2004/08/10 04:00:00 | 01,580,544 | ---- | M] (Microsoft Corporation) MD5=30A609E00BD1D4FFC49D6B5A432BE7F2 -- C:\WINDOWS\$NtServicePackUninstall$\sfcfiles.dll
          [2008/04/14 00:12:05 | 01,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\ServicePackFiles\i386\sfcfiles.dll
          [2008/04/14 00:12:05 | 01,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\system32\sfcfiles.dll
           
          < MD5 for: SPOOLSV.EXE  >
          [2005/06/11 00:17:13 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=AD3D9D191AEA7B5445FE1D82FFBB4788 -- C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
          [2008/04/14 00:12:36 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
          [2008/04/14 00:12:36 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\system32\spoolsv.exe
          [2005/06/10 23:53:32 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=DA81EC57ACD4CDC3D4C51CF3D409AF9F -- C:\i386\spoolsv.exe
          [2005/06/10 23:53:32 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=DA81EC57ACD4CDC3D4C51CF3D409AF9F -- C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
           
          < MD5 for: SRSVC.DLL  >
          [2008/04/14 00:12:07 | 00,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\ServicePackFiles\i386\srsvc.dll
          [2008/04/14 00:12:07 | 00,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\system32\srsvc.dll
          [2004/08/10 04:00:00 | 00,170,496 | ---- | M] (Microsoft Corporation) MD5=92BDF74F12D6CBEC43C94D4B7F804838 -- C:\i386\srsvc.dll
          [2004/08/10 04:00:00 | 00,170,496 | ---- | M] (Microsoft Corporation) MD5=92BDF74F12D6CBEC43C94D4B7F804838 -- C:\WINDOWS\$NtServicePackUninstall$\srsvc.dll
           
          < MD5 for: SVCHOST.EXE  >
          [2008/04/14 00:12:36 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
          [2008/04/14 00:12:36 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
          [2004/08/10 04:00:00 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\i386\svchost.exe
          [2004/08/10 04:00:00 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
           
          < MD5 for: TERMSRV.DLL  >
          [2004/08/10 04:00:00 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=B60C877D16D9C880B952FDA04ADF16E6 -- C:\WINDOWS\$NtUninstallKB895961$\termsrv.dll
          [2005/03/09 18:49:52 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=C29A5286E64D97385178452D5F307B98 -- C:\i386\termsrv.dll
          [2005/03/09 18:49:52 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=C29A5286E64D97385178452D5F307B98 -- C:\WINDOWS\$NtServicePackUninstall$\termsrv.dll
          [2008/04/14 00:12:07 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\ServicePackFiles\i386\termsrv.dll
          [2008/04/14 00:12:07 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\system32\termsrv.dll
           
          < MD5 for: USERINIT.EXE  >
          [2004/08/10 04:00:00 | 00,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\i386\userinit.exe
          [2004/08/10 04:00:00 | 00,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
          [2008/04/14 00:12:38 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
          [2008/04/14 00:12:38 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
           
          < MD5 for: WS2_32.DLL  >
          [2008/04/14 00:12:10 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
          [2008/04/14 00:12:10 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
          [2004/08/10 04:00:00 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 -- C:\i386\ws2_32.dll
          [2004/08/10 04:00:00 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
           
          < MD5 for: XMLPROV.DLL  >
          [2008/04/14 00:12:11 | 00,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\ServicePackFiles\i386\xmlprov.dll
          [2008/04/14 00:12:11 | 00,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\system32\xmlprov.dll
          [2004/08/10 04:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation) MD5=EEF46DAB68229A14DA3D8E73C99E2959 -- C:\i386\xmlprov.dll
          [2004/08/10 04:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation) MD5=EEF46DAB68229A14DA3D8E73C99E2959 -- C:\WINDOWS\$NtServicePackUninstall$\xmlprov.dll
           
          < %systemroot%\system32\*.dll /lockedfiles >
          [2008/04/14 00:11:51 | 01,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
          [8 C:\WINDOWS\system32\*.tmp files -> C:\WINDOWS\system32\*.tmp -> ]
           
          < %systemroot%\Tasks\*.job /lockedfiles >
           
          ========== Alternate Data Streams ==========
           
          @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BEB71B81
          < End of report >

          Dr Jay

          • Malware Removal Specialist


          • Specialist
          • Moderator emeritus
          • Thanked: 119
          • Experience: Guru
          • OS: Windows 10
          Re: Google Search Redirection
          « Reply #6 on: January 28, 2010, 08:09:32 PM »
          Hello again.

          Please run OTL.exe.
          • Copy the commands with file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):


            :otl
            IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
            IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555
            FF - prefs.js..browser.search.defaultenginen ame: "Fast Browser Search"
            FF - prefs.js..browser.search.defaultthis.en gineName: "Fast Browser Search"
            FF - prefs.js..browser.search.defaulturl: "http://www.fastbrowsersearch.com/results/results.aspx?s=DEF&v=19&q="
            FF - prefs.js..browser.search.order.1: "Fast Browser Search"
            FF - prefs.js..browser.search.selectedEngine: "Fast Browser Search"
            FF - prefs.js..browser.search.update: false
            FF - prefs.js..browser.search.useDBForOrder: true
            FF - prefs.js..keyword.URL: "http://www.fastbrowsersearch.com/results/results.aspx?s=NAUS&v=19&tid={8E8334DA-2042-A904-66EA-9D4F1286A756}&q="
            [2010/01/03 08:28:53 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}
            [2008/12/09 01:34:33 | 00,000,682 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\searchplugins\ask.xml
            [2010/01/03 08:28:55 | 00,005,413 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\searchplugins\fast-browser-search.xml
            O1 - Hosts: 127.0.0.1   www.007guard.com 
            O1 - Hosts: 127.0.0.1   007guard.com
            O1 - Hosts: 127.0.0.1   008i.com
            O1 - Hosts: 127.0.0.1   www.008k.com 
            O1 - Hosts: 127.0.0.1   008k.com
            O1 - Hosts: 127.0.0.1   www.00hq.com 
            O1 - Hosts: 127.0.0.1   00hq.com
            O1 - Hosts: 127.0.0.1   010402.com
            O1 - Hosts: 127.0.0.1   www.032439.com 
            O1 - Hosts: 127.0.0.1   032439.com
            O1 - Hosts: 127.0.0.1   www.0scan.com 
            O1 - Hosts: 127.0.0.1   0scan.com
            O1 - Hosts: 127.0.0.1   1000gratisproben.com
            O1 - Hosts: 127.0.0.1   www.1000gratisproben.com
            O1 - Hosts: 127.0.0.1   1001namen.com
            O1 - Hosts: 127.0.0.1   www.1001namen.com
            O1 - Hosts: 127.0.0.1   100888290cs.com
            O1 - Hosts: 127.0.0.1   www.100888290cs.com 
            O1 - Hosts: 127.0.0.1   www.100sexlinks.com 
            O1 - Hosts: 127.0.0.1   100sexlinks.com
            O1 - Hosts: 127.0.0.1   10sek.com
            O1 - Hosts: 127.0.0.1   www.10sek.com 
            O1 - Hosts: 127.0.0.1   www.1-2005-search.com
            O1 - Hosts: 127.0.0.1   1-2005-search.com
            O1 - Hosts: 13022 more lines...
            O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found.
            O2 - BHO: (BrowserHelper Class) - {8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6} - C:\Program Files\SGPSA\SearchAssistant.dll File not found
            O3 - HKLM\..\Toolbar: (no name) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - No CLSID value found.
            O3 - HKLM\..\Toolbar: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll File not found
            O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
            O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {A057A204-BACC-4D26-9990-79A187E2698E} - No CLSID value found.
            O3 - HKCU\..\Toolbar\WebBrowser: (BearShare MediaBar) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll File not found
            O4 - HKLM..\Run: [FBSearch] C:\Program Files\Search Guard Plus\SearchGuardPlus.exe File not found
            O15 - HKLM\..Trusted Domains: 63 domain(s) and sub-domain(s) not assigned to a zone.
            O15 - HKCU\..Trusted Domains: 63 domain(s) and sub-domain(s) not assigned to a zone.
            O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell - "" = AutoRun
            O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun - "" = Auto&Play
            O33 - MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\Shell\AutoRun\command - "" = E:\setup.exe -- File not found
            O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
            [2010/01/26 21:47:25 | 00,000,718 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Free Window Registry Repair.lnk
            [2009/03/28 13:12:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}

            :commands
            [emptytemp]
            [purity]
            [reboot]


          • Return to OTL.exe, right click in the "Custom Scans/Fixes" window (under the light green bar) and choose Paste.

          • Click the red Run Fix button.
          • A fix log in Notepad will appear. Copy the contents of the fix log to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
          • Close OTL.exe
          If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

          ======

          Please go HERE. Copy and paste the following file path in to the box.

          c:\windows\system32\drivers\atapi.sys

          Then click submit.

          Please post the results (URL) to your next reply.

          Note: make sure the file gets re-scanned. Do not give me an old scan (file already analyzed)

          ======

          Please download Cheetah-Anti-Rogue, and save to your Desktop.
          • Double-click on Cheetah-Anti-Rogue.zip, and extract the file to your Desktop.
          • Double-click on Cheetah-Anti-Rogue.cmd to start.
          • It will finish quickly and launch a log.
          • Post the contents of it in your next reply.
          ======

          Please make sure to copy and paste the results from OTL, VirusTotal scan, and Cheetah.
          ~Dr Jay

          Deckfitz

            Topic Starter


            Rookie

            Re: Google Search Redirection
            « Reply #7 on: January 28, 2010, 08:57:25 PM »
            "Note: make sure the file gets re-scanned. Do not give me an old scan (file already analyzed)"

            Hi again

            I'm not sure what you mean by the above.  Can you please clarify?

            Thanks

            Dr Jay

            • Malware Removal Specialist


            • Specialist
            • Moderator emeritus
            • Thanked: 119
            • Experience: Guru
            • OS: Windows 10
            Re: Google Search Redirection
            « Reply #8 on: January 28, 2010, 09:12:06 PM »
            It will tell you the file is already been scanned, do you want to see the last report. Instead, click Scan again.
            ~Dr Jay

            Deckfitz

              Topic Starter


              Rookie

              Re: Google Search Redirection
              « Reply #9 on: January 28, 2010, 09:23:30 PM »
              OTL File:-

              All processes killed
              ========== OTL ==========
              HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
              HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyServer| /E : value set successfully!
              Folder C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\extensions\{C2DCA7EB-22D2-4FD2-86A9-F99FCC8122BB}\ not found.
              File C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\searchplugins\ask.xml not found.
              File C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Firefox\Profiles\bt96kr5o.default\searchplugins\fast-browser-search.xml not found.
              127.0.0.1 www.007guard.com removed from HOSTS file successfully
              127.0.0.1 007guard.com removed from HOSTS file successfully
              127.0.0.1 008i.com removed from HOSTS file successfully
              127.0.0.1 www.008k.com removed from HOSTS file successfully
              127.0.0.1 008k.com removed from HOSTS file successfully
              127.0.0.1 www.00hq.com removed from HOSTS file successfully
              127.0.0.1 00hq.com removed from HOSTS file successfully
              127.0.0.1 010402.com removed from HOSTS file successfully
              127.0.0.1 www.032439.com removed from HOSTS file successfully
              127.0.0.1 032439.com removed from HOSTS file successfully
              127.0.0.1 www.0scan.com removed from HOSTS file successfully
              127.0.0.1 0scan.com removed from HOSTS file successfully
              127.0.0.1 1000gratisproben.com removed from HOSTS file successfully
              127.0.0.1 1001namen.com removed from HOSTS file successfully
              127.0.0.1 100888290cs.com removed from HOSTS file successfully
              127.0.0.1 www.100sexlinks.com removed from HOSTS file successfully
              127.0.0.1 100sexlinks.com removed from HOSTS file successfully
              127.0.0.1 10sek.com removed from HOSTS file successfully
              127.0.0.1 www.1-2005-search.com removed from HOSTS file successfully
              127.0.0.1 1-2005-search.com removed from HOSTS file successfully
              Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{02478D38-C3F9-4efb-9B51-7695ECA05670}\ not found.
              Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}\ deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8A9D74F9-560B-4FE7-ABEB-3B2E638E5CD6}\ deleted successfully.
              Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{21FA44EF-376D-4D53-9B0F-8A89D3229068} deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{21FA44EF-376D-4D53-9B0F-8A89D3229068}\ not found.
              Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}\ deleted successfully.
              Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
              Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{A057A204-BACC-4D26-9990-79A187E2698E} deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A057A204-BACC-4D26-9990-79A187E2698E}\ not found.
              Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}\ not found.
              Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\FBSearch deleted successfully.
              Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ deleted successfully.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found.
              Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found.
              Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found.
              Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{361ac05d-0e0d-11da-9aa9-806d6172696f}\ not found.
              File E:\setup.exe not found.
              Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session manager\\BootExecute:autocheck autochk * deleted successfully.
              C:\Documents and Settings\Declan Fitzpatrick\Desktop\Free Window Registry Repair.lnk moved successfully.
              C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}\x86 folder moved successfully.
              C:\Documents and Settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3} folder moved successfully.
              ========== COMMANDS ==========
               
              [EMPTYTEMP]
               
              User: Administrator
              ->Temp folder emptied: 0 bytes
              ->Temporary Internet Files folder emptied: 0 bytes
               
              User: All Users
               
              User: Declan Fitzpatrick
              ->Temp folder emptied: 1083294 bytes
              ->Temporary Internet Files folder emptied: 67219285 bytes
              ->Java cache emptied: 0 bytes
              ->Google Chrome cache emptied: 0 bytes
              ->Apple Safari cache emptied: 34605055 bytes
               
              User: Default User
              ->Temp folder emptied: 0 bytes
              ->Temporary Internet Files folder emptied: 134 bytes
               
              User: Guest
              ->Temp folder emptied: 0 bytes
              ->Temporary Internet Files folder emptied: 670 bytes
               
              User: LocalService
              ->Temp folder emptied: 66051 bytes
              ->Temporary Internet Files folder emptied: 33237 bytes
               
              User: NetworkService
              ->Temp folder emptied: 14942 bytes
              ->Temporary Internet Files folder emptied: 33170 bytes
               
              %systemdrive% .tmp files removed: 0 bytes
              %systemroot% .tmp files removed: 0 bytes
              %systemroot%\System32 .tmp files removed: 5246144 bytes
              %systemroot%\System32\dllcache .tmp files removed: 0 bytes
              %systemroot%\System32\drivers .tmp files removed: 0 bytes
              Windows Temp folder emptied: 35512 bytes
              %systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 23962060 bytes
              %systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 34318 bytes
              RecycleBin emptied: 147901389 bytes
               
              Total Files Cleaned = 267.00 mb
               
               
              OTL by OldTimer - Version 3.1.27.0 log created on 01292010_034203

              Files\Folders moved on Reboot...
              File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found!
              File\Folder C:\WINDOWS\temp\Perflib_Perfdata_6f0.dat not found!

              Registry entries deleted on Reboot...

              =======================================================================================================

              VirusTotal Scan URL

              http://www.virustotal.com/analisis/b4df1d2c56a593c6b54de57395e3b51d288f547842893b32b0f59228a0cf70b9-1264738630

              =======================================================================================================

              Cheetah File:-

              Cheetah-Anti-Rogue v1.2.10
              by DragonMaster Jay

              Microsoft Windows XP [Version 5.1.2600]
              Date: 29/01/2010 - Time:  4:04:19 - Arch.: x86
               
               
              -- Malware tools check --
              CCleaner
               
               
              -- Known infection --
               
              C:\WINDOWS\kb913800.exe (Exploit.WMP)
               
               
              Extra message: Detection only.
               
               
              EOF




              Dr Jay

              • Malware Removal Specialist


              • Specialist
              • Moderator emeritus
              • Thanked: 119
              • Experience: Guru
              • OS: Windows 10
              Re: Google Search Redirection
              « Reply #10 on: January 28, 2010, 09:31:01 PM »
              Please delete this file: C:\WINDOWS\kb913800.exe

              Please download Malwarebytes Anti-Malware from Malwarebytes.org.
              Alternate link: BleepingComputer.com.
              (Note: if you already have the program installed, just follow the directions. No need to re-download or re-install!)

              Double Click mbam-setup.exe to install the application.

              (Note: if you already have the program installed, open Malwarebytes from the Start Menu or Desktop shortcut, click the Update tab, and click Check for Updates, before doing the scan as instructed below!)
              • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
              • If an update is found, it will download and install the latest version.
              • Once the program has loaded, select "Perform Full Scan", then click Scan.
              • The scan may take some time to finish,so please be patient.
              • When the scan is complete, click OK, then Show Results to view the results.
              • Make sure that everything is checked, and click Remove Selected.
              • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Extra Note)
              • Please save the log to a location you will remember.
              • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
              • Copy and paste the entire report in your next reply.
              Extra Note:

              If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.
              ~Dr Jay

              Deckfitz

                Topic Starter


                Rookie

                Re: Google Search Redirection
                « Reply #11 on: January 29, 2010, 08:12:52 AM »
                Scan Results:-

                Malwarebytes' Anti-Malware 1.44
                Database version: 3655
                Windows 5.1.2600 Service Pack 3
                Internet Explorer 8.0.6001.18702

                29/01/2010 15:08:47
                mbam-log-2010-01-29 (15-08-47).txt

                Scan type: Full Scan (C:\|)
                Objects scanned: 858515
                Time elapsed: 8 hour(s), 26 minute(s), 33 second(s)

                Memory Processes Infected: 0
                Memory Modules Infected: 0
                Registry Keys Infected: 30
                Registry Values Infected: 0
                Registry Data Items Infected: 0
                Folders Infected: 2
                Files Infected: 0

                Memory Processes Infected:
                (No malicious items detected)

                Memory Modules Infected:
                (No malicious items detected)

                Registry Keys Infected:
                HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook (Adware.Ecobar) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\urlsearchhook.toolbarurlsearchhook.1 (Adware.Ecobar) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\videoegg.activexloader (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\videoegg.activexloader.1 (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{168dc258-1455-4e61-8590-9dac2f27b675} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{1a8642f1-dc80-4edc-a39d-0fb62a58b455} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{3f91eb90-ef62-44ee-a685-fac29af111cd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{5c29c7e4-5321-4cad-be2e-877666bed5df} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{83dfb6ee-ab18-41b5-86d4-b544a141d67e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{88d6cf0e-cf70-4c24-bf6e-e4e414bc649c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{8f6a82a2-d7b1-443e-bb9f-f7dc887dd618} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{9856e2d8-ffb2-4fe5-8cad-d5ad6a35a804} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{a3d06987-c35e-49e4-8fe2-ac67b9fbfb4c} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{a58c497b-3ee2-45e7-9594-daca6be2a0d0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{ad0a3058-fd49-4f98-a514-fd055201835e} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{ad5915ea-b61a-4dba-b5c8-ef4b2df0a3c7} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{af2e62b6-f9e1-4d4f-a10a-9dc8e6dcbcc0} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{bb187c0d-6f53-4f3e-9590-98fd3a7364a2} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{c5041fd9-4819-4dc4-b20e-c950b5b03d2a} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{d17726cc-d4dd-4c4a-9671-471d56e413b5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{db8cce99-59c6-4552-8bfc-058feb38d6ce} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{dc3a04ee-cdd7-4407-915c-a5502f97eecd} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{e1a63484-a022-4d42-830a-fbd411514440} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\CLSID\{e282c728-189d-419e-8ee2-1601f4b39ba5} (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\{F9197A7E-CE10-458e-85F8-5B0CE6DF2BBE} (Trojan.Agent) -> Quarantined and deleted successfully.
                HKEY_CLASSES_ROOT\Eeshellx.ShellExt (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_CURRENT_USER\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\MozillaPlugins\@videoegg.com/publisher,version=1.5 (Adware.VideoEgg) -> Quarantined and deleted successfully.
                HKEY_LOCAL_MACHINE\SOFTWARE\VideoEgg (Adware.VideoEgg) -> Quarantined and deleted successfully.

                Registry Values Infected:
                (No malicious items detected)

                Registry Data Items Infected:
                (No malicious items detected)

                Folders Infected:
                C:\Documents and Settings\Declan Fitzpatrick\Start Menu\Programs\Evidence Eliminator (Rogue.EvidenceEliminator) -> Quarantined and deleted successfully.
                C:\resycled (Trojan.DNSChanger) -> Quarantined and deleted successfully.

                Files Infected:
                (No malicious items detected)

                Dr Jay

                • Malware Removal Specialist


                • Specialist
                • Moderator emeritus
                • Thanked: 119
                • Experience: Guru
                • OS: Windows 10
                Re: Google Search Redirection
                « Reply #12 on: January 29, 2010, 08:47:10 AM »
                Please run a free online scan with the ESET Online Scanner
                • Tick the box next to YES, I accept the Terms of Use
                • Click Start
                • When asked, allow the ActiveX control to install
                • Click Start
                • Make sure that the options Remove found threats and the option Scan unwanted applications is checked
                • Click Scan (This scan can take several hours, so please be patient)
                • Once the scan is completed, you may close the window
                • Use Notepad to open the logfile located at C:\Program Files\EsetOnlineScanner\log.txt
                • Copy and paste that log as a reply to this topic
                ~Dr Jay

                Deckfitz

                  Topic Starter


                  Rookie

                  Re: Google Search Redirection
                  « Reply #13 on: January 29, 2010, 08:51:59 AM »
                  Hi again

                  I don't know if this is relevant at this point, but I was looking back throught this thread and I saw that "fastbrowsersearch" was supposed to be deleted, but when I open a new tab in Internet Explorer, I am brought to http://tab.fastbrowsersearch.com/?v=9&tid=0

                  I will proceed with the ESET Scan as instructed

                  Thanks again

                  Dr Jay

                  • Malware Removal Specialist


                  • Specialist
                  • Moderator emeritus
                  • Thanked: 119
                  • Experience: Guru
                  • OS: Windows 10
                  Re: Google Search Redirection
                  « Reply #14 on: January 29, 2010, 09:51:46 AM »
                  Oh. Ok. We'll check that soon. Go ahead with ESET scan for now. :)
                  ~Dr Jay

                  Deckfitz

                    Topic Starter


                    Rookie

                    Re: Google Search Redirection
                    « Reply #15 on: January 29, 2010, 05:30:21 PM »
                    ESET Scan Result:-

                    ESETSmartInstaller@High as CAB hook log:
                    OnlineScanner.ocx - registred OK
                    # version=7
                    # iexplore.exe=8.00.6001.18702 (longhorn_ie8_rtm(wmbla).090308-0339)
                    # OnlineScanner.ocx=1.0.0.6211
                    # api_version=3.0.2
                    # EOSSerial=6b5615ec62b3a34690f5f756cd4f2fc5
                    # end=finished
                    # remove_checked=true
                    # archives_checked=false
                    # unwanted_checked=true
                    # unsafe_checked=false
                    # antistealth_checked=true
                    # utc_time=2010-01-30 12:19:17
                    # local_time=2010-01-30 12:19:17 (+0000, GMT Standard Time)
                    # country="Ireland"
                    # lang=1033
                    # osver=5.1.2600 NT Service Pack 3
                    # compatibility_mode=769 16775125 100 98 32555 201065397 29014 0
                    # compatibility_mode=1024 16777215 100 0 231424 231424 0 0
                    # compatibility_mode=5891 16776533 100 100 52804 19429759 0 0
                    # compatibility_mode=8192 67108863 100 0 3763 3763 0 0
                    # scanned=928331
                    # found=0
                    # cleaned=0
                    # scan_time=30114

                    Dr Jay

                    • Malware Removal Specialist


                    • Specialist
                    • Moderator emeritus
                    • Thanked: 119
                    • Experience: Guru
                    • OS: Windows 10
                    Re: Google Search Redirection
                    « Reply #16 on: January 29, 2010, 06:21:38 PM »
                    Now to get you off to a good start we will clean your restore points so that all the bad stuff is gone for good. Then if you need to restore at some stage you will be clean. There are several ways to reset your restore points, but this is my method:
                    • Select Start > All Programs > Accessories > System tools > System Restore.
                    • On the dialogue box that appears select Create a Restore Point
                    • Click NEXT
                    • Enter a name e.g. Clean
                    • Click CREATE
                    You now have a clean restore point, to get rid of the bad ones:
                    • Select Start > All Programs > Accessories > System tools > Disk Cleanup.
                    • In the Drop down box that appears select your main drive e.g. C
                    • Click OK
                    • The System will do some calculation and the display a dialogue box with TABS
                    • Select the More Options Tab.
                    • At the bottom will be a system restore box with a CLEANUP button click this
                    • Accept the Warning and select OK again, the program will close and you are done
                    To remove all of the tools we used and the files and folders they created, please do the following:
                    Please download OTC.exe by OldTimer:
                    • Save it to your Desktop.
                    • Double click OTC.exe.
                    • Click the CleanUp! button.
                    • If you are prompted to Reboot during the cleanup, select Yes.
                    • The tool will delete itself once it finishes.
                    Note: If any tool, file or folder (belonging to the program we have used) hasn't been deleted, please delete it manually.

                    ==

                    Please download TFC by OldTimer to your desktop
                    • Please double-click TFC.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
                    • It will close all programs when run, so make sure you have saved all your work before you begin.
                    • Click the Start
                      button to begin the process. Depending on how often you clean temp
                      files, execution time should be anywhere from a few seconds to a minute
                      or two. Let it run uninterrupted to completion.
                    • Once it's finished it should reboot your machine. If it does not, please manually reboot the machine yourself to ensure a complete clean.
                    ==

                    Download Security Check by screen317 from SpywareInfoforum.org or Changelog.fr.
                    • Save it to your Desktop.
                    • Double click SecurityCheck.exe and follow the onscreen instructions inside of the black box.
                    • A Notepad document should open automatically called checkup.txt; please post the contents of that document.
                    ~Dr Jay

                    Deckfitz

                      Topic Starter


                      Rookie

                      Re: Google Search Redirection
                      « Reply #17 on: January 29, 2010, 06:48:36 PM »
                      Hi Jay

                      Just a quick update.  Today, the misdirections have started taking me to an "Adultfriendfinder" page every time

                      Dr Jay

                      • Malware Removal Specialist


                      • Specialist
                      • Moderator emeritus
                      • Thanked: 119
                      • Experience: Guru
                      • OS: Windows 10
                      Re: Google Search Redirection
                      « Reply #18 on: January 29, 2010, 07:41:37 PM »
                      Re-run OTL and post a log, please.
                      ~Dr Jay

                      Deckfitz

                        Topic Starter


                        Rookie

                        Re: Google Search Redirection
                        « Reply #19 on: January 29, 2010, 07:46:56 PM »
                        Do I copy and paste, the exact same way as the first time that created the OTL and Extras logs?

                        Dr Jay

                        • Malware Removal Specialist


                        • Specialist
                        • Moderator emeritus
                        • Thanked: 119
                        • Experience: Guru
                        • OS: Windows 10
                        Re: Google Search Redirection
                        « Reply #20 on: January 29, 2010, 08:18:25 PM »
                        Sure...
                        ~Dr Jay

                        Deckfitz

                          Topic Starter


                          Rookie

                          Re: Google Search Redirection
                          « Reply #21 on: January 29, 2010, 09:11:52 PM »
                          There's no extras file this time?

                          OTL logfile created on: 30/01/2010 03:44:47 - Run 3
                          OTL by OldTimer - Version 3.1.27.0     Folder = C:\Documents and Settings\Declan Fitzpatrick\Desktop
                          Windows XP Media Center Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
                          Internet Explorer (Version = 8.0.6001.18702)
                          Locale: 00001809 | Country: Ireland | Language: ENI | Date Format: dd/MM/yyyy
                           
                          2.00 Gb Total Physical Memory | 1.00 Gb Available Physical Memory | 56.00% Memory free
                          4.00 Gb Paging File | 3.00 Gb Available in Paging File | 79.00% Paging File free
                          Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
                           
                          %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
                          Drive C: | 460.96 Gb Total Space | 40.61 Gb Free Space | 8.81% Space Free | Partition Type: NTFS
                          D: Drive not present or media not loaded
                          Drive E: | 1.32 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF1.02
                          F: Drive not present or media not loaded
                          G: Drive not present or media not loaded
                          H: Drive not present or media not loaded
                          I: Drive not present or media not loaded
                           
                          Computer Name: DECLAN
                          Current User Name: Declan Fitzpatrick
                          Logged in as Administrator.
                           
                          Current Boot Mode: Normal
                          Scan Mode: Current user
                          Company Name Whitelist: On
                          Skip Microsoft Files: On
                          File Age = 14 Days
                          Output = Standard
                          Quick Scan
                           
                          ========== Processes (SafeList) ==========
                           
                          PRC - [2010/01/30 03:44:02 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
                          PRC - [2010/01/11 15:21:52 | 00,246,504 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe
                          PRC - [2009/12/17 17:14:11 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
                          PRC - [2009/11/24 23:51:40 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
                          PRC - [2009/11/24 23:51:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
                          PRC - [2009/11/24 23:51:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
                          PRC - [2009/11/24 23:48:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
                          PRC - [2009/11/24 23:43:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
                          PRC - [2009/10/28 20:21:26 | 00,141,600 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe
                          PRC - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe
                          PRC - [2009/10/25 16:36:07 | 01,217,808 | ---- | M] (Valve Corporation) -- C:\Program Files\Steam\Steam.exe
                          PRC - [2009/10/12 01:16:18 | 00,520,024 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
                          PRC - [2009/10/12 01:16:17 | 01,028,432 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
                          PRC - [2009/09/13 18:52:50 | 01,048,392 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Security Essentials\msseces.exe
                          PRC - [2009/07/02 17:36:52 | 00,017,904 | ---- | M] (Microsoft Corporation) -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
                          PRC - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
                          PRC - [2009/05/21 09:55:32 | 00,206,064 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtcmd.exe
                          PRC - [2009/04/16 22:53:11 | 00,198,160 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Common Files\Real\Update_OB\realsched.exe
                          PRC - [2009/02/06 17:07:48 | 00,027,512 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Live\Contacts\wlcomm.exe
                          PRC - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
                          PRC - [2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
                          PRC - [2008/08/13 17:32:40 | 00,201,968 | ---- | M] (SupportSoft, Inc.) -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe
                          PRC - [2008/05/08 08:01:50 | 00,681,424 | ---- | M] () -- C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe
                          PRC - [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
                          PRC - [2007/12/01 23:10:48 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe
                          PRC - [2007/08/27 17:12:28 | 01,082,664 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\ezi_hnm2.exe
                          PRC - [2007/08/27 15:36:34 | 00,111,912 | ---- | M] (SingleClick Systems) -- C:\Program Files\Dell Network Assistant\hnm_svc.exe
                          PRC - [2006/08/28 20:57:12 | 00,395,776 | ---- | M] (Gteko Ltd.) -- C:\Program Files\Dell Support\DSAgnt.exe
                          PRC - [2006/08/17 11:32:04 | 00,017,920 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\CTHELPER.EXE
                          PRC - [2006/08/17 11:28:14 | 00,729,600 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTXFISPI.EXE
                          PRC - [2006/08/14 13:20:26 | 00,462,336 | ---- | M] (Corel, Inc.) -- C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
                          PRC - [2006/07/06 06:15:00 | 00,151,552 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
                          PRC - [2006/07/06 06:14:30 | 00,090,112 | ---- | M] (Intel Corporation) -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe
                          PRC - [2006/03/02 12:00:18 | 00,018,944 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTXFIHLP.EXE
                          PRC - [2005/11/04 17:07:56 | 00,049,152 | ---- | M] (Creative Technology Ltd.) -- C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe
                          PRC - [2005/10/14 10:01:06 | 00,122,880 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe
                          PRC - [2005/10/05 02:12:00 | 00,094,208 | ---- | M] () -- C:\Program Files\Dell\Media Experience\DMXLauncher.exe
                          PRC - [2005/09/08 04:20:00 | 00,122,940 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DLA\DLACTRLW.EXE
                          PRC - [2005/08/11 14:30:30 | 00,081,920 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
                          PRC - [2004/08/10 04:00:00 | 00,016,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\unsecapp.exe
                          PRC - [2003/06/18 00:00:00 | 00,045,056 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.exe
                          PRC - [2003/06/02 18:50:58 | 00,053,248 | ---- | M] (Dell Computer Corporation) -- C:\Program Files\Dell AIO Printer A920\dlbkbmon.exe
                          PRC - [2003/06/02 18:25:24 | 00,270,336 | ---- | M] (Dell Computer Corporation) -- C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe
                          PRC - [2003/06/02 16:01:26 | 00,303,104 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXBCES.EXE
                          PRC - [2003/06/02 15:56:02 | 00,174,592 | ---- | M] (Lexmark International, Inc.) -- C:\WINDOWS\system32\LEXPPS.EXE
                          PRC - [1999/12/12 17:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTSVCCDA.EXE
                           
                           
                          ========== Modules (SafeList) ==========
                           
                          MOD - [2010/01/30 03:44:02 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
                          MOD - [2009/04/16 22:53:42 | 00,008,704 | ---- | M] () -- C:\Program Files\Real\RealPlayer\rpchromebrowserrecordhelper.dll
                          MOD - [2006/08/17 11:32:04 | 00,007,168 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\system32\CTAGENT.DLL
                          MOD - [2006/07/11 17:35:38 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcr71.dll
                           
                           
                          ========== Win32 Services (SafeList) ==========
                           
                          SRV - [2009/12/17 17:14:11 | 00,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService)
                          SRV - [2009/11/24 23:51:35 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
                          SRV - [2009/11/24 23:51:21 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
                          SRV - [2009/11/24 23:48:48 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
                          SRV - [2009/11/24 23:43:56 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
                          SRV - [2009/10/28 20:21:14 | 00,545,568 | ---- | M] (Apple Inc.) [On_Demand | Running] -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service)
                          SRV - [2009/10/12 01:16:17 | 01,028,432 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
                          SRV - [2009/08/05 21:48:42 | 00,704,864 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
                          SRV - [2009/07/02 17:36:52 | 00,017,904 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Program Files\Microsoft Security Essentials\MsMpEng.exe -- (MsMpSvc)
                          SRV - [2009/06/05 10:48:14 | 00,144,712 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device)
                          SRV - [2008/12/12 11:17:38 | 00,238,888 | ---- | M] (Apple Inc.) [Auto | Running] -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service)
                          SRV - [2008/11/04 01:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
                          SRV - [2008/10/07 13:33:00 | 00,163,908 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc)
                          SRV - [2008/08/13 17:32:40 | 00,201,968 | ---- | M] (SupportSoft, Inc.) [Auto | Running] -- C:\Program Files\Dell Support Center\bin\sprtsvc.exe -- (sprtsvc_dellsupportcenter) SupportSoft Sprocket Service (dellsupportcenter)
                          SRV - [2008/02/20 09:42:38 | 00,354,816 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\Nokia\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)
                          SRV - [2007/12/01 23:10:48 | 00,066,872 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA)
                          SRV - [2007/08/27 15:36:34 | 00,111,912 | ---- | M] (SingleClick Systems) [Auto | Running] -- C:\Program Files\Dell Network Assistant\hnm_svc.exe -- (hnmsvc)
                          SRV - [2006/10/26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose)
                          SRV - [2006/07/06 06:14:30 | 00,090,112 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
                          SRV - [2003/06/02 16:01:26 | 00,303,104 | ---- | M] (Lexmark International, Inc.) [Auto | Running] -- C:\WINDOWS\system32\LEXBCES.EXE -- (LexBceS)
                          SRV - [1999/12/12 17:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\WINDOWS\system32\CTSVCCDA.EXE -- (Creative Service for CDROM Access)
                           
                           
                          ========== Standard Registry (SafeList) ==========
                           
                           
                          ========== Internet Explorer ==========
                           
                          IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=3070605
                          IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant =
                          IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = www.google.ie/ig/dell?hl=en&client=dell-row&channel=ie&ibd=3070605
                           
                          IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.msn.com/
                          IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://www.live.com/ [binary data]
                          IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page =
                          IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
                          IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ie/ig?hl=en&source=iglk
                          IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
                           
                          FF - HKLM\software\mozilla\Firefox\extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009/04/16 22:53:43 | 00,000,000 | ---D | M]
                           
                          [2010/01/29 01:21:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Extensions
                          [2009/06/18 23:22:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Mozilla\Extensions\[email protected]
                           
                          O1 HOSTS File: ([2010/01/29 03:42:10 | 00,753,772 | RH-- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
                          O1 - Hosts: 127.0.0.1       localhost
                          O1 - Hosts: 127.0.0.1   123fporn.info
                          O1 - Hosts: 127.0.0.1   123haustiereundmehr.com
                          O1 - Hosts: 127.0.0.1   123moviedownload.com
                          O1 - Hosts: 127.0.0.1   123simsen.com
                          O1 - Hosts: 127.0.0.1   123topsearch.com
                          O1 - Hosts: 127.0.0.1   125sms.co.uk
                          O1 - Hosts: 127.0.0.1   125sms.com
                          O1 - Hosts: 127.0.0.1   132.com
                          O1 - Hosts: 127.0.0.1   1337crew.info
                          O1 - Hosts: 127.0.0.1   1337-crew.to
                          O1 - Hosts: 127.0.0.1   136136.net
                          O1 - Hosts: 127.0.0.1   150freesms.de
                          O1 - Hosts: 127.0.0.1   163ns.com
                          O1 - Hosts: 127.0.0.1   171203.com
                          O1 - Hosts: 127.0.0.1   17concepts.info
                          O1 - Hosts: 127.0.0.1   17-plus.com
                          O1 - Hosts: 127.0.0.1   1800searchonline.com
                          O1 - Hosts: 127.0.0.1   180searchassistant.com
                          O1 - Hosts: 127.0.0.1   180solutions.com
                          O1 - Hosts: 127.0.0.1   181.365soft.info
                          O1 - Hosts: 127.0.0.1   1987324.com
                          O1 - Hosts: 127.0.0.1   1-domains-registrations.com
                          O1 - Hosts: 127.0.0.1   1sexparty.com
                          O1 - Hosts: 127.0.0.1   1sms.de
                          O1 - Hosts: 12989 more lines...
                          O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
                          O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
                          O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll File not found
                          O2 - BHO: (Windows Live Family Safety Browser Helper Class) - {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - C:\Program Files\Windows Live\Family Safety\fssbho.dll (Microsoft Corporation)
                          O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
                          O2 - BHO: (CBrowserHelperObject Object) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll (Dell Inc.)
                          O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
                          O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
                          O4 - HKLM..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe (Apple Inc.)
                          O4 - HKLM..\Run: [AudioDrvEmulator] C:\Program Files\Creative\Shared Files\Module Loader\DLLML.exe (Creative Technology Ltd.)
                          O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
                          O4 - HKLM..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe (Corel, Inc.)
                          O4 - HKLM..\Run: [CTDVDDET] C:\Program Files\Creative\Sound Blaster X-Fi\DVDAudio\CTDVDDET.EXE (Creative Technology Ltd)
                          O4 - HKLM..\Run: [CTHelper] C:\WINDOWS\CTHELPER.EXE (Creative Technology Ltd)
                          O4 - HKLM..\Run: [CTxfiHlp] C:\WINDOWS\System32\CTXFIHLP.EXE (Creative Technology Ltd)
                          O4 - HKLM..\Run: [Dell AIO Printer A920] C:\Program Files\Dell AIO Printer A920\dlbkbmgr.exe (Dell Computer Corporation)
                          O4 - HKLM..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
                          O4 - HKLM..\Run: [DLA] C:\WINDOWS\system32\DLA\DLACTRLW.EXE (Sonic Solutions)
                          O4 - HKLM..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe ()
                          O4 - HKLM..\Run: [dscactivate] C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe ( )
                          O4 - HKLM..\Run: [fssui] C:\Program Files\Windows Live\Family Safety\fsui.exe (Microsoft Corporation)
                          O4 - HKLM..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation)
                          O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe (Macrovision Corporation)
                          O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (Macrovision Corporation)
                          O4 - HKLM..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.)
                          O4 - HKLM..\Run: [MSSE] c:\Program Files\Microsoft Security Essentials\msseces.exe (Microsoft Corporation)
                          O4 - HKLM..\Run: [NokiaMServer] C:\Program Files\Common Files\Nokia\MPlatform\NokiaMServer.exe ()
                          O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
                          O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
                          O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe ()
                          O4 - HKLM..\Run: [QuickTime Task] C:\Program Files\QuickTime\qttask.exe (Apple Inc.)
                          O4 - HKLM..\Run: [SGPUpdater] C:\Program Files\Search Guard PlusU\sgpUpdaters.exe File not found
                          O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
                          O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe (RealNetworks, Inc.)
                          O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\Updreg.EXE (Creative Technology Ltd.)
                          O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanel.exe (Creative Technology Ltd)
                          O4 - HKCU..\Run: [DellSupport] C:\Program Files\Dell Support\DSAgnt.exe (Gteko Ltd.)
                          O4 - HKCU..\Run: [DellSupportCenter] C:\Program Files\Dell Support Center\bin\sprtcmd.exe (SupportSoft, Inc.)
                          O4 - HKCU..\Run: [Google Update] C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\Google\Update\GoogleUpdate.exe (Google Inc.)
                          O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\Steam.exe (Valve Corporation)
                          O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk = C:\WINDOWS\Installer\{0240BDFB-2995-4A3F-8C96-18D41282B716}\Icon0240BDFB3.exe ()
                          O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Nokia Nseries PC Suite.lnk = C:\Program Files\Nokia\NNPCS\RunLauncher.exe ()
                          O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
                          O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
                          O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
                          O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
                          O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
                          O9 - Extra Button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
                          O9 - Extra 'Tools' menuitem : &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
                          O9 - Extra Button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
                          O9 - Extra 'Tools' menuitem : S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
                          O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
                          O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
                          O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
                          O15 - HKLM\..Trusted Domains: 63 domain(s) and sub-domain(s) not assigned to a zone.
                          O15 - HKCU\..Trusted Domains: 64 domain(s) and sub-domain(s) not assigned to a zone.
                          O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} http://support.euro.dell.com/systemprofiler/SysPro.CAB (SysProWmi Class)
                          O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} http://www.bebo.com/files/BeboUploader.5.1.4.cab (Bebo Uploader Control)
                          O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
                          O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://go.microsoft.com/fwlink/?linkid=39204 (Windows Genuine Advantage Validation Tool)
                          O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.srtest.com/srl_bin/sysreqlab_srl.cab (System Requirements Lab Class)
                          O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} C:\Program Files\Yahoo!\Common\Yinsthelper.dll (Installation Support)
                          O16 - DPF: {459E93B6-150E-45D5-8D4B-45C66FC035FE} http://apps.corel.com/nos_dl_manager_dev/plugin/IEGetPlugin.ocx (get_atlcom Class)
                          O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1190059001203 (MUWebControl Class)
                          O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
                          O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} http://upload.facebook.com/controls/2009.07.28_v5.5.8.1/FacebookPhotoUploader55.cab (Facebook Photo Uploader 5 Control)
                          O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
                          O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.)
                          O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab (ActiveScan 2.0 Installer Class)
                          O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab (IWinAmpActiveX Class)
                          O16 - DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab (Reg Error: Key error.)
                          O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Reg Error: Key error.)
                          O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Reg Error: Key error.)
                          O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab (Reg Error: Key error.)
                          O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.)
                          O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.)
                          O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
                          O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
                          O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
                          O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5155/mcfscan.cab (McFreeScan Class)
                          O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
                          O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll File not found
                          O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
                          O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
                          O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
                          O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
                          O24 - Desktop WallPaper: C:\Documents and Settings\Declan Fitzpatrick\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
                          O24 - Desktop BackupWallPaper: C:\Documents and Settings\Declan Fitzpatrick\Application Data\Microsoft\Internet Explorer\Internet Explorer Wallpaper.bmp
                          O32 - HKLM CDRom: AutoRun - 1
                          O32 - AutoRun File - [2005/08/16 03:43:04 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
                          O32 - AutoRun File - [2006/05/16 21:54:55 | 00,000,000 | R--D | M] - E:\Autorun -- [ UDF1.02 ]
                          O32 - AutoRun File - [2006/01/21 13:00:50 | 00,253,952 | R--- | M] (Firaxis Games) - E:\autorun.exe -- [ UDF1.02 ]
                          O32 - AutoRun File - [2006/01/21 13:00:50 | 00,007,952 | R--- | M] () - E:\autorun.inf -- [ UDF1.02 ]
                          O35 - comfile [open] -- "%1" %*
                          O35 - exefile [open] -- "%1" %*
                           
                          NetSvcs: 6to4 -  File not found
                          NetSvcs: Ias - C:\WINDOWS\system32\ias [2005/08/16 03:22:48 | 00,000,000 | ---D | M]
                          NetSvcs: Iprip -  File not found
                          NetSvcs: Irmon -  File not found
                          NetSvcs: NWCWorkstation -  File not found
                          NetSvcs: Nwsapagent -  File not found
                          NetSvcs: WmdmPmSp -  File not found
                           
                          MsConfig - StartUpReg: MSN Messenger - hkey= - key= -  File not found
                          MsConfig - State: "system.ini" - 0
                          MsConfig - State: "win.ini" - 0
                          MsConfig - State: "bootini" - 0
                          MsConfig - State: "services" - 0
                          MsConfig - State: "startup" - 2
                           
                          SafeBootMin: Base - Driver Group
                          SafeBootMin: Boot Bus Extender - Driver Group
                          SafeBootMin: Boot file system - Driver Group
                          SafeBootMin: File system - Driver Group
                          SafeBootMin: Filter - Driver Group
                          SafeBootMin: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
                          SafeBootMin: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
                          SafeBootMin: PCI Configuration - Driver Group
                          SafeBootMin: PNP Filter - Driver Group
                          SafeBootMin: Primary disk - Driver Group
                          SafeBootMin: SCSI Class - Driver Group
                          SafeBootMin: sermouse.sys - Driver
                          SafeBootMin: System Bus Extender - Driver Group
                          SafeBootMin: vds - Service
                          SafeBootMin: vga.sys - Driver
                          SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                          SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                          SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                          SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                          SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                          SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                          SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                          SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                          SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                          SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                          SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                          SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
                          SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                          SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                           
                          SafeBootNet: Base - Driver Group
                          SafeBootNet: Boot Bus Extender - Driver Group
                          SafeBootNet: Boot file system - Driver Group
                          SafeBootNet: File system - Driver Group
                          SafeBootNet: Filter - Driver Group
                          SafeBootNet: Lavasoft Ad-Aware Service - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe (Lavasoft)
                          SafeBootNet: MsMpSvc - c:\Program Files\Microsoft Security Essentials\MsMpEng.exe (Microsoft Corporation)
                          SafeBootNet: NDIS Wrapper - Driver Group
                          SafeBootNet: NetBIOSGroup - Driver Group
                          SafeBootNet: NetDDEGroup - Driver Group
                          SafeBootNet: Network - Driver Group
                          SafeBootNet: NetworkProvider - Driver Group
                          SafeBootNet: PCI Configuration - Driver Group
                          SafeBootNet: PNP Filter - Driver Group
                          SafeBootNet: PNP_TDI - Driver Group
                          SafeBootNet: Primary disk - Driver Group
                          SafeBootNet: SCSI Class - Driver Group
                          SafeBootNet: sermouse.sys - Driver
                          SafeBootNet: Streams Drivers - Driver Group
                          SafeBootNet: System Bus Extender - Driver Group
                          SafeBootNet: TDI - Driver Group
                          SafeBootNet: vga.sys - Driver
                          SafeBootNet: vsmon - Service
                          SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
                          SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
                          SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
                          SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
                          SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
                          SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
                          SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
                          SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
                          SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
                          SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
                          SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
                          SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
                          SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
                          SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
                          SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
                          SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
                          SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
                           
                          ActiveX: {0291E591-EA41-4c82-8106-3DC6CE7F7664} - Reg Error: Value error.
                          ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
                          ActiveX: {10072CEC-8CC1-11D1-986E-00A0C955B42F} - Vector Graphics Rendering (VML)
                          ActiveX: {1BC46932-21B2-4130-86E0-B4EB4F7A7A7B} - Microsoft .NET Framework 1.0 Hotfix (KB887998)
                          ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - NetShow
                          ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 6.4
                          ActiveX: {233C1507-6A77-46A4-9443-F871F945D258} - Adobe Shockwave Director 10.4
                          ActiveX: {283807B5-2C60-11D0-A31D-00AA00B92C03} - DirectAnimation
                          ActiveX: {2A202491-F00D-11cf-87CC-0020AFEECF20} - Adobe Shockwave Director 10.4
                          ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
                          ActiveX: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} - Reg Error: Value error.
                          ActiveX: {347B0667-C7ED-429B-BDE3-CC8D3BACAA31} - Reg Error: Value error.
                          ActiveX: {36f8ec70-c29a-11d1-b5c7-0000f8051515} - Dynamic HTML Data Binding for Java
                          ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
                          ActiveX: {3bf42070-b3b1-11d1-b5c5-0000f8051515} - Uniscribe
                          ActiveX: {407408d4-94ed-4d86-ab69-a7f649d112ee} - %SystemRoot%\System32\rundll32.exe setupapi,InstallHinfSection QuickLaunchShortcut 640 %systemroot%\inf\mcdftreg.inf
                          ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
                          ActiveX: {4278c270-a269-11d1-b5bf-0000f8051515} - Advanced Authoring
                          ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:OE /CALLER:WINNT /user /install
                          ActiveX: {44BBA842-CC51-11CF-AAFA-00AA00B6015B} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msnetmtg.inf,NetMtg.Install.PerUser.NT
                          ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - DirectShow
                          ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
                          ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
                          ActiveX: {4f216970-c90c-11d1-b5c7-0000f8051515} - DirectAnimation Java Classes
                          ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.8
                          ActiveX: {5056b317-8d4c-43ee-8543-b9d1e234b8f4} - Security Update for Windows XP (KB923789)
                          ActiveX: {5945c046-1e7d-11d1-bc44-00c04fd912be} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\msmsgs.inf,BLC.QuietInstall.PerUser
                          ActiveX: {5A8D6EE0-3E18-11D0-821E-444553540000} - ICW
                          ActiveX: {5CA109D3-A084-47E8-A9CB-D497322E3F50} - Silverlight 2.0
                          ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
                          ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
                          ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
                          ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
                          ActiveX: {7131646D-CD3C-40F4-97B9-CD9E4E6262EF} - .NET Framework
                          ActiveX: {73fa19d0-2d75-11d2-995d-00c04f98bbc9} - Web Folders
                          ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - "%ProgramFiles%\Outlook Express\setup50.exe" /APP:WAB /CALLER:WINNT /user /install
                          ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
                          ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\WINDOWS\system32\ie4uinit.exe -BaseSettings
                          ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - c:\WINDOWS\system32\Rundll32.exe c:\WINDOWS\system32\mscories.dll,Install
                          ActiveX: {8b15971b-5355-4c82-8c07-7e181ea07608} - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\fxsocm.inf,Fax.Install.PerUser
                          ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
                          ActiveX: {94de52c8-2d59-4f1b-883e-79663d2d9a8c} - Fax Provider
                          ActiveX: {A17E30C4-A9BA-11D4-8673-60DB54C10000} - Reg Error: Value error.
                          ActiveX: {AA218328-0EA8-4D70-8972-E987A9190FF4} - Reg Error: Value error.
                          ActiveX: {B508B3F1-A24A-32C0-B310-85786919EF28} - .NET Framework
                          ActiveX: {BDE0FA43-6952-4BA8-8C58-09AF690F88E1} - Microsoft .NET Framework 1.0 Hotfix (KB930494)
                          ActiveX: {C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F} - .NET Framework
                          ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
                          ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
                          ActiveX: {CC2A9BA0-3BDD-11D0-821E-444553540000} - Task Scheduler
                          ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
                          ActiveX: {D27CDB6E-AE6D-11cf-96B8-444553540000} - Adobe Flash Player
                          ActiveX: {DAA94A2A-2A8D-4D3B-9DB8-56FBECED082D} - Microsoft .NET Framework 1.1 Security Update (KB953297)
                          ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
                          ActiveX: {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - Reg Error: Value error.
                          ActiveX: {E8EA5BD6-D931-4001-ABF6-81BAA500360A} - Microsoft .NET Framework 1.0 Hotfix (KB953295)
                          ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
                          ActiveX: {EA29D410-CE41-4953-A862-2DE706A1DAD7} - Microsoft .NET Framework 1.0 Service Pack 3
                          ActiveX: {FDC11A6F-17D1-48f9-9EA3-9051954BAA24} - .NET Framework
                          ActiveX: <{12d0ed0d-0ee0-4f90-8827-78cefb8f4988} - C:\WINDOWS\system32\ieudinit.exe
                          ActiveX: >{1b5ce4e5-0b1e-4e64-9d91-3829ccb2414e} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
                          ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\WINDOWS\inf\unregmp2.exe /ShowWMP
                          ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\WINDOWS\system32\ie4uinit.exe -UserIconConfig
                          ActiveX: >{881dd1c5-3dcf-431b-b061-f3f88e8be88a} - %systemroot%\system32\shmgrate.exe OCInstallUserConfigOE
                          ActiveX: KB910393 - rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\INF\EasyCDBlock.inf,PerUserInstall

                          Deckfitz

                            Topic Starter


                            Rookie

                            Re: Google Search Redirection
                            « Reply #22 on: January 29, 2010, 09:12:48 PM »
                            Drivers32: msacm.iac2 - C:\WINDOWS\system32\iac25_32.ax (Intel Corporation)
                            Drivers32: msacm.l3acm - C:\WINDOWS\system32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
                            Drivers32: msacm.siren - C:\WINDOWS\System32\sirenacm.dll (Microsoft Corporation)
                            Drivers32: msacm.sl_anet - C:\WINDOWS\System32\sl_anet.acm (Sipro Lab Telecom Inc.)
                            Drivers32: msacm.trspch - C:\WINDOWS\System32\tssoft32.acm (DSP GROUP, INC.)
                            Drivers32: vidc.cvid - C:\WINDOWS\System32\iccvid.dll (Radius Inc.)
                            Drivers32: vidc.DIVX - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
                            Drivers32: vidc.iv31 - C:\WINDOWS\System32\ir32_32.dll ()
                            Drivers32: vidc.iv32 - C:\WINDOWS\System32\ir32_32.dll ()
                            Drivers32: vidc.iv41 - C:\WINDOWS\System32\ir41_32.ax (Intel Corporation)
                            Drivers32: vidc.iv50 - C:\WINDOWS\System32\ir50_32.dll (Intel Corporation)
                            Drivers32: vidc.VP60 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
                            Drivers32: vidc.VP61 - C:\WINDOWS\system32\vp6vfw.dll (On2.com)
                            Drivers32: vidc.yv12 - C:\WINDOWS\System32\DivX.dll (DivX, Inc.)
                             
                            ========== Files/Folders - Created Within 14 Days ==========
                             
                            [2010/01/30 03:43:56 | 00,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
                            [2010/01/30 02:37:09 | 00,439,808 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\TFC.exe
                            [2010/01/29 04:38:39 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Malwarebytes
                            [2010/01/29 04:38:34 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
                            [2010/01/29 04:38:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
                            [2010/01/29 04:38:30 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
                            [2010/01/29 04:38:30 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
                            [2010/01/28 23:53:01 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Recent
                            [2010/01/28 23:37:33 | 00,000,000 | ---D | C] -- C:\Program Files\CCleaner
                            [2010/01/28 20:03:03 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Sun
                            [2010/01/27 19:52:12 | 00,028,552 | ---- | C] (Panda Security, S.L.) -- C:\WINDOWS\System32\drivers\pavboot.sys
                            [2010/01/27 19:52:04 | 00,000,000 | ---D | C] -- C:\Program Files\Panda Security
                            [2010/01/27 18:37:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
                            [2010/01/27 18:18:55 | 00,000,000 | ---D | C] -- C:\Program Files\Microsoft Security Essentials
                            [2010/01/26 23:39:59 | 00,050,968 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgfwdx.dll
                            [2010/01/26 23:39:59 | 00,030,104 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgfwdx.sys
                            [2010/01/26 23:36:02 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Application Data\Microsoft
                            [2010/01/26 23:36:02 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Application Data\Microsoft
                            [2010/01/26 23:36:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft
                            [2010/01/26 23:36:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft
                            [2010/01/26 21:47:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\avg9
                            [2010/01/26 21:47:08 | 00,000,000 | ---D | C] -- C:\Program Files\Free Window Registry Repair
                            [2010/01/26 21:37:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\AVG8
                            [2010/01/23 22:33:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\vlc
                            [2010/01/23 22:31:49 | 00,000,000 | ---D | C] -- C:\Program Files\VideoLAN
                            [2010/01/18 06:12:36 | 00,000,000 | ---D | C] -- C:\Program Files\Netopia
                            [2010/01/18 01:12:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\swvypg
                            [2009/12/08 22:57:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Help
                            [2009/12/08 22:57:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Help
                            [2009/02/07 17:21:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\SupportSoft
                            [2007/11/23 23:12:21 | 00,033,792 | ---- | C] ( ) -- C:\WINDOWS\System32\a3d.dll
                            [2007/10/05 20:38:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Macromedia
                            [2007/10/05 20:33:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Local Settings\Application Data\Google
                            [2007/10/05 20:33:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Application Data\Google
                            [2007/08/15 22:08:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Local Settings\Application Data\Apple
                            [2005/09/01 01:33:54 | 00,092,672 | ---- | C] ( ) -- C:\WINDOWS\System32\DVDRead.dll
                             
                            ========== Files - Modified Within 14 Days ==========
                             
                            [2010/01/30 03:44:02 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\OTL.exe
                            [2010/01/30 03:41:46 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
                            [2010/01/30 03:40:17 | 00,002,333 | ---- | M] () -- C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Dell Network Assistant.lnk
                            [2010/01/30 03:39:42 | 00,192,017 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
                            [2010/01/30 03:39:29 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
                            [2010/01/30 03:39:21 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
                            [2010/01/30 03:39:19 | 21,453,04576 | -HS- | M] () -- C:\hiberfil.sys
                            [2010/01/30 03:38:34 | 19,136,512 | -H-- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\NTUSER.DAT
                            [2010/01/30 03:38:34 | 00,064,980 | ---- | M] () -- C:\WINDOWS\System32\DVCState-{00000004-00000000-00000004-00001102-00000005-10031102}.rfx
                            [2010/01/30 03:38:34 | 00,055,172 | ---- | M] () -- C:\WINDOWS\System32\BMXStateBkp-{00000004-00000000-00000004-00001102-00000005-10031102}.rfx
                            [2010/01/30 03:38:34 | 00,055,172 | ---- | M] () -- C:\WINDOWS\System32\BMXState-{00000004-00000000-00000004-00001102-00000005-10031102}.rfx
                            [2010/01/30 03:38:34 | 00,001,080 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm
                            [2010/01/30 03:38:34 | 00,001,080 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm
                            [2010/01/30 03:38:11 | 00,000,178 | -HS- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\ntuser.ini
                            [2010/01/30 02:51:00 | 00,001,030 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3329145560-1003980739-774479982-1005UA.job
                            [2010/01/30 02:51:00 | 00,000,978 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskUserS-1-5-21-3329145560-1003980739-774479982-1005Core.job
                            [2010/01/30 02:37:13 | 00,439,808 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\TFC.exe
                            [2010/01/30 02:30:33 | 00,179,448 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
                            [2010/01/30 00:29:09 | 00,000,448 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{642F835B-E188-4E72-943B-FC527F25C4DA}.job
                            [2010/01/29 20:49:31 | 00,021,063 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Thingy.xlsx
                            [2010/01/29 16:39:50 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\iTunes.lnk
                            [2010/01/29 04:38:37 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
                            [2010/01/29 04:36:07 | 00,115,200 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
                            [2010/01/29 03:42:10 | 00,753,772 | RH-- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
                            [2010/01/28 23:37:34 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\CCleaner.lnk
                            [2010/01/28 02:16:10 | 00,000,472 | ---- | M] () -- C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job
                            [2010/01/27 18:46:04 | 00,000,933 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Spybot - Search & Destroy.lnk
                            [2010/01/27 18:18:56 | 00,000,820 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
                            [2010/01/27 00:59:53 | 00,025,088 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Covering Letter 01.doc
                            [2010/01/26 23:39:59 | 00,050,968 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\avgfwdx.dll
                            [2010/01/26 23:39:59 | 00,030,104 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\WINDOWS\System32\drivers\avgfwdx.sys
                            [2010/01/26 15:00:19 | 00,000,165 | -H-- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\~$Thingy.xlsx
                            [2010/01/25 18:39:46 | 00,000,279 | ---- | M] () -- C:\WINDOWS\dellstat.ini
                            [2010/01/24 13:06:31 | 02,120,678 | -H-- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\IconCache.db
                            [2010/01/24 02:47:38 | 00,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat
                            [2010/01/23 22:32:13 | 00,000,719 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
                            [2010/01/23 08:29:13 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
                            [2010/01/22 15:47:55 | 00,025,600 | ---- | M] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Covering Letter.doc
                            [2010/01/18 06:12:36 | 00,000,136 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\eircom broadband connection.url
                             
                            ========== Files Created - No Company Name ==========
                             
                            [2010/01/29 04:38:37 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Malwarebytes' Anti-Malware.lnk
                            [2010/01/28 23:37:34 | 00,001,548 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\CCleaner.lnk
                            [2010/01/27 18:46:04 | 00,000,933 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Desktop\Spybot - Search & Destroy.lnk
                            [2010/01/27 18:18:56 | 00,000,820 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Microsoft Security Essentials.lnk
                            [2010/01/26 15:00:19 | 00,000,165 | -H-- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\~$Thingy.xlsx
                            [2010/01/24 02:47:38 | 00,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat
                            [2010/01/23 22:32:13 | 00,000,719 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\VLC media player.lnk
                            [2010/01/22 15:19:12 | 00,025,088 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\My Documents\Covering Letter 01.doc
                            [2010/01/18 06:12:35 | 00,000,136 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\eircom broadband connection.url
                            [2009/06/29 21:21:22 | 00,076,407 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Smiley.ico
                            [2009/03/15 18:47:01 | 00,002,516 | -HS- | C] () -- C:\Documents and Settings\All Users\Application Data\KGyGaAvL.sys
                            [2009/03/15 18:47:01 | 00,000,088 | RHS- | C] () -- C:\Documents and Settings\All Users\Application Data\26D3307CAE.sys
                            [2009/03/15 18:34:56 | 00,000,000 | ---- | C] () -- C:\WINDOWS\iPlayer.INI
                            [2009/01/09 19:47:13 | 00,000,187 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\G-Force Prefs (WindowsMediaPlayer).txt
                            [2008/09/11 21:08:06 | 00,010,273 | ---- | C] () -- C:\WINDOWS\cdplayer.ini
                            [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
                            [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
                            [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
                            [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
                            [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
                            [2008/06/11 09:02:34 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
                            [2008/06/11 09:02:32 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
                            [2008/06/11 09:02:32 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
                            [2008/06/11 09:02:32 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
                            [2008/06/05 08:58:26 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll
                            [2008/04/23 02:21:37 | 01,490,661 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\NMM-MetaData.db
                            [2007/12/24 16:12:32 | 00,278,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
                            [2007/12/24 16:12:32 | 00,025,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
                            [2007/11/27 20:48:29 | 00,000,319 | ---- | C] () -- C:\WINDOWS\game.ini
                            [2007/11/24 00:02:03 | 00,087,403 | ---- | C] () -- C:\WINDOWS\System32\instwdm.ini
                            [2007/11/23 23:13:10 | 00,003,072 | ---- | C] () -- C:\WINDOWS\CTXFIRES.DLL
                            [2007/11/22 12:17:27 | 00,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
                            [2007/11/22 12:17:27 | 00,022,328 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\PnkBstrK.sys
                            [2007/10/31 20:25:36 | 00,000,049 | ---- | C] () -- C:\WINDOWS\lexstat.ini
                            [2007/10/04 17:14:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
                            [2007/10/04 17:14:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
                            [2007/10/04 17:14:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
                            [2007/10/04 17:14:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
                            [2007/10/04 17:14:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
                            [2007/08/07 19:22:22 | 00,141,180 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
                            [2007/06/27 21:59:46 | 00,000,152 | ---- | C] () -- C:\WINDOWS\CoolPlay.ini
                            [2007/06/20 22:37:22 | 00,003,764 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
                            [2007/06/20 22:37:22 | 00,000,088 | RHS- | C] () -- C:\WINDOWS\System32\FD98559E90.sys
                            [2007/06/20 16:20:59 | 00,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll
                            [2007/06/19 20:25:42 | 00,000,091 | ---- | C] () -- C:\WINDOWS\CIV.INI
                            [2007/06/19 19:54:34 | 00,001,755 | ---- | C] () -- C:\Documents and Settings\All Users\Application Data\QTSBandwidthCache
                            [2007/06/12 21:39:18 | 00,000,279 | ---- | C] () -- C:\WINDOWS\dellstat.ini
                            [2007/06/12 21:39:07 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbkvs.dll
                            [2007/06/12 21:38:45 | 00,000,255 | ---- | C] () -- C:\WINDOWS\System32\dlbkcoin.ini
                            [2007/06/10 21:09:28 | 00,115,200 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
                            [2007/06/10 20:41:30 | 00,011,776 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\dvd.bmk
                            [2007/06/09 19:16:41 | 00,000,141 | ---- | C] () -- C:\Documents and Settings\Declan Fitzpatrick\Local Settings\Application Data\fusioncache.dat
                            [2007/06/05 20:39:48 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
                            [2007/06/05 20:35:44 | 00,000,126 | ---- | C] () -- C:\WINDOWS\wininit.ini
                            [2007/06/05 20:06:18 | 00,000,190 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini
                            [2007/06/05 20:06:12 | 00,050,432 | ---- | C] () -- C:\WINDOWS\System32\claptn.ini
                            [2007/06/05 19:58:04 | 00,001,206 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
                            [2006/09/27 16:47:40 | 00,000,307 | ---- | C] () -- C:\WINDOWS\System32\KILL.INI
                            [2006/08/17 11:33:54 | 00,037,888 | ---- | C] () -- C:\WINDOWS\System32\CTBURST.DLL
                            [2005/12/07 10:31:00 | 00,202,752 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
                            [2005/11/10 00:56:34 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
                            [2005/08/16 03:37:24 | 00,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
                            [2005/08/16 03:35:21 | 00,057,600 | ---- | C] () -- C:\WINDOWS\System32\drivers\redbook.sys
                            [2005/08/05 13:01:54 | 00,235,008 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
                            [2005/06/07 21:10:50 | 00,070,656 | ---- | C] () -- C:\WINDOWS\System32\CTMMACTL.DLL
                             
                            ========== LOP Check ==========
                             
                            [2009/07/01 22:50:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\1219D
                            [2010/01/26 23:40:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\avg9
                            [2008/04/23 02:06:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Downloaded Installations
                            [2009/06/11 22:12:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Installations
                            [2009/08/26 20:29:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Last.fm
                            [2007/09/21 16:20:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\MailFrontier
                            [2008/04/23 01:50:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\Nokia
                            [2008/04/23 02:04:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\PC Suite
                            [2007/06/05 20:32:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SingleClick Systems
                            [2007/11/05 17:31:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SupportSoft
                            [2010/01/30 03:40:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\TEMP
                            [2007/07/14 22:49:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\WinZip
                            [2009/11/04 01:31:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
                            [2009/04/29 22:44:17 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
                            [2009/06/18 23:08:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
                            [2010/01/27 18:37:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\{BC9FCCF7-E686-494B-8C9B-55C9A39A7CA9}
                            [2009/12/03 21:39:57 | 00,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}
                            [2008/02/03 01:47:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\.BitTornado
                            [2007/12/24 14:43:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Bioshock
                            [2010/01/27 02:12:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\BitTorrent
                            [2008/04/19 21:38:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Datalayer
                            [2009/01/12 08:01:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\DNA
                            [2007/06/20 22:39:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Leadertech
                            [2009/06/23 00:54:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\LimeWire
                            [2007/07/06 21:12:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\My Games
                            [2009/06/11 21:04:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\Nokia
                            [2009/06/12 21:44:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\NSeries
                            [2008/04/22 21:50:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\PC Suite
                            [2009/04/20 22:38:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\TweetDeckFast.F9107117265DB7542C1A806C8DB837742CE14C21.1
                            [2008/09/14 19:07:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Declan Fitzpatrick\Application Data\vghd
                            [2010/01/28 02:16:10 | 00,000,472 | ---- | M] () -- C:\WINDOWS\Tasks\Ad-Aware Update (Weekly).job
                            [2010/01/30 00:29:09 | 00,000,448 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{642F835B-E188-4E72-943B-FC527F25C4DA}.job
                             
                            ========== Purity Check ==========
                             
                             
                             
                            ========== Custom Scans ==========
                             
                             
                            < %SYSTEMDRIVE%\*.exe >
                             
                            < %systemroot%\*. /mp /s >
                             
                            < c:\$recycle.bin\*.* /s >
                             
                            < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs >
                            HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2010-01-22 02:29:23
                             
                             
                            < MD5 for: AGP440.SYS  >
                            [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\i386\sp2.cab:AGP440.sys
                            [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:AGP440.sys
                            [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:AGP440.sys
                            [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:AGP440.sys
                            [2008/04/13 18:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\ServicePackFiles\i386\agp440.sys
                            [2008/04/13 18:36:38 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=08FD04AA961BDC77FB983F328334E3D7 -- C:\WINDOWS\system32\drivers\agp440.sys
                            [2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\i386\AGP440.SYS
                            [2004/08/03 22:07:42 | 00,042,368 | ---- | M] (Microsoft Corporation) MD5=2C428FA0C3E3A01ED93C9B2A27D8D4BB -- C:\WINDOWS\$NtServicePackUninstall$\agp440.sys
                             
                            < MD5 for: ATAPI.SYS  >
                            [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\i386\sp2.cab:atapi.sys
                            [2004/08/10 04:00:00 | 16,971,599 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp2.cab:atapi.sys
                            [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\Driver Cache\i386\sp3.cab:atapi.sys
                            [2008/09/11 19:09:37 | 23,852,652 | ---- | M] () .cab file -- C:\WINDOWS\ServicePackFiles\i386\sp3.cab:atapi.sys
                            [2008/04/13 18:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\ServicePackFiles\i386\atapi.sys
                            [2008/04/13 18:40:30 | 00,096,512 | ---- | M] (Microsoft Corporation) MD5=9F3A2F5AA6875C72BF062C712CFA2674 -- C:\WINDOWS\system32\drivers\atapi.sys
                            [2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\i386\atapi.sys
                            [2004/08/03 21:59:44 | 00,095,360 | ---- | M] (Microsoft Corporation) MD5=CDFE4411A69C224BD1D11B2DA92DAC51 -- C:\WINDOWS\$NtServicePackUninstall$\atapi.sys
                             
                            < MD5 for: AUTOCHK.EXE  >
                            [2008/04/14 00:12:12 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\ServicePackFiles\i386\autochk.exe
                            [2008/04/14 00:12:12 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=23043C91A0F9DFB4B9E9F87B680863B4 -- C:\WINDOWS\system32\autochk.exe
                            [2004/08/10 04:00:00 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=B3415B9D6026F65E43089ABED096C38C -- C:\i386\autochk.exe
                            [2004/08/10 04:00:00 | 00,588,800 | ---- | M] (Microsoft Corporation) MD5=B3415B9D6026F65E43089ABED096C38C -- C:\WINDOWS\$NtServicePackUninstall$\autochk.exe
                             
                            < MD5 for: BEEP.SYS  >
                            [2004/08/10 04:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\i386\beep.sys
                            [2004/08/10 04:00:00 | 00,004,224 | ---- | M] (Microsoft Corporation) MD5=DA1F27D85E0D1525F6621372E7B685E9 -- C:\WINDOWS\system32\drivers\beep.sys
                             
                            < MD5 for: EVENTLOG.DLL  >
                            [2008/04/14 00:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\ServicePackFiles\i386\eventlog.dll
                            [2008/04/14 00:11:53 | 00,056,320 | ---- | M] (Microsoft Corporation) MD5=6D4FEB43EE538FC5428CC7F0565AA656 -- C:\WINDOWS\system32\eventlog.dll
                            [2004/08/10 04:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\i386\eventlog.dll
                            [2004/08/10 04:00:00 | 00,055,808 | ---- | M] (Microsoft Corporation) MD5=82B24CB70E5944E6E34662205A2A5B78 -- C:\WINDOWS\$NtServicePackUninstall$\eventlog.dll
                             
                            < MD5 for: EXPLORER.EXE  >
                            [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\explorer.exe
                            [2008/04/14 00:12:19 | 01,033,728 | ---- | M] (Microsoft Corporation) MD5=12896823FB95BFB3DC9B46BCAEDC9923 -- C:\WINDOWS\ServicePackFiles\i386\explorer.exe
                            [2007/06/13 11:26:03 | 01,033,216 | ---- | M] (Microsoft Corporation) MD5=7712DF0CDDE3A5AC89843E61CD5B3658 -- C:\WINDOWS\$hf_mig$\KB938828\SP2QFE\explorer.exe
                            [2007/06/13 10:23:07 | 01,033,216 | ---- | M] (Microsoft Corporation) MD5=97BD6515465659FF8F3B7BE375B2EA87 -- C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
                            [2004/08/10 04:00:00 | 01,032,192 | ---- | M] (Microsoft Corporation) MD5=A0732187050030AE399B241436565E64 -- C:\WINDOWS\$NtUninstallKB938828$\explorer.exe
                             
                            < MD5 for: IASTOR.SYS  >
                            [2006/10/10 12:03:48 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\drivers\storage\R130118\iastor.sys
                            [2006/07/06 05:59:42 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\i386\iaStor.sys
                            [2006/07/06 05:59:42 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver\iaStor.sys
                            [2006/07/06 05:59:42 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\WINDOWS\system32\drivers\iaStor.sys
                            [2006/10/10 12:03:48 | 00,246,784 | ---- | M] (Intel Corporation) MD5=019CF5F31C67030841233C545A0E217A -- C:\WINDOWS\system32\ReinstallBackups\0014\DriverFiles\iaStor.sys
                            [2006/07/06 06:01:32 | 00,484,864 | ---- | M] (Intel Corporation) MD5=6A3C354BFC163B81F6EF2FC421280DB5 -- C:\Program Files\Intel\Intel Matrix Storage Manager\Driver64\IaStor.sys
                             
                            < MD5 for: IMM32.DLL  >
                            [2008/04/14 00:11:54 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\ServicePackFiles\i386\imm32.dll
                            [2008/04/14 00:11:54 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=0DA85218E92526972A821587E6A8BF8F -- C:\WINDOWS\system32\imm32.dll
                            [2004/08/10 04:00:00 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=87CA7CE6469577F059297B9D6556D66D -- C:\i386\imm32.dll
                            [2004/08/10 04:00:00 | 00,110,080 | ---- | M] (Microsoft Corporation) MD5=87CA7CE6469577F059297B9D6556D66D -- C:\WINDOWS\$NtServicePackUninstall$\imm32.dll
                             
                            < MD5 for: KERNEL32.DLL  >
                            [2007/04/16 16:07:27 | 00,986,112 | ---- | M] (Microsoft Corporation) MD5=09F7CB3687F86EDAA4CA081F7AB66C03 -- C:\WINDOWS\$hf_mig$\KB935839\SP2QFE\kernel32.dll
                            [2006/07/05 10:57:10 | 00,985,088 | ---- | M] (Microsoft Corporation) MD5=0FDD84928A5DDE2510761B7EC76CCEC9 -- C:\WINDOWS\$hf_mig$\KB917422\SP2QFE\kernel32.dll
                            [2007/04/16 15:52:53 | 00,984,576 | ---- | M] (Microsoft Corporation) MD5=A01F9CA902A88F7CED06884174D6419D -- C:\WINDOWS\$NtServicePackUninstall$\kernel32.dll
                            [2009/03/21 14:06:58 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\system32\dllcache\kernel32.dll
                            [2009/03/21 14:06:58 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=B921FB870C9AC0D509B2CCABBBBE95F3 -- C:\WINDOWS\system32\kernel32.dll
                            [2008/04/14 00:11:56 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\$NtUninstallKB959426$\kernel32.dll
                            [2008/04/14 00:11:56 | 00,989,696 | ---- | M] (Microsoft Corporation) MD5=C24B983D211C34DA8FCC1AC38477971D -- C:\WINDOWS\ServicePackFiles\i386\kernel32.dll
                            [2006/07/05 10:55:01 | 00,984,064 | ---- | M] (Microsoft Corporation) MD5=D8DB5397DE07577C1CB50BA6D23B3AD4 -- C:\i386\kernel32.dll
                            [2006/07/05 10:55:01 | 00,984,064 | ---- | M] (Microsoft Corporation) MD5=D8DB5397DE07577C1CB50BA6D23B3AD4 -- C:\WINDOWS\$NtUninstallKB935839$\kernel32.dll
                            [2009/03/21 13:59:23 | 00,991,744 | ---- | M] (Microsoft Corporation) MD5=DA11D9D6ECBDF0F93436A4B7C13F7BEC -- C:\WINDOWS\$hf_mig$\KB959426\SP3QFE\kernel32.dll
                             
                            < MD5 for: MSWSOCK.DLL  >
                            [2008/06/20 17:41:10 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=097722F235A1FB698BF9234E01B52637 -- C:\WINDOWS\$NtServicePackUninstall$\mswsock.dll
                            [2008/06/20 17:36:11 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=1DFCA7713EA5A70D5D93B436AEA0317A -- C:\WINDOWS\$hf_mig$\KB951748\SP2QFE\mswsock.dll
                            [2004/08/10 04:00:00 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\i386\mswsock.dll
                            [2004/08/10 04:00:00 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=4E74AF063C3271FBEA20DD940CFD1184 -- C:\WINDOWS\$NtUninstallKB951748_0$\mswsock.dll
                            [2008/06/20 17:46:57 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\$hf_mig$\KB951748\SP3GDR\mswsock.dll
                            [2008/06/20 17:46:57 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\system32\dllcache\mswsock.dll
                            [2008/06/20 17:46:57 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=832E4DD8964AB7ACC880B2837CB1ED20 -- C:\WINDOWS\system32\mswsock.dll
                            [2008/04/14 00:12:01 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\$NtUninstallKB951748$\mswsock.dll
                            [2008/04/14 00:12:01 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=B4138E99236F0F57D4CF49BAE98A0746 -- C:\WINDOWS\ServicePackFiles\i386\mswsock.dll
                            [2008/06/20 17:43:05 | 00,245,248 | ---- | M] (Microsoft Corporation) MD5=FCEE5FCB99F7C724593365C706D28388 -- C:\WINDOWS\$hf_mig$\KB951748\SP3QFE\mswsock.dll
                             
                            < MD5 for: NDIS.SYS  >
                            [2008/04/13 19:20:37 | 00,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\ServicePackFiles\i386\ndis.sys
                            [2008/04/13 19:20:37 | 00,182,656 | ---- | M] (Microsoft Corporation) MD5=1DF7F42665C94B825322FAE71721130D -- C:\WINDOWS\system32\drivers\ndis.sys
                            [2004/08/10 04:00:00 | 00,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\i386\ndis.sys
                            [2004/08/10 04:00:00 | 00,182,912 | ---- | M] (Microsoft Corporation) MD5=558635D3AF1C7546D26067D5D9B6959E -- C:\WINDOWS\$NtServicePackUninstall$\ndis.sys
                             
                            < MD5 for: NETLOGON.DLL  >
                            [2008/04/14 00:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\ServicePackFiles\i386\netlogon.dll
                            [2008/04/14 00:12:01 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=1B7F071C51B77C272875C3A23E1E4550 -- C:\WINDOWS\system32\netlogon.dll
                            [2004/08/10 04:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\i386\netlogon.dll
                            [2004/08/10 04:00:00 | 00,407,040 | ---- | M] (Microsoft Corporation) MD5=96353FCECBA774BB8DA74A1C6507015A -- C:\WINDOWS\$NtServicePackUninstall$\netlogon.dll
                             
                            < MD5 for: NTFS.SYS  >
                            [2007/02/09 11:23:36 | 00,574,976 | ---- | M] (Microsoft Corporation) MD5=05AB81909514BFD69CBB1F2C147CF6B9 -- C:\WINDOWS\$hf_mig$\KB930916\SP2QFE\ntfs.sys
                            [2007/02/09 11:10:35 | 00,574,464 | ---- | M] (Microsoft Corporation) MD5=19A811EF5F1ED5C926A028CE107FF1AF -- C:\WINDOWS\$NtServicePackUninstall$\ntfs.sys
                            [2008/04/13 19:15:53 | 00,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\ServicePackFiles\i386\ntfs.sys
                            [2008/04/13 19:15:53 | 00,574,976 | ---- | M] (Microsoft Corporation) MD5=78A08DD6A8D65E697C18E1DB01C5CDCA -- C:\WINDOWS\system32\drivers\ntfs.sys
                            [2004/08/10 04:00:00 | 00,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\i386\ntfs.sys
                            [2004/08/10 04:00:00 | 00,574,592 | ---- | M] (Microsoft Corporation) MD5=B78BE402C3F63DD55521F73876951CDD -- C:\WINDOWS\$NtUninstallKB930916$\ntfs.sys
                             
                            < MD5 for: NTMSSVC.DLL  >
                            [2008/04/14 00:12:02 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\ServicePackFiles\i386\ntmssvc.dll
                            [2008/04/14 00:12:02 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=156F64A3345BD23C600655FB4D10BC08 -- C:\WINDOWS\system32\ntmssvc.dll
                            [2004/08/10 04:00:00 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=B62F29C00AC55A761B2E45877D85EA0F -- C:\i386\ntmssvc.dll
                            [2004/08/10 04:00:00 | 00,435,200 | ---- | M] (Microsoft Corporation) MD5=B62F29C00AC55A761B2E45877D85EA0F -- C:\WINDOWS\$NtServicePackUninstall$\ntmssvc.dll
                             
                            < MD5 for: PROQUOTA.EXE  >
                            [2004/08/10 04:00:00 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=4D9D45A4370E0C2AD00C362B7118E2A4 -- C:\i386\proquota.exe
                            [2004/08/10 04:00:00 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=4D9D45A4370E0C2AD00C362B7118E2A4 -- C:\WINDOWS\$NtServicePackUninstall$\proquota.exe
                            [2008/04/14 00:12:32 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\ServicePackFiles\i386\proquota.exe
                            [2008/04/14 00:12:32 | 00,050,176 | ---- | M] (Microsoft Corporation) MD5=F6465A2EEF75468988A4FCF124148FA8 -- C:\WINDOWS\system32\proquota.exe
                             
                            < MD5 for: QMGR.DLL  >
                            [2004/08/10 04:00:00 | 00,382,464 | ---- | M] (Microsoft Corporation) MD5=2C69EC7E5A311334D10DD95F338FCCEA -- C:\i386\qmgr.dll
                            [2004/08/10 04:00:00 | 00,382,464 | ---- | M] (Microsoft Corporation) MD5=2C69EC7E5A311334D10DD95F338FCCEA -- C:\WINDOWS\$NtServicePackUninstall$\qmgr.dll
                            [2008/04/14 00:12:03 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\ServicePackFiles\i386\qmgr.dll
                            [2008/04/14 00:12:03 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\system32\bits\qmgr.dll
                            [2008/04/14 00:12:03 | 00,409,088 | ---- | M] (Microsoft Corporation) MD5=574738F61FCA2935F5265DC4E5691314 -- C:\WINDOWS\system32\qmgr.dll
                             
                            < MD5 for: SCECLI.DLL  >
                            [2004/08/10 04:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\i386\scecli.dll
                            [2004/08/10 04:00:00 | 00,180,224 | ---- | M] (Microsoft Corporation) MD5=0F78E27F563F2AAF74B91A49E2ABF19A -- C:\WINDOWS\$NtServicePackUninstall$\scecli.dll
                            [2008/04/14 00:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\ServicePackFiles\i386\scecli.dll
                            [2008/04/14 00:12:05 | 00,181,248 | ---- | M] (Microsoft Corporation) MD5=A86BB5E61BF3E39B62AB4C7E7085A084 -- C:\WINDOWS\system32\scecli.dll
                             
                            < MD5 for: SFCFILES.DLL  >
                            [2004/08/10 04:00:00 | 01,580,544 | ---- | M] (Microsoft Corporation) MD5=30A609E00BD1D4FFC49D6B5A432BE7F2 -- C:\i386\sfcfiles.dll
                            [2004/08/10 04:00:00 | 01,580,544 | ---- | M] (Microsoft Corporation) MD5=30A609E00BD1D4FFC49D6B5A432BE7F2 -- C:\WINDOWS\$NtServicePackUninstall$\sfcfiles.dll
                            [2008/04/14 00:12:05 | 01,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\ServicePackFiles\i386\sfcfiles.dll
                            [2008/04/14 00:12:05 | 01,614,848 | ---- | M] (Microsoft Corporation) MD5=9DD07AF82244867CA36681EA2D29CE79 -- C:\WINDOWS\system32\sfcfiles.dll
                             
                            < MD5 for: SPOOLSV.EXE  >
                            [2005/06/11 00:17:13 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=AD3D9D191AEA7B5445FE1D82FFBB4788 -- C:\WINDOWS\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
                            [2008/04/14 00:12:36 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\ServicePackFiles\i386\spoolsv.exe
                            [2008/04/14 00:12:36 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=D8E14A61ACC1D4A6CD0D38AEBAC7FA3B -- C:\WINDOWS\system32\spoolsv.exe
                            [2005/06/10 23:53:32 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=DA81EC57ACD4CDC3D4C51CF3D409AF9F -- C:\i386\spoolsv.exe
                            [2005/06/10 23:53:32 | 00,057,856 | ---- | M] (Microsoft Corporation) MD5=DA81EC57ACD4CDC3D4C51CF3D409AF9F -- C:\WINDOWS\$NtServicePackUninstall$\spoolsv.exe
                             
                            < MD5 for: SRSVC.DLL  >
                            [2008/04/14 00:12:07 | 00,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\ServicePackFiles\i386\srsvc.dll
                            [2008/04/14 00:12:07 | 00,171,008 | ---- | M] (Microsoft Corporation) MD5=3805DF0AC4296A34BA4BF93B346CC378 -- C:\WINDOWS\system32\srsvc.dll
                            [2004/08/10 04:00:00 | 00,170,496 | ---- | M] (Microsoft Corporation) MD5=92BDF74F12D6CBEC43C94D4B7F804838 -- C:\i386\srsvc.dll
                            [2004/08/10 04:00:00 | 00,170,496 | ---- | M] (Microsoft Corporation) MD5=92BDF74F12D6CBEC43C94D4B7F804838 -- C:\WINDOWS\$NtServicePackUninstall$\srsvc.dll
                             
                            < MD5 for: SVCHOST.EXE  >
                            [2008/04/14 00:12:36 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\ServicePackFiles\i386\svchost.exe
                            [2008/04/14 00:12:36 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=27C6D03BCDB8CFEB96B716F3D8BE3E18 -- C:\WINDOWS\system32\svchost.exe
                            [2004/08/10 04:00:00 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\i386\svchost.exe
                            [2004/08/10 04:00:00 | 00,014,336 | ---- | M] (Microsoft Corporation) MD5=8F078AE4ED187AAABC0A305146DE6716 -- C:\WINDOWS\$NtServicePackUninstall$\svchost.exe
                             
                            < MD5 for: TERMSRV.DLL  >
                            [2004/08/10 04:00:00 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=B60C877D16D9C880B952FDA04ADF16E6 -- C:\WINDOWS\$NtUninstallKB895961$\termsrv.dll
                            [2005/03/09 18:49:52 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=C29A5286E64D97385178452D5F307B98 -- C:\i386\termsrv.dll
                            [2005/03/09 18:49:52 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=C29A5286E64D97385178452D5F307B98 -- C:\WINDOWS\$NtServicePackUninstall$\termsrv.dll
                            [2008/04/14 00:12:07 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\ServicePackFiles\i386\termsrv.dll
                            [2008/04/14 00:12:07 | 00,295,424 | ---- | M] (Microsoft Corporation) MD5=FF3477C03BE7201C294C35F684B3479F -- C:\WINDOWS\system32\termsrv.dll
                             
                            < MD5 for: USERINIT.EXE  >
                            [2004/08/10 04:00:00 | 00,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\i386\userinit.exe
                            [2004/08/10 04:00:00 | 00,024,576 | ---- | M] (Microsoft Corporation) MD5=39B1FFB03C2296323832ACBAE50D2AFF -- C:\WINDOWS\$NtServicePackUninstall$\userinit.exe
                            [2008/04/14 00:12:38 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\ServicePackFiles\i386\userinit.exe
                            [2008/04/14 00:12:38 | 00,026,112 | ---- | M] (Microsoft Corporation) MD5=A93AEE1928A9D7CE3E16D24EC7380F89 -- C:\WINDOWS\system32\userinit.exe
                             
                            < MD5 for: WS2_32.DLL  >
                            [2008/04/14 00:12:10 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\ServicePackFiles\i386\ws2_32.dll
                            [2008/04/14 00:12:10 | 00,082,432 | ---- | M] (Microsoft Corporation) MD5=2CCC474EB85CEAA3E1FA1726580A3E5A -- C:\WINDOWS\system32\ws2_32.dll
                            [2004/08/10 04:00:00 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 -- C:\i386\ws2_32.dll
                            [2004/08/10 04:00:00 | 00,082,944 | ---- | M] (Microsoft Corporation) MD5=2ED0B7F12A60F90092081C50FA0EC2B2 -- C:\WINDOWS\$NtServicePackUninstall$\ws2_32.dll
                             
                            < MD5 for: XMLPROV.DLL  >
                            [2008/04/14 00:12:11 | 00,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\ServicePackFiles\i386\xmlprov.dll
                            [2008/04/14 00:12:11 | 00,129,024 | ---- | M] (Microsoft Corporation) MD5=295D21F14C335B53CB8154E5B1F892B9 -- C:\WINDOWS\system32\xmlprov.dll
                            [2004/08/10 04:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation) MD5=EEF46DAB68229A14DA3D8E73C99E2959 -- C:\i386\xmlprov.dll
                            [2004/08/10 04:00:00 | 00,129,536 | ---- | M] (Microsoft Corporation) MD5=EEF46DAB68229A14DA3D8E73C99E2959 -- C:\WINDOWS\$NtServicePackUninstall$\xmlprov.dll
                             
                            < %systemroot%\system32\*.dll /lockedfiles >
                            [2008/04/14 00:11:51 | 01,267,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\WINDOWS\system32\comsvcs.dll
                             
                            < %systemroot%\Tasks\*.job /lockedfiles >
                             
                            ========== Alternate Data Streams ==========
                             
                            @Alternate Data Stream - 124 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:BEB71B81
                            < End of report >

                            Dr Jay

                            • Malware Removal Specialist


                            • Specialist
                            • Moderator emeritus
                            • Thanked: 119
                            • Experience: Guru
                            • OS: Windows 10
                            Re: Google Search Redirection
                            « Reply #23 on: January 30, 2010, 08:14:15 AM »
                            Please visit this webpage for instructions for downloading and running ComboFix:

                            http://www.bleepingcomputer.com/combofix/how-to-use-combofix

                            Post the log from ComboFix when you've accomplished that.
                            ~Dr Jay

                            Deckfitz

                              Topic Starter


                              Rookie

                              Re: Google Search Redirection
                              « Reply #24 on: January 30, 2010, 10:31:51 AM »
                              Hi again

                              I am on another PC at the moment.  I ran Combofix and it said it had successfully installed Microsoft Windows recovery console and then started to scan for infected files.  Almost immediately it said it had found rootkit activity and needed to reboot.  I accepted and now it is still telling me that it needs to reboot and that I should not reboot it manually and it's been like that for about an hour.  What should I do?  Has it stalled or can it take this long to reboot?

                              Thanks again

                              Dr Jay

                              • Malware Removal Specialist


                              • Specialist
                              • Moderator emeritus
                              • Thanked: 119
                              • Experience: Guru
                              • OS: Windows 10
                              Re: Google Search Redirection
                              « Reply #25 on: January 30, 2010, 10:57:39 AM »
                              Go ahead and reboot it manually.

                              I will report that to the developer of the tool. Odd for it to stall like that.

                              Tell me if it still does a reboot loop. Otherwise post the log, please.
                              ~Dr Jay

                              Deckfitz

                                Topic Starter


                                Rookie

                                Re: Google Search Redirection
                                « Reply #26 on: January 30, 2010, 11:04:55 AM »
                                There appears to be a serious problem with my PC now.

                                I'm getting a blue screen error

                                A problem has been detected and Windows has been shut down to prevent damage to your computer

                                The problem seems to be caused by the following file:redbook.sys

                                DRIVER_UNLOADED_WITHOUT_CANCELLING_PEND ING_OPERATIONS


                                Dr Jay

                                • Malware Removal Specialist


                                • Specialist
                                • Moderator emeritus
                                • Thanked: 119
                                • Experience: Guru
                                • OS: Windows 10
                                Re: Google Search Redirection
                                « Reply #27 on: January 30, 2010, 11:22:14 AM »
                                That would be for the KS filter of your audio device.

                                Can Windows boot?

                                Please reboot to Safe Mode (tap the F8 key just before Windows starts to load and select the Safe Mode option from the menu).

                                How to capture an SYSTEM event log and upload it to the forum:
                                • First, open Event Viewer by clicking Start -> Run -> type eventvwr.msc and press ENTER.
                                • In the Event Viewer please right click the requested event log (i.e. Application, system, etc...) and click Save Log File As.
                                • Please save the logfile to your desktop and give it a recognizable name.
                                • Do this for each log that has been requested.
                                • When you are finished saving the necessary logs, close Event Viewer.
                                • On your desktop find the saved log files.  Hold the CTRL key and click to select each event log.
                                • When all event logs are selected, right-click one of them, click Send to -> Compressed Zip Folder.
                                • A new .ZIP file will have been created on your desktop.  Please attach that file to this forum in your next reply.
                                ~Dr Jay

                                Deckfitz

                                  Topic Starter


                                  Rookie

                                  Re: Google Search Redirection
                                  « Reply #28 on: January 30, 2010, 11:27:42 AM »
                                  Windows wont boot in SAfe Mode either

                                  It says

                                  PAGE_FAULT_IN_NONPAGED_AREA

                                  Dr Jay

                                  • Malware Removal Specialist


                                  • Specialist
                                  • Moderator emeritus
                                  • Thanked: 119
                                  • Experience: Guru
                                  • OS: Windows 10
                                  Re: Google Search Redirection
                                  « Reply #29 on: January 30, 2010, 11:37:26 AM »
                                  Do you have your Windows XP cd?

                                  We will need to work in the Recovery Console safely, to do a System Restore.

                                  Let me know that, then we can get started. :)
                                  ~Dr Jay

                                  Deckfitz

                                    Topic Starter


                                    Rookie

                                    Re: Google Search Redirection
                                    « Reply #30 on: January 30, 2010, 11:42:50 AM »
                                    I am at the C:\WINDOWS prompt in Microsoft Windows XP Recovery Console now

                                    Dr Jay

                                    • Malware Removal Specialist


                                    • Specialist
                                    • Moderator emeritus
                                    • Thanked: 119
                                    • Experience: Guru
                                    • OS: Windows 10
                                    Re: Google Search Redirection
                                    « Reply #31 on: January 30, 2010, 11:58:46 AM »
                                    Good.

                                    Type cd \ and press "Enter".

                                    Type cd system~1\_resto~1 and press "Enter".

                                    Type dir and press "Enter".

                                    After
                                    you press enter you will see a list of folders (like rp1, rp2) If the
                                    list of restore points has more than one page then press the "Enter" key until you reach the end of the list


                                    Type cd rp {number of the second to last folder in the list} and press "Enter".
                                    Note: Example: cd rp9 if the last restore point is rp10

                                    Type cd snapshot and press "Enter".

                                    Type copy _registry_machine_system c:\windows\system32\config\system and press "Enter".

                                    Type copy _registry_machine_software c:\windows\system32\config\software and press "Enter".

                                    Type exit and press "Enter".

                                    Your PC will reboot.

                                    =======================

                                    If you get an access denied error when doing the above, then do the following at the recovery console:

                                    Type cd \ and press "Enter".

                                    Type cd windows\system32\config and press "Enter".

                                    Type ren system system.bak and press "Enter".

                                    Type exit and press "Enter".

                                    Your PC will reboot, go back into the Recovery Console and start from the beginning.
                                    ~Dr Jay

                                    Deckfitz

                                      Topic Starter


                                      Rookie

                                      Re: Google Search Redirection
                                      « Reply #32 on: January 30, 2010, 12:07:43 PM »
                                      After typing ren system system.bak

                                      it said a file or directory with the name system.bak already exists


                                      Deckfitz

                                        Topic Starter


                                        Rookie

                                        Re: Google Search Redirection
                                        « Reply #33 on: January 30, 2010, 12:14:09 PM »
                                        Access is still denied

                                        Dr Jay

                                        • Malware Removal Specialist


                                        • Specialist
                                        • Moderator emeritus
                                        • Thanked: 119
                                        • Experience: Guru
                                        • OS: Windows 10
                                        Re: Google Search Redirection
                                        « Reply #34 on: January 30, 2010, 02:06:40 PM »
                                        Please save the following instructions into Notepad and print it out as this webpage would not be available when you're carrying out the process.

                                        1.Please reboot into Recovery Console as you did before.

                                        2.You must enter which Windows installation to log onto. Type 1 and press Enter.

                                        3.At the C:\Windows prompt, type the following bolded command, and press Enter:

                                        set allowallpaths = true

                                        4.At the next prompt type without the quotes "cd erdnt\subs" and hit Enter.

                                        5.At the next prompt, please type in the following without the quotes: "batch erdnt.con" and hit Enter.

                                        The erunt backups should begin copying backup files. At the next prompt after it is complete, Type exit.

                                        kindly reboot your pc and tell me if Windows is loading now
                                        ~Dr Jay

                                        Deckfitz

                                          Topic Starter


                                          Rookie

                                          Re: Google Search Redirection
                                          « Reply #35 on: January 30, 2010, 02:30:20 PM »
                                          I tried to enter the set allowallpaths = true command, but I got this message:-

                                          The SET command is currently disabled.  The SET command is an optional Recovery Console command that can only be enabled by using the Security Configuration and Analysis snap in

                                          Dr Jay

                                          • Malware Removal Specialist


                                          • Specialist
                                          • Moderator emeritus
                                          • Thanked: 119
                                          • Experience: Guru
                                          • OS: Windows 10
                                          Re: Google Search Redirection
                                          « Reply #36 on: January 30, 2010, 02:45:58 PM »
                                          No biggie. Go ahead and try the commands after that.
                                          ~Dr Jay

                                          Deckfitz

                                            Topic Starter


                                            Rookie

                                            Re: Google Search Redirection
                                            « Reply #37 on: January 30, 2010, 02:50:01 PM »
                                            Nope.  Still getting the same blue screen error as before :-(

                                            Deckfitz

                                              Topic Starter


                                              Rookie

                                              Re: Google Search Redirection
                                              « Reply #38 on: January 30, 2010, 02:59:12 PM »
                                              I only have access to this (my friends) PC for another hour or so today.  Can my system be restored? :-/

                                              Dr Jay

                                              • Malware Removal Specialist


                                              • Specialist
                                              • Moderator emeritus
                                              • Thanked: 119
                                              • Experience: Guru
                                              • OS: Windows 10
                                              Re: Google Search Redirection
                                              « Reply #39 on: January 30, 2010, 03:12:20 PM »
                                              Cannot be restored. We tried two paths.

                                              I would say a reinstall of Windows might work.

                                              Use Windows disc, and do a repair install (data-safe)

                                              See: http://support.microsoft.com/kb/978788
                                              ~Dr Jay

                                              Deckfitz

                                                Topic Starter


                                                Rookie

                                                Re: Google Search Redirection
                                                « Reply #40 on: January 30, 2010, 03:14:24 PM »
                                                Okay - I'll try that

                                                tkrasna



                                                  Starter

                                                  Re: Google Search Redirection
                                                  « Reply #41 on: January 30, 2010, 09:09:06 PM »
                                                  Hello. If you need help, please start a new topic. This topic is for Deckfitz only. ~DragonMaster Jay
                                                  « Last Edit: January 31, 2010, 03:10:48 AM by DragonMaster Jay »

                                                  Deckfitz

                                                    Topic Starter


                                                    Rookie

                                                    Re: Google Search Redirection
                                                    « Reply #42 on: January 30, 2010, 09:31:57 PM »
                                                    I couldn't repair Windows - I had to do a complete reinstall.  At least now I know my machine is clean again.

                                                    Dr Jay

                                                    • Malware Removal Specialist


                                                    • Specialist
                                                    • Moderator emeritus
                                                    • Thanked: 119
                                                    • Experience: Guru
                                                    • OS: Windows 10
                                                    Re: Google Search Redirection
                                                    « Reply #43 on: January 31, 2010, 03:11:19 AM »
                                                    Alright, thanks for letting me know.
                                                    ~Dr Jay