Little annoying problems

There seems to be two main problems with my computer: first, Google searches sometimes redirect me to random sites, and when the computer goes on standby mode, it will not move past a black screen after I start it again. Thanks in advance!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:27:14 PM, on 7/31/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Spare Backup\SpareBackup.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\Taskmgr.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=DTP&M=GM5639E
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=DTP&M=GM5639E
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=DTP&M=GM5639E
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.2.4204.1700\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [Spare Backup] "C:\Program Files\Spare Backup\SpareBackup.exe" /silent
O4 - HKLM\..\Run: [BigFix] c:\program files\Bigfix\bigfix.exe /atstartup
O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\npjpi160_01.dll
O13 - Gopher Prefix:
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9023 bytes

Hello piggyjelly,

Welcome to Geek Police, my name is Origin and I will be helping you today. Please keep the following in mind:

• If you do not get a reply from me or another helper within 2 days, please reply to your topic with the phrase BUMP
  
• If you have any cracked/pirated software in your computer delete them or we will not help you.
  
• Only follow advise from Geek Police Staff and not a regular member.
  
• Do NOT run any tool without Geek Police supervision as it could hinder your system useless.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

I'm still getting redirected to random search sites, and I haven't tried to put it on standby.

Malwarebytes' Anti-Malware 1.39
Database version: 2541
Windows 6.0.6002 Service Pack 2

8/1/2009 11:29:51 AM
mbam-log-2009-08-01 (11-29-51).txt

Scan type: Quick Scan
Objects scanned: 80981
Time elapsed: 2 minute(s), 23 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Please download GooredFix from one of the locations below and save it to your Desktop
Download Mirror #1
Download Mirror #2

• Ensure all Firefox windows are closed.
  
• To run the tool, double-click it (XP), or right-click and select Run As Administrator (Vista).
  
• When prompted to run the scan, click Yes.
  
• GooredFix will check for infections, and then a log will appear. Please post the contents of that log in your next reply (it can also be found on your desktop, called GooredFix.txt).
  

Still being redirected...

GooredFix by jpshortstuff (12.07.09)
Log created at 11:36 on 01/08/2009 (andrew)
Firefox version 3.5.1 (en-US)

========== GooredScan ==========

C:\Program Files\Mozilla Firefox\extensions\
{972ce4c6-7e08-4474-a285-3208198ce6fd} [23:10 23/07/2009]

[HKEY_LOCAL_MACHINE\Software\Mozilla\Firefox\Extensions]
"{20a82645-c095-46ed-80e3-08825760534b}"="c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\" [23:21 11/03/2009]

-=E.O.F=-

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouse click combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-08-01.06 - andrew 08/01/2009 22:36.1.2 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6002.2.1252.1.1033.18.1918.809 [GMT -7:00]
Running from: c:\users\andrew\Desktop\Combo-Fix.exe
SP: Lavasoft Ad-Watch Live! *enabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: SUPERAntiSpyware *enabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-659259697-2814466138-1499362724-500
c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
c:\windows\Installer\7f739b8.msi
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-07-02 to 2009-08-02 )))))))))))))))))))))))))))))))
.

2009-08-01 23:28 . 2009-08-01 23:28 -------- d-----w- c:\program files\Seagate
2009-08-01 23:28 . 2009-08-01 23:28 -------- d-----w- c:\progra~2\Seagate
2009-08-01 23:27 . 2009-08-01 23:27 -------- d-----w- c:\users\andrew\AppData\Local\Downloaded Installations
2009-08-01 23:27 . 2009-08-01 23:27 -------- d-sh--w- c:\windows\ftpcache
2009-08-01 23:24 . 2009-08-01 23:24 -------- d-----w- c:\users\andrew\AppData\Roaming\Leadertech
2009-07-31 22:03 . 2009-07-31 22:03 -------- d-----w- c:\progra~2\SUPERAntiSpyware.com
2009-07-31 22:02 . 2009-08-02 05:27 -------- d-----w- c:\users\andrew\AppData\Roaming\SUPERAntiSpyware.com
2009-07-31 22:02 . 2009-08-02 05:27 -------- d-----w- c:\program files\SUPERAntiSpyware
2009-07-28 23:18 . 2009-07-18 11:35 828416 ----a-w- c:\windows\system32\wininet.dll
2009-07-28 23:18 . 2009-07-18 16:01 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-07-27 00:32 . 2009-07-27 00:33 -------- d-----w- c:\windows\system32\ca-ES
2009-07-27 00:32 . 2009-07-27 00:33 -------- d-----w- c:\windows\system32\eu-ES
2009-07-27 00:32 . 2009-07-27 00:33 -------- d-----w- c:\windows\system32\vi-VN
2009-07-26 21:20 . 2009-07-26 21:20 -------- d-----w- c:\windows\system32\EventProviders
2009-07-26 18:17 . 2009-04-11 06:28 550400 ----a-w- c:\windows\system32\rpcss.dll
2009-07-26 18:16 . 2009-03-30 04:42 155456 ----a-w- c:\windows\system32\mscorier.dll
2009-07-26 18:15 . 2009-04-11 06:22 7168 ----a-w- c:\windows\system32\f3ahvoas.dll
2009-07-26 18:15 . 2009-04-11 04:54 2048 ----a-w- c:\windows\system32\mferror.dll
2009-07-26 18:15 . 2009-04-11 04:27 2560 ----a-w- c:\windows\system32\msimsg.dll
2009-07-26 18:15 . 2009-04-11 06:28 83968 ----a-w- c:\windows\system32\wbem\wmiutils.dll
2009-07-26 18:15 . 2009-04-11 06:28 744448 ----a-w- c:\windows\system32\wbem\wbemcore.dll
2009-07-26 18:15 . 2009-04-11 06:28 30208 ----a-w- c:\windows\system32\wbem\wbemprox.dll
2009-07-26 18:15 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\repdrvfs.dll
2009-07-26 18:15 . 2009-04-11 06:28 189440 ----a-w- c:\windows\system32\wbem\mofd.dll
2009-07-26 18:15 . 2009-04-11 06:28 614912 ----a-w- c:\windows\system32\wbem\fastprox.dll
2009-07-26 18:15 . 2009-04-11 06:28 265728 ----a-w- c:\windows\system32\wbem\esscli.dll
2009-07-26 18:15 . 2009-04-11 06:28 705536 ----a-w- c:\windows\system32\SmiEngine.dll
2009-07-26 18:15 . 2009-04-11 06:28 218624 ----a-w- c:\windows\system32\wdscore.dll
2009-07-26 18:15 . 2009-04-11 06:27 130560 ----a-w- c:\windows\system32\PkgMgr.exe
2009-07-26 18:14 . 2009-04-11 06:28 247808 ----a-w- c:\windows\system32\drvstore.dll
2009-07-23 22:00 . 2009-07-23 22:00 -------- d--h--w- C:\$AVG8.VAULT$
2009-07-23 21:46 . 2009-07-23 21:46 -------- d-----w- c:\program files\AVG
2009-07-23 21:46 . 2009-07-23 21:46 -------- d-----w- c:\progra~2\avg8
2009-07-23 06:56 . 2009-07-23 06:56 -------- d-----w- c:\users\andrew\AppData\Roaming\Uniblue
2009-07-23 06:52 . 2004-08-04 14:00 506368 ----a-w- c:\windows\system32\msxml.dll
2009-07-23 06:49 . 2009-07-23 22:21 -------- d-----w- c:\program files\CCleaner
2009-07-23 06:43 . 2009-07-03 14:49 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-07-23 06:24 . 2009-07-03 14:49 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-07-23 06:21 . 2009-07-23 06:21 -------- dc-h--w- c:\progra~2\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-23 06:21 . 2009-07-23 06:24 -------- d-----w- c:\progra~2\Lavasoft
2009-07-23 06:21 . 2009-07-23 06:21 -------- d-----w- c:\program files\Lavasoft
2009-07-23 04:34 . 2009-07-23 04:34 -------- d-----w- c:\users\andrew\AppData\Roaming\AVG8
2009-07-21 20:17 . 2009-07-21 20:17 -------- d-----w- c:\program files\iPod
2009-07-21 20:17 . 2009-07-23 22:21 -------- d-----w- c:\program files\iTunes
2009-07-17 02:17 . 2009-07-17 02:22 -------- d-----w- c:\users\andrew\AppData\Roaming\uTorrent
2009-07-15 07:48 . 2009-06-15 14:53 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-15 07:48 . 2009-06-15 12:42 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-15 07:48 . 2009-06-15 14:52 23552 ----a-w- c:\windows\system32\lpk.dll
2009-07-15 07:48 . 2009-06-15 14:52 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-15 07:48 . 2009-06-15 14:51 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-15 07:48 . 2009-04-11 06:28 34304 ----a-w- c:\windows\system32\atmlib.dll
2009-07-14 09:56 . 2009-07-14 09:56 -------- d-----w- c:\program files\Trend Micro
2009-07-14 09:54 . 2009-07-14 09:54 -------- d-----w- c:\users\andrew\AppData\Roaming\Malwarebytes
2009-07-14 09:54 . 2009-07-13 20:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-14 09:54 . 2009-08-01 17:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-14 09:54 . 2009-07-14 09:54 -------- d-----w- c:\progra~2\Malwarebytes
2009-07-14 09:54 . 2009-07-13 20:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-08 16:35 . 2009-08-01 21:05 -------- d-----w- c:\program files\Diablo II
2009-07-08 16:06 . 2009-07-23 22:21 -------- d-----w- c:\program files\D2LOD-1.12A-enUS
2009-07-08 07:22 . 2009-07-23 22:21 -------- d-----w- c:\program files\D2-1.12A-enUS
2009-07-07 17:32 . 2009-07-21 06:12 -------- d-----w- c:\program files\Warcraft III
2009-07-07 16:05 . 2009-07-07 16:43 -------- d-----w- c:\program files\Warcraft III 1.21b ROC Installer enUS
2009-07-07 15:03 . 2009-07-07 15:36 -------- d-----w- c:\program files\Warcraft III 1.21b TFT Installer enUS
2009-07-07 06:18 . 2009-07-26 16:36 -------- d-----w- c:\program files\StarCraft
2009-07-07 04:31 . 2009-07-07 05:55 -------- d-----w- c:\program files\SC-1.15.2-enUS
2009-07-07 04:31 . 2009-07-08 16:37 -------- d-----w- c:\program files\Common Files\Blizzard Entertainment

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-02 05:49 . 2008-04-14 06:40 -------- d-----w- c:\users\andrew\AppData\Roaming\Spare Backup
2009-08-01 23:29 . 2007-09-15 20:09 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-08-01 20:10 . 2008-04-22 06:14 31808 ----a-w- c:\users\andrew\AppData\Roaming\wklnhst.dat
2009-07-27 00:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Calendar
2009-07-27 00:33 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2009-07-27 00:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2009-07-27 00:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Journal
2009-07-27 00:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Collaboration
2009-07-27 00:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Photo Gallery
2009-07-27 00:33 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Defender
2009-07-27 00:32 . 2006-11-02 10:25 665600 ----a-w- c:\windows\inf\drvindex.dat
2009-07-27 00:25 . 2006-11-02 12:37 37665 ----a-w- c:\windows\Fonts\GlobalUserInterface.CompositeFont
2009-07-23 22:24 . 2009-03-17 17:47 -------- d-----w- c:\program files\Bonjour
2009-07-23 22:21 . 2007-09-15 20:19 -------- d-----w- c:\program files\Spare Backup
2009-07-23 22:21 . 2007-09-15 20:12 -------- d-----w- c:\program files\eBay
2009-07-23 22:21 . 2008-09-06 04:18 -------- d-----w- c:\program files\Apple Software Update
2009-07-23 22:21 . 2007-09-15 20:35 -------- d-----w- c:\program files\BigFix
2009-07-23 22:21 . 2007-09-15 20:16 -------- d-----w- c:\program files\AOL 9.0
2009-07-23 22:21 . 2007-09-15 20:21 -------- d-----w- c:\program files\Activation Assistant for the 2007 Microsoft Office suites
2009-07-23 22:20 . 2007-09-15 20:23 -------- d-----w- c:\program files\Gateway Games
2009-07-23 22:20 . 2006-11-02 12:37 -------- d-----w- c:\program files\Reference Assemblies
2009-07-23 22:20 . 2006-11-02 12:37 -------- d-----w- c:\program files\Microsoft Games
2009-07-21 20:17 . 2008-07-18 23:19 -------- d-----w- c:\program files\Common Files\Apple
2009-07-19 17:56 . 2008-09-20 18:58 7052 ----a-w- c:\users\andrew\AppData\Local\d3d9caps.dat
2009-07-17 09:46 . 2009-06-06 08:09 -------- d-----w- c:\program files\Exterminate It!
2009-07-16 09:50 . 2008-04-14 06:39 69656 ----a-w- c:\users\andrew\AppData\Local\GDIPFONTCACHEV1.DAT
2009-07-15 20:55 . 2009-07-15 20:55 28952 ----a-w- c:\windows\Fonts\Cirno.ttf
2009-07-01 22:10 . 2009-06-26 17:28 16 ----a-w- c:\windows\popcinfo.dat
2009-06-23 21:07 . 2009-06-23 21:06 -------- d-----w- c:\program files\QuickTime
2009-06-20 17:02 . 2007-09-15 20:23 -------- d-----w- c:\progra~2\WildTangent
2009-06-20 02:38 . 2009-06-20 02:38 -------- d-----w- c:\users\andrew\AppData\Roaming\WildTangent
2009-06-05 18:42 . 2009-06-05 18:42 39424 ----a-w- c:\windows\system32\drivers\usbaapl.sys
2009-06-05 18:42 . 2009-06-05 18:42 2060288 ----a-w- c:\windows\system32\usbaaplrc.dll
2009-07-15 20:30 . 2009-07-23 23:10 137208 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-01-01 39408]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-19 1008184]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-11 29744]
"Spare Backup"="c:\program files\Spare Backup\SpareBackup.exe" [2007-07-13 5252936]
"BigFix"="c:\program files\Bigfix\bigfix.exe" [2006-11-16 2348584]
"MskAgentexe"="c:\program files\McAfee\MSK\MskAgent.exe" [2007-01-18 152144]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-03-26 645328]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2009-05-14 177472]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-06-20 13535776]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-06-20 92704]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-05-27 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"MaxMenuMgr"="c:\program files\Seagate\SeagateManager\FreeAgent Status\StxMenuMgr.exe" [2009-03-27 181544]
"RtHDVCpl"="RtHDVCpl.exe" - c:\windows\RtHDVCpl.exe [2007-01-18 4349952]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2007-07-04 40072]

c:\progra~2\MICROS~1\Windows\STARTM~1\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\progra~1\Google\GOOGLE~1\GoogleDesktopNetwork3.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):8a,bc,98,d5,52,0e,ca,01

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{C58F007E-C672-4305-B5DC-6549B96A0396}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F7B81498-C610-4CCB-9754-013C6161E326}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{992AE7E3-9C4A-4BA1-B5FE-D177978F9F62}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"{8783DA07-A53F-4743-9143-BD4E0C578576}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{2D160310-FA29-403D-A67F-59B5DDA2E201}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{AFBC4129-11E2-4422-B63C-2BE5D80304F8}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{83EFDB14-FB6F-4E19-BEAD-EDA6FEC15BA1}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"{9E8D508C-D24C-4542-B5E0-A2979E6F9597}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{8325E003-D567-4366-87FF-E96F04B1ED91}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 AFS;AFS;c:\windows\System32\drivers\AFS.SYS [4/14/2008 10:09 PM 77004]
R0 Lbd;Lbd;c:\windows\System32\drivers\Lbd.sys [7/22/2009 11:24 PM 64160]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\Seagate\SeagateManager\Sync\FreeAgentService.exe [3/27/2009 3:54 PM 165160]
R3 AVer88xHD;AVerMedia 23888 AvStream Video Capture;c:\windows\System32\drivers\AVer88xHD.sys [9/15/2007 1:10 PM 401408]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [9/15/2007 1:17 PM 29744]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [7/3/2009 7:49 AM 1029456]
S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\System32\drivers\NETw2v32.sys [11/2/2006 3:25 AM 2589184]
.
.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=DTP&M=GM5639E
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\andrew\AppData\Roaming\Mozilla\Firefox\Profiles\597hpac1.default\
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-08-01 22:49
Windows 6.0.6002 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'Explorer.exe'(5908)
c:\program files\McAfee\MSK\mskoeplg.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\System32\nvvsvc.exe
c:\windows\System32\audiodg.exe
c:\windows\System32\rundll32.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Common Files\McAfee\HackerWatch\HWAPI.exe
c:\progra~1\McAfee\VIRUSS~1\mcods.exe
c:\progra~1\COMMON~1\McAfee\McProxy\McProxy.exe
c:\windows\System32\rundll32.exe
c:\progra~1\COMMON~1\McAfee\RedirSvc\RedirSvc.exe
c:\progra~1\McAfee\VIRUSS~1\Mcshield.exe
c:\program files\McAfee\MPF\MpfSrv.exe
c:\progra~1\McAfee\MPS\mps.exe
c:\program files\McAfee\MSK\msksrver.exe
c:\program files\McAfee\MPS\mpsevh.exe
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\windows\System32\drivers\XAudio.exe
c:\windows\System32\WUDFHost.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Windows Mail\WinMail.exe
c:\program files\Common Files\McAfee\MNA\McNASvc.exe
c:\windows\servicing\TrustedInstaller.exe
.
**************************************************************************
.
Completion time: 2009-08-02 22:59 - machine was rebooted
ComboFix-quarantined-files.txt 2009-08-02 05:59

Pre-Run: 302,181,625,856 bytes free
Post-Run: 302,204,719,104 bytes free

299 --- E O F --- 2009-07-31 08:40

Download the GMER rootkit scan from here: GMER

1. Unzip it and start GMER.
   
2. Click the >>> tab and then click the Scan button.
   
3. Once done, click the Copy button.
   
4. This will copy the results to your clipboard.
   
5. Paste the results in your next reply.
   

Note:
If you're having problems with running GMER.exe, try it in safe mode. This tools works in safe mode.
You can also try renaming it since some malware blocks GMER.

GMER 1.0.15.15011 [moomoofarm.exe] - http://www.gmer.net
Rootkit scan 2009-08-02 14:21:43
Windows 6.0.6002 Service Pack 2


---- System - GMER 1.0.15 ----

Code 85C31D48 ZwEnumerateKey
Code 860372F8 ZwFlushInstructionCache
Code 860423AE ZwSaveKey
Code 85C31D7E ZwSaveKeyEx
Code 86033515 IofCallDriver
Code 8603F2CE IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!IofCallDriver 82653912 5 Bytes JMP 8603351A
.text ntkrnlpa.exe!IofCompleteRequest 8265397F 5 Bytes JMP 8603F2D3
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 827BEEF5 5 Bytes JMP 860372FC
PAGE ntkrnlpa.exe!ZwEnumerateKey 8280C0BA 5 Bytes JMP 85C31D4C
PAGE ntkrnlpa.exe!ZwSaveKey 82861969 5 Bytes JMP 860423B2
PAGE ntkrnlpa.exe!ZwSaveKeyEx 82861B07 5 Bytes JMP 85C31D82

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\lsm.exe[556] ntdll.dll!LdrLoadDll 77519390 5 Bytes JMP 0017000A
.text C:\Windows\system32\svchost.exe[704] ntdll.dll!LdrLoadDll 77519390 5 Bytes JMP 0060000A
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[760] ntdll.dll!LdrLoadDll 77519390 5 Bytes JMP 003C000A
.text C:\Windows\System32\svchost.exe[824] ntdll.dll!LdrLoadDll 77519390 5 Bytes JMP 000C000A
.text C:\Windows\System32\svchost.exe[1016] ntdll.dll!LdrLoadDll 77519390 5 Bytes JMP 0026000A
.text ...

---- Services - GMER 1.0.15 ----

Service C:\Windows\system32\drivers\vsfoceicnqwlro.sys (*** hidden *** ) [SYSTEM] vsfocebqneokrv <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@start 1
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@type 1
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@imagepath \systemroot\system32\drivers\UACmvmgbfpjit.sys
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys@group file system
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@UACd \\?\globalroot\systemroot\system32\drivers\UACmvmgbfpjit.sys
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@UACc \\?\globalroot\systemroot\system32\UACiseikxyopq.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacbbr \\?\globalroot\systemroot\system32\UACuxrobxqhhy.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacsr \\?\globalroot\systemroot\system32\UACtfqqriispx.dat
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacmal \\?\globalroot\systemroot\system32\UACcmgexbqvwf.db
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacrem \\?\globalroot\systemroot\system32\UACqttqyjsfmo.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacmask \\?\globalroot\systemroot\system32\UACcgnagpjeof.dll
Reg HKLM\SYSTEM\ControlSet001\Services\UACd.sys\modules@uacserf \\?\globalroot\systemroot\system32\UACueqridrqsf.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@imagepath \systemroot\system32\drivers\vsfoceicnqwlro.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@aid 10002
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@sid 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@cmddelay 14400
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\injector@* vsfocewsp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocerk.sys \systemroot\system32\drivers\vsfoceicnqwlro.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocecmd.dll \systemroot\system32\vsfoceokutuses.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocelog.dat \systemroot\system32\vsfoceqiotvxxo.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocewsp.dll \systemroot\system32\vsfoceionrqtct.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfoce.dat \systemroot\system32\vsfoceavmbqomv.dat
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@imagepath \systemroot\system32\drivers\vsfoceicnqwlro.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@aid 10002
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@sid 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\injector@* vsfocewsp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocerk.sys \systemroot\system32\drivers\vsfoceicnqwlro.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocecmd.dll \systemroot\system32\vsfoceokutuses.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocelog.dat \systemroot\system32\vsfoceqiotvxxo.dat
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocewsp.dll \systemroot\system32\vsfoceionrqtct.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfoce.dat \systemroot\system32\vsfoceavmbqomv.dat

---- Files - GMER 1.0.15 ----

File C:\Users\andrew\AppData\Local\Temp\vsfoce000 0 bytes
File C:\Windows\System32\drivers\vsfoceicnqwlro.sys 67072 bytes <-- ROOTKIT !!!
File C:\Windows\System32\drivers\vsfocewrsrpiim.sys 67072 bytes
File C:\Windows\System32\vsfoceavmbqomv.dat 91 bytes
File C:\Windows\System32\vsfoceionrqtct.dll 18944 bytes
File C:\Windows\System32\vsfocekicdvdsa.dll 41472 bytes
File C:\Windows\System32\vsfoceokutuses.dll 41472 bytes
File C:\Windows\System32\vsfoceqiotvxxo.dat 21048 bytes
File C:\Windows\System32\vsfoceqyeuhsgn.dll 18944 bytes
File C:\Windows\Temp\vsfocewggensurbr.tmp 91 bytes

---- EOF - GMER 1.0.15 ----

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
vsfocebqneokrv.sys

Files to delete:
C:\Windows\system32\drivers\vsfoceicnqwlro.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.



Please run another GMER scan and post the results back here.

I ran it, but there was no black command window. I just saw this logfile before I got the blue screen that restarted my computer.

http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\vsfocebqneokrv.sys" not found!
Deletion of driver "vsfocebqneokrv.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: could not delete file "C:\Windows\system32\drivers\vsfoceicnqwlro.sys"
Deletion of file "C:\Windows\system32\drivers\vsfoceicnqwlro.sys" failed!
Status: 0xc0000156


Completed script processing.

*******************

Finished! Terminate.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\Users\andrew\AppData\Local\Temp\vsfoce000
C:\Windows\System32\drivers\vsfoceicnqwlro.sys
C:\Windows\System32\drivers\vsfocewrsrpiim.sys
C:\Windows\System32\vsfoceavmbqomv.dat
C:\Windows\System32\vsfoceionrqtct.dll
C:\Windows\System32\vsfocekicdvdsa.dll
C:\Windows\System32\vsfoceokutuses.dll
C:\Windows\System32\vsfoceqiotvxxo.dat
C:\Windows\System32\vsfoceqyeuhsgn.dll
C:\Windows\Temp\vsfocewggensurbr.tmp

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

No blue screen this time.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not delete file "C:\Users\andrew\AppData\Local\Temp\vsfoce000"
Deletion of file "C:\Users\andrew\AppData\Local\Temp\vsfoce000" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\drivers\vsfoceicnqwlro.sys"
Deletion of file "C:\Windows\System32\drivers\vsfoceicnqwlro.sys" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\drivers\vsfocewrsrpiim.sys"
Deletion of file "C:\Windows\System32\drivers\vsfocewrsrpiim.sys" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceavmbqomv.dat"
Deletion of file "C:\Windows\System32\vsfoceavmbqomv.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceionrqtct.dll"
Deletion of file "C:\Windows\System32\vsfoceionrqtct.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfocekicdvdsa.dll"
Deletion of file "C:\Windows\System32\vsfocekicdvdsa.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceokutuses.dll"
Deletion of file "C:\Windows\System32\vsfoceokutuses.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceqiotvxxo.dat"
Deletion of file "C:\Windows\System32\vsfoceqiotvxxo.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceqyeuhsgn.dll"
Deletion of file "C:\Windows\System32\vsfoceqyeuhsgn.dll" failed!
Status: 0xc0000156


Error: file "C:\Windows\Temp\vsfocewggensurbr.tmp" not found!
Deletion of file "C:\Windows\Temp\vsfocewggensurbr.tmp" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :reg
  [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UACd.sys]
  [-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv]
  [-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vsfocebqneokrv]
  
  :files
  C:\Users\andrew\AppData\Local\Temp\vsfoce000
  C:\Windows\System32\drivers\vsfoceicnqwlro.sys
  C:\Windows\System32\drivers\vsfocewrsrpiim.sys
  C:\Windows\System32\vsfoceavmbqomv.dat
  C:\Windows\System32\vsfoceionrqtct.dll
  C:\Windows\System32\vsfocekicdvdsa.dll
  C:\Windows\System32\vsfoceokutuses.dll
  C:\Windows\System32\vsfoceqiotvxxo.dat
  C:\Windows\System32\vsfoceqyeuhsgn.dll
  C:\Windows\Temp\vsfocewggensurbr.tmp
  
  
  
• Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

I didn't copy the results window by accident...

========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UACd.sys\ not found.
Registry delete failed. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vsfocebqneokrv\ scheduled to be deleted on reboot.
========== FILES ==========
File/Folder C:\Users\andrew\AppData\Local\Temp\vsfoce000 not found.
File/Folder C:\Windows\System32\drivers\vsfoceicnqwlro.sys not found.
File/Folder C:\Windows\System32\drivers\vsfocewrsrpiim.sys not found.
File/Folder C:\Windows\System32\vsfoceavmbqomv.dat not found.
File/Folder C:\Windows\System32\vsfoceionrqtct.dll not found.
File/Folder C:\Windows\System32\vsfocekicdvdsa.dll not found.
File/Folder C:\Windows\System32\vsfoceokutuses.dll not found.
File/Folder C:\Windows\System32\vsfoceqiotvxxo.dat not found.
File/Folder C:\Windows\System32\vsfoceqyeuhsgn.dll not found.
File/Folder C:\Windows\Temp\vsfocewggensurbr.tmp not found.

OTM by OldTimer - Version 3.0.0.5 log created on 08022009_150317

Files moved on Reboot...

Registry entries deleted on Reboot...
Registry delete failed. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\ scheduled to be deleted on reboot.
Registry delete failed. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vsfocebqneokrv\ scheduled to be deleted on reboot.

Hello.
Lets try a different avenger script.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to delete:
UACd.sys
vsfocebqneokrv

Files to delete:
C:\Windows\System32\drivers\vsfoceicnqwlro.sys
C:\Windows\System32\drivers\vsfocewrsrpiim.sys
C:\Windows\System32\vsfoceavmbqomv.dat
C:\Windows\System32\vsfoceionrqtct.dll
C:\Windows\System32\vsfocekicdvdsa.dll
C:\Windows\System32\vsfoceokutuses.dll
C:\Windows\System32\vsfoceqiotvxxo.dat
C:\Windows\System32\vsfoceqyeuhsgn.dll

Registry keys to delete:
HKLM\SYSTEM\ControlSet001\Services\UACd.sys
HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv
HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Last edited by Belahzur on 4th August 2009, 6:59 pm; edited 1 time in total

//////////////////////////////////////////
Avenger Pre-Processor log
//////////////////////////////////////////

Platform: Windows NT 6.0 (build 6002, Service Pack 2)
Mon Aug 03 14:08:00 2009

14:07:57: Warning: Skipping potentially dangerous line:
"HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv" (Registry key deletion mode)
14:08:00: Error: Execution aborted by user!


//////////////////////////////////////////


Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\System\CurrentControlSet\Services\UACd.sys" not found!
Deletion of driver "UACd.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Driver "vsfocebqneokrv" deleted successfully.

Error: could not open file ":\Windows\System32\drivers\vsfoceicnqwlro.sys"
Deletion of file ":\Windows\System32\drivers\vsfoceicnqwlro.sys" failed!
Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
--> bad path / the parent directory does not exist


Error: could not delete file "C:\Windows\System32\drivers\vsfocewrsrpiim.sys"
Deletion of file "C:\Windows\System32\drivers\vsfocewrsrpiim.sys" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceavmbqomv.dat"
Deletion of file "C:\Windows\System32\vsfoceavmbqomv.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceionrqtct.dll"
Deletion of file "C:\Windows\System32\vsfoceionrqtct.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfocekicdvdsa.dll"
Deletion of file "C:\Windows\System32\vsfocekicdvdsa.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceokutuses.dll"
Deletion of file "C:\Windows\System32\vsfoceokutuses.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceqiotvxxo.dat"
Deletion of file "C:\Windows\System32\vsfoceqiotvxxo.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceqyeuhsgn.dll"
Deletion of file "C:\Windows\System32\vsfoceqyeuhsgn.dll" failed!
Status: 0xc0000156

Registry key "HKLM\SYSTEM\ControlSet001\Services\UACd.sys" deleted successfully.

Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

I'm not getting redirected anymore...

========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\UACd.sys\ not found.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vsfocebqneokrv\ deleted successfully.
========== FILES ==========
File/Folder C:\Users\andrew\AppData\Local\Temp\vsfoce000 not found.
File/Folder C:\Windows\System32\drivers\vsfoceicnqwlro.sys not found.
File/Folder C:\Windows\System32\drivers\vsfocewrsrpiim.sys not found.
File/Folder C:\Windows\System32\vsfoceavmbqomv.dat not found.
File/Folder C:\Windows\System32\vsfoceionrqtct.dll not found.
File/Folder C:\Windows\System32\vsfocekicdvdsa.dll not found.
File/Folder C:\Windows\System32\vsfoceokutuses.dll not found.
File/Folder C:\Windows\System32\vsfoceqiotvxxo.dat not found.
File/Folder C:\Windows\System32\vsfoceqyeuhsgn.dll not found.
File/Folder C:\Windows\Temp\vsfocewggensurbr.tmp not found.

OTM by OldTimer - Version 3.0.0.5 log created on 08032009_145706

One time more, I made a slight error on my last script.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
Files to delete:
C:\Windows\System32\drivers\vsfoceicnqwlro.sys
C:\Windows\System32\drivers\vsfocewrsrpiim.sys
C:\Windows\System32\vsfoceavmbqomv.dat
C:\Windows\System32\vsfoceionrqtct.dll
C:\Windows\System32\vsfocekicdvdsa.dll
C:\Windows\System32\vsfoceokutuses.dll
C:\Windows\System32\vsfoceqiotvxxo.dat
C:\Windows\System32\vsfoceqyeuhsgn.dll

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Well, I'm getting redirected again. I notices the link says clickover.cn every time before it goes to another site, if that helps.


Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: could not delete file "C:\Windows\System32\drivers\vsfoceicnqwlro.sys"
Deletion of file "C:\Windows\System32\drivers\vsfoceicnqwlro.sys" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\drivers\vsfocewrsrpiim.sys"
Deletion of file "C:\Windows\System32\drivers\vsfocewrsrpiim.sys" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceavmbqomv.dat"
Deletion of file "C:\Windows\System32\vsfoceavmbqomv.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceionrqtct.dll"
Deletion of file "C:\Windows\System32\vsfoceionrqtct.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfocekicdvdsa.dll"
Deletion of file "C:\Windows\System32\vsfocekicdvdsa.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceokutuses.dll"
Deletion of file "C:\Windows\System32\vsfoceokutuses.dll" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceqiotvxxo.dat"
Deletion of file "C:\Windows\System32\vsfoceqiotvxxo.dat" failed!
Status: 0xc0000156


Error: could not delete file "C:\Windows\System32\vsfoceqyeuhsgn.dll"
Deletion of file "C:\Windows\System32\vsfoceqyeuhsgn.dll" failed!
Status: 0xc0000156


Completed script processing.

*******************

Finished! Terminate.

Hello.
Please hold tight, I'm talking to someone who's played with this and we might be able to beat it, as the avenger isn't shifting it.

For now, please re-run GMER and post a new log.

I got another bluescreen when trying to run it in normal mode, but it works in safe mode.

GMER 1.0.15.15011 [moomoofarm.exe] - http://www.gmer.net
Rootkit scan 2009-08-05 12:24:06
Windows 6.0.6002 Service Pack 2


---- System - GMER 1.0.15 ----

Code 85FCB398 ZwEnumerateKey
Code 85FCB360 ZwFlushInstructionCache
Code 85FB2516 ZwSaveKey
Code 85FC72E6 ZwSaveKeyEx
Code 85FCA2DD IofCallDriver
Code 85FBF46E IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!IofCallDriver 8268F912 5 Bytes JMP 85FCA2E2
.text ntkrnlpa.exe!IofCompleteRequest 8268F97F 5 Bytes JMP 85FBF473
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 827FAEF5 5 Bytes JMP 85FCB364
PAGE ntkrnlpa.exe!ZwEnumerateKey 828480BA 5 Bytes JMP 85FCB39C
PAGE ntkrnlpa.exe!ZwSaveKey 8289D969 5 Bytes JMP 85FB251A
PAGE ntkrnlpa.exe!ZwSaveKeyEx 8289DB07 5 Bytes JMP 85FC72EA

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\lsm.exe[548] ntdll.dll!LdrLoadDll 77159390 5 Bytes JMP 007E000A
.text C:\Windows\system32\svchost.exe[696] ntdll.dll!LdrLoadDll 77159390 5 Bytes JMP 0025000A
.text C:\Windows\System32\svchost.exe[816] ntdll.dll!LdrLoadDll 77159390 5 Bytes JMP 006D000A
.text C:\Windows\system32\svchost.exe[1096] ntdll.dll!LdrLoadDll 77159390 5 Bytes JMP 000E000A
.text c:\PROGRA~1\mcafee.com\agent\mcagent.exe[1216] ntdll.dll!LdrLoadDll 77159390 5 Bytes JMP 003C000A
.text ...

---- Services - GMER 1.0.15 ----

Service C:\Windows\system32\drivers\vsfoceyqcnixtb.sys (*** hidden *** ) [SYSTEM] vsfocebqneokrv <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@imagepath \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@aid 10002
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@sid 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@cmddelay 14400
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\injector@* vsfocewsp.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocerk.sys \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfoce.dat \systemroot\system32\vsfocetpbcydmi.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocelog.dat \systemroot\system32\vsfoceiyrvdopr.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocecmd.dll \systemroot\system32\vsfoceihbjcqxm.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocewsp.dll \systemroot\system32\vsfocetvpobrha.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@imagepath \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@aid 10002
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@sid 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@cmddelay 14400
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\injector@* vsfocewsp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocerk.sys \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfoce.dat \systemroot\system32\vsfocetpbcydmi.dat
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocelog.dat \systemroot\system32\vsfoceiyrvdopr.dat
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocecmd.dll \systemroot\system32\vsfoceihbjcqxm.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocewsp.dll \systemroot\system32\vsfocetvpobrha.dll

---- Files - GMER 1.0.15 ----

File C:\Users\andrew\AppData\Local\Temp\vsfoce000 0 bytes
File C:\Windows\System32\drivers\vsfoceicnqwlro.sys 67072 bytes
File C:\Windows\System32\drivers\vsfocevsubmmox.sys 67072 bytes
File C:\Windows\System32\drivers\vsfocewrsrpiim.sys 67072 bytes
File C:\Windows\System32\drivers\vsfoceyqcnixtb.sys 67072 bytes <-- ROOTKIT !!!
File C:\Windows\System32\vsfocekicdvdsa.dll 41472 bytes
File C:\Windows\System32\vsfoceavmbqomv.dat 91 bytes
File C:\Windows\System32\vsfocebxtctfpi.dat 91 bytes
File C:\Windows\System32\vsfocedutbikto.dll 18944 bytes
File C:\Windows\System32\vsfoceebipxxii.dll 18944 bytes
File C:\Windows\System32\vsfoceeeadtedu.dat 762 bytes
File C:\Windows\System32\vsfoceihbjcqxm.dll 41472 bytes
File C:\Windows\System32\vsfoceionrqtct.dll 18944 bytes
File C:\Windows\System32\vsfoceiyrvdopr.dat 18351 bytes
File C:\Windows\System32\vsfoceokutuses.dll 41472 bytes
File C:\Windows\System32\vsfoceprlibcit.dat 11196 bytes
File C:\Windows\System32\vsfoceqiotvxxo.dat 21740 bytes
File C:\Windows\System32\vsfoceqyeuhsgn.dll 18944 bytes
File C:\Windows\System32\vsfocetpbcydmi.dat 91 bytes
File C:\Windows\System32\vsfocetvpobrha.dll 18944 bytes
File C:\Windows\System32\vsfocevmjirnqw.dll 41472 bytes
File C:\Windows\System32\vsfocevymmowtj.dat 402 bytes
File C:\Windows\System32\vsfocexkivgxni.dll 41472 bytes
File C:\Windows\Temp\vsfoceqdkrwyopis.tmp 91 bytes

---- EOF - GMER 1.0.15 ----

Hello.
We've found away around this now. We can't delete the files just yet, first, we have to kill them from the inside before deleting them from the outside if you know what I mean.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Registry keys to replace with dummy:
HKLM\SYSTEM\ControlSet001\Services\UACd.sys
HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv
HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv

Files to replace with dummy:
C:\Windows\System32\drivers\vsfoceyqcnixtb.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: registry key "\Registry\Machine\SYSTEM\ControlSet001\Services\UACd.sys" not found!
Replacement with dummy of registry key "HKLM\SYSTEM\ControlSet001\Services\UACd.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv" replaced with dummy successfully.
Registry key "HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv" replaced with dummy successfully.

Error: could not delete file "C:\Windows\System32\drivers\vsfoceyqcnixtb.sys"
Replacement with dummy of file "C:\Windows\System32\drivers\vsfoceyqcnixtb.sys" failed!
Status: 0xc0000156


Completed script processing.

*******************

Finished! Terminate.

Hello.
Damn, didn't work. Were gonna have to try this next method manually.

Go to Start and in the little search box, just type "Run", then when it finds the run command, right click and select "Run as administrator"

Now when the run command box opens, copy/paste in the following, do not edit this in any way.

notepad "C:\Windows\System32\drivers\vsfoceyqcnixtb.sys"

When it opens, it will show a bunch of random letter junk, this is normal.
Press ctrl+A to select everything (it will go blue highlight) and press the backspace key so it deletes everything, leaving it blank.

Go to File > Save. Press ok to any warning about overwriting it.

Let me know how that goes.

I did it, as far as I know it stays blank with nothing special happening.

Yes, nothing special is supposed to happen. It worked, I didn't think it would.
Reboot normally.

Now navigate to and see if you can manually delete this file:
C:\Windows\System32\drivers\vsfoceyqcnixtb.sys

Right click > Delete.

Let me know how it goes.

I was able to delete it.

Can you run another GMER scan, I want to make sure there's no leftovers.

GMER 1.0.15.15011 [moomoofarm.exe] - http://www.gmer.net
Rootkit scan 2009-08-06 15:18:23
Windows 6.0.6002 Service Pack 2


---- Services - GMER 1.0.15 ----

Service system32\drivers\vsfoceyqcnixtb.sys (*** hidden *** ) [SYSTEM] vsfocebqneokrv <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv@imagepath \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@aid
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@sid
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main@cmddelay 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\delete
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\injector
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\injector@*
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\main\tasks
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocerk.sys \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfoce.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocelog.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocecmd.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv\modules@vsfocewsp.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv@imagepath \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@aid
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@sid
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main@cmddelay 0
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\delete (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\injector (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\injector@*
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\main\tasks (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocerk.sys \systemroot\system32\drivers\vsfoceyqcnixtb.sys
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfoce.dat
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocelog.dat
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocecmd.dll
Reg HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv\modules@vsfocewsp.dll
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib@Last Counter 5112
Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib@Last Help 5113

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 60: copy of MBR

---- EOF - GMER 1.0.15 ----

Okay, lets finish this now.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to disable:
vsfocebqneokrv

Drivers to delete:
vsfocebqneokrv

Files to delete:
C:\WINDOWS\system32\drivers\vsfoceyqcnixtb.sys

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv
HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

Driver "vsfocebqneokrv" disabled successfully.
Driver "vsfocebqneokrv" deleted successfully.

Error: file "C:\WINDOWS\system32\drivers\vsfoceyqcnixtb.sys" not found!
Deletion of file "C:\WINDOWS\system32\drivers\vsfoceyqcnixtb.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\vsfocebqneokrv" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\ControlSet003\Services\vsfocebqneokrv" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Okay, one more scan.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Ver_09-07-30.01) - NTFSx86
Run by andrew at 17:05:31.49 on Fri 08/07/2009
Internet Explorer: 7.0.6002.18005
Microsoft Windows Vista Home Premium 6.0.6002.2.1252.1.1033.18.1918.926 [GMT -7:00]

SP: Lavasoft Ad-Watch Live! *disabled* (Updated) {67844DAE-4F77-4D69-9457-98E8CFFDAA22}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: SUPERAntiSpyware *disabled* (Updated) {222A897C-5018-402e-943F-7E7AC8560DA7}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\rundll32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Spare Backup\SpareBackup.exe
C:\Program Files\McAfee\MSK\mskagent.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Windows Mail\WinMail.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Seagate\SeagateManager\Sync\FreeAgentService.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\PROGRA~1\McAfee\MPS\mps.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\McAfee\MPS\mpsevh.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\WUDFHost.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\iPod\bin\iPodService.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\Windows\System32\mobsync.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Users\andrew\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page =
mStart Page = hxxp://www.gateway.com/g/startpage.html?Ch=Retail&SubCH=nofound&Br=GTW&Loc=ENG_US&Sys=DTP&M=GM5639E
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\mcafee\virusscan\scriptcl.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.2.4204.1700\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_B7C5AC242193BB3E.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\windows\system32\BAE.dll
BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRunOnce: [FlashPlayerUpdate] c:\windows\system32\macromed\flash\NPSWF32_FlashUtil.exe -p
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [Spare Backup] "c:\program files\spare backup\SpareBackup.exe" /silent
mRun: [BigFix] c:\program files\bigfix\bigfix.exe /atstartup
mRun: [MskAgentexe] c:\program files\mcafee\msk\MskAgent.exe
mRun: [mcagent_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\bin\AppleSyncNotifier.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [MaxMenuMgr] "c:\program files\seagate\seagatemanager\freeagent status\StxMenuMgr.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\npjpi160_01.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
AppInit_DLLs: c:\progra~1\google\google~1\GoogleDesktopNetwork3.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\andrew\appdata\roaming\mozilla\firefox\profiles\597hpac1.default\
FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 AFS;AFS;c:\windows\system32\drivers\AFS.SYS [2008-4-14 77004]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-7-22 64160]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-6-23 74480]
R2 FreeAgentGoNext Service;Seagate Service;c:\program files\seagate\seagatemanager\sync\FreeAgentService.exe [2009-3-27 165160]
R3 AVer88xHD;AVerMedia 23888 AvStream Video Capture;c:\windows\system32\drivers\AVer88xHD.sys [2007-9-15 401408]
R3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-6-23 7408]
S1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-6-23 9968]
S3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\google\google desktop search\GoogleDesktop.exe [2007-9-15 29744]
S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-7-3 1029456]
S3 NETw2v32;Intel(R) PRO/Wireless 2200BG Network Connection Driver for Windows Vista;c:\windows\system32\drivers\NETw2v32.sys [2006-11-2 2589184]

=============== Created Last 30 ================

2009-08-04 07:27 91 a------- c:\windows\system32\vsfocetpbcydmi.dat
2009-08-04 07:16 18,944 a------- c:\windows\system32\vsfocetvpobrha.dll
2009-08-04 07:16 41,472 a------- c:\windows\system32\vsfoceihbjcqxm.dll
2009-08-03 15:20 26,193 a------- c:\windows\system32\vsfoceiyrvdopr.dat
2009-08-03 14:20 762 a------- c:\windows\system32\vsfoceeeadtedu.dat
2009-08-02 20:44 --d----- c:\program files\common files\Wise Installation Wizard
2009-08-02 16:13 91 a------- c:\windows\system32\vsfocebxtctfpi.dat
2009-08-02 16:02 18,944 a------- c:\windows\system32\vsfocedutbikto.dll
2009-08-02 16:02 41,472 a------- c:\windows\system32\vsfocevmjirnqw.dll
2009-08-02 15:14 11,196 a------- c:\windows\system32\vsfoceprlibcit.dat
2009-08-02 15:04 18,944 a------- c:\windows\system32\vsfoceebipxxii.dll
2009-08-02 15:04 41,472 a------- c:\windows\system32\vsfocexkivgxni.dll
2009-08-02 15:04 67,072 a------- c:\windows\system32\drivers\vsfocevsubmmox.sys
2009-08-02 15:03 402 a------- c:\windows\system32\vsfocevymmowtj.dat
2009-08-02 15:03 --d----- C:\_OTM
2009-08-02 13:34 196,500,522 a------- c:\windows\MEMORY.DMP
2009-08-01 22:58 --dsh--- C:\$RECYCLE.BIN
2009-08-01 22:31 219,648 a------- c:\windows\PEV.exe
2009-08-01 22:31 161,792 a------- c:\windows\SWREG.exe
2009-08-01 22:31 98,816 a------- c:\windows\sed.exe
2009-08-01 16:28 --d----- c:\programdata\Seagate
2009-08-01 16:28 --d----- c:\program files\Seagate
2009-08-01 16:28 --d----- c:\progra~2\Seagate
2009-08-01 16:27 --dsh--- c:\windows\ftpcache
2009-08-01 11:30 91 a------- c:\windows\system32\vsfoceavmbqomv.dat
2009-07-31 15:03 --d----- c:\programdata\SUPERAntiSpyware.com
2009-07-31 15:03 --d----- c:\progra~2\SUPERAntiSpyware.com
2009-07-31 15:02 --d----- c:\users\andrew\appdata\roaming\SUPERAntiSpyware.com
2009-07-31 15:02 --d----- c:\program files\SUPERAntiSpyware
2009-07-31 10:30 18,944 a------- c:\windows\system32\vsfoceionrqtct.dll
2009-07-31 10:28 67,072 a------- c:\windows\system32\drivers\vsfocewrsrpiim.sys
2009-07-31 10:28 41,472 a------- c:\windows\system32\vsfocekicdvdsa.dll
2009-07-31 10:28 18,944 a------- c:\windows\system32\vsfoceqyeuhsgn.dll
2009-07-31 10:27 21,740 a------- c:\windows\system32\vsfoceqiotvxxo.dat
2009-07-31 10:27 67,072 a------- c:\windows\system32\drivers\vsfoceicnqwlro.sys
2009-07-31 10:27 41,472 a------- c:\windows\system32\vsfoceokutuses.dll
2009-07-28 16:18 828,416 a------- c:\windows\system32\wininet.dll
2009-07-28 16:18 78,336 a------- c:\windows\system32\ieencode.dll
2009-07-26 17:32 --d----- c:\windows\system32\eu-ES
2009-07-26 17:32 --d----- c:\windows\system32\ca-ES
2009-07-26 17:32 --d----- c:\windows\system32\vi-VN
2009-07-26 14:20 --d----- c:\windows\system32\EventProviders
2009-07-26 11:17 2,926,592 a------- c:\windows\explorer.exe
2009-07-26 11:16 155,456 a------- c:\windows\system32\mscorier.dll
2009-07-26 11:15 7,168 a------- c:\windows\system32\f3ahvoas.dll
2009-07-26 11:14 247,808 a------- c:\windows\system32\drvstore.dll
2009-07-23 15:00 --d-h--- C:\$AVG8.VAULT$
2009-07-23 14:46 --d----- c:\program files\AVG
2009-07-23 14:46 --d----- c:\programdata\avg8
2009-07-23 14:46 --d----- c:\progra~2\avg8
2009-07-22 23:56 --d----- c:\users\andrew\appdata\roaming\Uniblue
2009-07-22 23:52 506,368 a------- c:\windows\system32\msxml.dll
2009-07-22 23:49 --d----- c:\program files\CCleaner
2009-07-22 23:43 15,688 a------- c:\windows\system32\lsdelete.exe
2009-07-22 23:24 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-07-22 23:21 -cd-h--- c:\programdata\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-22 23:21 -cd-h--- c:\progra~2\{EF63305C-BAD7-4144-9208-D65528260864}
2009-07-22 23:21 --d----- c:\programdata\Lavasoft
2009-07-22 23:21 --d----- c:\program files\Lavasoft
2009-07-22 21:34 --d----- c:\users\andrew\appdata\roaming\AVG8
2009-07-22 20:53 1,110,399 a------- c:\windows\system32\UACcmgexbqvwf.db
2009-07-21 13:17 --d----- c:\program files\iPod
2009-07-21 13:17 --d----- c:\program files\iTunes
2009-07-16 19:17 --d----- c:\users\andrew\appdata\roaming\uTorrent
2009-07-15 00:48 289,792 a------- c:\windows\system32\atmfd.dll
2009-07-15 00:48 156,672 a------- c:\windows\system32\t2embed.dll
2009-07-15 00:48 72,704 a------- c:\windows\system32\fontsub.dll
2009-07-15 00:48 34,304 a------- c:\windows\system32\atmlib.dll
2009-07-15 00:48 23,552 a------- c:\windows\system32\lpk.dll
2009-07-15 00:48 10,240 a------- c:\windows\system32\dciman32.dll
2009-07-14 02:56 --d----- c:\program files\Trend Micro
2009-07-14 02:54 --d----- c:\users\andrew\appdata\roaming\Malwarebytes
2009-07-14 02:54 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-14 02:54 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-14 02:54 --d----- c:\programdata\Malwarebytes
2009-07-14 02:54 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-07-14 02:54 --d----- c:\progra~2\Malwarebytes
2009-07-14 02:17 a-d----- c:\programdata\TEMP

==================== Find3M ====================

2009-08-06 17:10 31,548 a------- c:\users\andrew\appdata\roaming\wklnhst.dat
2009-07-26 17:40 143,360 a------- c:\windows\inf\infstrng.dat
2009-07-26 17:40 86,016 a------- c:\windows\inf\infstor.dat
2009-07-26 17:40 51,200 a------- c:\windows\inf\infpub.dat
2009-07-26 17:32 665,600 a------- c:\windows\inf\drvindex.dat
2009-06-05 11:42 2,060,288 a------- c:\windows\system32\usbaaplrc.dll
2008-09-22 14:47 174 a--sh--- c:\program files\desktop.ini
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 05:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 05:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 02:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 02:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 17:06:05.74 ===============

Hello.
Lets finish this off now. We've removed the big problems, now just the files to go, and then we can tidy this up.

1. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
Hello.

c:\windows\system32\vsfocetpbcydmi.dat
c:\windows\system32\vsfocetvpobrha.dll
c:\windows\system32\vsfoceihbjcqxm.dll
c:\windows\system32\vsfoceiyrvdopr.dat
c:\windows\system32\vsfoceeeadtedu.dat
c:\windows\system32\vsfocebxtctfpi.dat
c:\windows\system32\vsfocedutbikto.dll
c:\windows\system32\vsfocevmjirnqw.dll
c:\windows\system32\vsfoceprlibcit.dat
c:\windows\system32\vsfoceebipxxii.dll
c:\windows\system32\vsfocexkivgxni.dll
c:\windows\system32\drivers\vsfocevsubmmox.sys
c:\windows\system32\vsfocevymmowtj.dat
c:\windows\system32\vsfoceavmbqomv.dat
c:\windows\system32\vsfoceionrqtct.dll
c:\windows\system32\drivers\vsfocewrsrpiim.sys
c:\windows\system32\vsfocekicdvdsa.dll
c:\windows\system32\vsfoceqyeuhsgn.dll
c:\windows\system32\vsfoceqiotvxxo.dat
c:\windows\system32\drivers\vsfoceicnqwlro.sys
c:\windows\system32\vsfoceokutuses.dll
c:\windows\system32\msxml.dll
c:\windows\system32\UACcmgexbqvwf.db

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Error: file "Hello." not found!
Deletion of file "Hello." failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "c:\windows\system32\vsfocetpbcydmi.dat" deleted successfully.
File "c:\windows\system32\vsfocetvpobrha.dll" deleted successfully.
File "c:\windows\system32\vsfoceihbjcqxm.dll" deleted successfully.
File "c:\windows\system32\vsfoceiyrvdopr.dat" deleted successfully.
File "c:\windows\system32\vsfoceeeadtedu.dat" deleted successfully.
File "c:\windows\system32\vsfocebxtctfpi.dat" deleted successfully.
File "c:\windows\system32\vsfocedutbikto.dll" deleted successfully.
File "c:\windows\system32\vsfocevmjirnqw.dll" deleted successfully.
File "c:\windows\system32\vsfoceprlibcit.dat" deleted successfully.
File "c:\windows\system32\vsfoceebipxxii.dll" deleted successfully.
File "c:\windows\system32\vsfocexkivgxni.dll" deleted successfully.
File "c:\windows\system32\drivers\vsfocevsubmmox.sys" deleted successfully.
File "c:\windows\system32\vsfocevymmowtj.dat" deleted successfully.
File "c:\windows\system32\vsfoceavmbqomv.dat" deleted successfully.
File "c:\windows\system32\vsfoceionrqtct.dll" deleted successfully.
File "c:\windows\system32\drivers\vsfocewrsrpiim.sys" deleted successfully.
File "c:\windows\system32\vsfocekicdvdsa.dll" deleted successfully.
File "c:\windows\system32\vsfoceqyeuhsgn.dll" deleted successfully.
File "c:\windows\system32\vsfoceqiotvxxo.dat" deleted successfully.
File "c:\windows\system32\drivers\vsfoceicnqwlro.sys" deleted successfully.
File "c:\windows\system32\vsfoceokutuses.dll" deleted successfully.
File "c:\windows\system32\msxml.dll" deleted successfully.
File "c:\windows\system32\UACcmgexbqvwf.db" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Run another Malwarebytes scan and post the results here.

Malwarebytes' Anti-Malware 1.40
Database version: 2575
Windows 6.0.6002 Service Pack 2

8/7/2009 5:50:26 PM
mbam-log-2009-08-07 (17-50-26).txt

Scan type: Quick Scan
Objects scanned: 78558
Time elapsed: 3 minute(s), 27 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

I don't get redirected anymore, and I can use the standby again.

Thank you guys sooo much!

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.