Member Avatar for Killroy7777

Hi, and thank you very much for checking this out, I downloaded a nice little package, and it installed a lot of random viruses into my computer, it seems to run fine, I mean I'm here aren't I? But it is hyjacking my Google searches, it redirects with a starting URL of "overclick.cn" Also, if I right click, and go to new, 'Text Document' is now missing, it deleted all my restore points, smart... Some applications when I try opening them, they don't visualize, their process pops up, and starts using massive resources. I have scanned using CA-Yahoo Anti Virus, Norton 360 scanner, Malwarebytes' Anti-Malware, and Windows Defender, and they have cleaned out some, but not all. I did a HJT log, and here it is, if you can help me, it would be really appreciated.
-----------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:08:44 PM, on 6/14/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Windows\RtHDVCpl.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Users\Ryen Nelsen\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\NetMeter\NetMeter.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Windows\system32\igfxsrvc.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cndt
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.inbox.com/search/dispatcher.aspx?tp=aus&qkw=%s&tbid=70102
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cndt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cndt
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=en_us&c=83&bd=Presario&pf=cndt
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] [ProgramFilesFolder]Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton 360\osCheck.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Ryen Nelsen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Snapfish Media Detector.lnk = C:\Program Files\Snapfish Picture Mover\SnapfishMediaDetector.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O12 - Plugin for .mdz: C:\Program Files\Internet Explorer\Plugins\npmod32.dll
O13 - Gopher Prefix:
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Folder and Drive Access Manager (FM Service) - Unknown owner - C:\Program Files\One Technology\Smart Folder\FMSvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

  • 4 Contributors
  • 11 Replies
  • 185 Views
  • 2 Days Discussion Span
  • Latest Post Latest Post by crunchie
Member Avatar for crunchie

Can you please do only the following.

Can you disable Windows Defender as it may interfere with the removal process. Please leave it disabled until your PC has been given the all clear.

  • Open Windows Defender
  • Click Tools
  • Click General Settings
  • Scroll down to Real Time Protection Options
  • Uncheck Turn on Real Time Protection (recommended)
  • After you uncheck this, click on the Save button
  • Close Windows Defender

Scan with HijackThis and then place a check next to all the following, if present:

[color=#9933cc][b] R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://ie.redirect.hp.com/svs/rdr?TY...esario&pf=cndt[/url] [/b][/color] 
[color=#9933cc][b] R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://ie.redirect.hp.com/svs/rdr?TY...esario&pf=cndt[/url] [/b][/color] 
[color=#9933cc][b] R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://ie.redirect.hp.com/svs/rdr?TY...esario&pf=cndt[/url] [/b][/color] 
[color=#9933cc][b] R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://ie.redirect.hp.com/svs/rdr?TY...esario&pf=cndt[/url] [/b][/color] 
[color=#9933cc][b] R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =  [/b][/color] 
[color=#9933cc][b] R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =  [/b][/color] 
[color=#9933cc][b] R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =  [/b][/color] 

[color=#9933cc][b] O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file) [/b][/color] 

[color=#9933cc][b] O13 - Gopher Prefix:  [/b][/color]

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

Post the log from MBA-M please.

Please download ComboFix by sUBs from HERE or HERE

  • You must download it to and run it from your Desktop
  • Physically disconnect from the internet.
  • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
  • Double click combofix.exe & follow the prompts.
  • When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
  • Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Run Combofix ONCE only!!

Edited by mike_2000_17 because: Fixed formatting
Member Avatar for Killroy7777

I did everything, I'm on the boot that ComboFix put me on, so I can see it's very limited, I'm going to reboot now, and hope for the best, the attachments show the new HJT log, and a MWB log, thank you so much for helping me so far.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:19:38 AM, on 6/16/2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v7.00 (7.00.6002.18005)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\PowerMenu\PowerMenu.exe
C:\Windows\Explorer.exe
C:\Program Files\OpenOffice.org 3\program\soffice.exe
C:\Program Files\OpenOffice.org 3\program\soffice.bin
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Windows\system32\igfxsrvc.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.6\CoIEPlg.dll
O3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\hp\support\hpsysdrv.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [Google Update] "C:\Users\Ryen Nelsen\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [Gadwin PrintScreen] C:\Program Files\Gadwin Systems\PrintScreen\PrintScreen.exe /nosplash
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKUS\S-1-5-18\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background (User 'Default user')
O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe
O4 - Startup: PowerMenu.lnk = C:\Program Files\PowerMenu\PowerMenu.exe
O4 - Global Startup: Snapfish Media Detector.lnk = C:\Program Files\Snapfish Picture Mover\SnapfishMediaDetector.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O9 - Extra 'Tools' menuitem: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm
O12 - Plugin for .mdz: C:\Program Files\Internet Explorer\Plugins\npmod32.dll
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Folder and Drive Access Manager (FM Service) - Unknown owner - C:\Program Files\One Technology\Smart Folder\FMSvc.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - c:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\Windows\system32\GameMon.des.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9886 bytes
Malwarebytes' Anti-Malware 1.37
Database version: 2279
Windows 6.0.6002 Service Pack 2

6/16/2009 1:45:45 AM
mbam-log-2009-06-16 (01-45-39).txt

Scan type: Full Scan (C:\|D:\|)
Objects scanned: 350602
Time elapsed: 1 hour(s), 7 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\program files\NSIS\Plugins\NSISdl.dll (Adware.AdRotator) -> No action taken.
Member Avatar for gerbil

I bet heaps that Crunchie is going to ask for that comboFix log... it's in C:\.

Member Avatar for Killroy7777

I knew I was forgetting something I am so sorry.

ComboFix 09-06-15.06 - Ryen Nelsen 06/16/2009  1:59.1 - NTFSx86
Microsoft Windows Vista Home Premium   6.0.6002.2.1252.1.1033.18.2036.986 [GMT -7:00]
Running from: c:\users\Ryen Nelsen\Desktop\ComboFix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
 * Created a new restore point
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\Ryen Nelsen\AppData\Roaming\.#
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@1134@1D52950.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@1134@1D52980.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@1134@1D529B0.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@1358@1BF2950.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@1358@1BF2980.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@1358@1BF29B0.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@9FC@272950.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@9FC@272980.###
c:\users\Ryen Nelsen\AppData\Roaming\.#\MBX@9FC@2729B0.###
c:\windows\system32\drivers\SKYNETitieadjx.sys
c:\windows\system32\SKYNETbsfioqbw.dat
c:\windows\system32\SKYNETidkufppo.dat
c:\windows\system32\SKYNETmqgqxxxb.dll
c:\windows\system32\SKYNETqrdwtvxb.dll
D:\Desktop.ini

.
(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SKYNETgcnmthce


(((((((((((((((((((((((((   Files Created from 2009-05-16 to 2009-06-16  )))))))))))))))))))))))))))))))
.

2009-08-01 07:32 . 2009-06-14 22:01	--------	d-----w-	c:\users\Ryen Nelsen\AppData\Roaming\Hamachi
2009-08-01 07:31 . 2009-06-14 17:06	--------	d-----w-	c:\program files\Hamachi
2009-06-16 09:06 . 2009-06-16 09:06	--------	d-----w-	c:\users\Ryen Nelsen\AppData\Local\temp
2009-06-16 07:25 . 2009-05-13 15:32	89104	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\NAVENG.SYS
2009-06-16 07:25 . 2009-05-13 15:32	876144	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\NAVEX15.SYS
2009-06-16 07:25 . 2009-05-13 15:32	371248	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\EECTRL.SYS
2009-06-16 07:25 . 2009-05-13 15:32	259368	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\ECMSVR32.DLL
2009-06-16 07:25 . 2009-05-13 15:32	2414128	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\CCERASER.DLL
2009-06-16 07:25 . 2009-05-13 15:32	177520	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\NAVENG32.DLL
2009-06-16 07:25 . 2009-05-13 15:32	1181040	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\NAVEX32A.DLL
2009-06-16 07:25 . 2009-05-13 15:32	101936	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090615.050\ERASER.SYS
2009-06-15 03:11 . 2009-05-13 15:32	89104	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\NAVENG.SYS
2009-06-15 03:11 . 2009-05-13 15:32	876144	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\NAVEX15.SYS
2009-06-15 03:11 . 2009-05-13 15:32	371248	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\EECTRL.SYS
2009-06-15 03:11 . 2009-05-13 15:32	259368	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\ECMSVR32.DLL
2009-06-15 03:11 . 2009-05-13 15:32	2414128	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\CCERASER.DLL
2009-06-15 03:11 . 2009-05-13 15:32	177520	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\NAVENG32.DLL
2009-06-15 03:11 . 2009-05-13 15:32	1181040	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\NAVEX32A.DLL
2009-06-15 03:11 . 2009-05-13 15:32	101936	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090614.035\ERASER.SYS
2009-06-15 02:07 . 2009-06-15 02:07	--------	d-----w-	c:\program files\Trend Micro
2009-06-15 00:03 . 2009-06-15 00:03	--------	d-----w-	c:\users\Ryen Nelsen\AppData\Roaming\Malwarebytes
2009-06-15 00:03 . 2009-05-26 20:20	40160	----a-w-	c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-15 00:03 . 2009-06-15 00:03	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2009-06-15 00:03 . 2009-06-15 00:03	--------	d-----w-	c:\programdata\Malwarebytes
2009-06-15 00:03 . 2009-05-26 20:19	19096	----a-w-	c:\windows\system32\drivers\mbam.sys
2009-06-14 19:55 . 2009-06-14 19:55	--------	d-----w-	c:\program files\Pocket Tanks Deluxe
2009-06-14 19:39 . 2009-06-15 02:23	--------	d-----w-	c:\users\Ryen Nelsen\.scorched3d
2009-06-14 19:35 . 2009-06-14 19:35	--------	d-----w-	c:\program files\Scorched3D
2009-06-14 17:48 . 2009-06-14 17:48	--------	d-----w-	c:\program files\HMSoft
2009-06-14 17:06 . 2009-06-14 17:06	25280	----a-w-	c:\windows\system32\drivers\hamachi.sys
2009-06-14 01:39 . 2009-06-14 01:39	--------	d-----w-	C:\.jagex_cache_32
2009-06-12 23:11 . 2009-03-06 17:25	439672	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\scxpx86.dll
2009-06-12 23:11 . 2009-02-09 22:59	272432	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\IDSvix86.sys
2009-06-12 23:11 . 2009-02-09 22:59	251768	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\symidsco.sys
2009-06-12 23:11 . 2009-02-09 22:59	685432	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\idsxpx86.dll
2009-06-12 23:11 . 2009-02-09 22:59	173432	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\SymIDSI.dll
2009-06-12 23:11 . 2009-02-09 22:59	370224	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\IDSvia64.sys
2009-06-12 23:11 . 2008-08-09 04:27	157120	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090610.001\IDS9xx86.dll
2009-06-12 22:38 . 2009-06-12 22:38	2141	----a-w-	c:\users\Ryen Nelsen\AppData\Roaming\.purple\certificates\x509\tls_peers\omega.contacts.msn.com
2009-06-12 21:07 . 2009-06-12 21:12	--------	d-----w-	c:\users\Ryen Nelsen\AppData\Roaming\NetMeter
2009-06-12 21:07 . 2009-06-12 21:07	--------	d-----w-	c:\program files\NetMeter
2009-06-11 06:00 . 2009-06-11 06:00	--------	d-----w-	c:\users\Ryen Nelsen\dwhelper
2009-06-11 05:45 . 2009-04-21 11:39	2034688	----a-w-	c:\windows\system32\win32k.sys
2009-06-11 05:45 . 2009-04-23 12:14	623616	----a-w-	c:\windows\system32\localspl.dll
2009-06-11 05:45 . 2009-04-23 12:15	784896	----a-w-	c:\windows\system32\rpcrt4.dll
2009-06-11 05:44 . 2009-04-23 12:15	828416	----a-w-	c:\windows\system32\wininet.dll
2009-06-11 05:44 . 2009-04-24 16:02	78336	----a-w-	c:\windows\system32\ieencode.dll
2009-06-10 23:37 . 2009-06-10 23:37	--------	d-----w-	c:\users\Ryen Nelsen\AppData\Roaming\GetRightToGo
2009-06-10 23:08 . 2009-06-10 23:10	--------	d-----w-	c:\users\Ryen Nelsen\AppData\Local\Nemex
2009-06-10 23:08 . 2009-06-10 23:08	--------	d-----w-	c:\program files\Nemex
2009-06-10 22:34 . 2009-06-10 22:34	758088	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2009-06-10 21:29 . 2009-03-06 17:25	439672	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\scxpx86.dll
2009-06-10 21:29 . 2009-02-09 22:59	272432	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\IDSvix86.sys
2009-06-10 21:29 . 2009-02-09 22:59	251768	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\symidsco.sys
2009-06-10 21:29 . 2009-02-09 22:59	685432	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\idsxpx86.dll
2009-06-10 21:29 . 2009-02-09 22:59	173432	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\SymIDSI.dll
2009-06-10 21:29 . 2009-02-09 22:59	370224	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\IDSvia64.sys
2009-06-10 21:29 . 2008-08-09 04:27	157120	----a-w-	c:\programdata\Symantec\Definitions\SymcData\ipsdefs\20090604.002\IDS9xx86.dll
2009-06-02 17:28 . 2009-06-02 17:28	--------	dc-h--w-	c:\programdata\{B98A2B83-8BB0-42E7-AA1D-D6FA6E7C8F31}
2009-06-02 17:19 . 2009-05-13 15:32	89104	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\NAVENG.SYS
2009-06-02 17:19 . 2009-05-13 15:32	876144	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\NAVEX15.SYS
2009-06-02 17:19 . 2009-05-13 15:32	371248	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\EECTRL.SYS
2009-06-02 17:19 . 2009-05-13 15:32	259368	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\ECMSVR32.DLL
2009-06-02 17:19 . 2009-05-13 15:32	2414128	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\CCERASER.DLL
2009-06-02 17:19 . 2009-05-13 15:32	177520	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\NAVENG32.DLL
2009-06-02 17:19 . 2009-05-13 15:32	1181040	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\NAVEX32A.DLL
2009-06-02 17:19 . 2009-05-13 15:32	101936	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\20090602.007\ERASER.SYS
2009-06-02 01:16 . 2009-06-02 01:17	--------	d-----w-	c:\windows\system32\ca-ES
2009-06-02 01:16 . 2009-06-02 01:16	--------	d-----w-	c:\windows\system32\eu-ES
2009-06-02 01:16 . 2009-06-02 01:16	--------	d-----w-	c:\windows\system32\vi-VN
2009-06-02 01:06 . 2009-06-02 01:06	--------	d-----w-	c:\windows\system32\SPReview
2009-06-02 00:53 . 2009-04-11 06:28	928768	----a-w-	c:\windows\system32\scavenge.dll
2009-06-02 00:53 . 2009-04-11 06:27	57856	----a-w-	c:\windows\system32\compcln.exe
2009-06-02 00:50 . 2009-04-11 06:28	978432	----a-w-	c:\windows\system32\drmv2clt.dll
2009-06-02 00:49 . 2009-04-11 06:28	61440	----a-w-	c:\windows\system32\wscsvc.dll
2009-06-02 00:45 . 2009-06-02 00:45	--------	d-----w-	c:\windows\system32\EventProviders
2009-06-02 00:12 . 2009-05-13 15:32	89104	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\BinHub\NAVENG.SYS
2009-06-02 00:12 . 2009-05-13 15:32	876144	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\BinHub\NAVEX15.SYS
2009-06-02 00:12 . 2009-05-13 15:32	177520	----a-w-	c:\programdata\Symantec\Definitions\VirusDefs\BinHub\NAVENG32.DLL
2009-06-02 00:12 . 2009-05-13 15:32	1181040	----a-w-	c:\programd
Member Avatar for crunchie

That's what I was waiting for :).

To my just opened eyes, those logs look ok.

How is the pc now?

commented: Make the thanks count :) +35
Member Avatar for Killroy7777

That's what I was waiting for :).

To my just opened eyes, those logs look ok.

How is the pc now?

Seems to be alright, actually, seems a little bit faster, but hey I'm not complaining, nothing seems to be of miss, thank you so much for the help, I really do appreciate you taking your time to view my computer and fix it. +rep for sure :)!

Member Avatar for caperjack

I did everything, I'm on the boot that ComboFix put me on, so I can see it's very limited, I'm going to reboot now, and hope for the best, the attachments show the new HJT log, and a MWB log, thank you so much for helping me so far.

you didn't fix the last malwarebytes scan
[Files Infected:
c:\program files\NSIS\Plugins\NSISdl.dll (Adware.AdRotator) -> No action taken.]

Member Avatar for Killroy7777

you didn't fix the last malwarebytes scan
[Files Infected:
c:\program files\NSIS\Plugins\NSISdl.dll (Adware.AdRotator) -> No action taken.]

Thank you for informing me, but actually I did, I just checked in Malwarebytes, it is quarantined. But I also just read on the internet that it is found to be a false negative, which it is, I'm pretty sure, the program it goes to is called NSIS, a Windows Installer Creator, so I'll just reinstall it to fix it.

Member Avatar for crunchie

No worries. Mark your thread as solved if you wish :).

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.