I've been having one problem after another since yesterday morning. The problems started with notifications that an application could not be executed, because the file is infected. I ran Malwarebytes Anti-Malware and that seemed to do the trick, at least until this morning, when problems started showing up. In order: redirects from certain search results in Google, Defence Center installing itself on my computer, disabled Task Manager, and getting prompted to choose what program I want to open .exe's with, and Windows not recognizing the application.
I've tried following the instructions for posting, with little luck. I managed to run Microsoft® Windows® Malicious Software Removal Tool, thought it froze the computer once and I had to restart. (I also can't seem to run in safe mode. I've tried to enter it, but keep on getting Blue Screens) I cannot run ATF, GMER, or Malwarebytes again, as I keep getting prompted to choose what program I want to open them with. (I had run Malwarebytes before this, but my computer would randomly restart once the program had been scanning for about an hour and a half.)
Any and all help will be greatly appreciated.
Here is my DDS.txt
DDS (Ver_10-03-17.01) - NTFSx86
Run by Sofia at 23:09:48.45 on Mon 06/28/2010
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.255.57 [GMT -4:00]
============== Running Processes ===============
c:\windows\system32\svchost -k dcomlaunch
svchost.exe
c:\windows\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\EPSON\EBAPI\eEBSVC.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
c:\windows\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
c:\windows\system32\svchost.exe -k netsvcs
C:\WINDOWS\Explorer.EXE
c:\windows\system32\svchost.exe -k httpfilter
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sofia\Desktop\dds.scr
============== Pseudo HJT Report ===============
uInternet Settings,ProxyOverride = <local>
uInternet Settings,ProxyServer = http=127.0.0.1:5555
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll
BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\ie\rpbrowserrecordplugin.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {BA52B914-B692-46c4-B683-905236F6F655} - No File
TB: {DE9C389F-3316-41A7-809B-AA305ED9D922} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
uRun: [WorkForce 610(Network)] c:\windows\system32\spool\drivers\w32x86\3\e_fatifja.exe /fu "c:\windows\temp\E_S359.tmp" /EF "HKCU"
uRun: [AIM] c:\program files\aim\aim.exe -cnetwait.odl
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [BCMSMMSG] BCMSMMSG.exe
mRun: [DVDSentry] c:\windows\system32\DSentry.exe
mRun: [nwiz] nwiz.exe /install
mRun: [McAfeeUpdaterUI] "c:\program files\network associates\common framework\UpdaterUI.exe" /StartedFromRunKey
mRun: [ShStatEXE] "c:\program files\network associates\virusscan\SHSTAT.EXE" /STANDALONE
mRun: [WinampAgent] c:\program files\winamp\winampa.exe
mRun: [<NO NAME>]
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\sharedcom8\RoxWatchTray.exe"
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
mRun: [EEventManager] c:\progra~1\epsons~1\eventm~1\EEventManager.exe
mRun: [FUFAXSTM] "c:\program files\epson software\fax utility\FUFAXSTM.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AIMWDInstallFilename] c:\progra~1\aim\AIMWDI~1.EXE
mRun: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
mRun: [Malwarebytes Anti-Malware (rootkit-scan)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
StartupFolder: c:\docume~1\sofia\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\sonicc~1.lnk - c:\program files\common files\sonic shared\CineTray.exe
uPolicies-system: DisableTaskMgr = 1 (0x1)
mPolicies-system: DisableTaskMgr = 1 (0x1)
IE: Copy to Semagic - c:\program files\semagic\copy.htm
IE: Semagic - c:\program files\semagic\link.htm
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: ActiveGS.cab - hxxp://www.virtualapple.org/activegs.cab
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://a1540.g.akamai.net/7/1540/52/20070711/qtinstall.info.apple.com/qtactivex/qtplugin.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://fpdownload.macromedia.com/get/shockwave/cabs/director/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/8/b/d/8bd77752-5704-4d68-a152-f7252adaa4f2/LegitCheckControl.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {41F17733-B041-4099-A042-B518BB6A408C} - hxxp://a1408.g.akamai.net/7/1408/9955/20031218/akamai.info.apple.com/iTunes4/WW/win/019-0123.20031218.zes4d/iTunesSetup.exe
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,83/mcinsctl.cab
DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} - hxxp://scan.safety.live.com/resource/download/scanner/wlscbase969.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {9B14B03A-B482-45C3-BE37-5B7CAA8B0B5D} - hxxp://hsearch.nayio.com/download/QBH.cab
DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} - hxxps://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx
DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} - hxxp://download.mcafee.com/molbin/shared/mcgdmgr/en-us/1,0,0,20/mcgdmgr.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
================= FIREFOX ===================
FF - ProfilePath - c:\docume~1\sofia\applic~1\mozilla\firefox\profiles\v636ncti.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.aol.com
FF - prefs.js: network.proxy.type - 4
FF - component: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\firefox\ext\components\nprpffbrowserrecordext.dll
FF - plugin: c:\documents and settings\all users\application data\real\realplayer\browserrecordplugin\mozillaplugins\nprphtml5videoshim.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npActiveGS.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}
---- FIREFOX POLICIES ----
FF - user.js: network.protocol-handler.warn-external.dnupdate - falsec:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency", 1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.lu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nu", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.nz", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--p1ai", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbayh7gpa", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.IDN.whitelist.tel", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.proxy.type", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("dom.ipc.plugins.timeoutSecs", 10);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight", 2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize", 1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight", 5);
c:\program files\mozilla firefox\greprefs\all.js - pref("accelerometer.enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_as_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugin", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.nptest.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npswf32.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npctrl.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled.npqtplugin.dll", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
============= SERVICES / DRIVERS ===============
R1 EPPSCSIx;EPPSCSIx;c:\windows\system32\drivers\EPPSCSI.SYS [2003-9-4 49628]
R1 SBRE;SBRE;c:\windows\system32\drivers\SBREDrv.sys [2010-6-27 93872]
R2 Iprip;RIP Listener;c:\windows\system32\svchost.exe -k netsvcs [2002-8-29 14336]
R2 McAfeeFramework;McAfee Framework Service;c:\program files\network associates\common framework\FrameworkService.exe [2005-1-16 106559]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-12-3 24652]
S3 A3AB;D-Link AirPro 802.11a/b Wireless Adapter Service(A3AB);c:\windows\system32\drivers\A3AB.sys [2004-8-11 396192]
============== File Associations ===============
.exe=secfile
=============== Created Last 30 ================
2010-06-29 00:22:03 0 d-----w- c:\program files\Avira
2010-06-29 00:22:03 0 d-----w- c:\docume~1\alluse~1\applic~1\Avira
2010-06-28 17:52:17 0 d-----w- c:\program files\Defense Center
2010-06-28 15:08:23 0 d-----w- c:\windows\system32\MpEngineStore
2010-06-28 15:04:44 0 d-----w- C:\11b3919bf3bf46d62b9d
2010-06-28 12:13:27 0 d-----w- c:\program files\ESET
2010-06-27 15:51:44 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-06-27 15:50:58 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-06-27 15:32:32 27944 ----a-w- c:\windows\system32\sbbd.exe
2010-06-27 15:32:31 93872 ----a-w- c:\windows\system32\drivers\SBREDrv.sys
2010-06-27 15:27:33 0 d-----w- C:\VIPRERESCUE
2010-06-25 01:27:21 0 d-----w- c:\windows\system32\NtmsData
2010-06-22 23:01:59 48640 ----a-w- c:\windows\system32\dllcache\kdsui.dll
2010-06-22 23:01:59 253952 ----a-w- c:\windows\system32\dllcache\kdsusd.dll
2010-06-22 23:01:55 5632 ----a-w- c:\windows\system32\dllcache\kbdusa.dll
2010-06-22 23:01:27 14592 ----a-w- c:\windows\system32\dllcache\kbdhid.sys
2010-06-22 23:01:07 18432 ----a-w- c:\windows\system32\dllcache\jupiw.dll
2010-06-22 23:01:01 26624 ----a-w- c:\windows\system32\dllcache\irstusb.sys
2010-06-22 23:01:01 18688 ----a-w- c:\windows\system32\dllcache\irsir.sys
2010-06-22 23:00:59 28160 ----a-w- c:\windows\system32\dllcache\irmon.dll
2010-06-22 23:00:55 23552 ----a-w- c:\windows\system32\dllcache\irmk7.sys
2010-06-22 23:00:54 151552 ----a-w- c:\windows\system32\dllcache\irftp.exe
2010-06-22 23:00:42 88192 ----a-w- c:\windows\system32\dllcache\irda.sys
2010-06-22 23:00:26 45632 ----a-w- c:\windows\system32\dllcache\ip5515.sys
2010-06-22 23:00:23 90200 ----a-w- c:\windows\system32\dllcache\io8ports.dll
2010-06-22 23:00:23 38784 ----a-w- c:\windows\system32\dllcache\io8.sys
2010-06-22 23:00:18 13056 ----a-w- c:\windows\system32\dllcache\inport.sys
2010-06-22 22:57:04 50751 ----a-w- c:\windows\system32\dllcache\hsf_tone.sys
2010-06-22 22:57:04 488383 ----a-w- c:\windows\system32\dllcache\hsf_v124.sys
2010-06-22 22:57:03 73279 ----a-w- c:\windows\system32\dllcache\hsf_spkp.sys
2010-06-22 22:57:03 44863 ----a-w- c:\windows\system32\dllcache\hsf_soar.sys
2010-06-22 22:57:02 57471 ----a-w- c:\windows\system32\dllcache\hsf_samp.sys
2010-06-22 22:57:02 542879 ----a-w- c:\windows\system32\dllcache\hsf_msft.sys
2010-06-22 22:57:01 9759 ----a-w- c:\windows\system32\dllcache\hsf_inst.dll
2010-06-22 22:57:01 391199 ----a-w- c:\windows\system32\dllcache\hsf_k56k.sys
2010-06-22 22:57:00 199711 ----a-w- c:\windows\system32\dllcache\hsf_faxx.sys
2010-06-22 22:57:00 115807 ----a-w- c:\windows\system32\dllcache\hsf_fsks.sys
2010-06-22 22:55:59 455296 ----a-w- c:\windows\system32\dllcache\fusbbase.sys
2010-06-22 22:54:59 634134 ----a-w- c:\windows\system32\dllcache\el656ct5.sys
2010-06-22 22:53:56 419357 ----a-w- c:\windows\system32\dllcache\dgconfig.dll
2010-06-22 22:52:59 14336 ----a-w- c:\windows\system32\dllcache\chgusr.exe
2010-06-22 22:51:59 3968 ----a-w- c:\windows\system32\dllcache\brfiltup.sys
2010-06-22 22:50:56 24576 ----a-w- c:\windows\system32\dllcache\agcgauge.ax
2010-06-22 22:49:11 66048 ----a-w- c:\windows\system32\dllcache\s3legacy.dll
2010-06-22 22:47:46 13107200 -c--a-w- c:\windows\system32\oembios.bin
2010-06-16 01:48:06 0 d-----w- c:\windows\system32\Adobe
==================== Find3M ====================
2010-05-04 12:39:27 70656 ----a-w- c:\windows\system32\dllcache\ie4uinit.exe
2010-05-04 12:39:27 13824 ------w- c:\windows\system32\dllcache\ieudinit.exe
2010-05-02 05:22:50 1851264 ----a-w- c:\windows\system32\win32k.sys
2010-05-02 05:22:50 1851264 ------w- c:\windows\system32\dllcache\win32k.sys
2010-04-20 05:30:08 285696 ----a-w- c:\windows\system32\dllcache\atmfd.dll
2010-04-20 05:30:08 285696 ----a-w- c:\windows\system32\atmfd.dll
2010-04-16 11:43:25 634656 --s-a-w- c:\windows\system32\dllcache\iexplore.exe
2010-04-16 11:43:23 161792 ----a-w- c:\windows\system32\dllcache\ieakui.dll
2010-04-06 08:52:46 2462720 ----a-w- c:\windows\system32\dllcache\WMVCore.dll
2010-03-31 04:16:34 99176 ----a-w- c:\windows\system32\PresentationHostProxy.dll
2010-03-31 04:10:40 295264 ----a-w- c:\windows\system32\PresentationHost.exe
2008-08-03 01:14:40 32768 -csha-w- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008080220080803\index.dat
============= FINISH: 23:12:46.71 ===============
And here is my Attach.txt
F
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
DDS (Ver_10-03-17.01)
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 8/31/2003 9:43:32 PM
System Uptime: 6/28/2010 10:31:51 PM (1 hours ago)
Motherboard: Dell Computer Corp. | | 02Y832
Processor: Intel(R) Pentium(R) 4 CPU 2.40GHz | Microprocessor | 2394/533mhz
==== Disk Partitions =========================
A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 1.451 GiB free.
D: is CDROM (UDF)
E: is CDROM (CDFS)
Z: is NetworkDisk (FAT) - 0 GiB total, 0 GiB free.
==== Disabled Device Manager Items =============
Class GUID:
Description: Ethernet Controller
Device ID: PCI\VEN_168C&DEV_001A&SUBSYS_3A161186&REV_01\4&1C660DD6&0&08F0
Manufacturer:
Name: Ethernet Controller
PNP Device ID: PCI\VEN_168C&DEV_001A&SUBSYS_3A161186&REV_01\4&1C660DD6&0&08F0
Service:
Class GUID: {4D36E97B-E325-11CE-BFC1-08002BE10318}
Description: Adaptec AHA-151X/AHA-152X or AIC-6260/AIC-6360 SCSI Host Adapter (non-pnp)
Device ID: ROOT\SCSIADAPTER\0000
Manufacturer: Adaptec
Name: Adaptec AHA-151X/AHA-152X or AIC-6260/AIC-6360 SCSI Host Adapter (non-pnp)
PNP Device ID: ROOT\SCSIADAPTER\0000
Service: sparrow
==== System Restore Points ===================
RP2193: 5/4/2010 4:23:55 AM - System Checkpoint
RP2194: 5/5/2010 4:27:47 AM - System Checkpoint
RP2195: 5/6/2010 5:27:53 AM - System Checkpoint
RP2196: 5/7/2010 6:54:21 AM - System Checkpoint
RP2197: 5/8/2010 12:13:39 PM - System Checkpoint
RP2198: 5/9/2010 1:41:01 PM - System Checkpoint
RP2199: 5/10/2010 1:46:55 PM - System Checkpoint
RP2200: 5/11/2010 10:55:17 PM - System Checkpoint
RP2201: 5/12/2010 12:01:03 PM - Software Distribution Service 3.0
RP2202: 5/13/2010 12:47:09 PM - System Checkpoint
RP2203: 5/14/2010 1:47:12 PM - System Checkpoint
RP2204: 5/15/2010 2:01:52 PM - System Checkpoint
RP2205: 5/16/2010 2:39:07 PM - System Checkpoint
RP2206: 5/17/2010 3:38:16 PM - System Checkpoint
RP2207: 5/18/2010 3:39:10 PM - System Checkpoint
RP2208: 5/19/2010 3:53:58 PM - System Checkpoint
RP2209: 5/20/2010 4:17:01 PM - System Checkpoint
RP2210: 5/21/2010 5:03:29 PM - System Checkpoint
RP2211: 5/22/2010 5:39:30 PM - System Checkpoint
RP2212: 5/23/2010 6:01:21 PM - System Checkpoint
RP2213: 5/24/2010 7:53:04 PM - System Checkpoint
RP2214: 5/25/2010 8:32:52 PM - System Checkpoint
RP2215: 5/26/2010 12:02:03 PM - Software Distribution Service 3.0
RP2216: 5/27/2010 6:33:46 PM - System Checkpoint
RP2217: 5/28/2010 8:04:29 PM - System Checkpoint
RP2218: 5/30/2010 3:06:03 AM - System Checkpoint
RP2219: 5/31/2010 9:09:42 AM - System Checkpoint
RP2220: 6/1/2010 9:12:37 AM - System Checkpoint
RP2221: 6/2/2010 12:44:51 PM - System Checkpoint
RP2222: 6/3/2010 5:59:32 PM - System Checkpoint
RP2223: 6/9/2010 7:11:33 PM - System Checkpoint
RP2224: 6/11/2010 12:48:23 AM - System Checkpoint
RP2225: 6/12/2010 1:00:06 AM - System Checkpoint
RP2226: 6/13/2010 12:29:04 AM - Software Distribution Service 3.0
RP2227: 6/15/2010 8:19:55 PM - System Checkpoint
RP2228: 6/17/2010 12:57:45 AM - System Checkpoint
RP2229: 6/22/2010 11:40:35 AM - System Checkpoint
RP2230: 6/23/2010 1:06:54 PM - System Checkpoint
RP2231: 6/24/2010 11:16:52 PM - Software Distribution Service 3.0
RP2232: 6/24/2010 11:39:02 PM - Software Distribution Service 3.0
RP2233: 6/26/2010 10:05:02 AM - System Checkpoint
RP2234: 6/26/2010 3:33:44 PM - Removed Magellan RoadMate Tools
RP2235: 6/27/2010 5:59:28 PM - System Checkpoint
RP2236: 6/28/2010 7:40:35 PM - System Checkpoint
==== Installed Programs ======================
AAC Decoder
Acrobat.com
Adobe AIR
Adobe Bridge 1.0
Adobe Common File Installer
Adobe Digital Editions
Adobe Flash Player 10 Plugin
Adobe Help Center 1.0
Adobe Photoshop CS2
Adobe Reader 7.1.0
Adobe Shockwave Player 11.5
Adobe Stock Photos 1.0
AOL Instant Messenger
Audacity 1.2.6
AutoUpdate
BCM V.92 56K Modem
CDisplayEx 1.4
Civilization III Complete Edition
Consumer Complete Care Services Agreement
Critical Update for Windows Media Player 11 (KB959772)
DAO
Defense Center
Dell Networking Guide
Dell Solution Center
Dell Support Center (Support Software)
DellSupport
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Version Checker
DivX Web Player
DVDSentry
Epson Event Manager
Epson FAX Utility
Epson PC-FAX Driver
EPSON Scan
EPSON WorkForce 610 Series Printer Uninstall
EpsonNet Print
EpsonNet Setup
ESET Online Scanner v3
getPlus(R) for Adobe
H.264 Decoder
Help and Support Customization
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet
Java(TM) 6 Update 17
Java(TM) 6 Update 3
Java(TM) 6 Update 5
Java(TM) 6 Update 7
LightScribe 1.4.97.1
LJ-SecInstall
ljArchive
Malwarebytes' Anti-Malware
Microsoft .NET Framework (English)
Microsoft .NET Framework (English) v1.0.3705
Microsoft .NET Framework 1.0 Hotfix (KB928367)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Data Access Components KB870669
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Excel Viewer 2003
Microsoft Office XP Professional with FrontPage
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Word 2002
Microsoft Works 2003 Setup Launcher
Microsoft Works 7.0
Microsoft Works Suite Add-in for Microsoft Word
MiraScan V3.30
MKV Splitter
Modem Helper
Monkey's Audio
Mozilla Firefox (3.6.4)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
NVIDIA Windows 2000/XP Display Drivers
PowerDVD
Qualxserve Service Agreement
RealPlayer
RealUpgrade 1.0
Roxio Creator 8.2 XE
Roxio DLA
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Internet Explorer 7 (KB982381)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB981349)
Semagic (remove only)
Shockwave
StepMania CVS (remove only)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
VideoLAN VLC media player 0.8.6f
Viewpoint Media Player
WebCam for MSN Messenger
WebFldrs XP
Winamp (remove only)
Windows Blaster Worm Removal Tool (KB833330)
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Safety Scanner
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
WinRAR archiver
Works Suite OS Pack
Yahoo! Messenger
==== Event Viewer Messages From Past Week ========
6/28/2010 10:46:01 AM, error: Print [19] - Sharing printer failed + 1722, Printer HP DeskJet 950C/952C/959C share name Printer.
6/27/2010 11:24:38 PM, error: Service Control Manager [7034] - The Roxio Hard Drive Watcher service terminated unexpectedly. It has done this 1 time(s).
6/27/2010 11:24:28 PM, error: Service Control Manager [7017] - Detected circular dependencies demand starting Remote Access Connection Manager.
6/27/2010 11:24:28 PM, error: Service Control Manager [7001] - The Remote Access Connection Manager service depends on the Telephony service which failed to start because of the following error: After starting, the service hung in a start-pending state.
6/27/2010 11:24:27 PM, error: Service Control Manager [7022] - The Telephony service hung on starting.
6/27/2010 11:22:50 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the RoxMediaDB service to connect.
6/27/2010 11:22:10 PM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service RoxMediaDB with arguments "" in order to run the server: {123D8A82-52BF-4C77-A90B-409B7CCBC3AD}
6/26/2010 8:42:29 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dnscache service.
6/26/2010 3:24:36 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HTTP SSL service to connect.
6/26/2010 3:24:36 PM, error: Service Control Manager [7000] - The HTTP SSL service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/26/2010 3:17:21 PM, error: Ftdisk [49] - Configuring the Page file for crash dump failed. Make sure there is a page file on the boot partition and that is large enough to contain all physical memory.
6/26/2010 3:17:21 PM, error: Ftdisk [45] - The system could not sucessfully load the crash dump driver.
6/24/2010 9:57:49 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
6/24/2010 9:57:49 PM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
6/24/2010 11:31:54 PM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
6/22/2010 7:53:46 PM, error: Print [19] - Sharing printer failed + 1722, Printer hp psc 2200 series share name hppsc220.
6/22/2010 7:06:22 PM, information: Windows File Protection [64017] - Windows File Protection file scan completed successfully.
6/22/2010 7:05:57 PM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\drivers\wceusbsh.sys has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 1.0.36764.0.
6/22/2010 7:05:51 PM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\drivers\wceusbsh.sys has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 3.7.1.3244.
6/22/2010 6:48:59 PM, information: Windows File Protection [64004] - The protected system file c:\windows\system32\oembios.sig could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject. ].
6/22/2010 6:48:57 PM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\oembios.sig has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
6/22/2010 6:48:57 PM, information: Windows File Protection [64004] - The protected system file c:\windows\system32\oembios.dat could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject. ].
6/22/2010 6:48:44 PM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\oembios.dat has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
6/22/2010 6:48:07 PM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000056' while processing the file 'oembios.bin.new' on the volume 'HarddiskVolume2'. It has stopped monitoring the volume.
6/22/2010 6:48:06 PM, information: Windows File Protection [64004] - The protected system file c:\windows\system32\oembios.bin could not be restored to its original, valid version. The file version of the bad file is 0.0.0.1 The specific error code is 0x800b0100 [No signature was present in the subject. ].
6/22/2010 6:47:40 PM, information: Windows File Protection [64020] - Windows File Protection scan found that the system file c:\windows\system32\oembios.bin has a bad signature. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
6/22/2010 6:45:25 PM, information: Windows File Protection [64016] - Windows File Protection file scan was started.
6/22/2010 12:14:31 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Pml Driver HPZ12 service to connect.
6/22/2010 12:14:31 PM, error: Service Control Manager [7000] - The Pml Driver HPZ12 service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
==== End Of File ===========================