[Goodbye Blue Monday]

I got the MS removal tool virus a couple days ago, but with the help of some virus removal programs I was able to remove it. I'm stuck with a search engine hijacker, though. When I try to click on a search result in any search engine I am redirected to ad sites, regardless of the browser. This doesn't happen 100% of the time, but I'm worried the I will get something even more malicious. I followed the forum guide, but unfortunately that didn't solve my problem. I also tried a few virus removal programs, also with no success. Any help would be appreciated. Thank you!

OTM Log:

OTL logfile created on: 4/14/2011 1:21:53 PM - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\James\My Documents\Downloads
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

3.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 74.00% Memory free
5.00 Gb Paging File | 4.00 Gb Available in Paging File | 89.00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 148.97 Gb Total Space | 121.98 Gb Free Space | 81.88% Space Free | Partition Type: NTFS
Drive S: | 148.97 Gb Total Space | 88.10 Gb Free Space | 59.14% Space Free | Partition Type: NTFS

Computer Name: MASSBIKENEW2 | User Name: James | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2011/04/14 13:21:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James\My Documents\Downloads\OTL.exe
PRC - [2011/03/24 09:18:10 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010/09/14 17:03:58 | 000,984,352 | ---- | M] (Intuit Inc.) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
PRC - [2010/09/14 15:45:30 | 000,045,056 | ---- | M] (Intuit) -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
PRC - [2009/10/03 00:32:51 | 000,640,376 | ---- | M] (Adobe Systems Inc.) -- C:\Program Files\Adobe\Acrobat 9.0\Acrobat\acrotray.exe
PRC - [2009/09/17 19:56:58 | 002,477,304 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe
PRC - [2009/09/17 19:38:02 | 001,864,888 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe
PRC - [2009/09/17 19:27:26 | 001,455,432 | ---- | M] (Symantec Corporation) -- C:\Program Files\Symantec\Symantec Endpoint Protection\SmcGui.exe
PRC - [2009/07/08 21:14:40 | 000,115,560 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccApp.exe
PRC - [2009/07/08 21:14:20 | 000,108,392 | ---- | M] (Symantec Corporation) -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
PRC - [2008/04/14 08:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (SafeList) ==========

MOD - [2011/04/14 13:21:30 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\James\My Documents\Downloads\OTL.exe
MOD - [2010/08/23 12:12:02 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll
MOD - [2009/01/19 00:11:08 | 000,106,496 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\hccutils.dll


========== Win32 Services (SafeList) ==========

SRV - [2010/09/14 15:45:30 | 000,045,056 | ---- | M] (Intuit) [Auto | Running] -- C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe -- (QBCFMonitorService)
SRV - [2010/03/09 12:00:36 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2009/10/01 04:22:42 | 000,131,072 | ---- | M] (Intuit, Inc.) [Disabled | Stopped] -- C:\Program Files\Intuit\QuickBooks 2009\QBDBMgrN.exe -- (QuickBooksDB19)
SRV - [2009/09/17 19:56:58 | 002,477,304 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Rtvscan.exe -- (Symantec AntiVirus)
SRV - [2009/09/17 19:38:02 | 001,864,888 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Symantec\Symantec Endpoint Protection\Smc.exe -- (SmcService)
SRV - [2009/09/17 18:21:10 | 000,341,320 | ---- | M] (Symantec Corporation) [Disabled | Stopped] -- C:\Program Files\Symantec\Symantec Endpoint Protection\SNAC.EXE -- (SNAC)
SRV - [2009/07/13 13:06:15 | 003,093,880 | ---- | M] (Symantec Corporation) [On_Demand | Stopped] -- C:\Program Files\Symantec\LiveUpdate\LuComServer_3_3.EXE -- (LiveUpdate)
SRV - [2009/07/08 21:14:20 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccSetMgr)
SRV - [2009/07/08 21:14:20 | 000,108,392 | ---- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe -- (ccEvtMgr)
SRV - [2009/07/01 10:17:21 | 000,068,096 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe -- (Macromedia Licensing Service)
SRV - [2008/11/18 15:45:28 | 000,061,440 | ---- | M] (Intuit Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe -- (QBFCService)
SRV - [2008/08/15 06:46:20 | 000,284,016 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe -- (Adobe Version Cue CS4)


========== Driver Services (SafeList) ==========

DRV - [2011/03/31 04:00:00 | 001,393,144 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110413.035\NAVEX15.SYS -- (NAVEX15)
DRV - [2011/03/31 04:00:00 | 000,086,136 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\VirusDefs\20110413.035\NAVENG.SYS -- (NAVENG)
DRV - [2010/09/10 22:32:20 | 000,167,936 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\wpshelper.sys -- (WpsHelper)
DRV - [2010/06/17 04:00:00 | 000,371,248 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys -- (eeCtrl)
DRV - [2010/06/17 04:00:00 | 000,102,448 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2010/03/04 15:44:55 | 000,124,976 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SYMEVENT.SYS -- (SymEvent)
DRV - [2009/09/17 19:38:10 | 000,092,488 | ---- | M] (Symantec Corporation) [Kernel | Disabled | Stopped] -- C:\WINDOWS\SYSTEM32\Drivers\SysPlant.sys -- (SysPlant)
DRV - [2009/09/17 19:31:50 | 000,042,312 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\WPSDRVnt.sys -- (WPS)
DRV - [2009/09/03 17:03:48 | 000,188,080 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\SYMTDI.SYS -- (SYMTDI)
DRV - [2009/09/03 17:03:48 | 000,026,416 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\Drivers\SYMREDRV.SYS -- (SYMREDRV)
DRV - [2009/08/26 12:54:38 | 000,421,424 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCDrv.sys -- (SPBBCDrv)
DRV - [2009/08/25 21:05:44 | 000,043,696 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srtspx.sys -- (SRTSPX)
DRV - [2009/08/25 21:05:42 | 000,320,560 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\srtspl.sys -- (SRTSPL)
DRV - [2009/08/25 21:05:42 | 000,281,648 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\srtsp.sys -- (SRTSP)
DRV - [2009/07/14 13:51:12 | 000,023,888 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\COH_Mon.sys -- (COH_Mon)
DRV - [2009/05/27 15:31:18 | 000,050,064 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Teefer2.sys -- (Teefer2)
DRV - [2008/07/16 00:03:18 | 000,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\k57xp32.sys -- (k57w2k) Broadcom NetLink ™
DRV - [2008/07/15 23:40:58 | 000,024,064 | ---- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO)
DRV - [2007/07/23 16:05:20 | 000,009,104 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLADResM.SYS -- (DLADResM)
DRV - [2007/07/23 16:04:58 | 000,037,360 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABMFSM.SYS -- (DLABMFSM)
DRV - [2007/07/23 16:04:56 | 000,098,448 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2007/07/23 16:04:56 | 000,093,552 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2007/07/23 16:04:54 | 000,027,216 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2007/07/23 16:04:52 | 000,032,848 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2007/07/23 16:04:52 | 000,016,304 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2007/07/23 16:04:50 | 000,108,752 | ---- | M] (Roxio) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2007/07/23 15:49:44 | 000,030,064 | ---- | M] (Roxio) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\DLARTL_M.SYS -- (DLARTL_M)
DRV - [2007/07/23 15:49:44 | 000,014,576 | ---- | M] (Roxio) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2000/07/24 01:01:00 | 000,019,537 | ---- | M] (Brother Industries Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\BrPar.sys -- (BrPar)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.msn.com/sphome.aspx
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Start Page = http://g.msn.com/USREL/1

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/USREL/1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.live.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/USREL/1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.massbike.org"
FF - prefs.js..extensions.enabledItems: [email protected]:1.0
FF - prefs.js..network.proxy.type: 0

FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011/03/24 09:18:19 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.16\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011/03/24 09:18:19 | 000,000,000 | ---D | M]

[2009/06/25 12:55:26 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James\Application Data\Mozilla\Extensions
[2011/04/13 13:18:09 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\James\Application Data\Mozilla\Firefox\Profiles\v6wxji9p.default\extensions
[2010/09/16 11:31:04 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\James\Application Data\Mozilla\Firefox\Profiles\v6wxji9p.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010/03/04 16:31:07 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2009/05/28 15:44:59 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

O1 HOSTS File: ([2011/04/13 16:52:36 | 000,000,098 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [Acrobat Assistant 8.0] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe (Adobe Systems Inc.)
O4 - HKLM..\Run: [Adobe Acrobat Speed Launcher] C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [Adobe_ID0ENQBO] C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4Tray.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe (Symantec Corporation)
O4 - HKLM..\Run: [Intuit SyncManager] C:\Program Files\Common Files\Intuit\Sync\IntuitSyncManager.exe (Intuit Inc. All rights reserved.)
O4 - HKLM..\Run: [QuickBooksDB19] C:\Program Files\Intuit\QuickBooks 2009\QBDBMgrN.exe (Intuit, Inc.)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [CY08W456F0] File not found
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe (Intuit Inc.)
O4 - Startup: C:\Documents and Settings\James\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Append Link Target to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Append to Existing PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert Link Target to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Convert to Adobe PDF - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O15 - HKCU\..Trusted Domains: localhost ([]http in Local intranet)
O15 - HKCU\..Trusted Ranges: GD ([http] in Local intranet)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/...indows-i586.cab (Java Plug-in 1.6.0_13)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 71.243.0.12 68.237.161.12
O18 - Protocol\Handler\intu-help-qb2 {84D77A00-41B5-4b8b-8ADF-86486D72E749} - C:\Program Files\Intuit\QuickBooks 2009\HelpAsyncPluggableProtocol.dll (Intuit, Inc.)
O20 - AppInit_DLLs: (C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL) - C:\Program Files\Google\Google Desktop Search\GoogleDesktopNetwork3.dll (Google)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Bliss.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008/04/25 17:29:32 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{ad36dde0-56f3-11df-af86-0023ae8a7d86}\Shell - "" = AutoRun
O33 - MountPoints2\{ad36dde0-56f3-11df-af86-0023ae8a7d86}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{ad36dde0-56f3-11df-af86-0023ae8a7d86}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2011/04/14 13:14:19 | 001,377,112 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\James\Desktop\TDSSKiller.exe
[2011/04/14 13:12:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James\Desktop\GooredFix Backups
[2011/04/14 13:10:53 | 000,071,398 | ---- | C] (jpshortstuff) -- C:\Documents and Settings\James\Desktop\GooredFix.exe
[2011/04/13 18:25:59 | 000,000,000 | ---D | C] -- C:\SERT
[2011/04/13 16:52:34 | 000,000,000 | ---D | C] -- C:\_OTM
[2011/04/13 16:50:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT
[2011/04/13 16:49:50 | 000,000,000 | ---D | C] -- C:\Program Files\ERUNT
[2011/04/13 16:49:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\ERUNT
[2011/04/12 19:44:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James\Desktop\Summer Century 2010
[2011/04/12 16:49:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James\Application Data\SUPERAntiSpyware.com
[2011/04/12 16:49:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
[2011/04/12 16:18:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\IObit
[2011/04/12 16:18:25 | 000,000,000 | ---D | C] -- C:\Program Files\IObit
[2011/04/12 12:10:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump
[2011/04/12 11:54:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Sun
[2011/04/12 11:28:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\James\Application Data\Malwarebytes
[2011/04/12 11:28:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Malwarebytes
[2011/04/12 11:26:51 | 007,734,208 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\James\Desktop\mbam-setup-1.50.1.1100.exe
[2011/04/12 10:45:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Macromedia
[2011/04/12 10:45:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\NetworkService\Application Data\Adobe
[2011/04/12 10:44:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
[2011/04/12 10:35:09 | 000,000,000 | -HSD | C] -- C:\WINDOWS\CSC
[2011/04/12 10:16:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\nIa31001mCmLb31001

========== Files - Modified Within 30 Days ==========

[2011/04/14 13:10:53 | 000,071,398 | ---- | M] (jpshortstuff) -- C:\Documents and Settings\James\Desktop\GooredFix.exe
[2011/04/14 09:17:10 | 000,000,503 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI
[2011/04/14 09:04:24 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2011/04/14 09:02:45 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\tasks\Cnxoaugmg.job
[2011/04/14 09:02:40 | 000,000,310 | -HS- | M] () -- C:\WINDOWS\tasks\Dybpkvsmk.job
[2011/04/14 09:02:34 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2011/04/14 09:02:32 | 3209,654,272 | -HS- | M] () -- C:\hiberfil.sys
[2011/04/13 20:03:15 | 000,167,584 | ---- | M] () -- C:\umcat_01.db
[2011/04/13 16:52:36 | 000,000,098 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\Hosts
[2011/04/13 16:49:59 | 000,000,769 | ---- | M] () -- C:\Documents and Settings\James\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/04/13 16:49:50 | 000,000,594 | ---- | M] () -- C:\Documents and Settings\James\Desktop\ERUNT.lnk
[2011/04/12 17:11:05 | 000,002,491 | ---- | M] () -- C:\Documents and Settings\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Excel 2007.lnk
[2011/04/12 17:10:42 | 000,002,533 | ---- | M] () -- C:\Documents and Settings\James\Application Data\Microsoft\Internet Explorer\Quick Launch\Microsoft Office Word 2007.lnk
[2011/04/12 11:27:06 | 007,734,208 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\James\Desktop\mbam-setup-1.50.1.1100.exe
[2011/04/12 11:08:13 | 000,000,245 | RHS- | M] () -- C:\boot.ini
[2011/04/12 10:09:42 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Qpakozoquqisefac.dat
[2011/04/12 10:09:42 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Qnopobojebuqaget.bin
[2011/04/12 10:07:59 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\rsaenhp.dll
[2011/04/07 16:47:00 | 000,087,510 | ---- | M] () -- C:\Documents and Settings\James\My Documents\MCC_BikeChallenge.JPG
[2011/04/07 16:27:31 | 000,056,107 | ---- | M] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge Right Rize.jpg
[2011/04/07 16:19:31 | 000,502,392 | ---- | M] () -- C:\Documents and Settings\James\Desktop\Bike_Logo.tif
[2011/04/07 16:10:53 | 000,115,184 | ---- | M] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge.jpf
[2011/04/07 16:08:27 | 000,193,523 | ---- | M] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge.jpg
[2011/04/07 15:56:00 | 000,151,587 | ---- | M] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge.pdf
[2011/03/25 15:00:21 | 000,004,349 | ---- | M] () -- C:\Documents and Settings\James\Desktop\Brookline Emails.tab
[2011/03/25 10:04:45 | 000,002,473 | ---- | M] () -- C:\Documents and Settings\James\Desktop\Microsoft Office Excel 2007.lnk
[2011/03/21 10:49:23 | 000,002,515 | ---- | M] () -- C:\Documents and Settings\James\Desktop\Microsoft Office Word 2007.lnk
[2011/03/17 13:38:20 | 000,047,656 | ---- | M] () -- C:\Documents and Settings\James\Desktop\Spring.jpg
[2011/03/16 03:00:41 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

========== Files Created - No Company Name ==========

[2011/04/13 19:05:05 | 000,167,584 | ---- | C] () -- C:\umcat_01.db
[2011/04/13 16:49:59 | 000,000,769 | ---- | C] () -- C:\Documents and Settings\James\Start Menu\Programs\Startup\ERUNT AutoBackup.lnk
[2011/04/13 16:49:50 | 000,000,594 | ---- | C] () -- C:\Documents and Settings\James\Desktop\ERUNT.lnk
[2011/04/13 13:01:10 | 3209,654,272 | -HS- | C] () -- C:\hiberfil.sys
[2011/04/12 10:09:42 | 000,000,120 | ---- | C] () -- C:\WINDOWS\Qpakozoquqisefac.dat
[2011/04/12 10:09:42 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Qnopobojebuqaget.bin
[2011/04/12 10:07:59 | 000,118,784 | RHS- | C] () -- C:\WINDOWS\System32\rsaenhp.dll
[2011/04/12 10:07:59 | 000,000,332 | -HS- | C] () -- C:\WINDOWS\tasks\Cnxoaugmg.job
[2011/04/12 10:07:59 | 000,000,310 | -HS- | C] () -- C:\WINDOWS\tasks\Dybpkvsmk.job
[2011/04/07 16:47:00 | 000,087,510 | ---- | C] () -- C:\Documents and Settings\James\My Documents\MCC_BikeChallenge.JPG
[2011/04/07 16:27:26 | 000,056,107 | ---- | C] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge Right Rize.jpg
[2011/04/07 16:19:31 | 000,502,392 | ---- | C] () -- C:\Documents and Settings\James\Desktop\Bike_Logo.tif
[2011/04/07 16:10:52 | 000,115,184 | ---- | C] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge.jpf
[2011/04/07 16:08:27 | 000,193,523 | ---- | C] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge.jpg
[2011/04/07 15:56:00 | 000,151,587 | ---- | C] () -- C:\Documents and Settings\James\My Documents\LW Bike Challenge.pdf
[2011/03/25 15:00:12 | 000,004,349 | ---- | C] () -- C:\Documents and Settings\James\Desktop\Brookline Emails.tab
[2011/03/17 13:36:05 | 000,047,656 | ---- | C] () -- C:\Documents and Settings\James\Desktop\Spring.jpg
[2011/01/26 13:37:25 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat
[2009/11/10 15:36:40 | 000,000,040 | ---- | C] () -- C:\WINDOWS\opt_1440.ini
[2009/08/28 10:51:03 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\James\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009/08/03 15:07:42 | 000,403,816 | ---- | C] () -- C:\WINDOWS\System32\OGACheckControl.dll
[2009/08/03 15:07:42 | 000,230,768 | ---- | C] () -- C:\WINDOWS\System32\OGAEXEC.exe
[2009/06/30 16:43:17 | 000,000,090 | ---- | C] () -- C:\WINDOWS\QBChanUtil_Trigger.ini
[2009/06/30 16:38:05 | 000,000,503 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2009/06/30 16:35:35 | 000,000,150 | ---- | C] () -- C:\WINDOWS\BRVIDEO.INI
[2009/06/30 16:35:35 | 000,000,089 | ---- | C] () -- C:\WINDOWS\brmx2001.ini
[2009/06/30 16:35:35 | 000,000,040 | ---- | C] () -- C:\WINDOWS\BRDIAG.INI
[2009/06/30 16:35:35 | 000,000,026 | ---- | C] () -- C:\WINDOWS\brpp2ka.ini
[2009/06/30 16:35:35 | 000,000,023 | ---- | C] () -- C:\WINDOWS\Brownie.ini
[2009/06/30 16:35:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\bw6050d.ini
[2009/06/30 16:35:11 | 000,077,824 | ---- | C] () -- C:\WINDOWS\System32\BROSNMP.DLL
[2009/06/30 16:35:11 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC32.DLL
[2009/06/30 16:35:11 | 000,004,608 | ---- | C] () -- C:\WINDOWS\System32\BRGSRC16.DLL
[2009/06/30 16:35:08 | 000,008,634 | ---- | C] () -- C:\WINDOWS\hl-6050d_dn.ini
[2009/06/30 16:35:01 | 000,000,030 | ---- | C] () -- C:\WINDOWS\System32\BRSS01A.ini
[2009/06/25 12:55:26 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2009/05/28 18:31:54 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\igfxCoIn_v4957.dll
[2009/05/28 18:31:51 | 000,077,824 | ---- | C] () -- C:\WINDOWS\setpwr32.exe
[2009/05/28 18:31:22 | 000,001,154 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2009/05/28 15:54:25 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2009/05/28 15:49:36 | 000,000,234 | ---- | C] () -- C:\WINDOWS\wininit.ini
[2008/05/26 22:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 22:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2008/04/25 17:31:41 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2008/04/25 17:27:18 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2008/04/25 17:26:32 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2008/04/25 12:16:24 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2008/04/25 12:16:22 | 000,466,414 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2008/04/25 12:16:22 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2008/04/25 12:16:22 | 000,079,630 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2008/04/25 12:16:22 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2008/04/25 12:16:22 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2008/04/25 12:16:21 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2008/04/25 12:16:20 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2008/04/25 12:16:18 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2008/04/25 12:16:18 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2008/04/25 12:16:13 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2008/04/25 12:16:11 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin
[2008/04/25 05:22:39 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2008/04/25 05:21:52 | 002,155,640 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2007/09/27 11:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 11:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 11:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2006/09/18 14:37:50 | 000,000,530 | ---- | C] () -- C:\WINDOWS\System32\tx12_ic.ini
[2006/09/18 14:37:48 | 000,667,280 | ---- | C] () -- C:\WINDOWS\System32\tx12.dll

========== LOP Check ==========

[2010/03/17 11:52:18 | 000,000,000 | -H-D | M] -- C:\Documents and Settings\All Users\Application Data\CanonBJ
[2009/06/30 16:43:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\COMMON FILES
[2011/04/12 16:18:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\IObit
[2011/04/12 11:35:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\nIa31001mCmLb31001
[2009/07/01 15:15:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Application Data\SQL Anywhere 10
[2010/02/22 13:24:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James\Application Data\gtk-2.0
[2009/05/28 15:42:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James\Application Data\Windows Desktop Search
[2009/06/25 12:29:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\James\Application Data\Windows Search
[2011/04/14 09:02:45 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\Tasks\Cnxoaugmg.job
[2011/04/14 09:02:40 | 000,000,310 | -HS- | M] () -- C:\WINDOWS\Tasks\Dybpkvsmk.job

========== Purity Check ==========



< End of report >

[Advertisements]

Hi there - on completion of this run could you check for redirects

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  [2011/04/12 10:16:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\nIa31001mCmLb31001
  [2011/04/14 09:02:45 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\tasks\Cnxoaugmg.job
  [2011/04/14 09:02:40 | 000,000,310 | -HS- | M] () -- C:\WINDOWS\tasks\Dybpkvsmk.job
  [2011/04/12 10:09:42 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Qpakozoquqisefac.dat
  [2011/04/12 10:09:42 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Qnopobojebuqaget.bin
  [2011/04/12 10:07:59 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\rsaenhp.dll
  
  
  :Files
  ipconfig /flushdns /c
  C:\Documents and Settings\All Users\Application Data\nIa31001mCmLb31001
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[Essexboy]

Hi there - on completion of this run could you check for redirects

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :OTL
  [2011/04/12 10:16:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\nIa31001mCmLb31001
  [2011/04/14 09:02:45 | 000,000,332 | -HS- | M] () -- C:\WINDOWS\tasks\Cnxoaugmg.job
  [2011/04/14 09:02:40 | 000,000,310 | -HS- | M] () -- C:\WINDOWS\tasks\Dybpkvsmk.job
  [2011/04/12 10:09:42 | 000,000,120 | ---- | M] () -- C:\WINDOWS\Qpakozoquqisefac.dat
  [2011/04/12 10:09:42 | 000,000,000 | ---- | M] () -- C:\WINDOWS\Qnopobojebuqaget.bin
  [2011/04/12 10:07:59 | 000,118,784 | RHS- | M] () -- C:\WINDOWS\System32\rsaenhp.dll
  
  
  :Files
  ipconfig /flushdns /c
  C:\Documents and Settings\All Users\Application Data\nIa31001mCmLb31001
  
  :Commands
  [purity]
  [resethosts]
  [emptytemp]
  [EMPTYFLASH]
  [CREATERESTOREPOINT]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done
• Open OTL again and click the Quick Scan button. Post the log it produces in your next reply.

[Goodbye Blue Monday]

This fixed my problem! Really, thank you very much for your help!

Do you still want the OTL log?

[Essexboy]

Nope - if you are happy it has gone I will tidy you up and then let you run to see if all is OK

I will remove my tools now and give some recommendations, but, I would like you to run for 24 hours or so and come back if you have any problems

Now the best part of the day ----- Your log now appears clean

A good workman always cleans up after himself so..The following will implement some cleanup procedures as well as reset System Restore points:

Run OTL

• Under the Custom Scans/Fixes box at the bottom, paste in the following
  
  

  :Commands
  [resethosts]
  [purity]
  [emptytemp]
  [EMPTYFLASH]
  [CLEARALLRESTOREPOINTS]
  [Reboot]

• Then click the Run Fix button at the top
• Let the program run unhindered, reboot the PC when it is done

Run OTL and hit the cleanup button. It will remove all the programmes we have used plus itself.

We will now confirm that your hidden files are set to that, as some of the tools I use will change that

• Click Start.
• Open My Computer.
• Select the Tools menu and click Folder Options.
• Select the View Tab.
• Under the Hidden files and folders heading select Do not show hidden files and folders.
• Click Yes to confirm.
• Click OK.

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version of Java components and upgrade the application.

Upgrading Java:

• Download the latest version of Java SE Runtime Environment (JRE)JRE 6 Update 24.
• Click the "Download" button to the right.
• Select your Platform and check the box that says: "I agree to the Java SE Runtime Environment 6 License Agreement.".
• Click on Continue.
• Click on the link to download Windows Offline Installation (jre-6u24-windows-i586-p.exe) and save it to your desktop. Do NOT use the Sun Download Manager..
• Close any programs you may have running - especially your web browser.
• Go to Start > Control Panel, double-click on Add/Remove programs and remove all older versions of Java.
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
• Click the Remove or Change/Remove button.
• Repeat as many times as necessary to remove each Java version.
• Reboot your computer once all Java components are removed.
• Then from your desktop double-click on the download to install the newest version.(Vista users, right click on the jre-6u24-windows-i586.exe and select "Run as an Administrator.")

SPRING CLEAN

Download and run Puran Disc Defragmenter
For the first run I would recommend a boot defrag and disk check




Now that you are clean, to help protect your computer in the future I recommend that you get the following free programmes:

Malwarebytes. Update and run weekly to keep your system clean

Download and install FileHippo update checker and run it monthly it will show you which programmes on your system need updating and give a download link

It is critical to have both a firewall and anti virus to protect your system and to keep them updated.

To keep your operating system up to date visit

• Microsoft Windows Update

To learn more about how to protect yourself while on the internet read our little guide How did I get infected in the first place ?
Keep safe

[Goodbye Blue Monday]

All cleaned up and ready for what might come. Thanks once again.

[Essexboy]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.