Carolyn,
Sorry there is quite a long time between my answers, thats because I do have a day job away from home
Here is the Combofix and new HJT Logas requested; by the way Combofix ran smoothly and took only 5 minutes to run.
ComboFix 08-03-14.2 - Owner 2008-03-14 20:36:11.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.719 [GMT 0:00]
Running from: E:\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
.
2008-03-13 20:16 . 2008-03-13 20:10 916,072 --a------ C:\fsbl.exe
2008-03-10 13:37 . 2008-03-10 13:37 <DIR> dr-h----- C:\Documents and Settings\Owner\Application Data\SecuROM
2008-03-10 13:37 . 2008-03-10 13:37 107,888 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2008-03-10 13:34 . 2008-03-10 13:33 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-03-10 13:33 . 2008-03-10 13:33 669,184 --a------ C:\WINDOWS\system32\pbsvc.exe
2008-03-10 13:33 . 2008-03-10 13:33 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2008-03-10 13:33 . 2008-03-10 13:33 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2008-03-10 13:33 . 2008-03-10 13:33 22,328 --a------ C:\Documents and Settings\Owner\Application Data\PnkBstrK.sys
2008-03-09 17:35 . 2008-03-09 17:35 <DIR> d-------- C:\Program Files\XBox 360 Controller for Windows Software
2008-03-09 17:23 . 2008-03-09 17:23 <DIR> d-------- C:\Program Files\Managed DirectX (0901)
2008-03-09 17:19 . 2008-03-09 17:12 724,992 --a------ C:\WINDOWS\iun6002.exe
2008-03-09 17:13 . 2008-03-09 22:08 <DIR> d-------- C:\Program Files\FireWarrior
2008-03-09 17:05 . 2008-03-09 17:08 <DIR> d-------- C:\Program Files\GameSpy Arcade
2008-03-02 12:32 . 2008-03-02 12:32 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Talkback
2008-03-02 12:29 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
2008-03-02 12:21 . 2008-03-02 12:21 <DIR> d-------- C:\downloads
2008-03-01 21:05 . 2008-03-01 21:06 1,355 --a------ C:\WINDOWS\imsins.BAK
2008-03-01 08:55 . 2008-03-01 13:04 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2008-02-29 20:18 . 2008-02-29 20:18 <DIR> d-------- C:\Program Files\Trend Micro
2008-02-29 18:09 . 2008-02-29 18:09 0 --a------ C:\WINDOWS\nsreg.dat
2008-02-20 18:22 . 2008-02-20 18:22 <DIR> d-------- C:\Program Files\GameSpy
2008-02-20 18:21 . 2008-03-09 17:22 <DIR> d-------- C:\WINDOWS\system32\URTTemp
2008-02-20 18:07 . 2008-02-20 18:07 <DIR> d-------- C:\Program Files\Electronic Arts
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-14 20:36 2,447,904 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-03-14 19:36 1,792,000 ----a-w C:\WINDOWS\Internet Logs\xDB2A.tmp
2008-03-13 21:56 33,476 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-03-08 07:49 1,700,864 ----a-w C:\WINDOWS\Internet Logs\xDB29.tmp
2008-03-05 21:53 1,699,328 ----a-w C:\WINDOWS\Internet Logs\xDB28.tmp
2008-03-04 21:05 26,624 ----a-w C:\WINDOWS\Internet Logs\xDB26.tmp
2008-03-04 21:05 1,988,608 ----a-w C:\WINDOWS\Internet Logs\xDB27.tmp
2008-03-04 16:15 470,016 ----a-w C:\WINDOWS\Internet Logs\xDB24.tmp
2008-03-04 16:15 1,987,584 ----a-w C:\WINDOWS\Internet Logs\xDB25.tmp
2008-03-02 10:06 1,966,592 ----a-w C:\WINDOWS\Internet Logs\xDB23.tmp
2008-03-01 10:27 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-01 08:52 --------- d-----w C:\Program Files\Common Files\Adobe
2008-02-29 16:39 2,007,040 ----a-w C:\WINDOWS\Internet Logs\xDB22.tmp
2008-02-27 16:10 --------- d-----w C:\Documents and Settings\Owner\Application Data\MailFrontier
2008-02-27 16:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\MailFrontier
2008-02-26 22:00 2,004,992 ----a-w C:\WINDOWS\Internet Logs\xDB21.tmp
2008-02-25 19:09 75,264 ----a-w C:\WINDOWS\Internet Logs\xDB1F.tmp
2008-02-25 19:09 2,004,480 ----a-w C:\WINDOWS\Internet Logs\xDB20.tmp
2008-02-21 18:52 173,568 ----a-w C:\WINDOWS\Internet Logs\xDB1D.tmp
2008-02-21 18:52 1,987,072 ----a-w C:\WINDOWS\Internet Logs\xDB1E.tmp
2008-02-20 21:56 1,986,560 ----a-w C:\WINDOWS\Internet Logs\xDB1C.tmp
2008-02-19 17:52 1,955,328 ----a-w C:\WINDOWS\Internet Logs\xDB1B.tmp
2008-02-18 16:25 1,940,992 ----a-w C:\WINDOWS\Internet Logs\xDB1A.tmp
2008-02-17 11:38 1,939,456 ----a-w C:\WINDOWS\Internet Logs\xDB19.tmp
2008-02-16 22:44 1,938,944 ----a-w C:\WINDOWS\Internet Logs\xDB18.tmp
2008-02-15 10:48 1,934,848 ----a-w C:\WINDOWS\Internet Logs\xDB17.tmp
2008-02-14 18:36 81,408 ----a-w C:\WINDOWS\Internet Logs\xDB15.tmp
2008-02-14 18:36 1,934,336 ----a-w C:\WINDOWS\Internet Logs\xDB16.tmp
2008-02-13 19:43 126,976 ----a-w C:\WINDOWS\Internet Logs\xDB13.tmp
2008-02-13 19:43 1,930,240 ----a-w C:\WINDOWS\Internet Logs\xDB14.tmp
2008-02-12 16:38 1,911,296 ----a-w C:\WINDOWS\Internet Logs\xDB12.tmp
2008-02-12 11:54 1,910,272 ----a-w C:\WINDOWS\Internet Logs\xDB11.tmp
2008-02-11 10:10 1,908,736 ----a-w C:\WINDOWS\Internet Logs\xDB10.tmp
2008-02-10 07:42 55,296 ----a-w C:\WINDOWS\Internet Logs\xDBE.tmp
2008-02-10 07:42 1,907,200 ----a-w C:\WINDOWS\Internet Logs\xDBF.tmp
2008-02-09 09:16 25,088 ----a-w C:\WINDOWS\Internet Logs\xDBC.tmp
2008-02-09 09:16 1,906,176 ----a-w C:\WINDOWS\Internet Logs\xDBD.tmp
2008-02-08 22:51 34,304 ----a-w C:\WINDOWS\Internet Logs\xDBA.tmp
2008-02-08 22:51 1,909,248 ----a-w C:\WINDOWS\Internet Logs\xDBB.tmp
2008-02-08 21:40 --------- d-----w C:\Program Files\Guild Wars
2008-02-07 22:39 1,899,008 ----a-w C:\WINDOWS\Internet Logs\xDB9.tmp
2008-02-07 07:21 49,152 ----a-w C:\WINDOWS\Internet Logs\xDB7.tmp
2008-02-07 07:21 1,889,792 ----a-w C:\WINDOWS\Internet Logs\xDB8.tmp
2008-02-06 22:52 591,360 ----a-w C:\WINDOWS\Internet Logs\xDB5.tmp
2008-02-06 22:52 1,885,696 ----a-w C:\WINDOWS\Internet Logs\xDB6.tmp
2008-02-04 22:09 1,883,136 ----a-w C:\WINDOWS\Internet Logs\xDB4.tmp
2008-02-02 15:22 1,880,064 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp
2008-02-01 18:44 1,878,528 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp
2008-01-31 17:47 1,871,360 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp
2008-01-29 18:57 --------- d-----w C:\Documents and Settings\Owner\Application Data\Template
2008-01-29 18:56 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2008-01-29 18:56 --------- d-----w C:\Program Files\SonicWallES
2008-01-27 17:07 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-01-27 17:07 --------- d-----w C:\Program Files\Realtek
2008-01-27 16:09 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2008-01-27 16:09 --------- d-----w C:\Program Files\Real
2008-01-27 16:09 --------- d-----w C:\Program Files\Common Files\xing shared
2008-01-27 16:09 --------- d-----w C:\Program Files\Common Files\Real
2008-01-27 15:49 --------- d-----w C:\Program Files\Lavasoft
2008-01-27 15:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-01-27 15:48 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-27 15:31 --------- d-----w C:\Program Files\MSXML 4.0
2008-01-27 14:49 --------- d-----w C:\Program Files\Microsoft Works
2008-01-27 14:35 --------- d-----w C:\Program Files\Zone Labs
2008-01-27 13:04 20,747 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2008-01-27 13:04 --------- d-----w C:\Program Files\ASUS
2008-01-27 12:50 --------- d-----w C:\Program Files\muvee Technologies
2008-01-27 12:50 --------- d-----w C:\Program Files\Common Files\muvee Technologies
2008-01-27 12:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\InstallShield
2008-01-27 12:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\muvee Technologies
2008-01-27 12:45 --------- d-----w C:\Program Files\XpertVision
2008-01-27 12:45 --------- d-----w C:\Program Files\Common Files\InstallShield
2008-01-27 12:37 --------- d-----w C:\Program Files\viewsonic
2008-01-27 12:33 --------- d-----w C:\Documents and Settings\Owner\Application Data\Leadertech
2008-01-27 12:17 --------- d-----w C:\Program Files\microsoft frontpage
2007-12-14 11:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2002-09-11 14:26 63,730 ----a-w C:\Program Files\viewsonicinstruct_xp.pdf
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 12:00 15360]
"Comrade.exe"="C:\Program Files\GameSpy\Comrade\Comrade.exe" [2007-06-29 15:03 36864]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ZoneAlarm Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2007-11-14 16:05 919016]
"Control Center"="C:\Program Files\ASUS\WLAN Card Utilities\Center.exe" [2006-03-02 21:10 1667584]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-05 05:59 81920]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-05 05:59 8491008]
"Gainward"="C:\Program Files\XpertVision\TBPanel.exe" [2007-10-02 12:18 2165256]
"SkyTel"="SkyTel.EXE" [2006-05-17 18:04 2879488 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2007-01-31 18:54 16116224 C:\WINDOWS\RTHDCPL.exe]
"nwiz"="nwiz.exe" [2007-10-05 05:59 1626112 C:\WINDOWS\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2006-02-28 12:00 15360]
C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
PowerReg Scheduler.exe [2008-01-27 12:36:40 225280]
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe"=
"C:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 19:54]
S3 iMSPQMn;iMSPQMn;C:\DOCUME~1\Owner\LOCALS~1\Temp\iMSPQMn.sys [2006-05-10 11:31]
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-03-14 20:37:19
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-03-14 20:37:45
.
2008-03-13 17:35:15 --- E O F ---
AND the HJT Log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:40:56, on 14/03/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\XpertVision\TBPanel.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\bluedog.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.google.co.uk/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Control Center] C:\Program Files\ASUS\WLAN Card Utilities\Center.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Comrade.exe] C:\Program Files\GameSpy\Comrade\Comrade.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://www.update.microsoft.com/windows ... 1445269031O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: ASWLSVC - Unknown owner - C:\WINDOWS\system32\ASWLSVC.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
--
End of file - 3762 bytes
Look forward to your next instructions
Gary