Here's my log from Combofix (followed by my latest Hijackthis log and my Kaspersky online scan report):
ComboFix 08-08-12.01 - Our Home Computer 2008-08-12 16:53:21.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.139 [GMT -7:00]
Running from: C:\Documents and Settings\Our Home Computer\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Our Home Computer\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\Downloaded Program Files\setup.inf
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\eWebControl.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_{DEF85C80-216A-43AB-AF70-1665EDBE2780}
((((((((((((((((((((((((( Files Created from 2008-07-13 to 2008-08-13 )))))))))))))))))))))))))))))))
.
2008-08-11 18:26 . 2008-08-11 18:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-11 18:26 . 2008-08-11 18:26 <DIR> d-------- C:\Documents and Settings\Our Home Computer\Application Data\Malwarebytes
2008-08-11 18:26 . 2008-08-11 18:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-11 18:26 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-08-11 18:26 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-08-08 20:50 . 2008-08-08 20:50 <DIR> d-------- C:\Program Files\Windows Defender
2008-08-01 19:03 . 2008-08-01 19:03 <DIR> d-------- C:\Program Files\AnswersThatWork
2008-08-01 19:03 . 2007-06-08 13:53 1,753,088 --a------ C:\WINDOWS\SYSTEM32\ExGrid.dll
2008-08-01 19:03 . 2007-04-03 16:51 614,400 --a------ C:\WINDOWS\SYSTEM32\ExButton.dll
2008-08-01 19:03 . 2007-06-05 10:20 602,112 --a------ C:\WINDOWS\SYSTEM32\ExMenu.dll
2008-08-01 19:03 . 2007-06-05 10:19 516,096 --a------ C:\WINDOWS\SYSTEM32\ExTab.dll
2008-08-01 19:03 . 2005-10-11 14:40 356,352 --a------ C:\WINDOWS\SYSTEM32\eSellerateEngine.dll
2008-08-01 19:03 . 2007-04-03 16:51 307,200 --a------ C:\WINDOWS\SYSTEM32\ExPMenu.dll
2008-08-01 19:03 . 2004-03-09 01:00 124,688 --a------ C:\WINDOWS\SYSTEM32\MSWinSck.ocx
2008-07-31 09:49 . 2008-08-12 17:18 72,706 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k0
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k7
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k6
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k5
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k4
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k3
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k2
2008-07-31 09:49 . 2008-08-12 17:18 64 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\kmxcfg.u2k1
2008-07-30 10:08 . 2008-08-12 15:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-07-30 09:22 . 2008-07-31 08:57 <DIR> d-------- C:\Program Files\IE New Window Maximizer
2008-07-30 09:06 . 2008-07-30 09:06 <DIR> d-------- C:\WINDOWS\SYSTEM32\GroupPolicy
2008-07-30 09:06 . 2008-07-30 09:06 <DIR> d-------- C:\Program Files\Windows Desktop Search
2008-07-27 17:43 . 2008-04-13 17:12 116,224 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\xrxwiadr.dll
2008-07-27 17:43 . 2002-09-03 10:14 28,288 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\xjis.nls
2008-07-27 17:43 . 2008-04-13 17:12 18,944 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\xrxscnui.dll
2008-07-27 17:43 . 2008-04-13 17:12 8,192 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wshirda.dll
2008-07-27 17:42 . 2001-08-17 13:28 113,762 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\usrpda.sys
2008-07-27 17:42 . 2008-04-13 11:45 31,744 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wceusbsh.sys
2008-07-27 17:42 . 2008-04-13 11:36 8,832 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\wmiacpi.sys
2008-07-27 17:41 . 2008-04-13 17:12 82,944 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\tp4mon.exe
2008-07-27 17:41 . 2008-04-13 11:45 60,032 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\usbaudio.sys
2008-07-27 17:41 . 2008-04-13 11:45 26,112 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\usbser.sys
2008-07-27 17:41 . 2008-04-13 11:45 17,152 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\usbohci.sys
2008-07-27 17:40 . 2008-04-13 11:40 149,376 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\tffsport.sys
2008-07-27 17:40 . 2008-04-13 11:40 7,552 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\sonyait.sys
2008-07-27 17:39 . 2004-08-03 22:31 32,768 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\sisnic.sys
2008-07-27 17:39 . 2008-04-13 11:36 16,000 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\smbbatt.sys
2008-07-27 17:39 . 2008-04-13 11:36 6,912 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\smbclass.sys
2008-07-27 17:38 . 2008-04-13 11:40 79,104 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\rocket.sys
2008-07-27 17:38 . 2008-04-13 11:40 43,904 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\sbp2port.sys
2008-07-27 17:38 . 2008-04-13 17:12 29,696 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\rw450ext.dll
2008-07-27 17:38 . 2008-04-13 17:12 27,648 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\rw430ext.dll
2008-07-27 17:38 . 2004-08-03 22:31 20,992 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\rtl8139.sys
2008-07-27 17:38 . 2008-04-13 11:45 11,520 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\scsiscan.sys
2008-07-27 17:37 . 2008-04-13 17:10 259,328 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\perm3dd.dll
2008-07-27 17:37 . 2008-04-13 17:12 159,232 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ptpusd.dll
2008-07-27 17:37 . 2002-09-03 09:52 83,748 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\prcp.nls
2008-07-27 17:37 . 2002-09-03 09:52 83,748 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\prc.nls
2008-07-27 17:37 . 2008-04-13 11:44 28,032 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\perm3.sys
2008-07-27 17:37 . 2008-04-13 11:41 17,664 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ppa3.sys
2008-07-27 17:37 . 2008-04-13 11:40 8,832 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\powerfil.sys
2008-07-27 17:37 . 2008-04-13 11:40 6,016 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\qic157.sys
2008-07-27 17:36 . 2008-04-13 11:31 2,065,792 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ntkrnlpa.exe
2008-07-27 17:36 . 2008-04-13 17:10 211,584 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\perm2dll.dll
2008-07-27 17:36 . 2008-04-13 11:46 61,696 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ohci1394.sys
2008-07-27 17:36 . 2004-08-03 22:31 29,502 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\pca200e.sys
2008-07-27 17:36 . 2008-04-13 11:54 28,672 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\nscirda.sys
2008-07-27 17:36 . 2008-04-13 11:44 27,904 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\perm2.sys
2008-07-27 17:35 . 2008-04-13 11:46 49,024 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\mstape.sys
2008-07-27 17:35 . 2008-04-13 11:54 22,016 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\msircomm.sys
2008-07-27 17:34 . 2008-04-13 11:41 26,112 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\memstpci.sys
2008-07-27 17:33 . 2004-08-03 22:41 606,684 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ltmdmnt.sys
2008-07-27 17:33 . 2008-04-13 17:11 253,952 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\kdsusd.dll
2008-07-27 17:33 . 2008-04-13 17:11 48,640 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\kdsui.dll
2008-07-27 17:33 . 2002-09-03 09:39 47,066 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ksc.nls
2008-07-27 17:33 . 2008-04-13 11:40 34,688 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\lbrtfdc.sys
2008-07-27 17:33 . 2008-04-13 11:39 14,592 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\kbdhid.sys
2008-07-27 17:33 . 2008-04-13 11:40 7,040 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ltotape.sys
2008-07-27 17:32 . 2008-04-13 17:12 151,552 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\irftp.exe
2008-07-27 17:32 . 2008-04-13 11:54 88,192 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\irda.sys
2008-07-27 17:32 . 2008-04-13 17:11 28,160 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\irmon.dll
2008-07-27 17:30 . 2008-04-13 11:45 59,136 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\gckernel.sys
2008-07-27 17:30 . 2008-04-13 11:40 28,288 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\grserial.sys
2008-07-27 17:30 . 2008-04-13 17:11 21,504 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\hidserv.dll
2008-07-27 17:30 . 2008-04-13 11:36 20,352 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\hidbatt.sys
2008-07-27 17:30 . 2008-04-13 11:45 10,624 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\gameenum.sys
2008-07-27 17:29 . 2004-08-03 22:31 34,173 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\forehe.sys
2008-07-27 17:28 . 2008-04-13 11:39 206,976 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\dot4.sys
2008-07-27 17:28 . 2008-04-13 17:12 20,992 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\dshowext.ax
2008-07-27 17:28 . 2008-04-13 11:40 8,320 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\dlttape.sys
2008-07-27 17:27 . 2008-04-13 17:11 249,856 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ctmasetp.dll
2008-07-27 17:27 . 2004-08-03 22:32 48,640 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\cwrwdm.sys
2008-07-27 17:26 . 2008-04-13 11:36 13,952 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\cmbatt.sys
2008-07-27 17:26 . 2008-04-13 11:36 10,240 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\compbatt.sys
2008-07-27 17:26 . 2008-04-13 11:40 8,192 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\changer.sys
2008-07-27 17:24 . 2002-09-03 09:28 82,172 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\bopomofo.nls
2008-07-27 17:24 . 2002-09-03 09:27 66,728 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\big5.nls
2008-07-27 17:24 . 2008-04-13 11:46 38,912 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\avc.sys
2008-07-27 17:24 . 2008-04-13 11:36 14,208 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\battc.sys
2008-07-27 17:24 . 2008-04-13 11:46 13,696 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\avcstrm.sys
2008-07-27 17:22 . 2008-04-13 12:27 2,188,928 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\ntoskrnl.exe
2008-07-27 17:22 . 2001-08-17 22:36 462,848 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\a3dapi.dll
2008-07-27 17:22 . 2008-04-13 11:46 53,376 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\1394bus.sys
2008-07-27 17:22 . 2008-04-13 11:46 48,128 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\61883.sys
2008-07-27 17:22 . 2008-04-13 11:40 12,288 --a--c--- C:\WINDOWS\SYSTEM32\DLLCACHE\4mmdat.sys
2008-07-27 09:27 . 2008-07-27 09:27 <DIR> d-------- C:\Program Files\Trend Micro
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-12 02:11 --------- d-----w C:\Program Files\Dell
2008-08-12 01:15 --------- d-----w C:\Program Files\Java
2008-08-02 03:53 --------- d-----w C:\Program Files\QuickTime
2008-08-02 02:56 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-02 02:03 --------- d-----w C:\Program Files\Common Files\eSellerate
2008-08-01 00:25 --------- d-----w C:\Program Files\NCUA Call Report
2008-07-31 19:11 --------- d-----w C:\Program Files\Google
2008-07-31 18:19 --------- d-----w C:\Program Files\Palm
2008-07-30 18:10 --------- d-----w C:\Program Files\Picasa2
2008-07-30 16:06 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-07-30 16:06 --------- d-----w C:\Program Files\SpywareBlaster
2008-07-27 17:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-07-04 23:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\ZoomBrowser
2008-07-04 23:25 --------- d-----w C:\Documents and Settings\Our Home Computer\Application Data\ZoomBrowser EX
2008-06-26 00:23 --------- d-----w C:\Program Files\Napster
2008-06-26 00:22 --------- d-----w C:\Program Files\Common Files\Roxio Shared
2008-06-26 00:22 --------- d-----w C:\Program Files\Common Files\Napster Shared
2008-06-25 02:10 256,528 ----a-w C:\WINDOWS\SYSTEM32\UmxSbxw.dll
2008-06-25 02:10 117,264 ----a-w C:\WINDOWS\SYSTEM32\UmxSbxExw.dll
2008-06-25 02:08 93,712 ----a-w C:\WINDOWS\system32\drivers\KmxStart.sys
2008-06-25 02:08 88,816 ----a-w C:\WINDOWS\system32\drivers\KmxCfg.sys
2008-06-25 02:08 66,576 ----a-w C:\WINDOWS\system32\drivers\KmxSbx.sys
2008-06-25 02:08 63,504 ----a-w C:\WINDOWS\system32\drivers\KmxAgent.sys
2008-06-25 02:08 45,584 ----a-w C:\WINDOWS\system32\drivers\KmxFile.sys
2008-06-25 02:08 134,648 ----a-w C:\WINDOWS\system32\drivers\KmxCF.sys
2008-06-25 02:08 115,216 ----a-w C:\WINDOWS\system32\drivers\KmxFw.sys
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\SYSTEM32\mswsock.dll
2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-13 01:53 524,288 ----a-w C:\WINDOWS\SYSTEM32\DivXsm.exe
2008-05-13 01:53 3,596,288 ----a-w C:\WINDOWS\SYSTEM32\qt-dx331.dll
2008-05-13 01:53 129,784 ------w C:\WINDOWS\SYSTEM32\pxafs.dll
2008-05-13 01:51 200,704 ----a-w C:\WINDOWS\SYSTEM32\ssldivx.dll
2008-05-13 01:51 1,044,480 ----a-w C:\WINDOWS\SYSTEM32\libdivx.dll
2008-05-13 01:49 161,096 ----a-w C:\WINDOWS\SYSTEM32\DivXCodecVersionChecker.exe
2008-05-13 01:49 12,288 ----a-w C:\WINDOWS\SYSTEM32\DivXWMPExtType.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccleaner"="C:\Program Files\CCleaner\ccleaner.exe" [2008-07-29 06:41 1213680]
"IE New Window Maximizer"="C:\Program Files\IE New Window Maximizer\iemaximizer.exe" [2005-02-08 23:06 356352]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CAVRID"="C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe" [2007-08-20 13:36 230664]
"cctray"="C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe" [2007-08-16 22:25 177416]
"cafwc"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe" [2008-07-31 17:57 1193200]
"capfasem"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe" [2008-07-31 17:57 173296]
"capfupgrade"="C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe" [2008-07-31 17:57 259312]
"QOELOADER"="C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe" [2008-07-31 19:00 14088]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"NvMediaCenter"="C:\WINDOWS\System32\NVMCTRAY.DLL" [2003-11-03 14:46 49152]
"Picasa Media Detector"="C:\Program Files\Picasa2\PicasaMediaDetector.exe" [2008-02-25 18:23 443968]
C:\Documents and Settings\Our Home Computer\Start Menu\Programs\Startup\
AutoBackup Launcher.lnk - C:\Program Files\Seagate\AutoBackup\MemeoLauncher.exe [2008-01-14 12:48:32 95456]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoViewOnDrive"= 0 (0x0)
"NoDesktopCleanupWizard"= 1 (0x1)
"NoAutoTrayNotify"= 1 (0x1)
"NoBandCustomize"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\PFW]
2007-05-18 13:30 79368 C:\WINDOWS\SYSTEM32\UmxWNP.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.iv41"= ir41_32.dll
"VIDC.SP54"= SP5X_32.DLL
"VIDC.SP55"= SP5X_32.DLL
"VIDC.SP56"= SP5X_32.DLL
"VIDC.SP57"= SP5X_32.DLL
"VIDC.SP58"= SP5X_32.DLL
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HOTSYNC.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HOTSYNC.lnk
backup=C:\WINDOWS\pss\HOTSYNC.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SoftStuff Wallpaper Changer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\SoftStuff Wallpaper Changer.lnk
backup=C:\WINDOWS\pss\SoftStuff Wallpaper Changer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"medic"="C:\Program Files\MEDIC\bin\sprtcmd.exe" /P MEDIC
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\CA Personal Firewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
R0 KmxStart;KmxStart;C:\WINDOWS\system32\DRIVERS\kmxstart.sys [2008-06-24 19:08]
R1 KmxAgent;KmxAgent;C:\WINDOWS\system32\DRIVERS\kmxagent.sys [2008-06-24 19:08]
R1 KmxFile;KmxFile;C:\WINDOWS\system32\DRIVERS\KmxFile.sys [2008-06-24 19:08]
R1 KmxFw;KmxFw;C:\WINDOWS\system32\DRIVERS\kmxfw.sys [2008-06-24 19:08]
R2 BCMNTIO;BCMNTIO;C:\PROGRA~1\CheckIt\DIAGNO~1\BCMNTIO.sys [2004-03-05 18:09]
R2 KmxCF;KmxCF;C:\WINDOWS\system32\DRIVERS\KmxCF.sys [2008-06-24 19:08]
R2 KmxSbx;KmxSbx;C:\WINDOWS\system32\DRIVERS\KmxSbx.sys [2008-06-24 19:08]
R2 MAPMEM;MAPMEM;C:\PROGRA~1\CheckIt\DIAGNO~1\MAPMEM.sys [2004-03-05 18:09]
R2 UmxAgent;HIPS Event Manager;C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe [2007-10-18 10:24]
R2 UmxCfg;HIPS Configuration Interpreter;C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe [2007-10-18 10:24]
R2 UmxPol;HIPS Policy Manager;C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe [2008-06-24 19:10]
R3 KmxCfg;KmxCfg;C:\WINDOWS\system32\DRIVERS\kmxcfg.sys [2008-06-24 19:08]
R3 PPCtlPriv;PPCtlPriv;C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe [2007-08-16 21:10]
S3 Bulk503;Chameleon Mega Digital Camera;C:\WINDOWS\system32\Drivers\Bulk503.sys []
S3 ISO503;Chameleon Mega Video Camera;C:\WINDOWS\system32\Drivers\ISO503.SYS []
S3 VisorUsb;Handspring USB;C:\WINDOWS\system32\DRIVERS\VisorUsb.sys []
.
Contents of the 'Scheduled Tasks' folder
2008-08-12 C:\WINDOWS\Tasks\CAAntiSpywareScan_Daily as Our Home Computer at 7 00 AM.job
- C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAAntiSpyware.exe [2007-08-16 21:10]
2008-08-13 C:\WINDOWS\Tasks\MP Scheduled Scan.job
- C:\Program Files\Windows Defender\MpCmdRun.exe [2006-11-03 19:20]
2008-08-12 C:\WINDOWS\Tasks\PPv5Scan_Daily as Our Home Computer at 6 30 PM.job
- C:\Program Files\CA\eTrust EZ Armor\eTrust PestPatrol\ppv5consumercl.exe []
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,SearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
R0 -: HKCU-Main,Start Page =
hxxp://www.signonsandiego.com/R1 -: HKCU-SearchURL,(Default) =
hxxp://www.google.com/search?q=%s
O16 -: DirectAnimation Java Classes -
file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd
O16 -: Microsoft XML Parser for Java -
file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd
O16 -: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} -
hxxp://vapwfa.ops.placeware.com/etc/pla ... silver.cabC:\WINDOWS\Downloaded Program Files\Quicksilver.inf
O16 -: {640B39C1-D713-464F-92C3-75BD972B95EE} -
hxxp://www.sidestep.com/get/k42037/sb02b.cabC:\WINDOWS\Downloaded Program Files\SbCIe02b.inf
C:\WINDOWS\Downloaded Program Files\SbCIe028.dll
C:\WINDOWS\Downloaded Program Files\SbCIe02b.dll
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-08-12 17:24:04
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\SYSTEM32\LEXBCES.EXE
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\isafe.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\vetmsg.exe
C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\Seagate\AutoBackup\MemeoBackup.exe
.
**************************************************************************
.
Completion time: 2008-08-12 17:36:30 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-13 00:35:06
Pre-Run: 16,205,668,352 bytes free
Post-Run: 16,100,691,968 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
294 --- E O F --- 2008-07-09 03:51:29
Here's my latest Hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:19:25 PM, on 08/12/08
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfsem.exe
C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe
C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe
C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe
C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\CAPPActiveProtection.exe
C:\Program Files\IE New Window Maximizer\iemaximizer.exe
C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
C:\Program Files\Seagate\AutoBackup\MemeoBackup.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\Our Home Computer\Local Settings\Temp\jkos-Our Home Computer\binaries\ScanningProcess.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.signonsandiego.com/R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [cctray] "C:\Program Files\CA\CA Internet Security Suite\cctray\cctray.exe"
O4 - HKLM\..\Run: [cafwc] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\cafw.exe -cl
O4 - HKLM\..\Run: [capfasem] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfasem.exe
O4 - HKLM\..\Run: [capfupgrade] C:\Program Files\CA\CA Internet Security Suite\CA Personal Firewall\capfupgrade.exe
O4 - HKLM\..\Run: [QOELOADER] "C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spam\QSP-5.1.18.0\QOELoader.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\ccleaner.exe" /AUTO
O4 - HKCU\..\Run: [IE New Window Maximizer] C:\Program Files\IE New Window Maximizer\iemaximizer.exe
O4 - HKUS\S-1-5-18\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NVMCTRAY.DLL,NvTaskbarInit (User 'Default user')
O4 - Startup: AutoBackup Launcher.lnk = C:\Program Files\Seagate\AutoBackup\MemeoLauncher.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CABO16 - DPF: {3299935F-2C5A-499A-9908-95CFFF6EF8C1} (Quicksilver Class) -
http://vapwfa.ops.placeware.com/etc/pla ... silver.cabO16 - DPF: {640B39C1-D713-464F-92C3-75BD972B95EE} -
http://www.sidestep.com/get/k42037/sb02b.cabO16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -
http://update.microsoft.com/windowsupda ... 0339741375O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) -
http://update.microsoft.com/microsoftup ... 5705867625O16 - DPF: {90C9629E-CD32-11D3-BBFB-00105A1F0D68} (InstallShield International Setup Player) -
http://www.installengine.com/engine/isetup.cabO16 - DPF: {E473A65C-8087-49A3-AFFD-C5BC4A10669B} (Quantum Streaming IE Player Class) -
http://mvnet.xlontech.net/qm/fox/061011 ... 101001.cabO17 - HKLM\System\CS1\Services\Tcpip\..\{1CC8C8E6-BC06-482B-89A0-2E796EEC7133}: NameServer = 192.168.0.1,4.2.2.2
O23 - Service: CaCCProvSP - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\ccprovsp.exe
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\ISafe.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: CA Pest Patrol Realtime Protection Service (ITMRTSVC) - CA, Inc. - C:\Program Files\CA\SharedComponents\PPRT\bin\ITMRTSVC.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - c:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Network Magic Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\nmsrvc.exe
O23 - Service: PPCtlPriv - CA, Inc. - C:\Program Files\CA\CA Internet Security Suite\CA Anti-Spyware\PPCtlPriv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe (file missing)
O23 - Service: HIPS Event Manager (UmxAgent) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxAgent.exe
O23 - Service: HIPS Configuration Interpreter (UmxCfg) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxCfg.exe
O23 - Service: HIPS Firewall Helper (UmxFwHlp) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxFwHlp.exe
O23 - Service: HIPS Policy Manager (UmxPol) - CA - C:\Program Files\CA\SharedComponents\HIPSEngine\UmxPol.exe
O23 - Service: VET Message Service (VETMSGNT) - CA, Inc. - C:\Program Files\CA\eTrust EZ Armor\eTrust EZ Antivirus\VetMsg.exe
--
End of file - 8772 bytes
Here's my Kaspersky online scan report:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Tuesday, August 12, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, August 13, 2008 01:55:02
Records in database: 1087424
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
Scan statistics:
Files scanned: 94104
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 02:16:48
No malware has been detected. The scan area is clean.
The selected area was scanned.
Again, thanks!