Please Help - Malware on my Computer

[Trevlyn7]

Hello, everytime I start my computer I get a message indicating "Your Computer is infected!" Antivirus Pro 2009 also runs which I believe is some sort of virus. I went into the registry by typing "regedit" in start->run and just started deleting a whole bunch of things. I know not a smart idea but i've fed up with it and it still appears to be there. Please Help. I downloaded RSIT and pasted the information from the log file below:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:58:54 PM, on 11/2/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Rundll32.exe
C:\WINDOWS\BCMSMMSG.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Mark T Huang\Desktop\RSIT.exe
C:\Program Files\trend micro\Mark T Huang.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
O2 - BHO: (no name) - {75ABCF92-9764-4DFA-A83F-5142C3905052} - C:\WINDOWS\system32\ddcYpolj.dll
O2 - BHO: (no name) - {81750B4F-9C4C-443B-9385-D9F9078540AA} - C:\WINDOWS\system32\ddcBQigH.dll
O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper
O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [HPHUPD08] C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [fce7935f] rundll32.exe "C:\WINDOWS\system32\rtgdfwqo.dll",b
O4 - HKLM\..\Run: [Antivirus Pro 2009] "C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe" /hide
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Facegame] "C:\Documents and Settings\Mark T Huang\Application Data\Facegame\Facegame.exe" 61A847B5BBF72813338B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKUS\S-1-5-18\..\Run: [Facegame] "C:\WINDOWS\system32\config\systemprofile\Application Data\Facegame\Facegame.exe" 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Gool] "C:\WINDOWS\system32\config\systemprofile\Application Data\Gool\Gool.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [SpeedRunner] C:\WINDOWS\system32\config\systemprofile\Application Data\SpeedRunner\SpeedRunner.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [SfKg6wIP] C:\WINDOWS\system32\config\systemprofile\Application Data\Microsoft\uulebj.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [GetPack23] "C:\Program Files\GetPack\GetPack23.exe" (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [kwrf] C:\PROGRA~1\COMMON~1\kwrf\kwrfm.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Aida] "C:\WINDOWS\system32\config\SYSTEM~1\APPLIC~1\YMANTE~1\regedit.exe" -vt yazb (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [Xarqbu] C:\WINDOWS\system32\?ppPatch\m?config.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Facegame] "C:\WINDOWS\system32\config\systemprofile\Application Data\Facegame\Facegame.exe" 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A (User 'Default user')
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Filter hijack: text/html - {64b49ec5-7c8f-45b6-af30-c2ec04812a16} - C:\WINDOWS\system32\msziptools.dll
O20 - AppInit_DLLs: karna.dat
O20 - Winlogon Notify: ddcYpolj - C:\WINDOWS\SYSTEM32\ddcYpolj.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

--
End of file - 6695 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\GoogleUpdateTaskUser.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{75ABCF92-9764-4DFA-A83F-5142C3905052}]
C:\WINDOWS\system32\ddcYpolj.dll [2008-11-01 38912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{81750B4F-9C4C-443B-9385-D9F9078540AA}]
C:\WINDOWS\system32\ddcBQigH.dll [2008-11-02 269824]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"P17Helper"=Rundll32 P17.dll []
"BCMSMMSG"=C:\WINDOWS\BCMSMMSG.exe [2003-08-29 122880]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"HPHUPD08"=C:\Program Files\HP\Digital Imaging\{33D6CC28-9F75-4d1b-A11D-98895B3A3729}\hphupd08.exe [2005-06-01 49152]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2005-05-11 49152]
"RemoteControl"=C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2005-01-12 32768]
"StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-13 169984]
"fce7935f"=C:\WINDOWS\system32\rtgdfwqo.dll [2008-11-02 76288]
"Antivirus Pro 2009"=C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe /hide []
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2008-07-19 78008]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
""= []
"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2008-10-22 399504]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-13 15360]
"Facegame"=C:\Documents and Settings\Mark T Huang\Application Data\Facegame\Facegame.exe [2008-11-01 56832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdaptecDirectCD]
C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe [2002-04-10 679936]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-06 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
[]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Antivirus Pro 2009]
C:\Program Files\AntivirusPro2009\AntivirusPro2009.exe /hide []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
C:\Documents and Settings\Mark T Huang\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2008-09-07 133104]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe [2008-03-30 267048]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2006-04-05 180269]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
C:\PROGRA~1\Adobe\ACROBA~1.0\Reader\READER~1.EXE [2005-09-23 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2005-05-11 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^VPN Client.lnk]
C:\WINDOWS\Installer\{24C67B54-0718-445E-B663-3138D9246BD1}\Icon3E5562ED7.ico [2006-07-04 6144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3
"OpenCASE Media Agent"=2
"iPod Service"=3
"CVPND"=2
"Apple Mobile Device"=2
"Network Monitor"=2
"Bonjour Service"=2
"idsvc"=3
"cmdService"=2
"ATI Smart"=2

C:\Documents and Settings\All Users\Start Menu\Programs\Startup
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="karna.dat"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2007-09-28 122880]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ddcYpolj]
C:\WINDOWS\system32\ddcYpolj.dll [2008-11-01 38912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2007-03-15 236928]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{75ABCF92-9764-4DFA-A83F-5142C3905052}"=C:\WINDOWS\system32\ddcYpolj.dll [2008-11-01 38912]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"authentication packages"=msv1_0
C:\WINDOWS\system32\ddcBQigH

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, msansspc.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\aawservice]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"ForceClassicControlPanel"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe:*:Enabled:Yahoo! Messenger"
"C:\Program Files\Yahoo!\Messenger\YServer.exe"="C:\Program Files\Yahoo!\Messenger\YServer.exe:*:Enabled:Yahoo! FT Server"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Common Files\AOL\Loader\aolload.exe"="C:\Program Files\Common Files\AOL\Loader\aolload.exe:*:Enabled:AOL Loader"
"C:\Program Files\iTunes\iTunes.exe"="C:\Program Files\iTunes\iTunes.exe:*:Enabled:iTunes"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.js - edit -

======List of files/folders created in the last 1 months======

2008-11-02 22:45:57 ----D---- C:\rsit
2008-11-02 22:41:22 ----D---- C:\Documents and Settings\Mark T Huang\Application Data\Malwarebytes
2008-11-02 22:41:06 ----D---- C:\Program Files\Malwarebytes' Anti-Malware
2008-11-02 22:41:06 ----D---- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-11-02 21:16:29 ----A---- C:\Program Files\Common Files\ofoducy.exe
2008-11-02 19:45:52 ----A---- C:\WINDOWS\system32\aswBoot.exe
2008-11-02 19:45:48 ----D---- C:\Program Files\Alwil Software
2008-11-02 19:35:56 ----D---- C:\Program Files\Trend Micro
2008-11-02 14:49:28 ----A---- C:\WINDOWS\system32\zresnt.dll
2008-11-02 14:49:28 ----A---- C:\WINDOWS\system32\sqpedjvp.dll
2008-11-02 14:46:28 ----SH---- C:\WINDOWS\system32\oqwfdgtr.ini
2008-11-02 14:46:28 ----A---- C:\WINDOWS\system32\rtgdfwqo.dll
2008-11-02 10:21:47 ----A---- C:\WINDOWS\system32\mcrh.tmp
2008-11-02 09:28:31 ----D---- C:\Program Files\Lavasoft
2008-11-02 09:28:28 ----D---- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-11-02 09:26:04 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2008-11-02 08:44:13 ----SH---- C:\WINDOWS\system32\llklodyw.ini
2008-11-02 08:44:12 ----A---- C:\WINDOWS\system32\unpvld.dll
2008-11-02 08:44:11 ----A---- C:\WINDOWS\system32\sbkyseaf.dll
2008-11-02 08:43:41 ----A---- C:\WINDOWS\system32\f7c45721-.txt
2008-11-02 08:42:59 ----ASH---- C:\WINDOWS\system32\HgiQBcdd.ini2
2008-11-02 08:42:58 ----ASH---- C:\WINDOWS\system32\HgiQBcdd.ini
2008-11-02 08:42:52 ----A---- C:\WINDOWS\system32\ddcBQigH.dll
2008-11-02 08:39:58 ----A---- C:\WINDOWS\pevadokub.dll
2008-11-02 08:39:58 ----A---- C:\WINDOWS\isukofa.com
2008-11-02 08:39:58 ----A---- C:\WINDOWS\apagudylux.com
2008-11-02 08:39:58 ----A---- C:\Documents and Settings\Mark T Huang\Application Data\efivyduj.bat
2008-11-02 08:38:04 ----A---- C:\WINDOWS\system32\wini1087100.exe
2008-11-01 23:16:58 ----D---- C:\WINDOWS\system32\?ppPatch
2008-11-01 23:11:47 ----SHD---- C:\WINDOWS\TWFyayBIdWFuZw
2008-11-01 22:46:41 ----D---- C:\Program Files\Webtools
2008-11-01 22:42:01 ----A---- C:\WINDOWS\system32\delself.bat
2008-11-01 22:38:40 ----A---- C:\WINDOWS\brastk.exe
2008-11-01 22:37:06 ----N---- C:\WINDOWS\system32\brastk.exe
2008-11-01 22:36:53 ----A---- C:\WINDOWS\system32\rqRIyXRi.dll
2008-11-01 22:36:53 ----A---- C:\WINDOWS\system32\ddcYpolj.dll
2008-11-01 22:36:47 ----A---- C:\WINDOWS\system32\msansspc.dll
2008-10-26 21:46:51 ----D---- C:\WINDOWS\pss
2008-10-26 21:38:33 ----A---- C:\WINDOWS\system32\TDSSdxcp.dll
2008-10-26 21:38:32 ----A---- C:\WINDOWS\system32\TDSSxhyf.dll
2008-10-26 21:38:32 ----A---- C:\WINDOWS\system32\TDSSnvbv.dll
2008-10-26 21:38:31 ----A---- C:\WINDOWS\system32\TDSSvoql.dll
2008-10-26 21:38:21 ----A---- C:\WINDOWS\system32\TDSSoity.dll
2008-10-26 21:37:24 ----A---- C:\WINDOWS\system32\uesiuqcr.exe
2008-10-26 21:37:19 ----D---- C:\Documents and Settings\Mark T Huang\Application Data\Facegame
2008-10-26 21:37:18 ----A---- C:\WINDOWS\system32\smwin32.dll
2008-10-26 21:37:16 ----A---- C:\WINDOWS\system32\getsn32.dll
2008-10-26 21:37:06 ----D---- C:\Documents and Settings\Mark T Huang\Application Data\GetModule
2008-10-25 02:01:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2008-10-24 13:08:24 ----D---- C:\WINDOWS\Prefetch
2008-10-24 07:22:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2008-10-24 07:22:00 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$
2008-10-24 07:21:49 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2008-10-24 07:21:39 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2008-10-24 07:21:26 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$
2008-10-24 07:21:14 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2008-10-24 07:21:04 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2008-10-24 07:20:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2008-10-24 07:20:41 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2008-10-24 07:20:28 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2008-10-24 07:20:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951376$
2008-10-24 07:19:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2008-10-24 07:19:40 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2008-10-24 07:19:28 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2008-10-24 07:19:12 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2008-10-24 07:18:59 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$
2008-10-24 07:09:00 ----D---- C:\WINDOWS\system32\scripting
2008-10-24 07:08:56 ----D---- C:\WINDOWS\l2schemas
2008-10-24 07:08:55 ----D---- C:\WINDOWS\system32\en
2008-10-24 02:01:10 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$
2008-10-18 20:44:29 ----A---- C:\WINDOWS\system32\javaws.exe
2008-10-18 20:44:29 ----A---- C:\WINDOWS\system32\javaw.exe
2008-10-18 20:44:29 ----A---- C:\WINDOWS\system32\java.exe
2008-10-16 23:42:09 ----D---- C:\Program Files\Common
2008-10-16 02:04:51 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$
2008-10-16 02:04:44 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$
2008-10-16 02:04:36 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$
2008-10-16 02:03:55 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$
2008-10-16 02:03:03 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$
2008-10-09 19:51:33 ----A---- C:\WINDOWS\system32\msziptools.dll

======List of files/folders modified in the last 1 months======

2008-11-02 22:41:10 ----D---- C:\WINDOWS\system32\drivers
2008-11-02 22:41:06 ----D---- C:\Program Files
2008-11-02 21:51:42 ----SHD---- C:\WINDOWS\Installer
2008-11-02 21:51:42 ----HD---- C:\Config.Msi
2008-11-02 21:51:41 ----D---- C:\Program Files\Skype
2008-11-02 21:51:39 ----D---- C:\Program Files\Common Files
2008-11-02 21:49:20 ----D---- C:\WINDOWS
2008-11-02 21:49:19 ----D---- C:\WINDOWS\system32
2008-11-02 21:43:28 ----D---- C:\WINDOWS\Internet Logs
2008-11-02 21:43:24 ----D---- C:\WINDOWS\system32\ZoneLabs
2008-11-02 21:35:14 ----D---- C:\WINDOWS\Temp
2008-11-02 21:29:29 ----D---- C:\WINDOWS\system32\CatRoot2
2008-11-02 21:18:53 ----D---- C:\Program Files\Mozilla Firefox
2008-11-02 21:09:14 ----RSHDC---- C:\WINDOWS\system32\dllcache
2008-11-02 19:47:13 ----A---- C:\WINDOWS\SchedLgU.Txt
2008-11-02 19:46:21 ----D---- C:\WINDOWS\system32\config
2008-11-02 19:30:18 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2008-11-02 19:26:42 ----RASH---- C:\boot.ini
2008-11-02 19:26:42 ----A---- C:\WINDOWS\win.ini
2008-11-02 19:26:42 ----A---- C:\WINDOWS\system.ini
2008-11-02 12:40:21 ----D---- C:\Program Files\Windows Media Connect 2
2008-11-02 12:32:59 ----D---- C:\Program Files\Windows Media Player
2008-11-02 12:29:29 ----D---- C:\Documents and Settings\Mark T Huang\Application Data\WholeSecurity
2008-11-02 12:22:59 ----RSD---- C:\WINDOWS\assembly
2008-11-02 12:20:46 ----D---- C:\Program Files\Viewpoint
2008-11-02 12:20:46 ----D---- C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-11-02 12:15:50 ----HD---- C:\WINDOWS\inf
2008-11-02 12:15:39 ----D---- C:\Documents and Settings\Mark T Huang\Application Data\Move Networks
2008-10-24 17:26:48 ----HD---- C:\WINDOWS\$hf_mig$
2008-10-24 13:12:00 ----A---- C:\WINDOWS\OEWABLog.txt
2008-10-24 13:07:45 ----D---- C:\WINDOWS\system32\wbem
2008-10-24 13:07:45 ----D---- C:\WINDOWS\system32\Setup
2008-10-24 13:07:45 ----D---- C:\WINDOWS\AppPatch
2008-10-24 13:07:44 ----RSD---- C:\WINDOWS\Fonts
2008-10-24 07:24:19 ----D---- C:\WINDOWS\security
2008-10-24 07:22:27 ----A---- C:\WINDOWS\imsins.BAK
2008-10-24 07:22:22 ----D---- C:\WINDOWS\system32\CatRoot
2008-10-24 07:19:14 ----D---- C:\Program Files\Messenger
2008-10-24 07:12:14 ----A---- C:\WINDOWS\setuplog.txt
2008-10-24 07:10:07 ----D---- C:\WINDOWS\WinSxS
2008-10-24 07:09:31 ----D---- C:\WINDOWS\ServicePackFiles
2008-10-24 07:09:27 ----D---- C:\WINDOWS\network diagnostic
2008-10-24 07:09:26 ----D---- C:\WINDOWS\ime
2008-10-24 07:09:26 ----D---- C:\WINDOWS\Help
2008-10-24 07:09:02 ----D---- C:\WINDOWS\system32\usmt
2008-10-24 07:09:02 ----D---- C:\WINDOWS\system32\en-US
2008-10-24 07:08:54 ----D---- C:\WINDOWS\system32\bits
2008-10-24 07:08:54 ----D---- C:\WINDOWS\peernet
2008-10-24 07:08:54 ----D---- C:\Program Files\Movie Maker
2008-10-24 07:04:31 ----D---- C:\WINDOWS\system32\Restore
2008-10-24 07:04:31 ----D---- C:\WINDOWS\system32\npp
2008-10-24 07:04:29 ----D---- C:\WINDOWS\msagent
2008-10-24 07:04:27 ----D---- C:\WINDOWS\srchasst
2008-10-24 07:04:26 ----D---- C:\Program Files\NetMeeting
2008-10-24 07:04:24 ----D---- C:\WINDOWS\system32\Com
2008-10-24 07:04:18 ----D---- C:\Program Files\Windows NT
2008-10-24 07:04:18 ----D---- C:\Program Files\Outlook Express
2008-10-24 07:04:13 ----D---- C:\Program Files\Common Files\System
2008-10-24 07:03:47 ----D---- C:\WINDOWS\system32\oobe
2008-10-24 07:03:44 ----D---- C:\WINDOWS\system
2008-10-24 06:59:37 ----D---- C:\WINDOWS\system32\ReinstallBackups
2008-10-24 06:59:16 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2008-10-24 06:54:52 ----D---- C:\WINDOWS\EHome
2008-10-23 19:35:09 ----SD---- C:\WINDOWS\Tasks
2008-10-18 20:44:28 ----D---- C:\Program Files\Java
2008-10-16 02:12:56 ----D---- C:\Program Files\Internet Explorer
2008-10-16 02:04:13 ----D---- C:\WINDOWS\ie7updates
2008-10-15 11:34:24 ----A---- C:\WINDOWS\system32\netapi32.dll
2008-10-07 14:19:40 ----A---- C:\WINDOWS\system32\MRT.exe
2008-10-03 12:41:15 ----A---- C:\WINDOWS\system32\ieframe.dll

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2008-07-19 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2008-07-19 42912]
R1 Cdr4_xp;Cdr4_xp; C:\WINDOWS\system32\drivers\Cdr4_xp.sys [2007-06-20 9072]
R1 Cdralw2k;Cdralw2k; C:\WINDOWS\system32\drivers\Cdralw2k.sys [2007-06-20 9200]
R1 cdudf_xp;cdudf_xp; C:\WINDOWS\system32\drivers\cdudf_xp.sys [2002-04-10 236032]
R1 intelppm;Intel Processor Driver; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 Odptdi;Odptdi; \??\C:\WINDOWS\system32\drivers\odptdi.sys []
R1 OMCI;OMCI; C:\WINDOWS\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 pwd_2k;pwd_2k; C:\WINDOWS\system32\drivers\pwd_2k.sys [2002-04-10 117898]
R1 UdfReadr_xp;UdfReadr_xp; C:\WINDOWS\system32\drivers\UdfReadr_xp.sys [2002-04-10 206336]
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2008-07-19 94416]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys []
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-09-28 2456064]
R3 BCMModem;BCM V.92 56K Modem; C:\WINDOWS\System32\DRIVERS\BCMSM.sys [2003-08-29 1101696]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys [2005-01-10 138752]
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2005-08-18 110080]
R3 dvd_2K;dvd_2K; C:\WINDOWS\system32\drivers\dvd_2K.sys [2002-04-10 24554]
R3 GEARAspiWDM;GEAR CDRom Filter; C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys [2008-01-29 16168]
R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2004-09-29 51120]
R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2004-09-29 16496]
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2004-09-29 21744]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\System32\DRIVERS\ctoss2k.sys [2005-01-10 106496]
R3 P17;Sound Blaster Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2005-07-07 1389056]
R3 rtl8139;Realtek RTL8139(A/B/C)-based PCI Fast Ethernet Adapter NT Driver; C:\WINDOWS\System32\DRIVERS\RTL8139.SYS [2004-08-04 20992]
R3 usbccgp;Microsoft USB Generic Parent Driver; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB PRINTER Class; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 USBSTOR;USB Mass Storage Driver; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vsdatant;vsdatant; C:\WINDOWS\System32\vsdatant.sys [2006-03-16 372824]
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\WINDOWS\system32\drivers\WmBEnum.sys [2004-04-14 10144]
R3 WmXlCore;Logitech WingMan Translation Layer Driver; C:\WINDOWS\system32\drivers\WmXlCore.sys [2004-04-14 44064]
S1 kbdhid;Keyboard HID Driver; C:\WINDOWS\System32\DRIVERS\kbdhid.sys [2008-04-13 14592]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2008-07-19 23152]
S3 CVirtA;Cisco Systems VPN Adapter; C:\WINDOWS\system32\DRIVERS\CVirtA.sys [2005-05-17 5315]
S3 hidusb;Microsoft HID Class Driver; C:\WINDOWS\System32\DRIVERS\hidusb.sys [2008-04-13 10368]
S3 ICDUSB2;Sony IC Recorder (P); C:\WINDOWS\System32\Drivers\ICDUSB2.sys [2002-11-28 39048]
S3 mmc_2K;mmc_2K; C:\WINDOWS\system32\drivers\mmc_2K.sys [2002-04-10 29638]
S3 MODEMCSA;Unimodem Streaming Filter Device; C:\WINDOWS\system32\drivers\MODEMCSA.sys [2001-08-17 16128]
S3 mouhid;Mouse HID Driver; C:\WINDOWS\System32\DRIVERS\mouhid.sys [2001-08-17 12160]
S3 usbscan;USB Scanner Driver; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WmFilter;Logitech WingMan HID Filter Driver; C:\WINDOWS\system32\drivers\WmFilter.sys [2004-04-14 21280]
S3 WmVirHid;Logitech Virtual Hid Device Driver; C:\WINDOWS\system32\drivers\WmVirHid.sys [2004-04-14 5600]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2008-07-19 16056]
S2 aawservice;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe [2008-11-02 611664]
S2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-09-28 483328]
S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2007-09-28 593920]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2008-07-19 147640]
S2 CCALib8;Canon Camera Access Library 8; C:\Program Files\Canon\CAL\CALMAIN.exe [2005-09-30 96341]
S2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-08-09 73728]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2008-07-19 250040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2008-07-23 348344]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 ICDSPTSV;Sony SPTI Service for DVE; C:\WINDOWS\system32\IcdSptSv.exe [2003-04-01 69632]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-13 14336]
S4 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2008-02-18 110592]
S4 cmdService;Command Service; C:\WINDOWS\TWFyayBIdWFuZw\command.exe []
S4 CVPND;Cisco Systems, Inc. VPN Service; C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe [2005-11-04 1516584]
S4 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S4 iPod Service;iPod Service; C:\Program Files\iPod\bin\iPodService.exe [2008-03-30 504104]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]
S4 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]

-----------------EOF-----------------

[Shaba]

Hi Trevlyn7

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a fresh HijackThis log.

[Shaba]

Due to lack of Response this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.