Ok here are the 3 logs and I haven't done anything with the file mentioned in my last post.
ComboFix 09-02-21.01 - Kenny 2009-02-22 22:25:20.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.671 [GMT -5:00]
Running from: c:\documents and settings\Kenny\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kenny\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated)
FW: McAfee Personal Firewall *disabled*
* Created a new restore point
FILE ::
c:\windows\GPInstall.exe
c:\windows\system32\fubebije.exe
c:\windows\system32\heweluwi.dll
c:\windows\system32\jtibrv.dll
c:\windows\system32\kigujuhi.dll
c:\windows\system32\mgvejp.dll
c:\windows\system32\muzaloda.dll
c:\windows\system32\nozigita.dll
c:\windows\system32\sidevoku.exe
c:\windows\system32\sozazela.dll
c:\windows\system32\viboluku.dll
c:\windows\system32\wafetela.dll
c:\windows\system32\wivozowi.dll
c:\windows\system32\yaruleji.dll
c:\windows\Tasks\VundoFixTool Scheduled Scan.job
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Azureus
c:\documents and settings\All Users\Application Data\Azureus\azCID.txt
c:\documents and settings\Kenny\Application Data\Azureus
c:\documents and settings\Kenny\Application Data\Azureus\.certs
c:\documents and settings\Kenny\Application Data\Azureus\.keystore
c:\documents and settings\Kenny\Application Data\Azureus\.lock
c:\documents and settings\Kenny\Application Data\Azureus\active\
00C07707C5DC0342EF754BD878F89487AB038D55.dat
c:\documents and settings\Kenny\Application Data\Azureus\active\
00C07707C5DC0342EF754BD878F89487AB038D55.dat.bak
c:\documents and settings\Kenny\Application Data\Azureus\active\25376AAC15F9DC97AC55DDB4888B7D87140D83D8.dat
c:\documents and settings\Kenny\Application Data\Azureus\active\25376AAC15F9DC97AC55DDB4888B7D87140D83D8.dat.bak
c:\documents and settings\Kenny\Application Data\Azureus\active\64A4B99426FCEDCE6A84166BEB0A3EA1B98164E5.dat
c:\documents and settings\Kenny\Application Data\Azureus\active\64A4B99426FCEDCE6A84166BEB0A3EA1B98164E5.dat.bak
c:\documents and settings\Kenny\Application Data\Azureus\active\8DF2F08C6F3E0A2F0ADAE2C980A3E3829B065FB7.dat
c:\documents and settings\Kenny\Application Data\Azureus\active\8DF2F08C6F3E0A2F0ADAE2C980A3E3829B065FB7.dat.bak
c:\documents and settings\Kenny\Application Data\Azureus\active\BEF96AFDD38E550C69C054F5B7934C437E34390E.dat
c:\documents and settings\Kenny\Application Data\Azureus\active\BEF96AFDD38E550C69C054F5B7934C437E34390E.dat.bak
c:\documents and settings\Kenny\Application Data\Azureus\active\cache.dat
c:\documents and settings\Kenny\Application Data\Azureus\azureus.config
c:\documents and settings\Kenny\Application Data\Azureus\azureus.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\azureus.statistics
c:\documents and settings\Kenny\Application Data\Azureus\azureus.statistics.bak
c:\documents and settings\Kenny\Application Data\Azureus\banips.config
c:\documents and settings\Kenny\Application Data\Azureus\banips.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\cnetworks.config
c:\documents and settings\Kenny\Application Data\Azureus\dht\addresses.dat
c:\documents and settings\Kenny\Application Data\Azureus\dht\contacts.dat
c:\documents and settings\Kenny\Application Data\Azureus\dht\diverse.dat
c:\documents and settings\Kenny\Application Data\Azureus\dht\general.dat
c:\documents and settings\Kenny\Application Data\Azureus\dht\version.dat
c:\documents and settings\Kenny\Application Data\Azureus\downloads.config
c:\documents and settings\Kenny\Application Data\Azureus\downloads.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\filters.config
c:\documents and settings\Kenny\Application Data\Azureus\friends.config
c:\documents and settings\Kenny\Application Data\Azureus\friends.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\ipfilter.cache
c:\documents and settings\Kenny\Application Data\Azureus\metasearch.config
c:\documents and settings\Kenny\Application Data\Azureus\metasearch.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\net\pm_33287.dat
c:\documents and settings\Kenny\Application Data\Azureus\net\pm_default.dat
c:\documents and settings\Kenny\Application Data\Azureus\sidebarauto.config
c:\documents and settings\Kenny\Application Data\Azureus\sidebarauto.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\subs\
047969C2F30A401262F9.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\
04C5EE008E353478F7DD.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\
065BC7FC173B034D8ED1.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\
0F193C9F601B15C4EFFE.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\13CCCA643B4D4185F7D8.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\21B6F154E1FA75E4DF0A.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\23C07FC046663EDB38E5.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\266C07A91A74D8CD05D0.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\2DD34BCB85CDDCB979F0.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\38F14939A1ADE522383C.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\400B09C6BFC041C77125.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\428870FB845DFB86BDFF.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\475A6FF4074864929368.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\581765478D3517627C73.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\5CBA0BA6AAA42E09B126.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\604C7F8616B38291CB89.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\645D29A4C5D9F90606BB.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\665FF0562B56B49EB83D.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\6824755C86CF5244EBB4.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\708C5D9333EC9E54E297.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\722FEC9BA057A883FE52.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\740AF5DF29177BDBE64C.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\7472680B49ACBCFA19D9.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\7EB198584F3721914E9D.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\87E23B1872099785E348.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\88831EE079954AC53525.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\A3287F0DF2346D598B5D.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\AA18A55630A89D766D85.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\AF734186BA1B192A332E.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\BBA708018991E48BD0CC.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\C2CA97BB53F50A950F22.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\C934D50DEAE6A54A6D1D.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\DC10272782C80481871B.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\DCC7B1A9E6EC36ED1548.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subs\FF68A7E4DB63E9E17CE9.vuze
c:\documents and settings\Kenny\Application Data\Azureus\subscriptions.config
c:\documents and settings\Kenny\Application Data\Azureus\subscriptions.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\tables.config
c:\documents and settings\Kenny\Application Data\Azureus\tables.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\timingstats.dat
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28788.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28789.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28790.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28791.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28792.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28793.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28794.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28795.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28800.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28801.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tmp\AZU28802.tmp
c:\documents and settings\Kenny\Application Data\Azureus\torrents\AZU36498.tmp
c:\documents and settings\Kenny\Application Data\Azureus\torrents\AZU36500.tmp
c:\documents and settings\Kenny\Application Data\Azureus\torrents\AZU46169.tmp
c:\documents and settings\Kenny\Application Data\Azureus\torrents\AZU46172.tmp
c:\documents and settings\Kenny\Application Data\Azureus\tracker.config
c:\documents and settings\Kenny\Application Data\Azureus\tracker.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\unsentdata.config
c:\documents and settings\Kenny\Application Data\Azureus\unsentdata.config.bak
c:\documents and settings\Kenny\Application Data\Azureus\update.log
c:\documents and settings\Kenny\Application Data\Azureus\update.properties
c:\documents and settings\Kenny\Application Data\Azureus\v3.Friends.dat
c:\documents and settings\Kenny\Application Data\Azureus\v3.Friends.dat.bak
c:\documents and settings\Kenny\Application Data\Azureus\VuzeActivities.config
c:\documents and settings\Kenny\Application Data\Azureus\VuzeActivities.config.bak
c:\documents and settings\Kenny\Application Data\VundoFixTool
c:\documents and settings\Kenny\Application Data\VundoFixTool\Log\2009 Feb 15 - 10_18_57 AM_625.log
c:\documents and settings\Kenny\Application Data\VundoFixTool\rs.dat
c:\documents and settings\Kenny\Application Data\VundoFixTool\Settings\ScanResults.pie
c:\program files\VirusBuster
c:\program files\VirusBuster\Update\HTTP\vb.idx
c:\program files\VirusBuster\Update\HTTP\vdb.inh
c:\windows\GPInstall.exe
c:\windows\system32\finawuzi\
c:\windows\system32\fubebije.exe
c:\windows\system32\heweluwi.dll
c:\windows\system32\jtibrv.dll
c:\windows\system32\kigujuhi.dll
c:\windows\system32\mgvejp.dll
c:\windows\system32\muzaloda.dll
c:\windows\system32\nozigita.dll
c:\windows\system32\sidevoku.exe
c:\windows\system32\sozazela.dll
c:\windows\system32\viboluku.dll
c:\windows\system32\wafetela.dll
c:\windows\system32\wivozowi.dll
c:\windows\system32\yaruleji.dll
c:\windows\Tasks\VundoFixTool Scheduled Scan.job
.
((((((((((((((((((((((((( Files Created from 2009-01-23 to 2009-02-23 )))))))))))))))))))))))))))))))
.
2009-02-21 21:50 . 2009-02-21 21:50 <DIR> d--h----- c:\windows\PIF
2009-02-21 20:47 . 2009-02-21 20:47 <DIR> d-------- c:\documents and settings\Kenny\Application Data\Malwarebytes
2009-02-21 20:47 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-21 20:46 . 2009-02-21 20:47 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 20:46 . 2009-02-21 20:46 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-21 20:46 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-16 02:09 . 2009-02-21 21:27 6,456 --ah----- c:\windows\system32\finawuzi
2009-02-15 09:24 . 2009-02-15 09:24 102,664 --a------ c:\windows\system32\drivers\tmcomm.sys
2009-02-15 09:23 . 2009-02-15 09:26 <DIR> d-------- c:\documents and settings\Kenny\.housecall6.6
2009-02-15 09:20 . 2009-02-15 09:19 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-15 09:19 . 2009-02-15 09:19 <DIR> d-------- c:\program files\Java
2009-02-14 16:54 . 2009-02-14 16:54 <DIR> d-------- c:\documents and settings\Administrator
2009-02-04 19:06 . 2009-02-04 19:08 <DIR> d-------- c:\documents and settings\Kenny\Application Data\U3
2009-01-31 22:46 . 2009-01-31 22:46 <DIR> d-------- c:\documents and settings\Kenny\Application Data\Apple Computer
2009-01-31 22:34 . 2009-01-31 22:34 <DIR> d-------- c:\documents and settings\Kenny\Application Data\vlc
2009-01-28 06:45 . 2009-01-28 06:45 <DIR> d-------- c:\documents and settings\Kenny\Application Data\Leadertech
2009-01-28 06:37 . 2009-01-28 06:37 0 --a------ c:\windows\PowerReg.dat
2009-01-26 06:08 . 2009-01-26 06:08 <DIR> d-------- c:\documents and settings\Kenny\Application Data\McAfee
2009-01-25 20:40 . 2009-01-26 05:52 107,888 --a------ c:\windows\system32\CmdLineExt.dll
2009-01-25 20:37 . 2007-05-16 16:45 3,497,832 --a------ c:\windows\system32\d3dx9_34.dll
2009-01-25 20:37 . 2007-05-16 16:45 1,124,720 --a------ c:\windows\system32\D3DCompiler_34.dll
2009-01-25 20:37 . 2007-05-16 16:45 443,752 --a------ c:\windows\system32\d3dx10_34.dll
2009-01-25 03:22 . 2008-10-02 10:07 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2009-01-24 14:57 . 2009-01-25 14:07 114 --a------ c:\windows\SpaceForce-RU.cfg
2009-01-24 14:23 . 2009-01-24 14:23 <DIR> d-------- c:\windows\SpaceForce - Rogue Universe
2009-01-23 09:20 . 2009-01-23 09:20 <DIR> d-------- c:\program files\Common Files\Thraex Software
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-22 02:43 --------- d-----w c:\documents and settings\Kenny\Application Data\mjusbsp
2009-02-22 02:31 --------- d-----w c:\program files\McAfee
2009-02-15 16:01 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-15 14:45 --------- d-----w c:\program files\Common Files\InstallShield
2009-02-15 14:19 410,984 ----a-w c:\windows\system32\deploytk.dll
2009-02-01 03:39 --------- d-----w c:\documents and settings\Kenny\Application Data\DivX
2009-02-01 03:38 --------- d-----w c:\program files\DivX
2009-01-26 11:08 --------- d-----w c:\documents and settings\All Users\Application Data\McAfee
2009-01-22 04:15 --------- d-----w c:\documents and settings\All Users\Application Data\Trymedia
2009-01-21 12:04 --------- d-----w c:\documents and settings\All Users\Application Data\SecTaskMan
2009-01-19 02:29 124 ----a-w C:\nvdata.dat
2009-01-19 02:26 611,064 ----a-w c:\windows\system32\drivers\sptd.sys
2009-01-14 07:46 --------- d-----w c:\documents and settings\Kenny\Application Data\vghd
2009-01-14 07:36 152,904 ----a-w c:\windows\system32\vghd.scr
2009-01-11 20:45 --------- d-----w c:\program files\Common Files\Adobe
2009-01-09 17:03 79,304 ----a-w c:\windows\system32\drivers\mfeavfk.sys
2009-01-09 17:03 40,552 ----a-w c:\windows\system32\drivers\mfesmfk.sys
2009-01-09 17:03 35,272 ----a-w c:\windows\system32\drivers\mfebopk.sys
2009-01-09 17:03 34,216 ----a-w c:\windows\system32\drivers\mferkdk.sys
2009-01-09 17:03 213,640 ----a-w c:\windows\system32\drivers\mfehidk.sys
2009-01-07 17:51 --------- d-----w c:\documents and settings\All Users\Application Data\nView_Profiles
2009-01-06 15:11 --------- d-----w c:\documents and settings\All Users\Application Data\PrevxCSI
2009-01-01 09:03 --------- d-----w c:\program files\Yahoo!
2009-01-01 09:02 --------- d-----w c:\documents and settings\All Users\Application Data\Yahoo!
2008-12-31 05:38 --------- dcsh--w c:\program files\Common Files\WindowsLiveInstaller
2008-12-31 05:36 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller
2008-12-31 03:43 --------- d-----w c:\documents and settings\Kenny\Application Data\Yahoo!
2008-12-30 00:50 --------- d-----w c:\documents and settings\All Users\Application Data\NVIDIA
2008-12-30 00:47 --------- d-----w c:\program files\Windows7
2008-12-29 22:53 --------- d-----w c:\program files\McAfee.com
2008-12-29 22:53 --------- d-----w c:\program files\Common Files\McAfee
2008-12-29 22:26 --------- d-----w c:\program files\CCleaner
2008-12-29 09:33 --------- d-----w c:\documents and settings\Kenny\Application Data\OtakuSoftware
2008-12-29 09:31 --------- d-----w c:\program files\RocketDock
2008-12-29 09:23 --------- d-----w c:\program files\microsoft frontpage
2008-12-29 09:17 --------- d-----w c:\program files\Windows Media Connect 2
2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll
2008-12-11 00:33 200,704 ----a-w c:\windows\system32\dtu100.dll
2008-12-09 02:28 593,920 ----a-w c:\windows\system32\dpuGUI11.dll
2008-12-09 02:28 57,344 ----a-w c:\windows\system32\dpv11.dll
2008-12-09 02:28 344,064 ----a-w c:\windows\system32\dpus11.dll
2008-12-09 02:28 294,912 ----a-w c:\windows\system32\dpu11.dll
2008-08-24 17:12 13,622 ----a-w c:\documents and settings\Kenny\STARTUP.reg
2006-05-06 16:42 7,260,160 ----a-w c:\program files\mozilla firefox\plugins\libvlc.dll
.
------- Sigcheck -------
2008-03-20 13:36 578560 f92d8964b5286de225bd2b6bf89764be c:\windows\system32\user32.dll
2008-04-28 04:25 920064 88348f8c92c28ba99fe49bd392100ce0 c:\windows\system32\wininet.dll
2008-04-28 04:24 547328 a55b8899d2ea2e800061bcfd456e34dc c:\windows\system32\winlogon.exe
2008-04-25 22:58 2185216 e184a0cf10cadd2b4f5af0a31e8627d6 c:\windows\system32\ntkrnlpa.exe
2008-04-25 22:44 2306560 0f733106a818383806060abc29fe0f3a c:\windows\system32\ntoskrnl.exe
2008-08-18 13:17 1616384 4a90f51b778fa0157f60d206e8b37d2a c:\windows\explorer.exe
2008-04-28 04:22 25088 b5e8782d4af1b3756f38e11e7c157bbe c:\windows\system32\ctfmon.exe
2008-03-20 13:36 989696 9a8d604748d9fe73b66021e5782a4a3c c:\windows\system32\kernel32.dll
.
((((((((((((((((((((((((((((( SnapShot@2009-02-21_21.44.38.26 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-02-22 01:42:33 32,768 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-23 03:21:24 32,768 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-22 01:42:33 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-23 03:21:24 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"cdloader"="c:\documents and settings\Kenny\Application Data\mjusbsp\cdloader2.exe" [2008-12-17 50520]
"RocketDock"="c:\program files\RocketDock\RocketDock.exe" [2007-09-02 495616]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-28 25088]
"Google Update"="c:\documents and settings\Kenny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-02-06 133104]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-01-08 645328]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144]
"UnlockerAssistant"="d:\program files\Unlocker\UnlockerAssistant.exe" [2006-09-07 15360]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-15 148888]
"nwiz"="nwiz.exe" [2008-10-07 c:\windows\system32\nwiz.exe]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]
"nltide_3"="advpack.dll" [2008-04-25 c:\windows\system32\advpack.dll]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.ffds"= ffdshow.ax
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2008-04-28 04:22 25088 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
--a----t- 2009-02-06 15:23 133104 c:\documents and settings\Kenny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2009-02-15 09:19 148888 c:\program files\Java\jre6\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"d:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcvsshld.exe"=
"c:\\Program Files\\RocketDock\\RocketDock.exe"=
"c:\\Documents and Settings\\Kenny\\Application Data\\mjusbsp\\magicJack.exe"=
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\autorun.exe
\Shell\phone\command - G:\autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\J]
\Shell\AutoRun\command - J:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder
2009-02-22 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-796845957-448539723-1644491937-1003.job
- c:\documents and settings\Kenny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-06 15:23]
2009-02-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-01-09 10:53]
2009-02-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2009-01-09 10:53]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
Trusted Zone: internet
Trusted Zone: mcafee.com
FF - ProfilePath - c:\documents and settings\Kenny\Application Data\Mozilla\Firefox\Profiles\dyhaq92o.default\
FF - plugin: c:\documents and settings\Kenny\Local Settings\Application Data\Google\Update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvlc.dll
FF - plugin: d:\program files\DivX\DivX Player\npDivxPlayerPlugin.dll
FF - plugin: d:\program files\DivX\DivX Web Player\npdivx32.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-02-22 22:27:02
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(628)
c:\windows\system32\SETUPAPI.dll
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll
- - - - - - - > 'lsass.exe'(684)
c:\windows\system32\setupapi.dll
.
Completion time: 2009-02-22 22:28:05
ComboFix-quarantined-files.txt 2009-02-23 03:28:02
ComboFix2.txt 2009-02-22 02:45:31
Pre-Run: 13,238,431,744 bytes free
Post-Run: 13,237,583,872 bytes free
354
____________________________________________________________________________
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, February 23, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, February 23, 2009 04:45:40
Records in database: 1833266
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
Scan statistics:
Files scanned: 52088
Threat name: 0
Infected objects: 0
Suspicious objects: 0
Duration of the scan: 01:38:55
No malware has been detected. The scan area is clean.
The selected area was scanned.
_________________________________________________________________________
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:51:00 AM, on 2/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\RocketDock\RocketDock.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Documents and Settings\Kenny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Documents and Settings\Kenny\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Kenny\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=69157R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Favorites
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UnlockerAssistant] "D:\Program Files\Unlocker\UnlockerAssistant.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [cdloader] "C:\Documents and Settings\Kenny\Application Data\mjusbsp\cdloader2.exe" MAGICJACK
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Kenny\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone:
http://*.mcafee.comO16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) -
https://h20436.www2.hp.com/ediags/dex/s ... DEXAXO.cabO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5670 bytes