Help with Malware Removal

[DShook]

Here is the ComboFix Log after adding the CFScript.txt file.

ComboFix 09-05-03.6 - Wendy C. Shook 05/04/2009 13:40.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.400 [GMT -4:00]
Running from: c:\documents and settings\Wendy C. Shook\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Wendy C. Shook\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090504-0] *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\ServicePackFiles\i386\explorer.exe --> c:\windows\explorer.exe
c:\windows\ServicePackFiles\i386\ctfmon.exe --> c:\windows\system32\ctfmon.exe
c:\windows\ServicePackFiles\i386\spoolsv.exe --> c:\windows\system32\spoolsv.exe
c:\windows\ServicePackFiles\i386\userinit.exe --> c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.

2009-05-04 15:10 . 2009-05-04 15:10 -------- d-----w C:\32788R22FWJFW.0.tmp
2009-04-19 21:38 . 2009-04-19 21:38 -------- d-----w c:\documents and settings\Wendy C. Shook\DoctorWeb
2009-04-14 22:00 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-14 22:00 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-04-14 22:00 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-14 22:00 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-14 22:00 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-14 22:00 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-14 22:00 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-14 22:00 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-04-14 22:00 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-14 22:00 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-14 21:59 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-14 21:59 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe
2009-04-11 15:24 . 2009-04-11 15:23 410984 ----a-w c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 14:31 . 2004-12-18 18:07 -------- d-----w c:\program files\Mozilla Thunderbird
2009-04-20 01:19 . 2002-08-29 11:00 433664 ----a-w c:\windows\system32\wiaacmgr.exe
2009-04-20 01:18 . 2002-08-29 11:00 77312 ----a-w c:\windows\system32\sdbinst.exe
2009-04-20 01:17 . 2002-08-29 11:00 76800 ----a-w c:\windows\system32\nslookup.exe
2009-04-20 01:17 . 2002-08-29 11:00 36864 ----a-w c:\windows\system32\netstat.exe
2009-04-20 01:17 . 2003-06-30 20:33 86016 ----a-w c:\windows\system32\netsh.exe
2009-04-20 01:17 . 2002-08-29 11:00 331776 ----a-w c:\windows\system32\netsetup.exe
2009-04-20 01:17 . 2002-08-29 11:00 124928 ----a-w c:\windows\system32\net1.exe
2009-04-20 01:17 . 2002-08-29 11:00 42496 ----a-w c:\windows\system32\net.exe
2009-04-20 01:17 . 2002-08-29 11:00 4096 ----a-w c:\windows\system32\nddeapir.exe
2009-04-20 01:17 . 2002-08-29 11:00 20480 ----a-w c:\windows\system32\NBTSTAT.EXE
2009-04-20 01:17 . 2002-11-20 16:50 53760 ----a-w c:\windows\system32\narrator.exe
2009-04-20 01:17 . 2008-06-22 00:40 176640 ----a-w c:\windows\system32\napstat.exe
2009-04-20 01:17 . 2002-08-29 11:00 677888 ----a-w c:\windows\system32\mstsc.exe
2009-04-20 01:17 . 2004-07-15 10:31 12288 ----a-w c:\windows\system32\mstinit.exe
2009-04-20 01:17 . 2002-08-29 11:00 6656 ----a-w c:\windows\system32\MSSWCHX.EXE
2009-04-20 01:15 . 2002-08-29 11:00 9728 ----a-w c:\windows\system32\LABEL.EXE
2009-04-20 01:15 . 2003-04-12 10:36 172032 ----a-w c:\windows\system32\jview.exe
2009-04-20 01:15 . 2003-04-12 10:35 14848 ----a-w c:\windows\system32\jdbgmgr.exe
2009-04-20 01:15 . 2000-04-26 19:34 39424 ----a-w c:\windows\system32\JETCOMP.exe
2009-04-20 01:15 . 2002-08-29 11:00 23552 ----a-w c:\windows\system32\ipxroute.exe
2009-04-20 01:15 . 2003-06-30 20:30 53248 ----a-w c:\windows\system32\ipv6.exe
2009-04-20 01:15 . 2002-08-29 11:00 44032 ----a-w c:\windows\system32\IPSEC6.EXE
2009-04-20 01:15 . 2002-08-29 11:00 55808 ----a-w c:\windows\system32\ipconfig.exe
2009-04-20 01:15 . 2005-10-19 12:59 114688 ----a-w c:\windows\system32\igfxzoom.exe
2009-04-20 01:15 . 1980-01-01 06:00 155648 ----a-w c:\windows\system32\igfxtray.exe
2009-04-20 01:15 . 2002-08-29 11:00 114688 ----a-w c:\windows\system32\iexpress.exe
2009-04-20 01:13 . 2003-09-01 19:46 17920 ----a-w c:\windows\system32\dpnsvr.exe
2009-04-20 01:12 . 2002-08-29 11:00 5120 ----a-w c:\windows\system32\BOOTVRFY.EXE
2009-04-20 01:12 . 2004-08-04 07:56 71680 ----a-w c:\windows\system32\blastcln.exe
2009-04-20 01:12 . 2002-08-29 11:00 4608 ----a-w c:\windows\system32\BOOTOK.EXE
2009-04-20 01:12 . 2002-09-10 23:34 98304 ----a-w c:\windows\system32\BacsTray.exe
2009-04-20 01:12 . 2004-08-04 07:56 14336 ----a-w c:\windows\system32\auditusr.exe
2009-04-20 01:12 . 2002-08-29 11:00 12288 ----a-w c:\windows\system32\attrib.exe
2009-04-20 01:12 . 2002-08-29 11:00 11264 ----a-w c:\windows\system32\atmadm.exe
2009-04-20 01:12 . 2002-08-29 11:00 25088 ----a-w c:\windows\system32\at.exe
2009-04-20 01:12 . 2002-08-29 11:00 19456 ----a-w c:\windows\system32\ARP.EXE
2009-04-20 01:12 . 2002-08-29 11:00 98304 ----a-w c:\windows\system32\ahui.exe
2009-04-20 01:12 . 2002-08-29 11:00 4096 ----a-w c:\windows\system32\actmovie.exe
2009-04-20 00:55 . 2002-08-29 11:00 744448 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
2009-04-20 00:35 . 2002-12-14 06:50 1077248 ----a-w c:\windows\Help\SBSI\Training\orun32.exe
2009-04-19 21:41 . 2002-08-29 11:00 289792 ----a-w c:\windows\system32\vssvc.exe
2009-04-19 21:40 . 2002-08-29 11:00 224768 ----a-w c:\windows\system32\dmadmin.exe
2009-04-19 21:40 . 2002-08-29 11:00 33280 ----a-w c:\windows\system32\clipsrv.exe
2009-04-19 21:40 . 2002-08-29 11:00 25600 ----a-w c:\windows\system32\cisvc.exe
2009-04-19 21:40 . 2002-08-29 11:00 64512 ----a-w c:\windows\system32\alg.exe
2009-04-18 21:02 . 2002-12-14 06:54 -------- d-----w c:\program files\Classic PhoneTools
2009-04-18 21:02 . 2004-08-10 00:22 -------- d-----w c:\program files\Audiovox USB Drivers
2009-04-18 16:30 . 2003-09-02 13:27 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-16 23:57 . 2005-02-19 03:02 -------- d-----w c:\program files\Startup Inspector for Windows
2009-04-16 23:57 . 2002-12-14 07:00 -------- d-----w c:\program files\QuickTime
2009-04-11 15:28 . 2007-07-21 16:59 -------- d-----w c:\program files\CCleaner
2009-04-11 15:23 . 2002-12-21 20:25 -------- d-----w c:\program files\Java
2009-03-06 14:22 . 2002-08-29 11:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-02-06 22:05 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2002-08-29 11:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-04-16 20:31 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2002-08-29 11:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2002-08-29 11:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-08-29 11:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 1980-01-01 06:00 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2002-08-29 11:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-03 19:59 . 2002-08-29 11:00 56832 ----a-w c:\windows\system32\secur32.dll
2009-01-16 23:03 . 2009-01-16 23:03 69632 --sha-w c:\windows\SYSTEM32\yenojuje.dll.vir
.

((((((((((((((((((((((((((((( SnapShot@2009-05-04_15.41.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-08-29 11:00 . 2008-04-14 00:12 26112 c:\windows\SYSTEM32\DLLCACHE\userinit.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 57856 c:\windows\SYSTEM32\DLLCACHE\spoolsv.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\DLLCACHE\ctfmon.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 347136 c:\windows\SYSTEM32\tourstart.exe
- 2002-08-29 11:00 . 2009-04-20 01:19 347136 c:\windows\SYSTEM32\tourstart.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 347136 c:\windows\SYSTEM32\DLLCACHE\tourstrt.exe
+ 2003-05-12 01:12 . 2008-04-14 00:12 1033728 c:\windows\SYSTEM32\DLLCACHE\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\progra~1\AWS\WEATHE~1\Weather.exe" [2009-04-19 1613824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
Contents of the 'Scheduled Tasks' folder

2009-05-04 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe [2004-04-01 21:40]

2002-12-21 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 21:41]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.espn.com/
uInternet Connection Wizard,ShellNext = hxxp://www.dellnet.com/
uInternet Settings,ProxyOverride = 127.0.0.1;hxxp://localhost;
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Wendy C. Shook\Application Data\Mozilla\Firefox\Profiles\mv0e142o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/outlook/health/c ... centsearch
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-04 13:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3992)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
c:\windows\system32\mshtml.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\program files\Adobe\Acrobat 7.0\ActiveX\PDFShell.dll
.
Completion time: 2009-05-04 13:45
ComboFix-quarantined-files.txt 2009-05-04 17:45
ComboFix2.txt 2009-05-04 15:44

Pre-Run: 16,893,829,120 bytes free
Post-Run: 16,876,240,896 bytes free

176 --- E O F --- 2009-04-15 00:52

[Shaba]

That went well

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  
  

  Code: Select all

  File::
  c:\windows\SYSTEM32\yenojuje.dll.vir
  

  
  
• Save this as CFScript.txt and change the "Save as type" to "All Files" and place it on your desktop.
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it shall produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.

[DShook]

Here is the latest ComboFix Log:

ComboFix 09-05-03.6 - Wendy C. Shook 05/04/2009 14:17.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.766.404 [GMT -4:00]
Running from: c:\documents and settings\Wendy C. Shook\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Wendy C. Shook\Desktop\CFScript.txt
AV: avast! antivirus 4.8.1335 [VPS 090504-0] *On-access scanning disabled* (Updated)

FILE ::
c:\windows\SYSTEM32\yenojuje.dll.vir
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\SYSTEM32\yenojuje.dll.vir

.
((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.

2009-05-04 15:10 . 2009-05-04 15:10 -------- d-----w C:\32788R22FWJFW.0.tmp
2009-04-19 21:38 . 2009-04-19 21:38 -------- d-----w c:\documents and settings\Wendy C. Shook\DoctorWeb
2009-04-14 22:00 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll
2009-04-14 22:00 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-04-14 22:00 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-04-14 22:00 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe
2009-04-14 22:00 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-04-14 22:00 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-14 22:00 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-14 22:00 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-04-14 22:00 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-04-14 22:00 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-04-14 21:59 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-04-14 21:59 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe
2009-04-11 15:24 . 2009-04-11 15:23 410984 ----a-w c:\windows\system32\deploytk.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-23 14:31 . 2004-12-18 18:07 -------- d-----w c:\program files\Mozilla Thunderbird
2009-04-20 01:19 . 2002-08-29 11:00 433664 ----a-w c:\windows\system32\wiaacmgr.exe
2009-04-20 01:18 . 2002-08-29 11:00 77312 ----a-w c:\windows\system32\sdbinst.exe
2009-04-20 01:17 . 2002-08-29 11:00 76800 ----a-w c:\windows\system32\nslookup.exe
2009-04-20 01:17 . 2002-08-29 11:00 36864 ----a-w c:\windows\system32\netstat.exe
2009-04-20 01:17 . 2003-06-30 20:33 86016 ----a-w c:\windows\system32\netsh.exe
2009-04-20 01:17 . 2002-08-29 11:00 331776 ----a-w c:\windows\system32\netsetup.exe
2009-04-20 01:17 . 2002-08-29 11:00 124928 ----a-w c:\windows\system32\net1.exe
2009-04-20 01:17 . 2002-08-29 11:00 42496 ----a-w c:\windows\system32\net.exe
2009-04-20 01:17 . 2002-08-29 11:00 4096 ----a-w c:\windows\system32\nddeapir.exe
2009-04-20 01:17 . 2002-08-29 11:00 20480 ----a-w c:\windows\system32\NBTSTAT.EXE
2009-04-20 01:17 . 2002-11-20 16:50 53760 ----a-w c:\windows\system32\narrator.exe
2009-04-20 01:17 . 2008-06-22 00:40 176640 ----a-w c:\windows\system32\napstat.exe
2009-04-20 01:17 . 2002-08-29 11:00 677888 ----a-w c:\windows\system32\mstsc.exe
2009-04-20 01:17 . 2004-07-15 10:31 12288 ----a-w c:\windows\system32\mstinit.exe
2009-04-20 01:17 . 2002-08-29 11:00 6656 ----a-w c:\windows\system32\MSSWCHX.EXE
2009-04-20 01:15 . 2002-08-29 11:00 9728 ----a-w c:\windows\system32\LABEL.EXE
2009-04-20 01:15 . 2003-04-12 10:36 172032 ----a-w c:\windows\system32\jview.exe
2009-04-20 01:15 . 2003-04-12 10:35 14848 ----a-w c:\windows\system32\jdbgmgr.exe
2009-04-20 01:15 . 2000-04-26 19:34 39424 ----a-w c:\windows\system32\JETCOMP.exe
2009-04-20 01:15 . 2002-08-29 11:00 23552 ----a-w c:\windows\system32\ipxroute.exe
2009-04-20 01:15 . 2003-06-30 20:30 53248 ----a-w c:\windows\system32\ipv6.exe
2009-04-20 01:15 . 2002-08-29 11:00 44032 ----a-w c:\windows\system32\IPSEC6.EXE
2009-04-20 01:15 . 2002-08-29 11:00 55808 ----a-w c:\windows\system32\ipconfig.exe
2009-04-20 01:15 . 2005-10-19 12:59 114688 ----a-w c:\windows\system32\igfxzoom.exe
2009-04-20 01:15 . 1980-01-01 06:00 155648 ----a-w c:\windows\system32\igfxtray.exe
2009-04-20 01:15 . 2002-08-29 11:00 114688 ----a-w c:\windows\system32\iexpress.exe
2009-04-20 01:13 . 2003-09-01 19:46 17920 ----a-w c:\windows\system32\dpnsvr.exe
2009-04-20 01:12 . 2002-08-29 11:00 5120 ----a-w c:\windows\system32\BOOTVRFY.EXE
2009-04-20 01:12 . 2004-08-04 07:56 71680 ----a-w c:\windows\system32\blastcln.exe
2009-04-20 01:12 . 2002-08-29 11:00 4608 ----a-w c:\windows\system32\BOOTOK.EXE
2009-04-20 01:12 . 2002-09-10 23:34 98304 ----a-w c:\windows\system32\BacsTray.exe
2009-04-20 01:12 . 2004-08-04 07:56 14336 ----a-w c:\windows\system32\auditusr.exe
2009-04-20 01:12 . 2002-08-29 11:00 12288 ----a-w c:\windows\system32\attrib.exe
2009-04-20 01:12 . 2002-08-29 11:00 11264 ----a-w c:\windows\system32\atmadm.exe
2009-04-20 01:12 . 2002-08-29 11:00 25088 ----a-w c:\windows\system32\at.exe
2009-04-20 01:12 . 2002-08-29 11:00 19456 ----a-w c:\windows\system32\ARP.EXE
2009-04-20 01:12 . 2002-08-29 11:00 98304 ----a-w c:\windows\system32\ahui.exe
2009-04-20 01:12 . 2002-08-29 11:00 4096 ----a-w c:\windows\system32\actmovie.exe
2009-04-20 00:55 . 2002-08-29 11:00 744448 ----a-w c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
2009-04-20 00:35 . 2002-12-14 06:50 1077248 ----a-w c:\windows\Help\SBSI\Training\orun32.exe
2009-04-19 21:41 . 2002-08-29 11:00 289792 ----a-w c:\windows\system32\vssvc.exe
2009-04-19 21:40 . 2002-08-29 11:00 224768 ----a-w c:\windows\system32\dmadmin.exe
2009-04-19 21:40 . 2002-08-29 11:00 33280 ----a-w c:\windows\system32\clipsrv.exe
2009-04-19 21:40 . 2002-08-29 11:00 25600 ----a-w c:\windows\system32\cisvc.exe
2009-04-19 21:40 . 2002-08-29 11:00 64512 ----a-w c:\windows\system32\alg.exe
2009-04-18 21:02 . 2002-12-14 06:54 -------- d-----w c:\program files\Classic PhoneTools
2009-04-18 21:02 . 2004-08-10 00:22 -------- d-----w c:\program files\Audiovox USB Drivers
2009-04-18 16:30 . 2003-09-02 13:27 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-04-16 23:57 . 2005-02-19 03:02 -------- d-----w c:\program files\Startup Inspector for Windows
2009-04-16 23:57 . 2002-12-14 07:00 -------- d-----w c:\program files\QuickTime
2009-04-11 15:28 . 2007-07-21 16:59 -------- d-----w c:\program files\CCleaner
2009-04-11 15:23 . 2002-12-21 20:25 -------- d-----w c:\program files\Java
2009-03-06 14:22 . 2002-08-29 11:00 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-02-06 22:05 826368 ----a-w c:\windows\system32\wininet.dll
2009-02-20 18:09 . 2004-08-04 07:56 78336 ----a-w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2002-08-29 11:00 729088 ----a-w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-04-16 20:31 401408 ----a-w c:\windows\system32\rpcss.dll
2009-02-09 12:10 . 2002-08-29 11:00 714752 ----a-w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2002-08-29 11:00 617472 ----a-w c:\windows\system32\advapi32.dll
2009-02-09 11:13 . 2002-08-29 11:00 1846784 ----a-w c:\windows\system32\win32k.sys
2009-02-07 23:02 . 1980-01-01 06:00 2066048 ----a-w c:\windows\system32\ntkrnlpa.exe
2009-02-06 11:11 . 2002-08-29 11:00 110592 ----a-w c:\windows\system32\services.exe
2009-02-06 11:08 . 1980-01-01 06:00 2189056 ----a-w c:\windows\system32\ntoskrnl.exe
2009-02-03 19:59 . 2002-08-29 11:00 56832 ----a-w c:\windows\system32\secur32.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-04_15.41.54 )))))))))))))))))))))))))))))))))))))))))
.
+ 2002-08-29 11:00 . 2008-04-14 00:12 26112 c:\windows\SYSTEM32\userinit.exe
- 2002-08-29 11:00 . 2009-04-19 21:41 26112 c:\windows\SYSTEM32\userinit.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 57856 c:\windows\SYSTEM32\spoolsv.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 26112 c:\windows\SYSTEM32\DLLCACHE\userinit.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 57856 c:\windows\SYSTEM32\DLLCACHE\spoolsv.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\DLLCACHE\ctfmon.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 15360 c:\windows\SYSTEM32\ctfmon.exe
- 2002-08-29 11:00 . 2009-04-19 21:40 15360 c:\windows\SYSTEM32\ctfmon.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 347136 c:\windows\SYSTEM32\tourstart.exe
- 2002-08-29 11:00 . 2009-04-20 01:19 347136 c:\windows\SYSTEM32\tourstart.exe
+ 2002-08-29 11:00 . 2008-04-14 00:12 347136 c:\windows\SYSTEM32\DLLCACHE\tourstrt.exe
+ 2003-05-12 01:12 . 2008-04-14 00:12 1033728 c:\windows\SYSTEM32\DLLCACHE\explorer.exe
+ 2003-05-12 01:12 . 2008-04-14 00:12 1033728 c:\windows\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Weather"="c:\progra~1\AWS\WEATHE~1\Weather.exe" [2009-04-19 1613824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
.
Contents of the 'Scheduled Tasks' folder

2009-05-04 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\pexpress\hphped05.exe [2004-04-01 21:40]

2002-12-21 c:\windows\Tasks\ISP signup reminder 1.job
- c:\windows\System32\OOBE\OOBEBALN.EXE [2002-08-29 21:41]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.espn.com/
uInternet Connection Wizard,ShellNext = hxxp://www.dellnet.com/
uInternet Settings,ProxyOverride = 127.0.0.1;hxxp://localhost;
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Wendy C. Shook\Application Data\Mozilla\Firefox\Profiles\mv0e142o.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.weather.com/outlook/health/c ... centsearch
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-04 14:19
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-05-04 14:22
ComboFix-quarantined-files.txt 2009-05-04 18:21
ComboFix2.txt 2009-05-04 17:45
ComboFix3.txt 2009-05-04 15:44

Pre-Run: 16,888,033,280 bytes free
Post-Run: 16,874,115,072 bytes free

169 --- E O F --- 2009-04-15 00:52

[Shaba]

Please go to Kaspersky website and perform an online antivirus scan.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button.
9. Please post this log in your next reply along with a fresh HijackThis log.

[DShook]

Here is the Kaspersky file:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Monday, May 4, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Monday, May 04, 2009 18:42:47
Records in database: 2129449
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 65250
Threat name: 14
Infected objects: 81
Suspicious objects: 58
Duration of the scan: 02:14:17


File name / Threat name / Threats count
C:\DELL\DELLBUTN.HTM Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\0\home.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\0\privacy_content.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\0\WhatisDS.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\261\NTVirus.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\265\Sobig_F.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\266\IE_How_To.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\267\Lightning.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\299\Swen.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\307\CriticalUpdate.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\413\Sasser_DS20.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\42\KaZaAalert.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\43\DellPicStd.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\44\OE6FileBlock1.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\492\home.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\492\privacy_content.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\492\WhatisDS.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\503\MS_IE_SecurityPatch.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\51\GenNtwking1.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\53\Invoice-PA1077558.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\56\Pop-up-McAfee.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\57\Pop-up-NAV.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\58\Pop-up-NAV.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\59\XP_Performance.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Dell\Alert\62\3rdParty-PA1078759.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\All Users\Application Data\Skype\Plugins\Plugins\F57B48ADF2224F088EDD1A2B9BAD84E8\PickGame.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Inbox Suspicious: Exploit.HTML.Iframe.FileDownload 38
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Inbox Infected: Email-Worm.Win32.Klez.h 15
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Sent Suspicious: Exploit.HTML.Iframe.FileDownload 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Trash Suspicious: Exploit.HTML.Iframe.FileDownload 18
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Trash Infected: Email-Worm.Win32.Klez.h 2
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Bagle.bo 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Bagle.cf 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Bagle.cl 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Sober.y 4
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Trash Infected: Trojan-Spy.HTML.Sunfraud.c 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Trash Infected: Email-Worm.Win32.Bagle.bj 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Trash Infected: Email-Worm.Win32.Bagle.bo 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Trash Infected: Net-Worm.Win32.Mytob.bk 4
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Trash Infected: Email-Worm.Win32.Bagle.cl 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Trash Infected: Email-Worm.Win32.Bagle.cf 1
C:\Documents and Settings\Wendy C. Shook\DoctorWeb\Quarantine\WxBugAutoUpgrade605b6.05.0.15d.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\Program Files\Alwil Software\Avast4\ENGLISH\HtmlData\11001.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Alwil Software\Avast4\ENGLISH\HtmlData\400.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Alwil Software\Avast4\ENGLISH\HtmlData\401.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Alwil Software\Avast4\ENGLISH\HtmlData\407.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Alwil Software\Avast4\ENGLISH\HtmlData\502.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Alwil Software\Avast4\ENGLISH\HtmlData\504.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\AWS\WeatherBug\Local\center_failed.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\AWS\WeatherBug\Local\center_loading.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Classic PhoneTools\html\INDEX.HTM Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Corel\WordPerfect Office 2002\ReleaseNotes.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\Congrats\7600demo.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Mozilla Firefox\res\hiddenWindow.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Mozilla Thunderbird\res\hiddenWindow.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Netscape\Netscape\palm.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\QuickTime\QuickTime Read Me.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Real\RealPlayer\playrlic.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Real\RealPlayer\Readme.html Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Qoobox\Quarantine\C\WINDOWS\QODCAT.dll.vir Infected: Trojan.Win32.Agent.cbrc 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2296\A0232088.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2297\A0234588.dll Infected: Trojan-Downloader.Win32.Agent.brzq 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2298\A0234618.dll Infected: Trojan.Win32.Agent.cbrc 1

The selected area was scanned.


Here is the most recent HijackThis File:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:13:30 PM, on 5/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\HP\hpcoretech\comp\hpdarc.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Wendy C. Shook\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.buddy.SndPlayFirstIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayOutgoing_ICQ", false);
user_pref("__000.aim.buddy.SndPlaySignOn_ICQ", false);
user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__000.icq.im.playall", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.cache.disk.parent_directory", "C:\\Documents and Settings\\Wendy
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.buddy.SndPlayFirstIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayOutgoing_ICQ", false);
user_pref("__000.aim.buddy.SndPlaySignOn_ICQ", false);
user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__000.icq.im.playall", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.cache.disk.parent_directory", "C:\\Documents and Settings\\Wendy
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1140727453
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 6323 bytes

[Shaba]

Looks like html files are infected.

Let's see if cureit can cure them.

Download to the desktop:Dr.Web CureIt

• Doubleclick the drweb-cureit.exe file and Allow to run the express scan
• This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
• Once the short scan has finished, Click Options > Change settings
• Choose the "Scan"-tab, remove the mark at "Heuristic analysis".
• Back at the main window, mark the drives that you want to scan.
• Select all drives. A red dot shows which drives have been chosen.
• Click the green arrow at the right, and the scan will start.
• Click 'Yes to all' if it asks if you want to cure/move the file.
• When the scan has finished, look if you can click next icon next to the files found:
  
  If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:
  
  This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
• After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
• Save the report to your desktop. The report will be called DrWeb.csv
• Close Dr.Web Cureit.
• Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
• After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log.

[DShook]

Here is the DrWeb report:
ComboFix.exe/data002\32788R22FWJFW\psexec.cfexe;C:\Documents and Settings\Wendy C. Shook\Desktop\ComboFix.exe/data002;Program.PsExec.171;;
data002;C:\Documents and Settings\Wendy C. Shook\Desktop;Archive contains infected objects;;
ComboFix.exe;C:\Documents and Settings\Wendy C. Shook\Desktop;Container contains infected objects;;
A0234705.EXE;C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2298;Program.PsExec.170;;


Here is HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:00:06 PM, on 5/5/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~1\AWS\WEATHE~1\Weather.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Wendy C. Shook\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.buddy.SndPlayFirstIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayOutgoing_ICQ", false);
user_pref("__000.aim.buddy.SndPlaySignOn_ICQ", false);
user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__000.icq.im.playall", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.cache.disk.parent_directory", "C:\\Documents and Settings\\Wendy
N3 - Netscape 7: # Mozilla User Preferences

/* Do not edit this file.
*
* If you make changes to this file while the browser is running,
* the changes will be overwritten when the browser exits.
*
* To make a manual change to preferences, you can visit the URL about:config
* For more information, see http://www.mozilla.org/unix/customizing.html#prefs
*/

user_pref("__000.aim.buddy.SndPlayFirstIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayIncoming_ICQ", false);
user_pref("__000.aim.buddy.SndPlayOutgoing_ICQ", false);
user_pref("__000.aim.buddy.SndPlaySignOn_ICQ", false);
user_pref("__000.aim.general.im.enterCR", false);
user_pref("__000.aim.general.im.tabKey", false);
user_pref("__000.aim.general.im.timeStamp", false);
user_pref("__000.icq.im.playall", false);
user_pref("aim.session.firsttime", false);
user_pref("browser.activation.checkedNNFlag", true);
user_pref("browser.bookmarks.added_static_root", true);
user_pref("browser.cache.disk.parent_directory", "C:\\Documents and Settings\\Wendy
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~1\AWS\WEATHE~1\Weather.exe 1
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1140727453
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 6382 bytes

[Shaba]

OK it didn't recongnize them.

Let's do this:

Uninstall and reinstall these programs:

avast!
Thunderbird
Firefox
WordPerfect Office 2002
NetScape
Quicktime
RealPlayer
Dell software

And uninstall this:

WeatherBug

Re-scan with kaspersky and post back new kaspersky log, please.

[DShook]

Sorry for the delay in reply. I had the Kaspersky scan stop a few times and it does take a while to complete.
It appears that many of the files are still infected, but I did uninstall and reinstall the programs requested - with the exception of the Dell files. I just deleted them as well as uninstalling Weatherbug.
Listed below are the Kaspersky results:
KASPERSKY ONLINE SCANNER 7.0 REPORT
Thursday, May 7, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Thursday, May 07, 2009 15:18:02
Records in database: 2143039
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 64958
Threat name: 11
Infected objects: 31
Suspicious objects: 58
Duration of the scan: 02:09:32


File name / Threat name / Threats count
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Inbox Suspicious: Exploit.HTML.Iframe.FileDownload 38
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Inbox Infected: Email-Worm.Win32.Klez.h 15
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Sent Suspicious: Exploit.HTML.Iframe.FileDownload 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Trash Suspicious: Exploit.HTML.Iframe.FileDownload 18
C:\Documents and Settings\Wendy C. Shook\Application Data\Mozilla\Profiles\default\o1ga506b.slt\Mail\pop.earthlink.net\Trash Infected: Email-Worm.Win32.Klez.h 2
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Bagle.bo 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Bagle.cf 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Bagle.cl 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Wendy C. Shook\Application Data\Thunderbird\Profiles\8t9n28x6.default\Mail\pop.earthlink.net\Junk Infected: Email-Worm.Win32.Sober.y 4
C:\Documents and Settings\Wendy C. Shook\DoctorWeb\Quarantine\WxBugAutoUpgrade605b6.05.0.15d.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\Program Files\Classic PhoneTools\html\INDEX.HTM Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\Congrats\7600demo.htm Infected: Trojan-Clicker.HTML.IFrame.aga 1
C:\Qoobox\Quarantine\C\WINDOWS\QODCAT.dll.vir Infected: Trojan.Win32.Agent.cbrc 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2296\A0232088.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2297\A0234588.dll Infected: Trojan-Downloader.Win32.Agent.brzq 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2298\A0234618.dll Infected: Trojan.Win32.Agent.cbrc 1

The selected area was scanned.

Here are the HijackThis results:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:26:43 PM, on 5/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Wendy C. Shook\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1140727453
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 4510 bytes

[Shaba]

Empty Junk and Trash folders in pop.earthlink.net Thunderbird account.

Empty these folders:

C:\Documents and Settings\Wendy C. Shook\DoctorWeb\Quarantine
C:\Qoobox\Quarantine

Delete these:

C:\Program Files\Classic PhoneTools\html\INDEX.HTM
C:\Program Files\Hewlett-Packard\{5372B9A6-6E51-4f90-9B40-E0A3B8475C4E}\Congrats\7600demo.htm

Empty Recycle Bin.

Still problems?

[DShook]

After I delete the files, do you want me to run Kaspersky and HijackThis and post the results again?

[Shaba]

No need if you don't have any issues left?

[DShook]

Sounds good. Thanks for the help.
What about these from the last Kaspersky scan? Where do I find them if I am to delete them?
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2296\A0232088.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2297\A0234588.dll Infected: Trojan-Downloader.Win32.Agent.brzq 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2298\A0234618.dll Infected: Trojan.Win32.Agent.cbrc 1

[Shaba]

They are in system restore and will get deleted during final instructions

[DShook]

I have deleted the files I could and emptied the trash and junk folders.
Just to be sure, I ran a Kaspersky scan and HijackThis.
Here are the results of Kaspersky:
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7.0 REPORT
Friday, May 8, 2009
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Friday, May 08, 2009 15:54:18
Records in database: 2145711
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
A:\
C:\
D:\
E:\

Scan statistics:
Files scanned: 64899
Threat name: 3
Infected objects: 4
Suspicious objects: 0
Duration of the scan: 02:09:35


File name / Threat name / Threats count
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2296\A0232088.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2297\A0234588.dll Infected: Trojan-Downloader.Win32.Agent.brzq 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2298\A0234618.dll Infected: Trojan.Win32.Agent.cbrc 1
C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP2308\A0237139.EXE Infected: not-a-virus:AdWare.Win32.WeatherBug.a 1

The selected area was scanned.

Here are the results of HijackThis:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:02:30 PM, on 5/8/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Documents and Settings\Wendy C. Shook\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.espn.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;http://localhost;
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\PROGRA~1\AWS\WEATHE~1\Weather.exe (file missing) (HKCU)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup ... 1140727453
O16 - DPF: {CAFEEFAC-0014-0000-0001-ABCDEFFEDCBA} (Java Runtime Environment 1.4.0_01) -
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

--
End of file - 4510 bytes