virusprotection2008 and other popups

It appears as a virus alert prompting me to scan and fix my computer with it.

I also get popups like http://www.registrydefender.com/l/index ... ron_113090

and my MyDocuments folder would randomly open every few minutes.

also I am unable to make an uninstall manager list. When I click 'save list' the Hijackthis closes.

here's the log file


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:14:23 AM, on 1/29/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dynex Wireless G Enhanced Adapter\WLService.exe
C:\Program Files\Dynex Wireless G Enhanced Adapter\WLanCfgG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Steam\Steam.exe
C:\Program Files\GetModule\GetModule35.exe
C:\WINDOWS\system32\prunnet.exe
C:\Documents and Settings\Andy II\Application Data\cogad\cogad.exe
C:\Program Files\GetPack\GetPack28.exe
C:\Documents and Settings\Andy II\Application Data\Twain\Twain.exe
C:\Program Files\VnrPack\VnrPack23.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cli ... bd=5070117
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = http://www.google.com/ig/dell?hl=en&cli ... bd=5070117
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB004" /M "Stylus CX4800"
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P35 "EPSON Stylus CX4800 Series (Copy 1)" /O6 "USB004" /M "Stylus CX4800"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [Vdunivagoxoyi] rundll32.exe "C:\WINDOWS\Kvadulazexizuxaw.dll",e
O4 - HKLM\..\Run: [Shurave] rundll32.exe "C:\WINDOWS\awotowuwuq.dll",e
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [986905e2] rundll32.exe "C:\WINDOWS\system32\uhrahdpo.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [GetModule35] C:\Program Files\GetModule\GetModule35.exe
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [cogad] "C:\Documents and Settings\Andy II\Application Data\cogad\cogad.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [GetPack28] "C:\Program Files\GetPack\GetPack28.exe"
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\Andy II\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [VnrPack23] "C:\Program Files\VnrPack\VnrPack23.exe"
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: qmhpbk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dynex Wireless G Enhanced Adapter Service (Dynex DX-WGPUSB WLService) - Unknown owner - C:\Program Files\Dynex Wireless G Enhanced Adapter\WLService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

--
End of file - 13721 bytes

Hello, and to the Malware Removal forums.
My name is Michael I'll be glad to help you with your computer problems.

HijackThis logs can take some time to research, so please be patient with me. I know that you need
your computer working as quickly as possible, and I will work hard to help see that happen.

Please be patient and I'd be grateful if you would note the following:

• I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
• The fixes are specific to your problem and should only be used for this issue on this machine.
• Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
• If after 5 days you have not responded to this topic, it will be closed, and you will need to start a new one.
• It's often worth reading through these instructions and printing them for ease of reference.
• If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
• Please reply to this thread. Do not start a new topic.
• All of my posts need to be checked by a teacher, so please be patient while I attempt to remove your malware.

Make an uninstall list using HijackThis
To access the Uninstall Manager you would do the following:

• Start HijackThis
• Click on the Config button
• Click on the Misc Tools button
• Click on the Open Uninstall Manager button.
• Click on the Save list... button and specify where you would like to save this file. When you press Save button a notepad will open with the contents of that file. Save the file to your desktop.

Please post this log on your next reply.

Thanks, Michael

Hi Mike, when I click on 'save' list' it closes immedietly, I dont have an option of where to save it

Download and Run ComboFix

Please visit this webpage for instructions for downloading ComboFix at your DESKTOP :
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Please ensure you read this guide carefully and install the Recovery Console first.

Additional links to download the tool:
http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Note: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

• Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. A guide to do this can be found here.
  The ones that need to be closed/disabled are:
  
  Symantec
  
• Click Yes to allow ComboFix to continue scanning for malware.
• When the tool is finished, it will produce a report for you.
• Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system.

Thanks!

Here is the Combofix Log, the Hijackthis log will follow after it:

ComboFix 09-02-05.01 - Andy II 2009-02-05 20:44:20.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.958.628 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning enabled* (Outdated)
FW: Norton Internet Worm Protection *disabled*
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Aaron\Application Data\GetModule
c:\documents and settings\Aaron\Application Data\GetModule\dicik.gz
c:\documents and settings\Aaron\Application Data\GetModule\kwdik.gz
c:\documents and settings\Aaron\Application Data\GetModule\ofadik.gz
c:\documents and settings\Aaron\Application Data\Google\T-Scan
c:\documents and settings\Aaron\Application Data\Google\T-Scan\n.gif
c:\documents and settings\Aaron\Application Data\Google\T-Scan\t.gif
c:\documents and settings\Aaron\Application Data\Google\T-Scan\y.gif
c:\documents and settings\Aaron\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Andy II\Application Data\GetModule
c:\documents and settings\Andy II\Application Data\GetModule\dicik.gz
c:\documents and settings\Andy II\Application Data\GetModule\kwdik.gz
c:\documents and settings\Andy II\Application Data\GetModule\ofadik.gz
c:\documents and settings\Andy II\Application Data\twain\Twain.exe
c:\documents and settings\Andy II\Local Settings\Temporary Internet Files\bestwiner.stt
c:\documents and settings\Andy II\Local Settings\Temporary Internet Files\CPV.stt
c:\documents and settings\Andy II\Local Settings\Temporary Internet Files\fbk.sts
C:\mimic.log
c:\program files\GetModule
c:\program files\GetModule\GetModule33.exe
c:\program files\GetModule\GetModule34.exe
c:\program files\GetModule\GetModule35.exe
c:\program files\GetModule\GetModule36.exe
c:\program files\GetPack
c:\program files\GetPack\dictame.gz
c:\program files\GetPack\GetPack27.exe
c:\program files\GetPack\GetPack28.exe
c:\program files\GetPack\trgtame.gz
c:\program files\iCheck
c:\program files\iCheck\Uninstall.exe
c:\program files\Mjcore
c:\program files\VnrPack
c:\program files\VnrPack\dicts.gz
c:\program files\VnrPack\trgts.gz
c:\program files\VnrPack\VnrPack23.exe
c:\windows\IE4 Error Log.txt
c:\windows\system32\40iswvBJ.exe.a_a
c:\windows\system32\62fvcAH3.exe.a_a
c:\windows\system32\akmusq.dll
c:\windows\system32\amwoctvo.dll
c:\windows\system32\aufjseeu.dll
c:\windows\system32\chert5-998.exe
c:\windows\system32\cymouw.dll
c:\windows\system32\digeste.dll
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekarkvusecr.sys
c:\windows\system32\eaksgbfb.dll
c:\windows\system32\fypoopjl.dll
c:\windows\system32\geBrpnLd.dll
c:\windows\system32\ipgwvsff.dll
c:\windows\system32\ismjlkar.dll
c:\windows\system32\jwgcfdwp.dll
c:\windows\system32\kswejq.dll
c:\windows\system32\lfuhvq.dll
c:\windows\system32\ltjetpli.dll
c:\windows\system32\ltjgar.dll
c:\windows\system32\mcrh.tmp
c:\windows\system32\mlJBTkKA.dll
c:\windows\system32\mlJBuvtr.dll
c:\windows\system32\mvxmny.dll
c:\windows\system32\MWFfgMoq.ini
c:\windows\system32\MWFfgMoq.ini2
c:\windows\system32\nnnkJCVn.dll
c:\windows\system32\opnopOHA.dll
c:\windows\system32\pmnkJyxx.dll
c:\windows\system32\prunnet.exe
c:\windows\system32\qkmpmtxd.dll
c:\windows\system32\qmhpbk.dll
c:\windows\system32\qoMgfFWM.dll
c:\windows\system32\qordna.dll
c:\windows\system32\rkbkkh.dll
c:\windows\system32\senekahmjqpvpg.dll
c:\windows\system32\senekancbhordn.dll
c:\windows\system32\senekaniwwnupl.dat
c:\windows\system32\senekavdersqsb.dat
c:\windows\system32\snqmbg.dll
c:\windows\system32\srgywhqu.dll
c:\windows\system32\srpfwema.dll
c:\windows\system32\tqmsmekr.dll
c:\windows\system32\urqQjkkL.dll
c:\windows\system32\vshdndku.dll
c:\windows\system32\vWn3Vdef.exe.a_a
c:\windows\system32\wjowpc.dll
c:\windows\system32\wnlfxpjw.dll
c:\windows\system32\wpv021232248330.cpx
c:\windows\system32\wpv151232083597.cpx
c:\windows\system32\wpv291232809034.cpx
c:\windows\system32\wpv711232809217.cpx
c:\windows\system32\wpv961232809217.cpx
c:\windows\system32\xfxglpay.dll
c:\windows\system32\xxkchcpy.dll
c:\windows\system32\xxsnrr.dll
c:\windows\system32\xxyJknmp.ini
c:\windows\system32\xxyJknmp.ini2
c:\windows\system32\yjvotgod.dll
c:\windows\Tasks\hjcybicl.job
c:\windows\wiaserviv.log

----- BITS: Possible infected sites -----

hxxp://childhe.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SENEKA


((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-02 17:45 . 2009-02-02 17:45 <DIR> d-------- c:\documents and settings\Andy II\Application Data\vlc
2009-01-30 01:51 . 2009-02-01 17:23 1,483,072 --ahs---- c:\windows\system32\ovtcowma.ini
2009-01-30 00:34 . 2009-01-30 00:34 1,515,358 --ahs---- c:\windows\system32\ilptejtl.ini
2009-01-28 23:15 . 2009-02-05 20:47 <DIR> d-------- c:\documents and settings\Andy II\Application Data\Twain
2009-01-28 23:11 . 2009-01-29 23:13 1,515,358 --ahs---- c:\windows\system32\opdharhu.ini
2009-01-28 23:10 . 2009-01-28 23:10 <DIR> d-------- c:\program files\WebShow
2009-01-25 13:53 . 2009-01-25 13:29 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-01-25 13:29 . 2009-01-25 13:29 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-01-25 13:28 . 2009-01-25 13:28 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-25 02:56 . 2009-01-25 02:56 <DIR> d-------- c:\program files\Trend Micro
2009-01-25 02:30 . 2009-01-25 02:30 <DIR> d-------- c:\program files\Enigma Software Group
2009-01-25 01:29 . 2009-01-25 01:29 134,144 --a------ c:\windows\awotowuwuq.dll
2009-01-25 01:25 . 2009-01-25 01:25 49,664 --a------ c:\windows\system32\jkkHYOHB.dll
2009-01-25 01:24 . 2009-01-25 01:24 <DIR> d-------- c:\documents and settings\Andy II\Application Data\VirusRemover2008
2009-01-25 01:20 . 2009-01-25 01:20 1,434,061 --ahs---- c:\windows\system32\ukdndhsv.ini
2009-01-25 01:17 . 2009-01-25 01:17 41,984 --a------ c:\windows\Kvadulazexizuxaw.dll
2009-01-25 01:10 . 2009-01-25 01:10 48,640 --a------ c:\windows\system32\cbXOIxyW.dll
2009-01-25 01:02 . 2009-01-25 01:02 49,664 --a------ c:\windows\system32\wvUkLdCt.dll
2009-01-24 23:58 . 2009-01-25 13:21 <DIR> d-------- c:\documents and settings\Andy II\Application Data\cogad
2009-01-24 04:50 . 2009-01-24 04:51 1,434,061 --ahs---- c:\windows\system32\ffsvwgpi.ini
2009-01-23 19:35 . 2008-08-15 23:22 198,941 --a------ c:\windows\system32\nvapps.nvb
2009-01-23 19:34 . 2008-08-06 07:51 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2009-01-23 19:33 . 2009-01-23 19:33 <DIR> d-------- C:\NVIDIA
2009-01-23 18:24 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll
2009-01-23 18:24 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll
2009-01-23 18:24 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll
2009-01-23 18:24 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll
2009-01-23 18:24 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll
2009-01-23 18:24 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll
2009-01-23 18:24 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll
2009-01-23 18:23 . 2009-01-23 18:28 <DIR> d--h----- c:\windows\msdownld.tmp
2009-01-23 18:05 . 2009-01-23 18:07 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2009-01-23 17:54 . 2009-01-23 17:54 <DIR> d-------- c:\windows\system32\xlive
2009-01-23 15:55 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-01-23 15:55 . 2006-12-08 12:02 251,672 --a------ c:\windows\system32\xactengine2_5.dll
2009-01-23 15:54 . 2009-01-23 15:54 <DIR> d-------- c:\windows\Logs
2009-01-23 14:19 . 2009-02-05 21:06 <DIR> d-------- c:\program files\Steam
2009-01-23 04:50 . 2009-01-23 04:50 1,434,061 --ahs---- c:\windows\system32\gwaufbeh.ini
2009-01-22 10:16 . 2009-02-05 00:07 <DIR> d-------- c:\documents and settings\Andy II\Application Data\OpenOffice.org2
2009-01-22 10:16 . 2009-01-22 10:16 <DIR> d-------- c:\documents and settings\Andy II\Application Data\NJStar
2009-01-22 04:47 . 2009-01-22 04:47 1,435,294 --ahs---- c:\windows\system32\ypchckxx.ini
2009-01-21 04:50 . 2009-01-21 04:50 1,432,799 --ahs---- c:\windows\system32\khikatrm.ini
2009-01-20 06:04 . 2009-02-03 02:18 <DIR> d-------- c:\documents and settings\Andy II\Application Data\BitTorrent
2009-01-20 04:47 . 2009-01-21 04:48 1,432,799 --ahs---- c:\windows\system32\ofhclomg.ini
2009-01-19 18:41 . 2009-01-19 18:41 <DIR> d-------- c:\documents and settings\Andy II\Application Data\AdobeUM
2009-01-19 17:37 . 2009-01-19 18:07 56 --a------ c:\windows\kgt2k.INI
2009-01-19 17:36 . 53,052 c:\windows\,Q,cSi"ªŸcŸN?[Ÿ<,Q,Z,,.mid
2009-01-19 16:29 . 2009-01-19 16:29 <DIR> d-------- c:\documents and settings\Andy II\Application Data\acccore
2009-01-19 16:28 . 2009-01-19 16:29 <DIR> d-------- c:\program files\AIM Toolbar
2009-01-19 16:28 . 2009-01-19 16:28 <DIR> d-------- c:\program files\AIM Search
2009-01-19 04:47 . 2009-01-19 04:47 1,403,021 --ahs---- c:\windows\system32\asruxdnb.ini
2009-01-19 04:45 . 2009-01-19 04:45 <DIR> d-------- c:\documents and settings\Andy II\Application Data\HP
2009-01-17 14:12 . 2009-01-18 14:12 1,403,021 --ahs---- c:\windows\system32\yjnlrudd.ini
2009-01-16 02:17 . 2009-01-17 02:18 1,402,999 --ahs---- c:\windows\system32\dcwspssj.ini
2009-01-11 22:17 . 2009-02-05 21:06 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-11 22:17 . 2009-01-11 22:17 1,409 --a------ c:\windows\QTFont.for
2009-01-11 07:07 . 2009-01-11 07:07 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-11 07:07 . 2009-01-11 07:07 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-11 07:05 . 2009-01-11 07:11 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-11 07:05 . 2009-01-11 07:07 <DIR> d-------- C:\ed730cada51539590ca06baec8c5
2009-01-11 07:05 . 2008-07-06 07:06 1,676,288 --a------ c:\windows\system32\xpssvcs.dll
2009-01-11 07:05 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-01-11 07:05 . 2008-07-06 05:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-01-11 07:05 . 2008-07-06 07:06 575,488 --a------ c:\windows\system32\xpsshhdr.dll
2009-01-11 07:05 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-11 07:05 . 2008-07-06 07:06 117,760 --a------ c:\windows\system32\prntvpt.dll
2009-01-11 07:05 . 2008-07-06 07:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-11 07:00 . 2009-01-11 07:00 <DIR> d-------- c:\program files\MSXML 6.0
2009-01-11 06:56 . 2009-01-11 06:56 <DIR> d-------- c:\program files\Wizards of the Coast
2009-01-06 02:22 . 2009-01-06 02:22 <DIR> d-------- c:\program files\Common Files\DirectX

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 02:05 --------- d-----w c:\documents and settings\Andy II\Application Data\WTablet
2009-02-06 02:03 --------- d-----w c:\documents and settings\LocalService\Application Data\WTablet
2009-01-30 07:16 --------- d-----w c:\documents and settings\Aaron\Application Data\DNA
2009-01-30 06:46 --------- d-----w c:\program files\DNA
2009-01-30 06:46 --------- d-----w c:\documents and settings\Aaron\Application Data\OpenOffice.org2
2009-01-30 06:45 --------- d-----w c:\documents and settings\Aaron\Application Data\WTablet
2009-01-25 18:28 --------- d-----w c:\program files\Lavasoft
2009-01-25 18:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-19 21:29 --------- d-----w c:\program files\AIM6
2009-01-19 21:28 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-01-17 19:43 --------- d-----w c:\documents and settings\Aaron\Application Data\Skype
2009-01-16 06:47 --------- d-----w c:\documents and settings\Aaron\Application Data\BitTorrent
2009-01-15 08:01 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-12-30 08:38 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-12-12 08:13 --------- d-----w c:\program files\Common Files\Software Update Utility
2008-12-12 08:13 --------- d-----w c:\documents and settings\All Users\Application Data\AIM Toolbar
2008-12-12 08:13 --------- d-----w c:\documents and settings\All Users\Application Data\acccore
2008-12-12 07:59 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2007-01-20 00:36 88 --sh--r c:\windows\system32\4032A62C6F.sys
2007-01-20 00:36 2,516 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15421B84-3488-49A7-AD18-CBF84A3EFAF6}]
2009-01-28 23:10 105984 --a------ c:\program files\WebShow\WebShow.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-31 50480]
"Steam"="c:\program files\Steam\Steam.exe" [2009-01-23 1410296]
"cogad"="c:\documents and settings\Andy II\Application Data\cogad\cogad.exe" [2009-01-25 56832]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UserFaultCheck"="c:\windows\system32\dumprep 0 -u" [X]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-15 13570048]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 52840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-02-20 185896]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-26 136600]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-02 98304]
"EPSON Stylus CX4800 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-02 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-15 86016]
"Vdunivagoxoyi"="c:\windows\Kvadulazexizuxaw.dll" [2009-01-25 41984]
"Shurave"="c:\windows\awotowuwuq.dll" [2009-01-25 134144]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-25 507224]
"SigmatelSysTrayApp"="stsystra.exe" [2006-08-15 c:\windows\stsystra.exe]
"nwiz"="nwiz.exe" [2008-08-15 c:\windows\system32\nwiz.exe]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\documents and settings\Andy II\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=rkbkkh.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\qoMgfFWM

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
"c:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-25 64160]
R2 Dynex DX-WGPUSB WLService;Dynex Wireless G Enhanced Adapter Service;c:\program files\Dynex Wireless G Enhanced Adapter\WLService.exe [2008-05-12 49152]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 942416]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-02-15 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-04-06 106808]
S3 padenum;Enumerador de dispositivos de NTPAD;c:\windows\system32\DRIVERS\padenum.sys --> c:\windows\system32\DRIVERS\padenum.sys [?]
S3 VendorJoystickEnabler;Driver para joystick paralelo de consola;c:\windows\system32\drivers\ntpad.sys --> c:\windows\system32\drivers\ntpad.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-02-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-25 13:29]

2009-02-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-05 c:\windows\Tasks\At25.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At26.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At27.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At28.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At29.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At30.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At31.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At32.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At33.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At34.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At35.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At36.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At37.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At38.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At39.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At40.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At41.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At42.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At43.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-06 c:\windows\Tasks\At44.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-06 c:\windows\Tasks\At45.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At46.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At47.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At48.job
- c:\windows\system32\vWn3Vdef.exe []

2009-02-05 c:\windows\Tasks\At49.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At50.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At51.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At52.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At53.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At54.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At55.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At56.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At57.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At58.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At59.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At60.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At61.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At62.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At63.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At64.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At65.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At66.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At67.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-06 c:\windows\Tasks\At68.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-06 c:\windows\Tasks\At69.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At70.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At71.job
- c:\windows\system32\62fvcAH3.exe []

2009-02-05 c:\windows\Tasks\At72.job
- c:\windows\system32\62fvcAH3.exe []

2009-01-31 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Aaron.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe []
.
- - - - ORPHANS REMOVED - - - -

URLSearchHooks-HookURL - (no file)
URLSearchHooks-Rank - (no file)
BHO-{698FCC61-DB15-4DD9-9B3A-A2345A8EA570} - c:\windows\system32\qoMgfFWM.dll
BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\opnopOHA.dll
BHO-{99C6D1BB-7555-474C-91DA-D8FB62A9CC75} - c:\windows\system32\38hxeCJ0.dll
BHO-{c753bfbe-e2f1-4442-8c2b-4d116ab28572} - c:\windows\system32\rkbkkh.dll
HKCU-Run-GetModule35 - c:\program files\GetModule\GetModule35.exe
HKCU-Run-prunnet - c:\windows\system32\prunnet.exe
HKCU-Run-GetPack28 - c:\program files\GetPack\GetPack28.exe
HKCU-Run-VnrPack23 - c:\program files\VnrPack\VnrPack23.exe
HKCU-Run-GetModule36 - c:\program files\GetModule\GetModule36.exe
HKLM-Run-prunnet - c:\windows\system32\prunnet.exe
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\opnopOHA.dll


.
------- Supplementary Scan -------
.
uStart Page =
mStart Page = hxxp://www.dell.com
IE: &AIM Toolbar Search - c:\documents and settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Andy II\Application Data\Mozilla\Firefox\Profiles\ato97zw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... rab&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-05 21:05:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Dynex Wireless G Enhanced Adapter\WLanCfgG.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
c:\program files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\wbem\unsecapp.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\system32\WTablet\TabUserW.exe
c:\windows\system32\Tablet.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\OpenOffice.org 2.3\program\soffice.exe
c:\program files\OpenOffice.org 2.3\program\soffice.bin
c:\program files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2009-02-05 21:11:30 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-06 02:11:27

Pre-Run: 1,424,470,016 bytes free
Post-Run: 7,162,290,176 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

492 --- E O F --- 2009-01-15 08:01:09




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:16:30 PM, on 2/5/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dynex Wireless G Enhanced Adapter\WLService.exe
C:\Program Files\Dynex Wireless G Enhanced Adapter\WLanCfgG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Tablet.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\WTablet\TabUserW.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\Andy II\Application Data\cogad\cogad.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=del ... bd=5070117
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: CPV - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\WebShow\WebShow.dll
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB004" /M "Stylus CX4800"
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P35 "EPSON Stylus CX4800 Series (Copy 1)" /O6 "USB004" /M "Stylus CX4800"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Vdunivagoxoyi] rundll32.exe "C:\WINDOWS\Kvadulazexizuxaw.dll",e
O4 - HKLM\..\Run: [Shurave] rundll32.exe "C:\WINDOWS\awotowuwuq.dll",e
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [cogad] "C:\Documents and Settings\Andy II\Application Data\cogad\cogad.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: rkbkkh.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dynex Wireless G Enhanced Adapter Service (Dynex DX-WGPUSB WLService) - Unknown owner - C:\Program Files\Dynex Wireless G Enhanced Adapter\WLService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

--
End of file - 14697 bytes

Run CFScript

Open Notepad and copy/paste the text in the box into the window:

File::

c:\windows\system32\ovtcowma.ini

c:\windows\system32\ilptejtl.ini

c:\windows\system32\opdharhu.ini

c:\windows\awotowuwuq.dll

c:\windows\system32\jkkHYOHB.dll

c:\windows\system32\ukdndhsv.ini

c:\windows\Kvadulazexizuxaw.dll

c:\windows\system32\cbXOIxyW.dll

c:\windows\system32\wvUkLdCt.dll

c:\windows\system32\ffsvwgpi.ini

c:\windows\system32\gwaufbeh.ini

c:\windows\system32\ypchckxx.ini

c:\windows\system32\khikatrm.ini

c:\windows\system32\ofhclomg.ini

c:\windows\system32\asruxdnb.ini

c:\windows\system32\yjnlrudd.ini

c:\windows\system32\dcwspssj.ini

c:\windows\system32\qoMgfFWM

c:\program files\Mozilla Firefox\plugins\npbittorrent.dll



DirLook::

c:\windows\system32\xlive



Folder::

c:\documents and settings\Andy II\Application Data\Twain

c:\documents and settings\Andy II\Application Data\VirusRemover2008

c:\documents and settings\Andy II\Application Data\cogad

c:\documents and settings\Andy II\Application Data\BitTorrent

c:\documents and settings\Aaron\Application Data\DNA

c:\program files\DNA

c:\program files\WebShow



Registry::

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{15421B84-3488-49A7-AD18-CBF84A3EFAF6}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"cogad"=-

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"UserFaultCheck"=-

"Vdunivagoxoyi"=-

"Shurave"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]

"AppInit_DLLs"=""

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

"Authentication Packages"=hex(7):6d,73,76,31,5f,30,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\security center]

"AntiVirusDisableNotify"=dword:00000000

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=-

"c:\\Program Files\\DNA\\btdna.exe"=-



AtJob:: 

Save it to your desktop as CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please post the ComboFix log and a new Hijackthis log.

Combofix Log, Hijackthis log will follow

ComboFix 09-02-05.01 - Andy II 2009-02-07 12:59:30.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.958.348 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Andy II\Desktop\CFScript.txt
AV: Norton Internet Security 2006 *On-access scanning enabled* (Outdated)
FW: Norton Internet Worm Protection *disabled*
* Created a new restore point

FILE ::
c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
c:\windows\awotowuwuq.dll
c:\windows\Kvadulazexizuxaw.dll
c:\windows\system32\asruxdnb.ini
c:\windows\system32\cbXOIxyW.dll
c:\windows\system32\dcwspssj.ini
c:\windows\system32\ffsvwgpi.ini
c:\windows\system32\gwaufbeh.ini
c:\windows\system32\ilptejtl.ini
c:\windows\system32\jkkHYOHB.dll
c:\windows\system32\khikatrm.ini
c:\windows\system32\ofhclomg.ini
c:\windows\system32\opdharhu.ini
c:\windows\system32\ovtcowma.ini
c:\windows\system32\qoMgfFWM
c:\windows\system32\ukdndhsv.ini
c:\windows\system32\wvUkLdCt.dll
c:\windows\system32\yjnlrudd.ini
c:\windows\system32\ypchckxx.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Aaron\Application Data\DNA
c:\documents and settings\Aaron\Application Data\DNA\dht.dat
c:\documents and settings\Aaron\Application Data\DNA\dht.dat.old
c:\documents and settings\Aaron\Application Data\DNA\dna.lng
c:\documents and settings\Aaron\Application Data\DNA\resume.dat
c:\documents and settings\Aaron\Application Data\DNA\resume.dat.old
c:\documents and settings\Aaron\Application Data\DNA\rss.dat
c:\documents and settings\Aaron\Application Data\DNA\rss.dat.old
c:\documents and settings\Aaron\Application Data\DNA\settings.dat
c:\documents and settings\Aaron\Application Data\DNA\settings.dat.old
c:\documents and settings\Andy II\Application Data\BitTorrent
c:\documents and settings\Andy II\Application Data\BitTorrent\[a4e]Metal_Skin_Panic_Madox-01[divx5.1.1].mkv.torrent
c:\documents and settings\Andy II\Application Data\BitTorrent\[ILA] MADOX-01.torrent
c:\documents and settings\Andy II\Application Data\BitTorrent\Conan The Barbarian (Complete Score).torrent
c:\documents and settings\Andy II\Application Data\BitTorrent\dht.dat
c:\documents and settings\Andy II\Application Data\BitTorrent\resume.dat
c:\documents and settings\Andy II\Application Data\BitTorrent\resume.dat.old
c:\documents and settings\Andy II\Application Data\BitTorrent\Rifts Backup.torrent
c:\documents and settings\Andy II\Application Data\BitTorrent\Rifts World Books.torrent
c:\documents and settings\Andy II\Application Data\BitTorrent\RIFTS.torrent
c:\documents and settings\Andy II\Application Data\BitTorrent\rss.dat
c:\documents and settings\Andy II\Application Data\BitTorrent\settings.dat
c:\documents and settings\Andy II\Application Data\BitTorrent\settings.dat.old
c:\documents and settings\Andy II\Application Data\BitTorrent\The Rifter 1-30.rar.torrent
c:\documents and settings\Andy II\Application Data\cogad
c:\documents and settings\Andy II\Application Data\cogad\cogad.exe
c:\documents and settings\Andy II\Application Data\Twain
c:\documents and settings\Andy II\Application Data\VirusRemover2008
c:\documents and settings\Andy II\Application Data\VirusRemover2008\Logs\scns.log
c:\documents and settings\Andy II\Local Settings\Temporary Internet Files\fbk.sts
c:\program files\DNA
c:\program files\DNA\btdna.exe
c:\program files\DNA\DNAcpl.cpl
c:\program files\DNA\plugins\npbtdna.dll
c:\program files\Mozilla Firefox\plugins\npbittorrent.dll
c:\program files\WebShow
c:\program files\WebShow\WebShow.dll
c:\windows\awotowuwuq.dll
c:\windows\Kvadulazexizuxaw.dll
c:\windows\system32\asruxdnb.ini
c:\windows\system32\cbXOIxyW.dll
c:\windows\system32\dcwspssj.ini
c:\windows\system32\ffsvwgpi.ini
c:\windows\system32\gwaufbeh.ini
c:\windows\system32\ilptejtl.ini
c:\windows\system32\jkkHYOHB.dll
c:\windows\system32\khikatrm.ini
c:\windows\system32\ofhclomg.ini
c:\windows\system32\opdharhu.ini
c:\windows\system32\ovtcowma.ini
c:\windows\system32\ukdndhsv.ini
c:\windows\system32\wvUkLdCt.dll
c:\windows\system32\yjnlrudd.ini
c:\windows\system32\ypchckxx.ini
c:\windows\Tasks\At25.job
c:\windows\Tasks\At26.job
c:\windows\Tasks\At27.job
c:\windows\Tasks\At28.job
c:\windows\Tasks\At29.job
c:\windows\Tasks\At30.job
c:\windows\Tasks\At31.job
c:\windows\Tasks\At32.job
c:\windows\Tasks\At33.job
c:\windows\Tasks\At34.job
c:\windows\Tasks\At35.job
c:\windows\Tasks\At36.job
c:\windows\Tasks\At37.job
c:\windows\Tasks\At38.job
c:\windows\Tasks\At39.job
c:\windows\Tasks\At40.job
c:\windows\Tasks\At41.job
c:\windows\Tasks\At42.job
c:\windows\Tasks\At43.job
c:\windows\Tasks\At44.job
c:\windows\Tasks\At45.job
c:\windows\Tasks\At46.job
c:\windows\Tasks\At47.job
c:\windows\Tasks\At48.job
c:\windows\Tasks\At49.job
c:\windows\Tasks\At50.job
c:\windows\Tasks\At51.job
c:\windows\Tasks\At52.job
c:\windows\Tasks\At53.job
c:\windows\Tasks\At54.job
c:\windows\Tasks\At55.job
c:\windows\Tasks\At56.job
c:\windows\Tasks\At57.job
c:\windows\Tasks\At58.job
c:\windows\Tasks\At59.job
c:\windows\Tasks\At60.job
c:\windows\Tasks\At61.job
c:\windows\Tasks\At62.job
c:\windows\Tasks\At63.job
c:\windows\Tasks\At64.job
c:\windows\Tasks\At65.job
c:\windows\Tasks\At66.job
c:\windows\Tasks\At67.job
c:\windows\Tasks\At68.job
c:\windows\Tasks\At69.job
c:\windows\Tasks\At70.job
c:\windows\Tasks\At71.job
c:\windows\Tasks\At72.job

.
((((((((((((((((((((((((( Files Created from 2009-01-07 to 2009-02-07 )))))))))))))))))))))))))))))))
.

2009-02-07 12:57 . 2009-02-07 12:57 <DIR> d-------- C:\32788R22FWJFW
2009-02-02 17:45 . 2009-02-02 17:45 <DIR> d-------- c:\documents and settings\Andy II\Application Data\vlc
2009-01-25 13:53 . 2009-01-25 13:29 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-01-25 13:29 . 2009-01-25 13:29 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-01-25 13:28 . 2009-01-25 13:28 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-25 02:56 . 2009-01-25 02:56 <DIR> d-------- c:\program files\Trend Micro
2009-01-25 02:30 . 2009-01-25 02:30 <DIR> d-------- c:\program files\Enigma Software Group
2009-01-23 19:35 . 2008-08-15 23:22 198,941 --a------ c:\windows\system32\nvapps.nvb
2009-01-23 19:34 . 2008-08-06 07:51 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2009-01-23 19:33 . 2009-01-23 19:33 <DIR> d-------- C:\NVIDIA
2009-01-23 18:24 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll
2009-01-23 18:24 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll
2009-01-23 18:24 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll
2009-01-23 18:24 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll
2009-01-23 18:24 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll
2009-01-23 18:24 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll
2009-01-23 18:24 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll
2009-01-23 18:23 . 2009-01-23 18:28 <DIR> d--h----- c:\windows\msdownld.tmp
2009-01-23 18:05 . 2009-01-23 18:07 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2009-01-23 17:54 . 2009-01-23 17:54 <DIR> d-------- c:\windows\system32\xlive
2009-01-23 15:55 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-01-23 15:55 . 2006-12-08 12:02 251,672 --a------ c:\windows\system32\xactengine2_5.dll
2009-01-23 15:54 . 2009-01-23 15:54 <DIR> d-------- c:\windows\Logs
2009-01-23 14:19 . 2009-02-05 21:06 <DIR> d-------- c:\program files\Steam
2009-01-22 10:16 . 2009-02-05 21:07 <DIR> d-------- c:\documents and settings\Andy II\Application Data\OpenOffice.org2
2009-01-22 10:16 . 2009-01-22 10:16 <DIR> d-------- c:\documents and settings\Andy II\Application Data\NJStar
2009-01-19 18:41 . 2009-01-19 18:41 <DIR> d-------- c:\documents and settings\Andy II\Application Data\AdobeUM
2009-01-19 17:37 . 2009-01-19 18:07 56 --a------ c:\windows\kgt2k.INI
2009-01-19 17:36 . 53,052 c:\windows\,Q,cSi"ªŸcŸN?[Ÿ<,Q,Z,,.mid
2009-01-19 16:29 . 2009-01-19 16:29 <DIR> d-------- c:\documents and settings\Andy II\Application Data\acccore
2009-01-19 16:28 . 2009-01-19 16:29 <DIR> d-------- c:\program files\AIM Toolbar
2009-01-19 16:28 . 2009-01-19 16:28 <DIR> d-------- c:\program files\AIM Search
2009-01-19 04:45 . 2009-01-19 04:45 <DIR> d-------- c:\documents and settings\Andy II\Application Data\HP
2009-01-11 22:17 . 2009-02-05 21:06 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-11 22:17 . 2009-01-11 22:17 1,409 --a------ c:\windows\QTFont.for
2009-01-11 07:07 . 2009-01-11 07:07 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-11 07:07 . 2009-01-11 07:07 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-11 07:05 . 2009-01-11 07:11 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-11 07:05 . 2009-01-11 07:07 <DIR> d-------- C:\ed730cada51539590ca06baec8c5
2009-01-11 07:05 . 2008-07-06 07:06 1,676,288 --a------ c:\windows\system32\xpssvcs.dll
2009-01-11 07:05 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-01-11 07:05 . 2008-07-06 05:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-01-11 07:05 . 2008-07-06 07:06 575,488 --a------ c:\windows\system32\xpsshhdr.dll
2009-01-11 07:05 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-11 07:05 . 2008-07-06 07:06 117,760 --a------ c:\windows\system32\prntvpt.dll
2009-01-11 07:05 . 2008-07-06 07:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-11 07:00 . 2009-01-11 07:00 <DIR> d-------- c:\program files\MSXML 6.0
2009-01-11 06:56 . 2009-01-11 06:56 <DIR> d-------- c:\program files\Wizards of the Coast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 02:05 --------- d-----w c:\documents and settings\Andy II\Application Data\WTablet
2009-02-06 02:03 --------- d-----w c:\documents and settings\LocalService\Application Data\WTablet
2009-01-30 06:46 --------- d-----w c:\documents and settings\Aaron\Application Data\OpenOffice.org2
2009-01-30 06:45 --------- d-----w c:\documents and settings\Aaron\Application Data\WTablet
2009-01-25 18:28 --------- d-----w c:\program files\Lavasoft
2009-01-25 18:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-19 21:29 --------- d-----w c:\program files\AIM6
2009-01-19 21:28 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-01-17 19:43 --------- d-----w c:\documents and settings\Aaron\Application Data\Skype
2009-01-16 06:47 --------- d-----w c:\documents and settings\Aaron\Application Data\BitTorrent
2009-01-15 08:01 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-06 07:22 --------- d-----w c:\program files\Common Files\DirectX
2008-12-30 08:38 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-12-12 17:27 3,067,392 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 08:13 --------- d-----w c:\program files\Common Files\Software Update Utility
2008-12-12 08:13 --------- d-----w c:\documents and settings\All Users\Application Data\AIM Toolbar
2008-12-12 08:13 --------- d-----w c:\documents and settings\All Users\Application Data\acccore
2008-12-12 07:59 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 11:57 333,184 ------w c:\windows\system32\dllcache\srv.sys
2007-01-20 00:36 88 --sh--r c:\windows\system32\4032A62C6F.sys
2007-01-20 00:36 2,516 -csha-w c:\windows\system32\KGyGaAvL.sys
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of c:\windows\system32\xlive ----

2007-09-18 15:01 134144 --a------ c:\windows\system32\xlive\sqmapi.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-15 13570048]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 52840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-02-20 185896]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-26 136600]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-02 98304]
"EPSON Stylus CX4800 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-02 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-15 86016]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-01-25 507224]
"SigmatelSysTrayApp"="stsystra.exe" [2006-08-15 c:\windows\stsystra.exe]
"nwiz"="nwiz.exe" [2008-08-15 c:\windows\system32\nwiz.exe]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\documents and settings\Andy II\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-25 64160]
R2 Dynex DX-WGPUSB WLService;Dynex Wireless G Enhanced Adapter Service;c:\program files\Dynex Wireless G Enhanced Adapter\WLService.exe [2008-05-12 49152]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 942416]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-02-15 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-04-06 106808]
S3 padenum;Enumerador de dispositivos de NTPAD;c:\windows\system32\DRIVERS\padenum.sys --> c:\windows\system32\DRIVERS\padenum.sys [?]
S3 VendorJoystickEnabler;Driver para joystick paralelo de consola;c:\windows\system32\drivers\ntpad.sys --> c:\windows\system32\drivers\ntpad.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-02-01 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-25 13:29]

2009-02-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3941659726-3948666053-3483446295-1008.job
- c:\documents and settings\Andy II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-05 21:21]

2009-02-07 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Aaron.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe []
.
.
------- Supplementary Scan -------
.
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=del ... bd=5070117
mStart Page = hxxp://www.dell.com
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Andy II\Application Data\Mozilla\Firefox\Profiles\ato97zw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... rab&query=
FF - plugin: c:\documents and settings\Andy II\Local Settings\Application Data\Google\Update\1.2.133.37\npGoogleOneClick7.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 13:04:59
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-07 13:16:34
ComboFix-quarantined-files.txt 2009-02-07 18:16:31
ComboFix2.txt 2009-02-06 02:11:32

Pre-Run: 6,460,796,928 bytes free
Post-Run: 6,423,334,912 bytes free

333 --- E O F --- 2009-01-15 08:01:09

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:15, on 2009-02-07
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Dynex Wireless G Enhanced Adapter\WLService.exe
C:\Program Files\Dynex Wireless G Enhanced Adapter\WLanCfgG.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe
C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WUSB54GC.exe
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\Tablet.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\Andy II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\OpenOffice.org 2.3\program\soffice.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\OpenOffice.org 2.3\program\soffice.BIN
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Documents and Settings\Andy II\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Documents and Settings\Andy II\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Symantec\LiveUpdate\AUpdate.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=del ... bd=5070117
R3 - URLSearchHook: AIM Toolbar Search Class - {03402f96-3dc7-4285-bc50-9e81fefafe43} - C:\Program Files\AIM Toolbar\aimtb.dll
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AIM Search\AOLSearch.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O2 - BHO: HP Smart Web Printing 1.0 - {AE84A6AA-A333-4B92-B276-C11E2212E4FE} - C:\Program Files\HP\Smart Web Printing\SmartWebPrinting.dll
O2 - BHO: AIM Toolbar Loader - {b0cda128-b425-4eef-a174-61a11ac5dbf8} - C:\Program Files\AIM Toolbar\aimtb.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll (file missing)
O3 - Toolbar: AIM Toolbar - {61539ecd-cc67-4437-a03c-9aaccbd14326} - C:\Program Files\AIM Toolbar\aimtb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P26 "EPSON Stylus CX4800 Series" /O6 "USB004" /M "Stylus CX4800"
O4 - HKLM\..\Run: [EPSON Stylus CX4800 Series (Copy 1)] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE /P35 "EPSON Stylus CX4800 Series (Copy 1)" /O6 "USB004" /M "Stylus CX4800"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "C:\Program Files\Steam\Steam.exe" -silent
O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Andy II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O4 - S-1-5-18 Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (User 'Default user')
O4 - .DEFAULT Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe (User 'Default user')
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &AIM Toolbar Search - C:\Documents and Settings\All Users\Application Data\AIM Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: AIM Toolbar - {0b83c99c-1efa-4259-858f-bcb33e007a5b} - C:\Program Files\AIM Toolbar\aimtb.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Program Files\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Dynex Wireless G Enhanced Adapter Service (Dynex DX-WGPUSB WLService) - Unknown owner - C:\Program Files\Dynex Wireless G Enhanced Adapter\WLService.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe (file missing)
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Unknown owner - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe (file missing)
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WUSB54GCSVC - GEMTEKS - C:\Program Files\Compact Wireless-G USB Adapter Wireless Network Monitor\WLService.exe

--
End of file - 15405 bytes

Upload a File to Virustotal

Please visit Virustotal

• Click the Browse... button
• Navigate to the file c:\windows\system32\xlive\sqmapi.dll
• Click the Open button
• Click the Send button
• Copy and paste the results back here please.

Run CFScript

Open Notepad and copy/paste the text in the box into the window:

Folder::

c:\documents and settings\Aaron\Application Data\BitTorrent

Save it to your desktop as CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware and save to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to:
  
  Update Malwarebytes' Anti-Malware
  Launch Malwarebytes' Anti-Malware
  
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform Full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked Except for the objects located in C:\System Volume Information, and click Remove Selected.
• When completed, a log will open in Notepad. Please copy and paste the log back into your next reply
  
  Note:
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
• Or via the Logs tab when Malwarebytes' Anti-Malware is started.

Please post the ComboFix log, the Malwarebyte's Anti-Malware log, the Virus Total results, and a new Hijackthis log on your next reply.

From Virustotal:

analisis/712d9d1d3f6656cf050b8bc85c4a68cb

I'm not sure how to follow these instructions

Open Notepad and copy/paste the text in the box into the window:

Code:
Folder::
c:\documents and settings\Aaron\Application Data\BitTorrent

I don't seem to have an 'application data' folder. I'm unclear as to what I'm suppose to do at this step.
What do you mean by 'copy/paste the text in the box into the window'. What is the box, and what is the window?

Here's my log results. Should I save that as CFScript.txt and drag into combo script? This would be skipping the step mentioned above.




ComboFix 09-02-08.02 - Andy II 2009-02-09 22:29:45.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.958.117 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Norton Internet Security 2006 *On-access scanning enabled* (Outdated)
FW: Norton Internet Worm Protection *disabled*
* Created a new restore point
.

((((((((((((((((((((((((( Files Created from 2009-01-10 to 2009-02-10 )))))))))))))))))))))))))))))))
.

2009-02-02 17:45 . 2009-02-02 17:45 <DIR> d-------- c:\documents and settings\Andy II\Application Data\vlc
2009-01-25 13:53 . 2009-01-25 13:29 15,688 --a------ c:\windows\system32\lsdelete.exe
2009-01-25 13:29 . 2009-01-25 13:29 64,160 --a------ c:\windows\system32\drivers\Lbd.sys
2009-01-25 13:28 . 2009-01-25 13:28 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-01-25 02:56 . 2009-01-25 02:56 <DIR> d-------- c:\program files\Trend Micro
2009-01-25 02:30 . 2009-01-25 02:30 <DIR> d-------- c:\program files\Enigma Software Group
2009-01-23 19:35 . 2008-08-15 23:22 198,941 --a------ c:\windows\system32\nvapps.nvb
2009-01-23 19:34 . 2008-08-06 07:51 453,152 --a------ c:\windows\system32\NVUNINST.EXE
2009-01-23 19:33 . 2009-01-23 19:33 <DIR> d-------- C:\NVIDIA
2009-01-23 18:24 . 2008-10-10 04:52 4,379,984 --a------ c:\windows\system32\D3DX9_40.dll
2009-01-23 18:24 . 2008-10-10 04:52 2,036,576 --a------ c:\windows\system32\D3DCompiler_40.dll
2009-01-23 18:24 . 2008-10-27 10:04 514,384 --a------ c:\windows\system32\XAudio2_3.dll
2009-01-23 18:24 . 2008-10-10 04:52 452,440 --a------ c:\windows\system32\d3dx10_40.dll
2009-01-23 18:24 . 2008-10-27 10:04 235,856 --a------ c:\windows\system32\xactengine3_3.dll
2009-01-23 18:24 . 2008-10-27 10:04 70,992 --a------ c:\windows\system32\XAPOFX1_2.dll
2009-01-23 18:24 . 2008-10-27 10:04 23,376 --a------ c:\windows\system32\X3DAudio1_5.dll
2009-01-23 18:23 . 2009-01-23 18:28 <DIR> d--h----- c:\windows\msdownld.tmp
2009-01-23 18:05 . 2009-01-23 18:07 <DIR> d-------- c:\program files\Microsoft Games for Windows - LIVE
2009-01-23 17:54 . 2009-01-23 17:54 <DIR> d-------- c:\windows\system32\xlive
2009-01-23 15:55 . 2006-11-29 13:06 3,426,072 --a------ c:\windows\system32\d3dx9_32.dll
2009-01-23 15:55 . 2006-12-08 12:02 251,672 --a------ c:\windows\system32\xactengine2_5.dll
2009-01-23 15:54 . 2009-01-23 15:54 <DIR> d-------- c:\windows\Logs
2009-01-23 14:19 . 2009-02-07 14:12 <DIR> d-------- c:\program files\Steam
2009-01-22 10:16 . 2009-02-07 14:12 <DIR> d-------- c:\documents and settings\Andy II\Application Data\OpenOffice.org2
2009-01-22 10:16 . 2009-01-22 10:16 <DIR> d-------- c:\documents and settings\Andy II\Application Data\NJStar
2009-01-19 18:41 . 2009-02-07 14:02 <DIR> d-------- c:\documents and settings\Andy II\Application Data\AdobeUM
2009-01-19 17:37 . 2009-01-19 18:07 56 --a------ c:\windows\kgt2k.INI
2009-01-19 17:36 . 2009-01-19 18:01 53,052 --a------ c:\windows\‚Q‚cŠi“¬ƒcƒN[ƒ‹‚Q‚Ž‚„.mid
2009-01-19 16:29 . 2009-01-19 16:29 <DIR> d-------- c:\documents and settings\Andy II\Application Data\acccore
2009-01-19 16:28 . 2009-01-19 16:29 <DIR> d-------- c:\program files\AIM Toolbar
2009-01-19 16:28 . 2009-01-19 16:28 <DIR> d-------- c:\program files\AIM Search
2009-01-19 04:45 . 2009-01-19 04:45 <DIR> d-------- c:\documents and settings\Andy II\Application Data\HP
2009-01-11 22:17 . 2009-02-07 14:11 54,156 --ah----- c:\windows\QTFont.qfn
2009-01-11 22:17 . 2009-01-11 22:17 1,409 --a------ c:\windows\QTFont.for
2009-01-11 07:07 . 2009-01-11 07:07 <DIR> d-------- c:\windows\system32\XPSViewer
2009-01-11 07:07 . 2009-01-11 07:07 <DIR> d-------- c:\program files\Reference Assemblies
2009-01-11 07:05 . 2009-01-11 07:11 <DIR> d-------- c:\windows\SxsCaPendDel
2009-01-11 07:05 . 2009-01-11 07:07 <DIR> d-------- C:\ed730cada51539590ca06baec8c5
2009-01-11 07:05 . 2008-07-06 07:06 1,676,288 --a------ c:\windows\system32\xpssvcs.dll
2009-01-11 07:05 . 2008-07-06 07:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-01-11 07:05 . 2008-07-06 05:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-01-11 07:05 . 2008-07-06 07:06 575,488 --a------ c:\windows\system32\xpsshhdr.dll
2009-01-11 07:05 . 2008-07-06 07:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-11 07:05 . 2008-07-06 07:06 117,760 --a------ c:\windows\system32\prntvpt.dll
2009-01-11 07:05 . 2008-07-06 07:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-11 07:00 . 2009-01-11 07:00 <DIR> d-------- c:\program files\MSXML 6.0
2009-01-11 06:56 . 2009-01-11 06:56 <DIR> d-------- c:\program files\Wizards of the Coast

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 19:10 --------- d-----w c:\documents and settings\LocalService\Application Data\WTablet
2009-02-07 19:08 --------- d-----w c:\documents and settings\Aaron\Application Data\Skype
2009-02-07 19:05 --------- d-----w c:\documents and settings\Aaron\Application Data\OpenOffice.org2
2009-02-07 19:04 --------- d-----w c:\documents and settings\Aaron\Application Data\WTablet
2009-02-07 18:49 --------- d-----w c:\documents and settings\Andy II\Application Data\WTablet
2009-01-25 18:28 --------- d-----w c:\program files\Lavasoft
2009-01-25 18:28 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-19 21:29 --------- d-----w c:\program files\AIM6
2009-01-19 21:28 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-01-16 06:47 --------- d-----w c:\documents and settings\Aaron\Application Data\BitTorrent
2009-01-15 08:01 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-01-06 07:22 --------- d-----w c:\program files\Common Files\DirectX
2008-12-30 08:38 --------- d-----w c:\program files\Common Files\Blizzard Entertainment
2008-12-12 17:27 3,067,392 ----a-w c:\windows\system32\dllcache\mshtml.dll
2008-12-12 08:13 --------- d-----w c:\program files\Common Files\Software Update Utility
2008-12-12 08:13 --------- d-----w c:\documents and settings\All Users\Application Data\AIM Toolbar
2008-12-12 08:13 --------- d-----w c:\documents and settings\All Users\Application Data\acccore
2008-12-12 07:59 --------- d-----w c:\documents and settings\All Users\Application Data\AOL Downloads
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 11:57 333,184 ------w c:\windows\system32\dllcache\srv.sys
2007-01-20 00:36 88 --sh--r c:\windows\system32\4032A62C6F.sys
2007-01-20 00:36 2,516 -csha-w c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-02-05_21.10.42.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-02-07 19:10:56 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_188.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-08-15 13570048]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 52840]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-02-20 185896]
"PHIME2002ASync"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"PHIME2002A"="c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-04 455168]
"MSPY2002"="c:\windows\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 59392]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"IMJPMIG8.1"="c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-04 208952]
"DMXLauncher"="c:\program files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 94208]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 517768]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2006-12-10 49152]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-10-26 136600]
"EPSON Stylus CX4800 Series"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-02 98304]
"EPSON Stylus CX4800 Series (Copy 1)"="c:\windows\System32\spool\DRIVERS\W32X86\3\E_FATIADA.EXE" [2005-02-02 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-08-15 86016]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-02-08 509784]
"SigmatelSysTrayApp"="stsystra.exe" [2006-08-15 c:\windows\stsystra.exe]
"nwiz"="nwiz.exe" [2008-08-15 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]

c:\documents and settings\Andy II\Start Menu\Programs\Startup\
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2007-12-07 101440]
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\documents and settings\Aaron\Start Menu\Programs\Startup\
Adobe Gamma.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 113664]
OpenOffice.org 2.3.lnk - c:\program files\OpenOffice.org 2.3\program\quickstart.exe [2007-08-17 393216]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 29696]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-01-02 210520]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"AOL ACS"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\PlayOnline\\SquareEnix\\PlayOnlineViewer\\pol.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-01-25 64160]
R2 Dynex DX-WGPUSB WLService;Dynex Wireless G Enhanced Adapter Service;c:\program files\Dynex Wireless G Enhanced Adapter\WLService.exe [2008-05-12 49152]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 950096]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-02-15 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2007-04-06 106808]
S3 padenum;Enumerador de dispositivos de NTPAD;c:\windows\system32\DRIVERS\padenum.sys --> c:\windows\system32\DRIVERS\padenum.sys [?]
S3 VendorJoystickEnabler;Driver para joystick paralelo de consola;c:\windows\system32\drivers\ntpad.sys --> c:\windows\system32\drivers\ntpad.sys [?]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2009-02-09 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-02-08 13:31]

2009-02-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]

2009-02-09 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3941659726-3948666053-3483446295-1008.job
- c:\documents and settings\Andy II\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-02-05 21:21]

2009-02-07 c:\windows\Tasks\Norton AntiVirus - Run Full System Scan - Aaron.job
- c:\progra~1\NORTON~1\NORTON~1\Navw32.exe []
.
.
------- Supplementary Scan -------
.
mStart Page = hxxp://www.dell.com
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Andy II\Application Data\Mozilla\Firefox\Profiles\ato97zw1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://slirsredirect.search.aol.com/sli ... ie7&query=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.com
FF - prefs.js: keyword.URL - hxxp://slirsredirect.search.aol.com/sli ... rab&query=
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-09 22:35:43
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-09 22:41:33
ComboFix-quarantined-files.txt 2009-02-10 03:41:29
ComboFix2.txt 2009-02-07 18:16:35
ComboFix3.txt 2009-02-06 02:11:32

Pre-Run: 6,541,099,008 bytes free
Post-Run: 6,531,579,904 bytes free

213 --- E O F --- 2009-01-15 08:01:09

It seems the results from Virus Total were cut off. Can you please copy and paste all of the results from the scanners? Please copy the whole list of scanners and the result of the file.

Upload a File to Virustotal

Please visit Virustotal

• Click the Browse... button
• Navigate to the file c:\windows\system32\xlive\sqmapi.dll
• Click the Open button
• Click the Send button
• Copy and paste the results back here please.

This is exactly what I had you do in the previous post, where you made the CFScript.txt and dragged it onto ComboFix.exe

Run CFScript

Open Notepad and copy/paste the text in the code-box into the notepad window:

Folder::

c:\documents and settings\Aaron\Application Data\BitTorrent

Save it to your desktop as CFScript.txt

Referring to the picture below, drag CFScript.txt into ComboFix.exe

This will let ComboFix run again.
Restart if you have to.
Save the produced logfile to your desktop.

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Malwarebytes' Anti-Malware

Please download Malwarebytes' Anti-Malware and save to your desktop.

• Double-click mbam-setup.exe and follow the prompts to install the program.
• At the end, be sure a checkmark is placed next to:
  
  Update Malwarebytes' Anti-Malware
  Launch Malwarebytes' Anti-Malware
  
• Then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select Perform Full scan, then click Scan.
• When the scan is complete, click OK, then Show Results to view the results.
• Be sure that everything is checked Except for the objects located in C:\System Volume Information, and click Remove Selected.
• When completed, a log will open in Notepad. Please copy and paste the log back into your next reply
  
  Note:
• The log can also be found here:
  C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
• Or via the Logs tab when Malwarebytes' Anti-Malware is started.

Please post the ComboFix log, the Malwarebyte's Anti-Malware log, the Virus Total results, and a new Hijackthis log on your next reply.

.

oh, I see, sorry I only posted the one line permalink

Antivirus Version Last Update Result
a-squared 4.0.0.93 2009.02.10 -
AhnLab-V3 5.0.0.2 2009.02.10 -
AntiVir 7.9.0.76 2009.02.10 -
Authentium 5.1.0.4 2009.02.10 -
Avast 4.8.1335.0 2009.02.09 -
AVG 8.0.0.229 2009.02.10 -
BitDefender 7.2 2009.02.10 -
CAT-QuickHeal 10.00 2009.02.10 -
ClamAV 0.94.1 2009.02.10 -
Comodo 973 2009.02.10 -
DrWeb 4.44.0.09170 2009.02.10 -
eSafe 7.0.17.0 2009.02.09 -
eTrust-Vet 31.6.6348 2009.02.10 -
F-Prot 4.4.4.56 2009.02.10 -
F-Secure 8.0.14470.0 2009.02.10 -
Fortinet 3.117.0.0 2009.02.10 -
GData 19 2009.02.10 -
Ikarus T3.1.1.45.0 2009.02.10 -
K7AntiVirus 7.10.626 2009.02.10 -
Kaspersky 7.0.0.125 2009.02.10 -
McAfee 5521 2009.02.10 -
McAfee+Artemis 5521 2009.02.09 -
Microsoft 1.4306 2009.02.10 -
NOD32 3843 2009.02.10 -
Norman 6.00.02 2009.02.09 -
nProtect 2009.1.8.0 2009.02.10 -
Panda 10.0.0.10 2009.02.10 -
PCTools 4.4.2.0 2009.02.10 -
Prevx1 V2 2009.02.10 -
Rising 21.16.12.00 2009.02.10 -
SecureWeb-Gateway 6.7.6 2009.02.10 -
Sophos 4.38.0 2009.02.10 -
Sunbelt 3.2.1847.2 2009.02.07 -
Symantec 10 2009.02.10 -
TheHacker 6.3.1.5.250 2009.02.09 -
TrendMicro 8.700.0.1004 2009.02.10 -
VBA32 3.12.8.12 2009.02.10 -
ViRobot 2009.2.10.1599 2009.02.10 -
VirusBuster 4.5.11.0 2009.02.10 -
Additional information
Tamano archivo: 134144 bytes
MD5...: 5eb87ba0b93ca7e894fc8002e3ce4c2a
SHA1..: 0775542b53804e31f3cd8c66b3d11b0b29fe2416
SHA256: 3736fa95578d4833cdc2bdee10cbbeac6b4d4a8e3d89e50e8723bba312ffe4f5
SHA512: fb7461887e6d86fd9eb224448bcecdc7b6be25567b71921f9bdc4e1b91d26474
6b8c028c06b77716acf4ceb77f0d04296376e7fd386c6b6e7ae2835f19fc6e17
ssdeep: 3072:kochw/MFWrJjKOMxRSepuBaqn/NlnBh2Lx0JVzx1wWobn1ek8F7HncO5hK9
YSHl3:dDFB47UhXBh2yJ5HcOSSSHZ
PEiD..: -
TrID..: File type identification
Win64 Executable Generic (59.6%)
Win32 Executable MS Visual C++ (generic) (26.2%)
Win32 Executable Generic (5.9%)
Win32 Dynamic Link Library (generic) (5.2%)
Generic Win/DOS Executable (1.3%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1ba2
timedatestamp.....: 0x4549bdf0 (Thu Nov 02 09:44:16 2006)
machinetype.......: 0x14c (I386)

( 4 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x1e3af 0x1e400 6.58 8f40ce369397a6833691b25e66b48090
.data 0x20000 0x580 0x600 1.31 475ddab5197055620df7728613f186c5
.rsrc 0x21000 0x400 0x400 3.37 afaad5092b84520cc14bb53355d72617
.reloc 0x22000 0x1808 0x1a00 6.58 665377577153f3901d6f155d8b40b142

( 4 imports )
> msvcrt.dll: _onexit, _lock, __dllonexit, _unlock, __1type_info@@UAE@XZ, _adjust_fdiv, _amsg_exit, _initterm, _XcptFilter, _callnewh, malloc, __0exception@@QAE@ABV0@@Z, __1exception@@UAE@XZ, _what@exception@@UBEPBDXZ, __0exception@@QAE@XZ, _CxxThrowException, _purecall, ceil, realloc, free, memmove, towupper, memset, _vsnprintf, wcschr, _vsnwprintf, __CxxFrameHandler, memcpy
> ADVAPI32.dll: RegOpenKeyExA, RegQueryValueExA, ImpersonateLoggedOnUser, RevertToSelf, GetSecurityDescriptorDacl, GetSecurityDescriptorOwner, SetNamedSecurityInfoW, OpenProcessToken, ConvertSidToStringSidW, GetTokenInformation, RegQueryInfoKeyW, RegEnumValueW, RegDeleteValueW, RegCreateKeyExW, RegSetValueExW, RegOpenKeyExW, RegQueryValueExW, RegCloseKey, ConvertStringSecurityDescriptorToSecurityDescriptorW, UnregisterTraceGuids, RegisterTraceGuidsW, GetTraceLoggerHandle, GetTraceEnableLevel, GetTraceEnableFlags, TraceEvent
> USER32.dll: PeekMessageW, GetSystemMetrics, TranslateMessage, DispatchMessageW, MsgWaitForMultipleObjects
> KERNEL32.dll: SetUnhandledExceptionFilter, UnhandledExceptionFilter, TerminateProcess, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, RtlUnwind, InterlockedExchange, OpenMutexW, CreateMutexW, ReleaseMutex, GetThreadPriority, SetThreadPriority, FileTimeToSystemTime, GetSystemTimeAsFileTime, FileTimeToDosDateTime, GetTempFileNameW, Sleep, GlobalFree, WaitForMultipleObjects, GetTempPathW, GetLongPathNameW, GetVersionExW, WideCharToMultiByte, CreateDirectoryW, GetFileAttributesW, GetFileSizeEx, SetFilePointerEx, lstrlenW, GetThreadLocale, GetModuleHandleA, OpenEventA, GetVersionExA, SetErrorMode, DelayLoadFailureHook, GetCurrentThread, WaitForSingleObject, InterlockedDecrement, OpenFileMappingW, VirtualFree, WriteFile, InterlockedIncrement, ResetEvent, CreateThread, FreeLibraryAndExitThread, CreateEventW, GetFileSize, ReadFile, DuplicateHandle, SetEvent, RaiseException, GetFileAttributesExW, CompareFileTime, DeleteFileW, FindFirstFileW, FindNextFileW, FindClose, GetCurrentProcess, GetTickCount, GetModuleFileNameW, InitializeCriticalSectionAndSpinCount, LocalFree, LocalAlloc, FreeLibrary, GetProcAddress, LoadLibraryW, DisableThreadLibraryCalls, InterlockedCompareExchange, LoadLibraryA, CompareStringW, VirtualAlloc, SetLastError, GetLastError, LeaveCriticalSection, EnterCriticalSection, CloseHandle, UnmapViewOfFile, SystemTimeToFileTime, GetSystemTime, MapViewOfFile, CreateFileMappingW, CreateFileW, DeleteCriticalSection

( 45 exports )
SqmAddToAverage, SqmAddToStream, SqmAddToStreamDWord, SqmAddToStreamString, SqmAddToStreamV, SqmCleanup, SqmClearFlags, SqmCreateNewId, SqmEndSession, SqmFlushSession, SqmGetEnabled, SqmGetFlags, SqmGetMachineId, SqmGetSession, SqmGetSessionStartTime, SqmGetUserId, SqmIncrement, SqmIsWindowsOptedIn, SqmReadSharedMachineId, SqmReadSharedUserId, SqmSet, SqmSetAppId, SqmSetAppVersion, SqmSetBits, SqmSetBool, SqmSetCurrentTimeAsUploadTime, SqmSetEnabled, SqmSetFlags, SqmSetIfMax, SqmSetIfMin, SqmSetMachineId, SqmSetString, SqmSetUserId, SqmStartSession, SqmStartUpload, SqmSysprepGeneralize, SqmSysprepSpecialize, SqmTimerAccumulate, SqmTimerAddToAverage, SqmTimerRecord, SqmTimerStart, SqmUnattendedSetup, SqmWaitForUploadComplete, SqmWriteSharedMachineId, SqmWriteSharedUserId

Did you make the CFScript.txt and run it with combofix? Did you run Malwarebyte's Anti-Malware?

Malwarebytes' Anti-Malware 1.34
Database version: 1749
Windows 5.1.2600 Service Pack 2

2/13/2009 7:25:48 PM
mbam-log-2009-02-13 (19-25-48).txt

Scan type: Full Scan (C:\|)
Objects scanned: 323551
Time elapsed: 1 hour(s), 59 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 88

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\bho_cpv.workhorse (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_cpv.workhorse.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\solution.solution (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\solution.solution.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{892b2785-b0d0-4aa2-ae6a-0ed60b00a979} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{00476c87-a276-49bf-86bc-ff005732430b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{e81cf86b-f683-422a-b742-3f2427ea9d6a} (Trojan.BHO) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Qoobox\Quarantine\C\Documents and Settings\Andy II\Application Data\cogad\cogad.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Documents and Settings\Andy II\Application Data\Twain\Twain.exe.vir (Adware.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\GetModule\GetModule36.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\VnrPack\VnrPack23.exe.vir (Adware.ISM) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\Program Files\WebShow\WebShow.dll.vir (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Kvadulazexizuxaw.dll.vir (Adware.BHO) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\amwoctvo.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\cbXOIxyW.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\chert5-998.exe.vir (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\cymouw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\digeste.dll.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\snqmbg.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\srgywhqu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\srpfwema.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\tqmsmekr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\urqQjkkL.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\vshdndku.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\fypoopjl.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\geBrpnLd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ipgwvsff.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ismjlkar.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jkkHYOHB.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\jwgcfdwp.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\kswejq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\lfuhvq.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ltjetpli.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\mvxmny.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\opnopOHA.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wjowpc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wnlfxpjw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\wvUkLdCt.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\xfxglpay.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\xxkchcpy.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\xxsnrr.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\yjvotgod.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\prunnet.exe.vir (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qkmpmtxd.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qmhpbk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qordna.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\rkbkkh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\eaksgbfb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ltjgar.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\pmnkJyxx.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP607\A0106916.exe (Trojan.Waledac) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP607\A0106918.dll (Trojan.Downloader) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108853.exe (Adware.ISM) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108854.exe (Trojan.Agent) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108855.dll (Trojan.Downloader) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108856.exe (Trojan.Downloader) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108858.exe (Adware.Agent) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108861.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108863.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108864.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108865.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108866.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108868.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108869.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108870.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108871.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108872.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108873.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108876.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108878.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108879.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108880.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108881.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108883.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108884.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108886.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108887.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108888.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108889.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108890.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108891.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108892.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108893.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108894.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108895.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108897.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108849.exe (Trojan.Agent) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108867.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP608\A0108885.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP609\A0109112.exe (Trojan.Agent) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP609\A0109117.dll (Trojan.BHO) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP609\A0109119.dll (Adware.BHO) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP609\A0109121.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP609\A0109126.dll (Trojan.Vundo) -> Not selected for removal.
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP609\A0109132.dll (Trojan.Vundo) -> Not selected for removal.