Hi Bjorn
Attached is my combofix and hijackthis log.
ComboFix 09-01-10.02 - Dolphin 2009-01-10 22:45:01.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.76 [GMT -4:00]
Running from: c:\documents and settings\Dolphin\Desktop\combofix.exe
Command switches used :: c:\documents and settings\Dolphin\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
FILE ::
c:\windows\SYSTEM32\frbmqhkm.ini
c:\windows\SYSTEM32\gxielfli.ini
c:\windows\SYSTEM32\hwplfhtg.exe
c:\windows\SYSTEM32\uhpgcagp.exe
c:\windows\SYSTEM32\xpjpxboq.ini
c:\windows\SYSTEM32\yshfvxvr.ini
c:\windows\Tasks\zwofrism.job
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\program files\Spyware Guard 2009
c:\windows\SYSTEM32\frbmqhkm.ini
c:\windows\SYSTEM32\gxielfli.ini
c:\windows\system32\mfcans32.DLL
c:\windows\system32\mfcuia32.dll
c:\windows\system32\msrdo20.dll
c:\windows\system32\rdocurs.dll
c:\windows\SYSTEM32\uhpgcagp.exe
c:\windows\SYSTEM32\xpjpxboq.ini
c:\windows\SYSTEM32\yshfvxvr.ini
c:\windows\Tasks\zwofrism.job
.
((((((((((((((((((((((((( Files Created from 2008-12-11 to 2009-01-11 )))))))))))))))))))))))))))))))
.
2009-01-10 03:01 . 2009-01-10 03:24 <DIR> d--h----- C:\$AVG8.VAULT$
2009-01-10 02:04 . 2009-01-10 02:06 <DIR> d-------- c:\windows\SYSTEM32\DRIVERS\Avg
2009-01-10 02:04 . 2009-01-10 02:04 97,928 --a------ c:\windows\SYSTEM32\DRIVERS\avgldx86.sys
2009-01-10 02:04 . 2009-01-10 02:04 10,520 --a------ c:\windows\SYSTEM32\avgrsstx.dll
2009-01-10 01:57 . 2009-01-10 02:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg8
2009-01-10 01:22 . 2009-01-10 01:24 <DIR> d-------- C:\ab
2009-01-08 00:42 . 2004-06-03 23:14 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Symantec
2009-01-08 00:42 . 2004-06-03 23:13 <DIR> d-------- c:\documents and settings\Administrator\Application Data\Jasc Software Inc
2009-01-08 00:42 . 2009-01-10 02:04 <DIR> d-------- c:\documents and settings\Administrator
2009-01-06 01:15 . 2009-01-06 01:15 <DIR> d-------- C:\VundoFix Backups
2009-01-05 22:43 . 2009-01-05 22:43 <DIR> d-------- c:\program files\CCleaner
2009-01-05 20:59 . 2009-01-05 20:59 <DIR> d-------- c:\program files\Trend Micro
2009-01-05 09:31 . 2009-01-05 20:40 <DIR> d-------- c:\documents and settings\Dolphin\Application Data\McAfee
2009-01-05 00:12 . 2009-01-05 23:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\McAfee
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-06 04:31 --------- d-----w c:\program files\Common Files\Real
2009-01-06 04:27 --------- d-----w c:\program files\PokerStars
2009-01-06 04:25 --------- d-----w c:\program files\Java
2009-01-06 04:24 --------- d-----w c:\program files\Google
2008-12-12 17:01 3,067,904 ------w c:\windows\SYSTEM32\DLLCACHE\mshtml.dll
2008-11-24 03:03 --------- d-----w c:\program files\Linksys
2008-10-24 11:21 455,296 ------w c:\windows\SYSTEM32\DLLCACHE\mrxsmb.sys
2008-10-23 12:36 286,720 ----a-w c:\windows\SYSTEM32\gdi32.dll
2008-10-23 12:36 286,720 ------w c:\windows\SYSTEM32\DLLCACHE\gdi32.dll
2008-10-16 18:13 202,776 ----a-w c:\windows\SYSTEM32\wuweb.dll
2008-10-16 18:13 202,776 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuweb.dll
2008-10-16 18:13 1,809,944 ----a-w c:\windows\SYSTEM32\wuaueng.dll
2008-10-16 18:13 1,809,944 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuaueng.dll
2008-10-16 18:12 561,688 ----a-w c:\windows\SYSTEM32\wuapi.dll
2008-10-16 18:12 561,688 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuapi.dll
2008-10-16 18:12 323,608 ----a-w c:\windows\SYSTEM32\wucltui.dll
2008-10-16 18:12 323,608 ----a-w c:\windows\SYSTEM32\DLLCACHE\wucltui.dll
2008-10-16 18:09 92,696 ----a-w c:\windows\SYSTEM32\DLLCACHE\cdm.dll
2008-10-16 18:09 92,696 ----a-w c:\windows\SYSTEM32\cdm.dll
2008-10-16 18:09 51,224 ----a-w c:\windows\SYSTEM32\wuauclt.exe
2008-10-16 18:09 51,224 ----a-w c:\windows\SYSTEM32\DLLCACHE\wuauclt.exe
2008-10-16 18:09 43,544 ----a-w c:\windows\SYSTEM32\wups2.dll
2008-10-16 18:08 34,328 ----a-w c:\windows\SYSTEM32\wups.dll
2008-10-16 18:08 34,328 ----a-w c:\windows\SYSTEM32\DLLCACHE\wups.dll
2008-10-16 01:00 666,112 ----a-w c:\windows\SYSTEM32\wininet.dll
2008-10-16 01:00 666,112 ------w c:\windows\SYSTEM32\DLLCACHE\wininet.dll
2008-10-16 01:00 619,520 ------w c:\windows\SYSTEM32\DLLCACHE\urlmon.dll
2008-10-16 01:00 1,499,136 ------w c:\windows\SYSTEM32\DLLCACHE\shdocvw.dll
2008-10-15 16:34 337,408 ------w c:\windows\SYSTEM32\DLLCACHE\netapi32.dll
2004-06-27 03:19 57,465 ----a-w c:\program files\mozilla firefox\components\inspector.dll
.
((((((((((((((((((((((((((((( snapshot@2009-01-10_ 0.55.47.01 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-01-06 03:47:57 26,824 ----a-w c:\windows\SYSTEM32\DRIVERS\avgmfx86.sys
+ 2009-01-10 06:04:23 26,824 ----a-w c:\windows\SYSTEM32\DRIVERS\avgmfx86.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IntelMeM"="c:\program files\Intel\Modem Event Monitor\IntelMEM.exe" [2003-09-03 221184]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-01-10 1261336]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\StarNet\\X-Win32 6.0\\xwin32.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"c:\\Program Files\\MSN Messenger\\livecall.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\SYSTEM32\DRIVERS\avgldx86.sys [2009-01-10 97928]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-01-10 231704]
S3 USBFVNETA;Wireless USB Network Adapter;c:\windows\SYSTEM32\DRIVERS\vnetusba.sys [2001-12-03 69504]
S4 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [2008-01-15 204800]
.
.
------- Supplementary Scan -------
.
uStart Page = about:blank
uSearchMigratedDefaultURL =
hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mWindow Title = Windows Internet Explorer provided by Comcast
uSearchURL,(Default) =
hxxp://www.google.com/search?q=%s
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O16 -: Microsoft XML Parser for Java -
file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
FF - ProfilePath - c:\documents and settings\Dolphin\Application Data\Mozilla\Firefox\Profiles\default.9nb\
FF - prefs.js: browser.search.defaulturl -
hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=FF - prefs.js: browser.search.selectedEngine - Wikipedia (Eng)
FF - prefs.js: browser.startup.homepage - about:blank
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\QuickTime\Plugins\npqtplugin8.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-01-10 22:47:16
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(636)
c:\windows\system32\avgrsstx.dll
- - - - - - - > 'lsass.exe'(744)
c:\windows\system32\avgrsstx.dll
.
Completion time: 2009-01-10 22:50:19
ComboFix-quarantined-files.txt 2009-01-11 02:49:24
ComboFix2.txt 2009-01-10 05:00:14
Pre-Run: 15,563,579,392 bytes free
Post-Run: 15,640,399,872 bytes free
155 --- E O F --- 2008-12-19 07:01:23
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:53:40 PM, on 1/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [IntelMeM] C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Linksys Updater (LinksysUpdater) - Unknown owner - C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\MATLAB6p5\webserver\bin\win32\matlabserver.exe
O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\Program Files\McAfee\VirusScan\McShield.exe (file missing)
O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
--
End of file - 3301 bytes