Okay, before I post my logs I ran MalwareBytes AntiMalware and it found a bunch of stuff. I had them removed and my computer was fixed. Fast forward one day and all the problems were back, so I obviously didn't remove the root cause of the problem. Here we go:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:28:24 PM, on 4/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Client\svchost32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\lcss.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Administrator\Desktop\dss.exe
c:\delextra.exe
C:\DOCUME~1\ADMINI~1\desktop\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\Client\svchost32.exe,
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Nick Aracde Toolbar - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - C:\PROGRA~1\NICKAR~1\NICKAR~1.DLL
O2 - BHO: (no name) - {6AC0E951-26FE-49CC-877E-C87BCE3CD298} - C:\WINDOWS\system32\ssttu.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: {0c54e61c-141e-1e0a-37a4-562bf402d6ee} - {ee6d204f-b265-4a73-a0e1-e141c16e45c0} - C:\WINDOWS\system32\yalbnrju.dll (file missing)
O2 - BHO: BrowsingProgram - {F8EACE56-0AF4-3AE3-6EF8-F8CC39675729} - C:\Program Files\BrowsingProgram\BrowsingProgram-2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Nick Aracde Toolbar - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - C:\PROGRA~1\NICKAR~1\NICKAR~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [BM77c85174] Rundll32.exe "C:\WINDOWS\system32\didhfexg.dll",s
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [imjpmig] C:\IME\IMJP\imjpmig.exe /RemAdvDef /AIMEREG /Migration /SetPreload
O4 - HKLM\..\Run: [74fb62e8] rundll32.exe "C:\WINDOWS\system32\__c009E3.dat",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKLM\..\Run: [440F] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\440F.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [A00F1DB2B8.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_A00F1DB2B8.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe
O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Administrator\cftmon.exe
O4 - HKCU\..\Run: [WintelUpdate] C:\WINDOWS\TEMP\EA0.tmp.exe
O4 - HKCU\..\Run: [kavir] C:\WINDOWS\kavir.exe
O4 - HKUS\S-1-5-18\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [autoload] C:\Documents and Settings\LocalService\cftmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PanasonicX800PCSoftwareSuite Detect.lnk = ?
O4 - Global Startup: PanasonicX800PCSoftwareSuite TS.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Administrator\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab
O20 - Winlogon Notify: __c0088D36 - C:\WINDOWS\system32\__c0088D36.dat
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: jqvm465hmygebkpp6 - Unknown owner - C:\WINDOWS\system32\lcss.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe (file missing)
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

--
End of file - 11234 bytes
====================================================

Malwarebytes' Anti-Malware 1.11
Database version: 688

Scan type: Full Scan (C:\|)
Objects scanned: 202853
Time elapsed: 1 hour(s), 38 minute(s), 36 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 2
Registry Keys Infected: 39
Registry Values Infected: 6
Registry Data Items Infected: 1
Folders Infected: 4
Files Infected: 65

Memory Processes Infected:
C:\WINDOWS\system32\Client\svchost32.exe (Trojan.Agent) -> No action taken.

Memory Modules Infected:
C:\WINDOWS\system32\__c0088D36.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\basefif32.dll (Trojan.Downloader) -> No action taken.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{04a38f6b-006f-4247-ba4c-02a139d5531c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{3c2d2a1e-031f-4397-9614-87c932a848e0} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> No action taken.
HKEY_CLASSES_ROOT\minibugtransporter.minibugtransporterx.1 (Adware.Minibug) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{28abc5c0-4fcb-11cf-aax5-81cx1c635612} (Trojan.Agent) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{84da4fdf-a1cf-4195-8688-3e961f505983} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\iot85 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\iot85 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\iot85 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\iot85 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\pwd63 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\pwd63 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\pwd63 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\pwd63 (Trojan.Downloader) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\playmp3 (Adware.PlayMP3Z) -> No action taken.
HKEY_CLASSES_ROOT\AppID\seekmotoolbar.seekmotoolband.1 (Adware.Seekmo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\__c0088d36 (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> No action taken.
HKEY_CURRENT_USER\Software\Mirar (AdWare.Mirar) -> No action taken.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> No action taken.
HKEY_CURRENT_USER\Software\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> No action taken.
HKEY_CURRENT_USER\Software\Trymedia Systems (Adware.Trymedia) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\jkwslist (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\aldd (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
HKEY_CLASSES_ROOT\MIME\Database\Content Type\application/x-f3embed (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\FocusInteractive (Adware.MyWebSearch) -> No action taken.

Registry Values Infected:
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\kavir (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM77c85174 (Trojan.Agent) -> No action taken.
HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload (Trojan.Agent) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.Agent) -> Data: c:\windows\system32\client\svchost32.exe -> No action taken.

Folders Infected:
C:\Program Files\LiveAntispy (Rogue.LiveAntispy) -> No action taken.
C:\Program Files\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\PlayMP3z (Adware.PlayMP3Z) -> No action taken.

Files Infected:
C:\Program Files\Common Files\Real\WeatherBug\MiniBugTransporter.dll (Adware.Minibug) -> No action taken.
C:\Deckard\System Scanner\20080426222541\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\GLK3C.tmp (Rogue.EvidenceEliminator) -> No action taken.
C:\Deckard\System Scanner\20080426222541\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tem72.tmp.exe (Adware.Agent) -> No action taken.
C:\Deckard\System Scanner\20080426222541\backup\DOCUME~1\ADMINI~1\LOCALS~1\Temp\tem7A.tmp.exe (Adware.SaveNow) -> No action taken.
C:\Deckard\System Scanner\20080426222541\backup\WINDOWS\temp\EA0.tmp (Trojan.Downloader) -> No action taken.
C:\Deckard\System Scanner\20080426222541\backup\WINDOWS\temp\F0D.tmp (Trojan.Downloader) -> No action taken.
C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\Internet Explorer\msimg32.dll (Adware.MyWebSearch) -> No action taken.
C:\Program Files\Mozilla Firefox\regxpcom.exe (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\MSN Messenger\msimg32.dll (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MSN Messenger\riched20.dll (Adware.MyWeb.FunWeb) -> No action taken.
C:\Program Files\PlayMP3z\PlayMP3.exe (Adware.Agent) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0583126.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0583130.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0583135.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0584130.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0584136.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0584175.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0584180.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0585175.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0585180.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0586175.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0586180.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0587175.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0587180.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0587190.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0587194.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0588190.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0588195.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0589204.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1262\A0589226.dll (Trojan.DownLoader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1263\A0589279.sys (Trojan.Downloader) -> No action taken.
C:\System Volume Information\_restore{A9FABAE9-01FC-46AD-AF85-81C503733A71}\RP1263\A0589280.dll (Trojan.DownLoader) -> No action taken.
C:\WINDOWS\system32\drivers\Hot52.sys (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\drivers\Iot85.sys (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\drivers\Pwd63.sys (Trojan.Downloader) -> No action taken.
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> No action taken.
C:\Program Files\PlayMP3z\uninstall.exe (Adware.PlayMP3Z) -> No action taken.
C:\WINDOWS\system32\Client\svchost32.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\config\systemprofile\cftmon.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\nivavir.config (Trojan.Agent) -> No action taken.
C:\WINDOWS\kavir.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Administrator\cftmon.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c0050CF9.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c007B640.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c007ED11.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c0088D36.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c00A0CD2.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c00ACB87.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c00D2C94.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c00F6779.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\__c00F8BDA.dat (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\coco.exe.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\baseubtbn32.dll (Trojan.Agent) -> No action taken.
C:\sysr.exe (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\basefif32.dll (Trojan.Downloader) -> No action taken.
C:\WINDOWS\system32\__c0060655.exe (Trojan.Vundo) -> No action taken.
C:\WINDOWS\system32\__c008101A.exe (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\LocalService\cftmon.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Guest.THESMACHINE\cftmon.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Guest.THESMACHINE\Local Settings\Temp\cd133.tmp (Heuristics.Malware) -> No action taken.

Hello Saruto

Welcome to Demon Cleaning.

Before we start fixing anything you should print out these instructions or copy them to a NotePad file so they will be accessible. Some steps will require you to disconnect from the Internet or use Safe Mode and you will not have access to this page.

1. Please download SDFix by AndyManchesta and save it to your desktop.
When using this tool, you must use the Administrator's account or an account with "Administrative rights"

• Double click SDFix.exe and it will extract the files to %systemdrive%
• (this is the drive that contains the Windows Directory, typically C:\SDFix).
• DO NOT use it just yet.

Reboot your computer in "Safe Mode" using the F8 method. To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly. A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".

Open the SDFix folder and double click RunThis.bat to start the script.

• Type Y to begin the cleanup process.
• It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts, the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
• Copy and paste the contents of the results file Report.txt in your next reply along with a new HijackThis log.

-- If this error message is displayed when running SDFix: "The command prompt has been disabled by your administrator. Press any key to continue..."
Please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\swreg IMPORT %systemdrive%\SDFix\apps\Enable_Command_Prompt.reg
Press Ok and then run SDFix again.

-- If the Command Prompt window flashes on then off again on XP or Win 2000, please go to Start Menu > Run > and copy/paste the following line:
%systemdrive%\SDFix\apps\FixPath.exe /Q
Reboot and then run SDFix again.

-- If SDFix still does not run, check the %comspec% variable. Right-click My Computer > click Properties > Advanced > Environment Variables and check that the ComSpec variable points to cmd.exe.
%SystemRoot%\system32\cmd.exe

2. Please download ComboFix from Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
For more information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

1. Please, never rename Combofix unless instructed.
2. Close any open browsers.
3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
   -----------------------------------------------------------
   • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
   • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
     
     -----------------------------------------------------------
   • Close any open browsers.
   • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
   • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
   • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
   -----------------------------------------------------------
4. Double click on combofix.exe & follow the prompts.
5. When finished, it will produce a report for you.
6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

You may run one and then post the reply and then run the second tool.

Kyuss

Thanks for ther eply Kyuss here's the results of SDFix and the HJT log:

Report.txt:


SDFix: Version 1.175
Run by Administrator on Mon 04/28/2008 at 03:01 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
DJP38

Path :

DJP38 - Deleted

Killing PID 1948 'svchost32.exe'
Killing PID 1948 'svchost32.exe'
Killing PID 824 'svchost32.exe'
Killing PID 1948 'svchost32.exe'
Killing PID 824 'svchost32.exe'


Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default Schedule Service Path

Rebooting


Checking Files :

Trojan Files Found:

C:\a.bat - Deleted
C:\delextra.exe - Deleted
C:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\sys32.exe - Deleted
C:\WINDOWS\hosts - Deleted
C:\WINDOWS\system32\drivers\hosts - Deleted
C:\WINDOWS\system32\lcss.exe - Deleted
C:\WINDOWS\system32\drivers\DJP38.sys - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1353.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-28 15:24:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7c,6c,5b,e2,8f,3e,fb,81,bd,52,1b,bc,4e,25,9f,35,ff,81,2c,86,f1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,88,fe,4c,e1,69,43,3d,00,c0,66,fe,b8,ec,25,41,c2,4e,..
"khjeh"=hex:65,da,a8,3f,1b,d3,e4,06,dc,92,1d,5f,84,cc,cc,2b,6c,0e,81,d8,25,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:95,19,59,9c,ca,0c,cc,a7,3e,0c,6d,f0,8f,2f,00,e2,8f,f1,c8,14,0f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:51,93,c1,34,a4,ae,dc,53,b6,90,b3,44,d1,df,12,bc,01,5c,e4,31,38,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7c,6c,5b,e2,8f,3e,fb,81,bd,52,1b,bc,4e,25,9f,35,ff,81,2c,86,f1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,88,fe,4c,e1,69,43,3d,00,c0,66,fe,b8,ec,25,41,c2,4e,..
"khjeh"=hex:65,da,a8,3f,1b,d3,e4,06,dc,92,1d,5f,84,cc,cc,2b,6c,0e,81,d8,25,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:95,19,59,9c,ca,0c,cc,a7,3e,0c,6d,f0,8f,2f,00,e2,8f,f1,c8,14,0f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:51,93,c1,34,a4,ae,dc,53,b6,90,b3,44,d1,df,12,bc,01,5c,e4,31,38,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7c,6c,5b,e2,8f,3e,fb,81,bd,52,1b,bc,4e,25,9f,35,ff,81,2c,86,f1,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,88,fe,4c,e1,69,43,3d,00,c0,66,fe,b8,ec,25,41,c2,4e,..
"khjeh"=hex:65,da,a8,3f,1b,d3,e4,06,dc,92,1d,5f,84,cc,cc,2b,6c,0e,81,d8,25,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:95,19,59,9c,ca,0c,cc,a7,3e,0c,6d,f0,8f,2f,00,e2,8f,f1,c8,14,0f,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:51,93,c1,34,a4,ae,dc,53,b6,90,b3,44,d1,df,12,bc,01,5c,e4,31,38,..
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Eventlog\Application\ESENT]
"EventMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
"CategoryMessageFile"=str(2):"c:\windows\system32\ESENT.dll"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:b0ba1d95
"s2"=dword:3b9cb772
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:7c,6c,5b,e2,8f,3e,fb,81,bd,52,1b,bc,4e,25,9f,35,ff,81,2c,86,f1,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,88,fe,4c,e1,69,43,3d,00,c0,66,fe,b8,ec,25,41,c2,4e,..
"khjeh"=hex:65,da,a8,3f,1b,d3,e4,06,dc,92,1d,5f,84,cc,cc,2b,6c,0e,81,d8,25,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:95,19,59,9c,ca,0c,cc,a7,3e,0c,6d,f0,8f,2f,00,e2,8f,f1,c8,14,0f,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:51,93,c1,34,a4,ae,dc,53,b6,90,b3,44,d1,df,12,bc,01,5c,e4,31,38,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe:*:Enabled:Windows Messenger"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"C:\\Program Files\\Common Files\\AOL\\1129248616\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1129248616\\ee\\aolsoftware.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\1137722718\\ee\\aolsoftware.exe"="C:\\Program Files\\Common Files\\AOL\\1137722718\\ee\\aolsoftware.exe:*:Enabled:AOL Services"
"C:\\Program Files\\Common Files\\AOL\\1137722718\\ee\\aim6.exe"="C:\\Program Files\\Common Files\\AOL\\1137722718\\ee\\aim6.exe:*:Enabled:AIM"
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"="C:\\Program Files\\Google\\Google Talk\\googletalk.exe:*:Enabled:Google Talk"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Stardock Games\\Sins of a Solar Empire Demo\\Sins of a Solar Empire.exe"="C:\\Program Files\\Stardock Games\\Sins of a Solar Empire Demo\\Sins of a Solar Empire.exe:*:Enabled:Sins of a Solar Empire Demo"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"
"C:\\WINDOWS\\kavir.exe"="C:\\WINDOWS\\kavir.exe:*:Enabled:enable"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\AIM\\aim.exe"="C:\\Program Files\\AIM\\aim.exe:*:Enabled:AOL Instant Messenger"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger"
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Fri 13 May 2005 217,073 A.SHR --- "C:\WINDOWS\meta4.exe"
Mon 24 Oct 2005 66,560 A.SHR --- "C:\WINDOWS\MOTA113.exe"
Thu 13 Oct 2005 422,400 A.SHR --- "C:\WINDOWS\x2.64.exe"
Fri 1 Sep 2006 56 ..SHR --- "C:\WINDOWS\system32\15A40FEAB6.sys"
Thu 27 Sep 2007 6,440 ..SH. --- "C:\WINDOWS\system32\abeeg.bak1"
Sun 26 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\system32\cygwin1.dll"
Tue 21 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\system32\cygz.dll"
Sun 23 Sep 2007 6,628 ..SH. --- "C:\WINDOWS\system32\ehhkj.bak1"
Fri 28 Sep 2007 6,610 ..SH. --- "C:\WINDOWS\system32\ehhkj.bak2"
Sun 23 Sep 2007 6,440 ..SH. --- "C:\WINDOWS\system32\ggjlm.bak1"
Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\system32\i420vfw.dll"
Sun 30 Sep 2007 6,440 ..SH. --- "C:\WINDOWS\system32\ihkmp.bak1"
Tue 9 Oct 2007 40,120 ..SH. --- "C:\WINDOWS\system32\ihkmp.bak2"
Fri 1 Sep 2006 11,690 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Tue 16 Oct 2007 49,589 ..SH. --- "C:\WINDOWS\system32\oqstv.tmp"
Mon 24 Sep 2007 6,440 ..SH. --- "C:\WINDOWS\system32\ppqss.bak1"
Wed 26 Sep 2007 6,440 ..SH. --- "C:\WINDOWS\system32\pqstv.bak1"
Mon 24 Sep 2007 6,558 ..SH. --- "C:\WINDOWS\system32\qpqss.bak1"
Tue 25 Sep 2007 6,480 ..SH. --- "C:\WINDOWS\system32\rtutv.bak1"
Thu 27 Apr 2006 2,945,024 A.SHR --- "C:\WINDOWS\system32\Smab.dll"
Mon 1 Oct 2007 23,810 ..SH. --- "C:\WINDOWS\system32\uttss.bak1"
Mon 18 Feb 2008 201,699 ..SH. --- "C:\WINDOWS\system32\uttss.bak2"
Mon 28 Feb 2005 240,128 A.SHR --- "C:\WINDOWS\system32\x.264.exe"
Sun 25 Jan 2004 70,656 A.SHR --- "C:\WINDOWS\system32\yv12vfw.dll"
Wed 28 Mar 2007 24,064 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL0003.tmp"
Thu 29 Mar 2007 26,624 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL0005.tmp"
Thu 29 Mar 2007 29,696 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL1027.tmp"
Thu 29 Mar 2007 29,696 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL1039.tmp"
Thu 29 Mar 2007 27,136 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL1185.tmp"
Thu 29 Mar 2007 27,648 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL1725.tmp"
Thu 29 Mar 2007 28,160 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL1981.tmp"
Fri 1 Dec 2006 27,648 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL2152.tmp"
Sun 3 Jun 2007 1,111,552 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL2356.tmp"
Thu 29 Mar 2007 29,184 ...H. --- "C:\Documents and Settings\Administrator\My Documents\~WRL4026.tmp"
Sat 15 Oct 2005 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Sun 4 Mar 2007 680 A..H. --- "C:\Program Files\InterActual\InterActual Player\iti86D.tmp"
Fri 21 Jan 2005 81,920 ...H. --- "C:\Program Files\Panasonic\Panasonic X800\MCCIUSBUninstall.exe"
Mon 7 Apr 2008 925,696 A..H. --- "C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\ijjistarter2FxB.exe"
Tue 19 Dec 2006 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Mon 15 Oct 2007 58,828 ..SH. --- "C:\Documents and Settings\Guest.THESMACHINE\Local Settings\Temp\srqss.bak1"
Fri 12 Nov 2004 37,376 ...H. --- "C:\Program Files\Common Files\Adobe\ESD\DLMCleanup.exe"
Wed 29 Aug 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\85d72ebd3332986fe72a8378dc1d1a21\BIT4.tmp"
Fri 1 Dec 2006 32,768 ...H. --- "C:\Documents and Settings\Administrator\Application Data\Microsoft\Word\~WRL1616.tmp"
Wed 27 Feb 2008 888 ...HR --- "C:\Documents and Settings\Administrator\Application Data\SecuROM\UserData\securom_v7_01.bak"
Sat 15 Oct 2005 4,348 ...H. --- "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv1key.bak"
Sat 22 Oct 2005 20 A..H. --- "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv1lic.bak"
Sat 15 Oct 2005 400 ...H. --- "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv2key.bak"
Sat 22 Oct 2005 1,536 A..H. --- "C:\Documents and Settings\Administrator\My Documents\My Music\License Backup\drmv2lic.bak"

Finished!

HJT Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:39:30 PM, on 4/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe
C:\Program Files\Veoh Networks\Veoh\VeohClient.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
C:\Program Files\Logitech\SetPoint\KEM.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
C:\Program Files\Panasonic\Panasonic X800 PC Software Suite\connmngmntbox.exe
C:\Program Files\Panasonic\Panasonic X800 PC Software Suite\ectaskscheduler.exe
C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\PANASO~1\PANASO~1\Elogerr.exe
C:\PROGRA~1\PANASO~1\PANASO~1\BROADC~1.EXE
C:\PROGRA~1\PANASO~1\PANASO~1\SCRFS.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\Desktop\virus removal\Administrator.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Nick Aracde Toolbar - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - C:\PROGRA~1\NICKAR~1\NICKAR~1.DLL
O2 - BHO: (no name) - {6AC0E951-26FE-49CC-877E-C87BCE3CD298} - C:\WINDOWS\system32\ssttu.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: {0c54e61c-141e-1e0a-37a4-562bf402d6ee} - {ee6d204f-b265-4a73-a0e1-e141c16e45c0} - C:\WINDOWS\system32\yalbnrju.dll (file missing)
O2 - BHO: BrowsingProgram - {F8EACE56-0AF4-3AE3-6EF8-F8CC39675729} - C:\Program Files\BrowsingProgram\BrowsingProgram-2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Nick Aracde Toolbar - {4E7BD74F-2B8D-469E-9EB4-FE6FA694B13E} - C:\PROGRA~1\NICKAR~1\NICKAR~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O4 - HKLM\..\Run: [Optimum Online] C:\Program Files\Optimum Online\Netsurf.exe -tray
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [imjpmig] C:\IME\IMJP\imjpmig.exe /RemAdvDef /AIMEREG /Migration /SetPreload
O4 - HKLM\..\Run: [74fb62e8] rundll32.exe "C:\WINDOWS\system32\__c009E3.dat",b
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [440F] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\440F.exe
O4 - HKLM\..\Run: [Winjava vil] sys32.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [A00F1DB2B8.exe] C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\_A00F1DB2B8.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [NVIDIA nTune] "C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" clear
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -scheduler
O4 - HKCU\..\Run: [Veoh] "C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: PanasonicX800PCSoftwareSuite Detect.lnk = ?
O4 - Global Startup: PanasonicX800PCSoftwareSuite TS.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Administrator\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.1.2.76.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {C5E28B9D-0A68-4B50-94E9-E8F6B4697519} (NsvPlayX Control) - http://www.nullsoft.com/nsv/embed/nsvplayx_vp6_aac.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CSIScanner - Unknown owner - C:\Program Files\PrevxCSI\\PrevxCSI.exe (file missing)
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: jqvm465hmygebkpp6 - Unknown owner - C:\WINDOWS\system32\lcss.exe (file missing)
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)

--
End of file - 11509 bytes

I'm running ComboFix now.

ComboFix Log:

ComboFix 08-04-27.3 - Administrator 2008-04-28 15:43:36.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.544 [GMT -4:00]
Running from: C:\Documents and Settings\Administrator\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Administrator\Application Data\FunWebProducts
C:\Documents and Settings\Administrator\Application Data\FunWebProducts\Data\Administrator\avatar.dat
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\#SharedObjects\3V5DF8N4\www.broadcaster.com
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Administrator\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Program Files\Seekmo Programs
C:\WINDOWS\7475.exe
C:\WINDOWS\BM77c85174.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\3E900c__.ini
C:\WINDOWS\system32\abeeg.bak1
C:\WINDOWS\system32\abeeg.ini
C:\WINDOWS\system32\acjierjl.ini
C:\WINDOWS\system32\aenmjghe.ini
C:\WINDOWS\system32\aildcafu.ini
C:\WINDOWS\system32\aqnolcwe.ini
C:\WINDOWS\system32\avbsptkr.ini
C:\WINDOWS\system32\avbssggp.ini
C:\WINDOWS\system32\aytcrftx.ini
C:\WINDOWS\system32\bhoyxqyg.ini
C:\WINDOWS\system32\blspuebc.ini
C:\WINDOWS\system32\bmnuxorf.ini
C:\WINDOWS\system32\bwtxyqvl.ini
C:\WINDOWS\system32\cbymeuae.ini
C:\WINDOWS\system32\ccucygtc.ini
C:\WINDOWS\system32\chqunkqi.ini
C:\WINDOWS\system32\cieigfkn.ini
C:\WINDOWS\system32\cjwugdbh.ini
C:\WINDOWS\system32\cksdeqkd.ini
C:\WINDOWS\system32\cmwkfvtl.ini
C:\WINDOWS\system32\dgvsytye.ini
C:\WINDOWS\system32\dtlrfncd.ini
C:\WINDOWS\system32\E6200c__.ini
C:\WINDOWS\system32\eaxxvbqj.ini
C:\WINDOWS\system32\ebvpnxqg.ini
C:\WINDOWS\system32\ehhkj.bak1
C:\WINDOWS\system32\ehhkj.bak2
C:\WINDOWS\system32\ehhkj.ini
C:\WINDOWS\system32\endfabic.ini
C:\WINDOWS\system32\eptiqixd.ini
C:\WINDOWS\system32\eqvahlru.ini
C:\WINDOWS\system32\euyqchdq.ini
C:\WINDOWS\system32\exfnunbn.ini
C:\WINDOWS\system32\exvjhrbm.ini
C:\WINDOWS\system32\faqykopb.ini
C:\WINDOWS\system32\fbdhuqyg.ini
C:\WINDOWS\system32\fjothcqc.ini
C:\WINDOWS\system32\flawrvmq.ini
C:\WINDOWS\system32\flsfroid.ini
C:\WINDOWS\system32\fnvfcfga.ini
C:\WINDOWS\system32\fsuehmwu.ini
C:\WINDOWS\system32\ftxqwkgf.ini
C:\WINDOWS\system32\fwuifykr.ini
C:\WINDOWS\system32\fwxbcgxe.ini
C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\gjobjxxc.ini
C:\WINDOWS\system32\gkehhtoh.ini
C:\WINDOWS\system32\gqgsutdi.ini
C:\WINDOWS\system32\gqnvqmvh.ini
C:\WINDOWS\system32\grnmbglv.ini
C:\WINDOWS\system32\hkeoxjvy.ini
C:\WINDOWS\system32\htlwosey.ini
C:\WINDOWS\system32\hyqyblnq.ini
C:\WINDOWS\system32\iechtrik.ini
C:\WINDOWS\system32\ihkmp.bak1
C:\WINDOWS\system32\ihkmp.bak2
C:\WINDOWS\system32\ihkmp.ini
C:\WINDOWS\system32\jahoajhy.ini
C:\WINDOWS\system32\jbhjcdsg.ini
C:\WINDOWS\system32\jfnekjwk.ini
C:\WINDOWS\system32\jixdgwsc.ini
C:\WINDOWS\system32\jmbdjfum.ini
C:\WINDOWS\system32\jpijqcwn.ini
C:\WINDOWS\system32\jrmyfjsc.ini
C:\WINDOWS\system32\jtcoymvp.ini
C:\WINDOWS\system32\jtjcshfp.ini
C:\WINDOWS\system32\juybkpro.ini
C:\WINDOWS\system32\jxvpwhag.ini
C:\WINDOWS\system32\kkpebsvi.ini
C:\WINDOWS\system32\knmmrxgv.ini
C:\WINDOWS\system32\kucgpecv.ini
C:\WINDOWS\system32\latfkhft.ini
C:\WINDOWS\system32\lbspufbd.ini
C:\WINDOWS\system32\lhslxkxg.ini
C:\WINDOWS\system32\llsobbtc.ini
C:\WINDOWS\system32\lmlajgqk.ini
C:\WINDOWS\system32\lmocrkuw.ini
C:\WINDOWS\system32\mcbglwtd.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mfuuuuqm.ini
C:\WINDOWS\system32\mhlyefau.ini
C:\WINDOWS\system32\moptsfrg.ini
C:\WINDOWS\system32\mpjvpvpm.ini
C:\WINDOWS\system32\mutokyie.ini
C:\WINDOWS\system32\mvcdpvfv.ini
C:\WINDOWS\system32\mxiswxml.ini
C:\WINDOWS\system32\nakagbis.ini
C:\WINDOWS\system32\naskqncu.ini
C:\WINDOWS\system32\nbkkdord.ini
C:\WINDOWS\system32\ndskdxeu.ini
C:\WINDOWS\system32\ntcbkgbf.ini
C:\WINDOWS\system32\nvfbdndg.ini
C:\WINDOWS\system32\nwxrwfam.ini
C:\WINDOWS\system32\nywphcsg.ini
C:\WINDOWS\system32\omlrssio.ini
C:\WINDOWS\system32\oopiiqdo.ini
C:\WINDOWS\system32\oqxpkdix.ini
C:\WINDOWS\system32\osiatonf.ini
C:\WINDOWS\system32\oxodxcfe.ini
C:\WINDOWS\system32\pdiacmlv.ini
C:\WINDOWS\system32\phxuhvjj.ini
C:\WINDOWS\system32\pinthwau.ini
C:\WINDOWS\system32\pmjgnrll.ini
C:\WINDOWS\system32\ppqss.bak1
C:\WINDOWS\system32\ppqss.ini
C:\WINDOWS\system32\pqstv.bak1
C:\WINDOWS\system32\pqstv.ini
C:\WINDOWS\system32\qcdvljfh.ini
C:\WINDOWS\system32\qgnqyons.ini
C:\WINDOWS\system32\qkdcdmla.ini
C:\WINDOWS\system32\qmwukhox.ini
C:\WINDOWS\system32\qpqss.bak1
C:\WINDOWS\system32\qpqss.ini
C:\WINDOWS\system32\qridmwhc.ini
C:\WINDOWS\system32\qtkhkmeg.ini
C:\WINDOWS\system32\qtogrwbe.ini
C:\WINDOWS\system32\rborilwf.ini
C:\WINDOWS\system32\rdiudrhb.ini
C:\WINDOWS\system32\rdodiwcl.ini
C:\WINDOWS\system32\rrtixbus.ini
C:\WINDOWS\system32\rsyhatvy.ini
C:\WINDOWS\system32\rtutv.bak1
C:\WINDOWS\system32\rtutv.ini
C:\WINDOWS\system32\rvvdeojs.ini
C:\WINDOWS\system32\rwntmnvp.ini
C:\WINDOWS\system32\sdocppsh.ini
C:\WINDOWS\system32\sjujwnwp.ini
C:\WINDOWS\system32\sojvpirk.ini
C:\WINDOWS\system32\sorknmfy.ini
C:\WINDOWS\system32\sqjctiud.ini
C:\WINDOWS\system32\stcohjsn.ini
C:\WINDOWS\system32\svsrhhbu.ini
C:\WINDOWS\system32\tdmsiprs.ini
C:\WINDOWS\system32\tstmrgsh.ini
C:\WINDOWS\system32\txpbibkr.ini
C:\WINDOWS\system32\ubhulimc.ini
C:\WINDOWS\system32\ufufkefj.ini
C:\WINDOWS\system32\umtgysoh.ini
C:\WINDOWS\system32\umumeouw.ini
C:\WINDOWS\system32\urcapclv.ini
C:\WINDOWS\system32\uslvwlmv.ini
C:\WINDOWS\system32\uttss.bak1
C:\WINDOWS\system32\uttss.bak2
C:\WINDOWS\system32\uttss.ini
C:\WINDOWS\system32\visoedop.ini
C:\WINDOWS\system32\vjmsmprb.ini
C:\WINDOWS\system32\vttssjxh.ini
C:\WINDOWS\system32\walfqqvx.ini
C:\WINDOWS\system32\wgywniwk.ini
C:\WINDOWS\system32\wkidwcqo.ini
C:\WINDOWS\system32\wlltiuxm.ini
C:\WINDOWS\system32\wtpmasji.ini
C:\WINDOWS\system32\wvkswgby.ini
C:\WINDOWS\system32\xclscibm.ini
C:\WINDOWS\system32\xdfxsucb.ini
C:\WINDOWS\system32\xfsshxxw.ini
C:\WINDOWS\system32\xouqlgnm.ini
C:\WINDOWS\system32\xreacksq.ini
C:\WINDOWS\system32\xskkgrae.ini
C:\WINDOWS\system32\xtwdmkcy.ini
C:\WINDOWS\system32\xykhqfrx.ini
C:\WINDOWS\system32\xyvetdod.ini
C:\WINDOWS\system32\ybxexwgv.ini
C:\WINDOWS\system32\yspuclmt.ini
C:\WINDOWS\system32\ywxblnot.ini
C:\xcrashdump.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_JQVM465HMYGEBKPP6
-------\Legacy_NPF
-------\Legacy_XPROTECTOR
-------\Service_jqvm465hmygebkpp6
-------\Service_XPROTECTOR


((((((((((((((((((((((((( Files Created from 2008-03-28 to 2008-04-28 )))))))))))))))))))))))))))))))
.

2008-04-27 14:12 . 2008-04-27 14:37 33,792 --a------ C:\mnow.exe
2008-04-27 12:47 . 2008-04-28 14:45 17,772 --a------ C:\starts.exe
2008-04-26 22:54 . 2008-04-26 22:54 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-26 22:54 . 2008-04-26 22:54 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-26 22:54 . 2008-04-26 22:54 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-04-26 22:14 . 2008-04-26 22:20 <DIR> d-------- C:\!KillBox
2008-04-26 22:08 . 2008-04-26 22:09 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-04-26 22:08 . 2008-04-26 22:08 10,880 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-04-26 21:51 . 2008-04-26 21:51 <DIR> d-------- C:\Deckard
2008-04-26 20:24 . 2008-04-26 20:24 <DIR> d-------- C:\Documents and Settings\Administrator\.housecall6.6
2008-04-26 18:57 . 2008-04-26 18:57 2,855 --a------ C:\WINDOWS\system32\userinit.PIF
2008-04-26 18:25 . 2008-04-26 18:25 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-26 18:20 . 2008-04-28 15:36 <DIR> d-------- C:\SDFix
2008-04-26 17:53 . 2008-04-27 11:01 10,513 --a------ C:\startup.exe
2008-04-26 16:43 . 2008-04-28 14:48 39,520 --a------ C:\winhost.exe
2008-04-26 11:07 . 2008-04-27 00:34 <DIR> d-------- C:\WINDOWS\system32\Client
2008-04-25 21:38 . 2008-04-25 21:38 <DIR> d-------- C:\Program Files\Common Files\xing shared
2008-04-21 20:30 . 2008-04-21 20:30 <DIR> d-------- C:\Program Files\TotalAudioConverter
2008-04-21 20:30 . 2008-04-21 20:30 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Softplicity
2008-04-21 12:16 . 2008-04-23 02:41 891,256 ---hs---- C:\WINDOWS\system32\ADB8F00c__.ini
2008-04-17 11:10 . 2008-04-17 11:10 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-04-17 08:48 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2008-04-17 08:48 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
2008-04-17 08:48 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2008-04-16 12:24 . 2008-04-16 12:25 <DIR> d-------- C:\Program Files\Windows Live
2008-04-16 12:24 . 2008-04-16 12:24 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-16 12:24 . 2008-04-16 12:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
2008-04-07 01:26 . 2008-04-07 01:26 <DIR> d-------- C:\Program Files\Common Files\INCA Shared
2008-04-07 01:25 . 2008-04-07 01:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\IJJIGame
2008-04-07 01:25 . 2008-04-07 01:25 <DIR> d--h----- C:\Documents and Settings\Administrator\Application Data\ijjigame
2008-04-06 23:46 . 2008-04-07 00:04 652 --a------ C:\WINDOWS\ago.INI
2008-04-06 23:44 . 2008-04-26 18:54 <DIR> d-------- C:\Program Files\Advanced GIF Optimizer
2008-04-06 22:35 . 2008-04-06 22:35 <DIR> d-------- C:\Program Files\Kongsoft
2008-04-06 22:28 . 2008-04-06 22:28 <DIR> d-------- C:\Program Files\AV2MP3
2008-04-06 22:28 . 2005-08-09 05:00 77,824 --a------ C:\WINDOWS\system32\mpfilecom.ax
2008-04-06 17:20 . 2008-04-06 17:20 <DIR> d-------- C:\Documents and Settings\Administrator\fontconfig
2008-04-06 05:29 . 2008-04-06 05:34 <DIR> d-------- C:\Program Files\Free FLV Converter
2008-04-06 05:29 . 2007-06-18 23:22 364,544 --a------ C:\WINDOWS\system32\PropertyGrid.ocx
2008-04-06 05:29 . 2005-10-13 13:42 208,500 --a------ C:\WINDOWS\system32\ReyXpBasics.tlb
2008-04-06 05:29 . 1998-07-12 23:00 141,312 --a------ C:\WINDOWS\system32\MSCMCFR.DLL
2008-04-06 05:29 . 2000-10-01 19:00 119,568 --a------ C:\WINDOWS\system32\VB6FR.DLL
2008-04-06 05:29 . 2004-03-09 00:00 84,512 --a------ C:\WINDOWS\system32\PICCLP32.OCX
2008-04-06 05:29 . 1998-07-12 19:00 32,768 --a------ C:\WINDOWS\system32\CMDLGFR.DLL
2008-04-06 05:29 . 2005-09-28 01:31 24,576 --a------ C:\WINDOWS\system32\ControlSubX.ocx
2008-04-06 05:29 . 1998-07-13 00:00 9,728 --a------ C:\WINDOWS\system32\PCCLPFR.DLL
2008-04-06 03:49 . 2008-04-06 03:49 <DIR> d-------- C:\IME
2008-04-06 01:14 . 2008-04-08 18:35 1,661,952 ---hs---- C:\WINDOWS\system32\42C3500c__.ini
2008-04-06 00:21 . 2008-04-06 00:21 <DIR> d-------- C:\Program Files\KeyHoleTV
2008-03-29 18:01 . 2006-12-24 05:15 27,904 --a------ C:\WINDOWS\system32\drivers\xPADFL02.sys
2008-03-29 18:01 . 2007-06-15 17:09 1,905 --a------ C:\WINDOWS\system32\drivers\xpadps3.inf
2008-03-29 09:30 . 2008-04-05 20:05 1,597,954 ---hs---- C:\WINDOWS\system32\9351F00c__.ini
2008-03-28 07:21 . 2008-03-30 19:35 583 --a------ C:\WINDOWS\kaillera.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-28 18:46 --------- d-----w C:\Program Files\XoftSpySE
2008-04-28 18:43 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Azureus
2008-04-27 23:17 --------- d-----w C:\Program Files\BrowsingProgram
2008-04-27 21:02 --------- d-----w C:\Program Files\Dl_cats
2008-04-27 04:24 --------- d-----w C:\Program Files\mIRC
2008-04-27 02:07 0 ----a-w C:\WINDOWS\system32\drivers\spools.exe.txt
2008-04-26 22:54 --------- d-----w C:\Program Files\CinemaForge
2008-04-26 22:54 --------- d-----w C:\Program Files\BFG
2008-04-26 22:54 --------- d-----w C:\Program Files\BabysittingMania_at
2008-04-26 22:54 --------- d-----w C:\Program Files\Azureus
2008-04-26 22:54 --------- d-----w C:\Program Files\AC3Filter
2008-04-26 01:38 --------- d-----w C:\Program Files\Common Files\Real
2008-04-16 16:25 --------- d-----w C:\Program Files\MSN Messenger
2008-04-13 16:05 10 ----a-w C:\Documents and Settings\All Users\Application Data\mmrpplic.dat
2008-04-11 20:59 --------- d-----w C:\Program Files\LimeWire
2008-04-08 16:40 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-04-06 21:22 --------- d-----w C:\Program Files\SMPlayer
2008-04-01 21:34 --------- d-----w C:\Program Files\StepMania CVS
2008-03-31 15:04 --------- d-----w C:\Program Files\Zoom Player
2008-03-27 03:03 71,576 ----a-w C:\Documents and Settings\Guest.THESMACHINE\Application Data\GDIPFONTCACHEV1.DAT
2008-03-26 22:27 --------- d-----w C:\Documents and Settings\Guest.THESMACHINE\Application Data\IMVU
2008-03-26 04:49 --------- d-----w C:\Documents and Settings\Guest.THESMACHINE\Application Data\acccore
2008-03-25 20:17 --------- d-----w C:\Documents and Settings\Guest.THESMACHINE\Application Data\InstallShield
2008-03-24 18:21 --------- d-----w C:\Program Files\Soulseek-Test
2008-03-21 04:12 --------- d-----w C:\Program Files\lilith
2008-03-19 06:32 --------- d-----w C:\Documents and Settings\LocalService\Application Data\Roxio
2008-03-19 06:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Roxio
2008-03-19 06:19 --------- d-----w C:\Program Files\Mobipocket.com
2008-03-19 06:19 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Research In Motion
2008-03-19 06:07 --------- d-----w C:\Program Files\Plucker
2008-03-19 05:49 --------- d-----w C:\Program Files\GowerPoint.com
2008-03-19 05:41 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Mobipocket
2008-03-19 03:01 71,576 ----a-w C:\Documents and Settings\Administrator\Application Data\GDIPFONTCACHEV1.DAT
2008-03-18 04:00 --------- d-----w C:\Program Files\MSXML 6.0
2008-03-18 01:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Roxio
2008-03-17 22:40 --------- d-----w C:\Program Files\WinAVI MP4 Converter
2008-03-17 22:24 --------- d-----w C:\Program Files\ImTOO
2008-03-17 14:12 --------- d-----w C:\Documents and Settings\Administrator\Application Data\InstallShield
2008-03-17 00:01 --------- d-----w C:\Program Files\Common Files\Sonic Shared
2008-03-17 00:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sonic
2008-03-17 00:00 --------- d-----w C:\Program Files\Roxio
2008-03-17 00:00 --------- d-----w C:\Program Files\Common Files\Roxio Shared
2008-03-16 23:53 --------- d-----w C:\Program Files\Research In Motion
2008-03-16 23:53 --------- d-----w C:\Program Files\Common Files\Research In Motion
2008-03-12 16:40 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Apple Computer
2008-03-12 16:37 --------- d-----w C:\Program Files\QuickTime
2008-03-12 16:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-12 00:22 --------- d-----w C:\Program Files\AIM
2008-03-10 22:41 --------- d-----w C:\Program Files\Mount&Blade
2008-03-09 17:13 --------- d-----w C:\Program Files\iTunes
2008-03-09 17:13 --------- d-----w C:\Program Files\iPod
2008-03-09 17:13 --------- d-----w C:\Program Files\Bonjour
2008-03-09 17:12 --------- d-----w C:\Program Files\Apple Software Update
2008-03-09 17:11 --------- d-----w C:\Program Files\Common Files\Apple
2008-03-09 17:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-03-09 13:58 --------- d-----w C:\Program Files\Winamp
2008-03-06 12:04 --------- d-----w C:\Program Files\Padus
2008-03-06 08:02 --------- d-----w C:\Program Files\Pcsx2
2008-03-05 08:23 --------- d-----w C:\Program Files\psx emulation cheater
2008-03-03 12:31 --------- d-----w C:\Program Files\DAEMON Tools Lite
2008-03-03 09:32 716,272 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2008-03-03 09:32 --------- d-----w C:\Documents and Settings\Administrator\Application Data\DAEMON Tools
2008-03-03 09:27 --------- d-----w C:\Program Files\Common Files\DirectX
2008-03-01 20:27 --------- d-----w C:\Program Files\RealMedia
2008-03-01 20:27 --------- d-----w C:\Program Files\OpenSource Flash Video Splitter
2008-03-01 20:27 --------- d-----w C:\Program Files\DScaler5
2008-03-01 20:27 --------- d-----w C:\Program Files\CD Audio Reader Filter
2008-03-01 20:26 --------- d-----w C:\Program Files\SHOUTcast Source
2008-03-01 20:26 --------- d-----w C:\Program Files\DSP-worx
2008-02-29 04:19 --------- d-----w C:\Program Files\DivX
2008-02-24 20:05 22,328 ----a-w C:\Documents and Settings\Administrator\Application Data\PnkBstrK.sys
2007-02-27 00:44 376,901 ----a-w C:\Program Files\Uninstall My Web Search.dll
2006-09-01 22:24 81,920 ----a-w C:\Documents and Settings\Administrator\Application Data\ezpinst.exe
2006-09-01 22:24 47,360 ----a-w C:\Documents and Settings\Administrator\Application Data\pcouffin.sys
2005-05-13 21:12 217,073 --sha-r C:\WINDOWS\meta4.exe
2005-10-24 15:13 66,560 --sha-r C:\WINDOWS\MOTA113.exe
2005-10-14 01:27 422,400 --sha-r C:\WINDOWS\x2.64.exe
2004-08-04 04:56 4,096 --sha-w C:\WINDOWS\system32\1112.dat
2006-09-02 02:29 56 --sh--r C:\WINDOWS\system32\15A40FEAB6.sys
2005-06-26 19:32 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 02:37 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
2004-01-25 04:00 70,656 --sha-r C:\WINDOWS\system32\i420vfw.dll
2006-09-02 02:29 11,690 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2006-04-27 14:24 2,945,024 --sha-r C:\WINDOWS\system32\Smab.dll
2005-02-28 17:16 240,128 --sha-r C:\WINDOWS\system32\x.264.exe
2004-01-25 04:00 70,656 --sha-r C:\WINDOWS\system32\yv12vfw.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6AC0E951-26FE-49CC-877E-C87BCE3CD298}]
C:\WINDOWS\system32\ssttu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ee6d204f-b265-4a73-a0e1-e141c16e45c0}]
C:\WINDOWS\system32\yalbnrju.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F8EACE56-0AF4-3AE3-6EF8-F8CC39675729}]
2007-12-30 16:48 1019904 --a------ C:\Program Files\BrowsingProgram\BrowsingProgram-2.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 17:22 3739648]
"Aim6"="" []
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-04 14:21 68856]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]
"NVIDIA nTune"="C:\Program Files\NVIDIA Corporation\nTune\nTuneCmd.exe" [2007-09-04 20:25 81920]
"DAEMON Tools Lite"="C:\Program Files\DAEMON Tools Lite\daemon.exe" [2008-02-13 19:09 486856]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" [2006-09-11 04:40 218032]
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" [2008-04-01 18:35 3587120]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Optimum Online"="C:\Program Files\Optimum Online\Netsurf.exe" [2005-09-02 17:43 786432]
"SoundMan"="SOUNDMAN.EXE" [2004-11-15 06:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43 83608]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2004-06-08 12:31 29696 C:\WINDOWS\KHALMNPR.Exe]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 17:48 479232]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-09-11 04:40 218032]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 04:40 86960]
"DLCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll" [2005-09-08 14:55 73728]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-19 14:26 7700480]
"nwiz"="nwiz.exe" [2007-04-19 14:26 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-19 14:26 86016]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-08-16 08:56 236016]
"imjpmig"="C:\IME\IMJP\imjpmig.exe" [2001-02-20 10:54 192592]
"74fb62e8"="C:\WINDOWS\system32\__c009E3.dat" [ ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-04-25 21:38 185632]
"Winjava vil"="sys32.exe" []

C:\Documents and Settings\Guest.THESMACHINE\Start Menu\Programs\Startup\
IMVU.lnk - C:\Program Files\IMVU\IMVUClient.exe [2007-03-29 14:59:32 46600]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 04:44:06 29696]
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2005-11-06 02:52:43 278528]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\KEM.exe [2005-09-03 17:54:17 581632]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04 83360]
PanasonicX800PCSoftwareSuite Detect.lnk - C:\Program Files\Panasonic\Panasonic X800 PC Software Suite\connmngmntbox.exe [2006-05-16 21:14:21 196608]
PanasonicX800PCSoftwareSuite TS.lnk - C:\Program Files\Panasonic\Panasonic X800 PC Software Suite\ectaskscheduler.exe [2006-05-16 21:14:22 258112]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.yv12"= yv12vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 nwprovau

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Djp38.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Iot85.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Pwd63.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\WINDOWS\\system32\\PnkBstrA.exe"=
"C:\\WINDOWS\\system32\\PnkBstrB.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

R2 PStrip;PSTRIP;C:\WINDOWS\system32\DRIVERS\PSTRIP.SYS [2004-11-09 17:32]
S2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service []
S2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []
S3 ASPI;Advanced SCSI Programming Interface Driver;C:\WINDOWS\System32\DRIVERS\ASPI32.sys [1999-09-10 08:06]
S3 dump_wmimmc;dump_wmimmc;c:\ijji\ENGLISH\Gunbound Revolution\GameGuard\dump_wmimmc.sys []
S3 x800bus;Panasonic X800 Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\x800bus.sys [2005-01-21 06:22]
S3 x800mdfl;Panasonic X800 Modem Filter;C:\WINDOWS\system32\DRIVERS\x800mdfl.sys [2005-01-21 06:22]
S3 x800mdm;Panasonic X800 Modem Drivers;C:\WINDOWS\system32\DRIVERS\x800mdm.sys [2005-01-21 06:22]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-19 22:47:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-28 19:47:37 C:\WINDOWS\Tasks\XoftSpySE 2.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
"2008-04-12 07:00:37 C:\WINDOWS\Tasks\XoftSpySE.job"
- C:\Program Files\XoftSpySE\XoftSpy.exe
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-28 15:48:10
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\WgaTray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\SetPoint\KHALMNPR.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Intuwave Ltd\Shared\mRouterRunTime\mRouterRuntime.exe
C:\PROGRA~1\PANASO~1\PANASO~1\Elogerr.exe
C:\PROGRA~1\PANASO~1\PANASO~1\BROADC~1.EXE
C:\PROGRA~1\PANASO~1\PANASO~1\SCRFS.exe
.
**************************************************************************
.
Completion time: 2008-04-28 16:06:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-28 20:05:31

Pre-Run: 18,356,031,488 bytes free
Post-Run: 19,180,507,136 bytes free

467 --- E O F --- 2008-04-17 15:10:17

One or more of the identified infections is a backdoor trojan.

This allows hackers to remotely control your computer, steal critical system information and download and execute files.

I would counsel you to disconnect this PC from the Internet immediately. If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all passwords where applicable, and it would be wise to contact those same financial institutions to apprise them of your situation.

Though the trojan has been identified and can be killed, because of it's backdoor functionality, your PC is very likely compromised and there is no way to be sure your computer can ever again be trusted. Many experts in the security community believe that once infected with this type of trojan, the best course of action would be a reformat and reinstall of the OS. Please read these for more information:

How Do I Handle Possible Identify Theft, Internet Fraud and CC Fraud?
When Should I Format, How Should I Reinstall

We can still clean this machine but I can't guarantee that it will be 100% secure afterwards. Let me know what you decide to do.

Kyuss

If we can kill the trojan and do a reformat/reinstall that's fine with me. I was planning to reformat and reinstall anyway once I got rid of the trojan. So let's gt "rid" of it then I can reformat.

Ok no problem. The only thing is if you reformat the infections will be totally gone anyway!

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.





Download the file & save it as it's originally named, next to ComboFix.exe.






Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log.

Please do not reboot your machine until we have reviewed the log.

Should I do a malware scan as well or click "No" after it creates the Recovery Tool?

Yes do a malware scan too.

Kyuss