WinBlue Soft..PLEASE help

Hi I really could use some help this winblue Soft is not letting me do any thing, I haven't registered for it because I knew there was something wrong with the program. I just want it gone. Here's the log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:44:14 PM, on 6/23/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\PDF Complete\pdfsty.exe
C:\Program Files\PDF Complete\pdfsaver.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
C:\Program Files\Logitech\ImageStudio\LogiTray.exe
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe
C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Administrator\My Documents\hijackgpthis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\YTSingleInstance.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe"
O4 - HKLM\..\Run: [SetRefresh] C:\Program Files\Compaq\SetRefresh\SetRefresh.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [LVCOMS] C:\Program Files\Common Files\Logitech\QCDriver3\LVCOMS.EXE
O4 - HKLM\..\Run: [LogitechGalleryRepair] C:\Program Files\Logitech\ImageStudio\ISStart.exe
O4 - HKLM\..\Run: [LogitechImageStudioTray] C:\Program Files\Logitech\ImageStudio\LogiTray.exe
O4 - HKLM\..\Run: [CanonSolutionMenu] C:\Program Files\Canon\SolutionMenu\CNSLMAIN.exe /logon
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [YSearchProtection] "C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe"
O4 - HKLM\..\Run: [FlyMonitor] "C:\Program Files\Leapfrog\FlyWorld\bin\FlyMonitor.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [YSearchProtection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [Search Protection] C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Exif Launcher.lnk = ?
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {226ACC34-3194-70E2-5AE7-864FCFE9E80D} (CPlayFirstmsiControl Object) - http://zone.msn.com/bingame/mosi/default/msi.1.0.0.9.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/yinst20040510.cab
O16 - DPF: {315B0BFB-2BD4-481B-80A3-A9B80727C61B} (WebIQ Engine Application Object) - http://webiq005.webiqonline.com/WebIQ/DataServer/Pub/DataServer.dll?Handler=GetEngineDistribution&EDID={896A23A1-5821-4609-A6C6-6D5536C585C9}
O16 - DPF: {49E67060-2C0D-415E-94C7-52A49F73B2F1} (CPlayFirstPiratePoppersControl Object) - http://zone.msn.com/bingame/pppp/default/PiratePoppers.1.0.0.39.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189203290437
O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://zone.msn.com/bingame/chnz/default/mjolauncher.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {C86FF4B0-AA1D-46D4-8612-025FB86583C7} (AstoundLauncher Control) - http://zone.msn.com/bingame/jobo/default/AstoundLauncher.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/3DVIA_player_installer.exe
O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://216.227.246.9:8063/activex/AMC.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://zone.msn.com/bingame/popcaploader_v10.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8414BD31-C009-4812-BF6E-247375BD2453}: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
O20 - Winlogon Notify: hpkcrkin - C:\Documents and Settings\Administrator\Application Data\hpkcrkin.dll (file missing)
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Unknown owner - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: OSCM Utility Service - Sprint Spectrum, L.L.C - C:\Program Files\Novatel Wireless\Sprint\Sprint PCS Connection Manager\OSCMUtilityService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe

--
End of file - 12280 bytes

Hello.

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
  O17 - HKLM\System\CCS\Services\Tcpip\..\{8414BD31-C009-4812-BF6E-247375BD2453}: NameServer = 85.255.112.169,85.255.112.111
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.169,85.255.112.111
  O20 - Winlogon Notify: hpkcrkin - C:\Documents and Settings\Administrator\Application Data\hpkcrkin.dll (file missing)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

I would be happy to EXCEPT, i cant the program refuses to run along with spy doctor and system restore. Any ideas??

Could I go to task manager and end it in PROCESSES without messing my computer up?

Are you talking about TeaTimer? if so, yes, try and end TeaTimer.exe via the Task Manager.

Ok so i used HJT and fixed every thing you instruced but now I cant download maleware bytes because neither Internet Exporer or Firefox will let me go through your link. Internet Explorer says page cant be displayed and Firefox redirects me to ask.com where every time I try to go to the maleware byets siteIm rediriected to another

Ok nevermind im not sure how but got the program, how ever i can,t open it. I see the hour glass fo a split second and then nothing what should i do?

Before we can use our main tool, we need to uninstall a few things.

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

3DVIA player 5.0
Acrobat.com
Acrobat.com
Adobe AIR
Adobe AIR
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Photoshop CS
Adobe Reader 9.1.2
Adobe Shockwave Player 11
Apple Software Update
ArcSoft VideoImpression 1.6FP
Athlon 64 Processor Driver
ATI Control Panel
ATI Display Driver
AXIS Media Control Embedded
Broadcom Management Programs
CA Yahoo! Anti-Spy (remove only)
Canon MP Navigator EX 1.0
Canon MX310 series
Canon MX310 series User Registration
Canon My Printer
Canon Utilities Easy-PhotoPrint EX
Canon Utilities Solution Menu
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
FinePixViewer Ver.2.0
FLY World
FUJIFILM USB Driver
Highlight Viewer (Windows Live Toolbar)
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB961118)
HP Help and Support
HP Safety and Comfort Guide
InterVideo WinDVD
Java DB 10.4.2.1
Java(TM) 6 Update 14
Java(TM) SE Development Kit 6 Update 14
LiveUpdate 3.0 (Symantec Corporation)
Logitech Desktop Messenger
Logitech IM Video Companion
Logitech ImageStudio
Logitech Print Service
Malwarebytes' Anti-Malware
Map Button (Windows Live Toolbar)
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Professional
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Mobile Broadband Drivers
Mozilla Firefox (3.0.11)
MP4-based Video Downloader
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
PDF Complete
PlayStation(R)Network Downloader
PlayStation(R)Store
Presto! PageManager 7.15.16
PSP Max Media Manager
QuickTime
QuickTiming
RealPlayer
Realtek AC'97 Audio
Roxio Easy Media Creator 7
Roxio UDF Reader
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923789)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Smart Menus (Windows Live Toolbar)
Sony Media Manager for PSP 3.0
Sprint Mobile Broadband (Novatel Wireless)
Spybot - Search & Destroy
Spyware Doctor 6.0
The Weather Channel Desktop 6
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
URGE
ViewAhead Photo Center
WebIQ Technology Engine
Windows Driver Package - LeapFrog (FlyUsb) USB (06/15/2007 1.0.0.6)
Windows Live Favorites for Windows Live Toolbar
Windows Live installer
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Live Toolbar
Windows Live Toolbar
Windows Live Toolbar Extension (Windows Live Toolbar)
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 3
Yahoo! Browser Services
Yahoo! Internet Mail
Yahoo! Messenger
Yahoo! Search Protection
Yahoo! Toolbar

What do you think i need to uninstall?

Hello.
Since you can't disable TeaTimer, were gonna temporarily uninstall it until we are done.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

Spybot - Search & Destroy
LiveUpdate 3.0 (Symantec Corporation)

Next,

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-06-25.01 - Administrator 06/25/2009 14:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.556 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.exe
c:\program files\Common Files\System\Uninstall
c:\windows\103525ormz9e.dll
c:\windows\1051worm945z.ocx
c:\windows\10754trojz9.cpl
c:\windows\109459amzot230.cpl
c:\windows\10970spy25az.cpl
c:\windows\10c4dzwnload9r2255.bin
c:\windows\10z96worm529.bin
c:\windows\110279pamb5t72ez.dll
c:\windows\11598trzj70b.exe
c:\windows\12559ackt5ol5f7z.dll
c:\windows\1297szea929725.ocx
c:\windows\12999haczt95l518.ocx
c:\windows\13094not-a9viru5z29.exe
c:\windows\13130zr5j3129.cpl
c:\windows\13358spamz5915.exe
c:\windows\13959ackdoor915z.ocx
c:\windows\13z565acktool19a.bin
c:\windows\14256nz9-a-virus5c7.exe
c:\windows\143z9not-a-vir5sb2.dll
c:\windows\15535virus9fz.cpl
c:\windows\1561695oj7zd.exe
c:\windows\15bfdownlozder2396.cpl
c:\windows\15fbackdo9r109z.ocx
c:\windows\15z48hacktoo539c.bin
c:\windows\16563zr9j655.exe
c:\windows\16745not-a-vizus7195.ocx
c:\windows\17255wzrm1fa9.dll
c:\windows\17857noz-a5v9rus51d.cpl
c:\windows\17956spy799z.dll
c:\windows\18dzb9ckdoor5489.bin
c:\windows\18z71hackto5l209.exe
c:\windows\19030nz5-a-vi9us174.bin
c:\windows\1907v5rzs6929.ocx
c:\windows\19109virzs2ce5.cpl
c:\windows\19226zpa9bot65f.dll
c:\windows\1979spyw5re3z17.bin
c:\windows\197ezhreat54389.bin
c:\windows\19825hazkt5ol2789.ocx
c:\windows\198fsp5war95z.ocx
c:\windows\1991spzrse1855.ocx
c:\windows\19z53s9y592.bin
c:\windows\1d87vi925z7.cpl
c:\windows\1e48thrza925691.ocx
c:\windows\1f47z95eat10612.ocx
c:\windows\1f9ezown5oader185.ocx
c:\windows\1fc9thrzat11532.dll
c:\windows\1z591spy23e.exe
c:\windows\1z774spam5o9402.dll
c:\windows\1zedth5e9t12158.ocx
c:\windows\20531tzoj7059.bin
c:\windows\2088hac5tzol698.dll
c:\windows\211z7hacktool5b9.dll
c:\windows\21792not-59vzrus70b.ocx
c:\windows\22499troj2z5.ocx
c:\windows\225009zrus695.cpl
c:\windows\22551hazkto9l52c5.bin
c:\windows\2288not-a-viz955d.dll
c:\windows\22995spam5otbz.ocx
c:\windows\22f8s9eal67z5.ocx
c:\windows\23599spy275z.bin
c:\windows\23805zoj1689.exe
c:\windows\24033v5rus75z9.exe
c:\windows\24702z5rus9a4.ocx
c:\windows\2495addware11z7.bin
c:\windows\25108ha5ztool44b9.dll
c:\windows\25405szam9ot9d5.exe
c:\windows\2589backdoor2z79.exe
c:\windows\25908v5rus51z.dll
c:\windows\25995worm74ez.dll
c:\windows\2601dow9loaderz695.dll
c:\windows\2619n5t-a-viruz5f8.exe
c:\windows\26734ha5zto9l396.cpl
c:\windows\26edown5oad9r121z.exe
c:\windows\27529no5-a-virus21az.bin
c:\windows\27691hac9to5l36cz.bin
c:\windows\27a7zpars51049.bin
c:\windows\27z50wo9m6515.cpl
c:\windows\2845z9pambot1da.ocx
c:\windows\28715sp5mboz2c99.bin
c:\windows\28887vir9526z.dll
c:\windows\288e5dz9are1438.cpl
c:\windows\28911not-azvir5s29.bin
c:\windows\28ddzackdoor18599.exe
c:\windows\29258not-a9vizus755.dll
c:\windows\29331s5y757z.ocx
c:\windows\29644hazk5o9l38f.bin
c:\windows\29650spy1fz.bin
c:\windows\2980s59zbot529.bin
c:\windows\299zhacktool454.exe
c:\windows\29a8do5zloader1955.exe
c:\windows\29edbzckdoor28335.cpl
c:\windows\2a5aste9l3z12.bin
c:\windows\2bazad5ware9885.ocx
c:\windows\2d005parsez792.ocx
c:\windows\2d715irz955.bin
c:\windows\2ez9sparse26025.dll
c:\windows\2z505hacktool7c59.cpl
c:\windows\2z543not-a-virus5e9.dll
c:\windows\2z553spambo95e6.exe
c:\windows\2zbst59l1754.exe
c:\windows\30359s5y9zc.ocx
c:\windows\30956viruz6a.bin
c:\windows\30z49spy539.bin
c:\windows\31557vir9s18z5.bin
c:\windows\3211z5py698.ocx
c:\windows\32425zorm79c.bin
c:\windows\324655ackto9lez.dll
c:\windows\3251backzo593215.exe
c:\windows\3259ownloazer2279.exe
c:\windows\32752zro559d.bin
c:\windows\3413z59al1198.ocx
c:\windows\346aadd59rz973.dll
c:\windows\34azst9al9445.dll
c:\windows\3539not-9-virzs1b95.exe
c:\windows\359avzr3097.ocx
c:\windows\35c9dowzloader157.ocx
c:\windows\35d6zpy9are2738.cpl
c:\windows\35dbackdoor9958z.dll
c:\windows\3625zroj7b59.dll
c:\windows\3843worz953.cpl
c:\windows\3920spa5se446z.dll
c:\windows\39a9thief2599z.bin
c:\windows\3a0b9pywaz52150.bin
c:\windows\3bz59hief3121.cpl
c:\windows\3cz49hreat3555.exe
c:\windows\3e9bzhi5f3099.dll
c:\windows\3z0705acktool799.exe
c:\windows\3z529or59d.dll
c:\windows\3z57addware9540.ocx
c:\windows\3zc95pa9se320.cpl
c:\windows\4089viruz2f5.ocx
c:\windows\40b1zownload9r2858.exe
c:\windows\41e9downlza5er1917.dll
c:\windows\437659yware308z.dll
c:\windows\445zvi91559.exe
c:\windows\44eb5ir121z9.bin
c:\windows\44f9dow5lo9dez1144.exe
c:\windows\4513s9arze2207.cpl
c:\windows\453znot-a-virus59.dll
c:\windows\45f1szywar596.ocx
c:\windows\45febackdoor193z5.exe
c:\windows\46c3spazse2955.cpl
c:\windows\4955ha9ktzol5c.dll
c:\windows\495abaczdoor763.cpl
c:\windows\49685hzeat55309.bin
c:\windows\4999backd5orz7.dll
c:\windows\49acv9r5z57.bin
c:\windows\4d31thz5at29678.exe
c:\windows\4d69backd5or3z0.dll
c:\windows\4z65spars510609.cpl
c:\windows\503stea91z46.dll
c:\windows\5067thre9t4z765.exe
c:\windows\50719viruz9a5.ocx
c:\windows\508zthief22459.exe
c:\windows\5154vzr1992.ocx
c:\windows\51812spambotbz9.dll
c:\windows\51967vir9s16ez.cpl
c:\windows\5217hac5t9ol6z1.dll
c:\windows\5229not5a-viz9s196.ocx
c:\windows\5255thr9atz6609.cpl
c:\windows\52a9ba5kzoor659.exe
c:\windows\533289ot-a-vizus235.cpl
c:\windows\5376viruz9d2.ocx
c:\windows\539ztroj99b.dll
c:\windows\5553t9zj6aa.bin
c:\windows\556cba9kdoor2000z.bin
c:\windows\557d9parse28z3.dll
c:\windows\5599zreat5557.cpl
c:\windows\55fzbackdoor953.dll
c:\windows\56097virusz92.bin
c:\windows\5649viz15425.exe
c:\windows\56a6z9r38.cpl
c:\windows\5795tzief1564.ocx
c:\windows\57a5s9ealz129.bin
c:\windows\58903not-azvi9us7f5.dll
c:\windows\58cdthiefz059.bin
c:\windows\5915zpyware115.ocx
c:\windows\593hacktooz34.cpl
c:\windows\5941zteal2001.bin
c:\windows\599spyw9ze1685.dll
c:\windows\59adsparz92861.cpl
c:\windows\5aza5parse9773.ocx
c:\windows\5cbbth9z51522.ocx
c:\windows\5ccfvi59z53.exe
c:\windows\5ce5download9z28615.bin
c:\windows\5d2th9ez2625.dll
c:\windows\5e59zddwa9e2424.dll
c:\windows\5ea9adzwa593209.exe
c:\windows\5ezfdownlo5der5379.dll
c:\windows\5fezspar5e933.ocx
c:\windows\5z1add9are588.dll
c:\windows\5z42tr9j85.ocx
c:\windows\5z54n9t-a5virus4c0.ocx
c:\windows\5z594viru931.dll
c:\windows\5z773spy5689.cpl
c:\windows\6181backdooz957.dll
c:\windows\61z5addwa9e249.ocx
c:\windows\6264not-9-vizus58c.dll
c:\windows\639cszeal1554.cpl
c:\windows\63fdthzef1759.exe
c:\windows\6450bac5door89z.ocx
c:\windows\64e0addware955z.exe
c:\windows\6560sz9ware875.bin
c:\windows\65775tzal692.cpl
c:\windows\6599spz35a.ocx
c:\windows\65d9add9are1z57.dll
c:\windows\6659backd5zr3104.exe
c:\windows\665zhacktool3fb9.exe
c:\windows\6730a5z9are2827.exe
c:\windows\68z1t5ief8199.ocx
c:\windows\6918zi5164.ocx
c:\windows\6925thief700z.cpl
c:\windows\69ac5teal15z7.exe
c:\windows\69ddsparsz1385.ocx
c:\windows\6a53thre5t169z1.dll
c:\windows\6b56dozn5oader9609.bin
c:\windows\6b7cad95are5z8.bin
c:\windows\6bccthr59t990z.ocx
c:\windows\6cz9bac5door485.dll
c:\windows\6e4bbackd9oz1569.cpl
c:\windows\6z97hacktool135.exe
c:\windows\6za9threat56392.ocx
c:\windows\7059spars5z98.exe
c:\windows\7245threat905z6.cpl
c:\windows\73zes9eal905.ocx
c:\windows\746zviru96f5.cpl
c:\windows\7558vzr2933.bin
c:\windows\755dow9loaderz20.bin
c:\windows\75b8ad9wzr51823.exe
c:\windows\75dzdownload9r94.ocx
c:\windows\76ezspywa5e2179.dll
c:\windows\781bspy9are227z5.ocx
c:\windows\78z4tro53c9.cpl
c:\windows\79715ozm59e.dll
c:\windows\7988zot-5-viru9577.bin
c:\windows\799b5ckdoor54z.exe
c:\windows\7d19spar5ez257.ocx
c:\windows\7fb9szarse1725.dll
c:\windows\7z529parse957.bin
c:\windows\7z849o5mf5.exe
c:\windows\835h9cktooz10d.exe
c:\windows\8556v9ruszf.bin
c:\windows\8626zot-a9virus557.bin
c:\windows\8d5threaz91907.ocx
c:\windows\90267s5z351.dll
c:\windows\9105downlzader2283.cpl
c:\windows\91972troz435.dll
c:\windows\922sp5ware1z959.exe
c:\windows\9296zpa5bot5c9.cpl
c:\windows\9325not-a-z9rus4ef.exe
c:\windows\93436not-5-viruz55.cpl
c:\windows\93892spambzt55.dll
c:\windows\93dfvir5z98.dll
c:\windows\93z8s5y21c.ocx
c:\windows\940s5y7f8z.ocx
c:\windows\948spzr9e9535.dll
c:\windows\9511z5roj50d.bin
c:\windows\952ddo5nzoader2972.bin
c:\windows\953dz9nloader85.dll
c:\windows\9569acktool13z.ocx
c:\windows\95884hacktoolzb0.exe
c:\windows\969vir1z685.exe
c:\windows\97564spz75.dll
c:\windows\97650vzrus42e.exe
c:\windows\9812hack5ool69bz.bin
c:\windows\9844hzcktoo52a0.cpl
c:\windows\984a5dzware3159.ocx
c:\windows\9855tz5j579.ocx
c:\windows\987csparse3z05.ocx
c:\windows\99375zpambot50.cpl
c:\windows\995dszeal3020.exe
c:\windows\9abcad5zare2735.bin
c:\windows\9c1bbackdozr5493.exe
c:\windows\9c55steaz942.ocx
c:\windows\9ce3zhrea52993.dll
c:\windows\9d06vzr485.dll
c:\windows\9e25steal56z.bin
c:\windows\9z642spy557.dll
c:\windows\a9fthi5z241.bin
c:\windows\b43s5yw9re2589z.cpl
c:\windows\c40dzwnloader95215.ocx
c:\windows\egadetakobi.dll
c:\windows\f71down9o5der2652z.cpl
c:\windows\f8aadd5are95z.bin
c:\windows\system32\10506viru95aaz.exe
c:\windows\system32\109625roz399.cpl
c:\windows\system32\1102a5dware1z539.exe
c:\windows\system32\11099sp5mbot5efz.exe
c:\windows\system32\11511sp9z5ot5ea.cpl
c:\windows\system32\11579notza9virus183.dll
c:\windows\system32\1199par5e257z.cpl
c:\windows\system32\12915wormz9.cpl
c:\windows\system32\13450ha9ktoolzbb.bin
c:\windows\system32\13469trojz549.ocx
c:\windows\system32\13635s9z45e.cpl
c:\windows\system32\13697s5z5ba.cpl
c:\windows\system32\138b9p5rsz1457.ocx
c:\windows\system32\14322hackto59zf1.exe
c:\windows\system32\14350sp9zbote5.dll
c:\windows\system32\1452n5z-a-9irus1a9.cpl
c:\windows\system32\14845h9cktzol64.cpl
c:\windows\system32\14858tzo91f4.bin
c:\windows\system32\15329zpambot986.dll
c:\windows\system32\155ddowzloader1793.dll
c:\windows\system32\15755tro97z5.exe
c:\windows\system32\15995vi9uz3325.ocx
c:\windows\system32\159z65py8e.ocx
c:\windows\system32\15d5addzare6509.dll
c:\windows\system32\1601zh5cktool709.bin
c:\windows\system32\16725hackto5z66f9.cpl

c:\windows\system32\1689bazkdoo52313.cpl
c:\windows\system32\16999wo5m4cez.ocx
c:\windows\system32\16z61viru55fc9.exe
c:\windows\system32\17445ha9ktoolz235.bin
c:\windows\system32\18816zp5mbot595.exe
c:\windows\system32\1914troj45z9.bin
c:\windows\system32\193865zr9677.bin
c:\windows\system32\1939zteal5869.dll
c:\windows\system32\193z3spy458.ocx
c:\windows\system32\19457spz16f.bin
c:\windows\system32\1949ste5z405.bin
c:\windows\system32\1992spzwa5e2153.dll
c:\windows\system32\1997zn9t-a-virus355.exe
c:\windows\system32\19f3downloadzr2354.cpl
c:\windows\system32\1a5adow9loazer5881.exe
c:\windows\system32\1aadad9wzre1335.ocx
c:\windows\system32\1bfa9pars5z352.bin
c:\windows\system32\1d795zarse3067.cpl
c:\windows\system32\1z363s5y935.cpl
c:\windows\system32\1z5fst5a9898.ocx
c:\windows\system32\1z6429ot5a-virus775.dll
c:\windows\system32\1z9ethief5962.bin

c:\windows\system32\1z9ethief5962.bin
c:\windows\system32\20180worz495.bin
c:\windows\system32\2018backdooz5697.bin
c:\windows\system32\20698not-a-vi5usz93.bin
c:\windows\system32\2072s9e5l11z.cpl
c:\windows\system32\20946not-5zvirus280.dll
c:\windows\system32\20d4s59alz043.cpl
c:\windows\system32\20e9backzoo5749.dll
c:\windows\system32\2137za9ktool5b05.exe
c:\windows\system32\2152not9azvirusa5.ocx
c:\windows\system32\21596spamboz9ed5.cpl
c:\windows\system32\2205zspy2c9.ocx
c:\windows\system32\22545not-a-virus39z.dll
c:\windows\system32\229t5ief1z94.cpl
c:\windows\system32\22z95troj41b9.ocx
c:\windows\system32\2343do9nloa5erz89.dll
c:\windows\system32\23652spambotzf95.cpl
c:\windows\system32\236z3w95m1d1.cpl
c:\windows\system32\239299ot5a-vzrus6f8.ocx
c:\windows\system32\24649szy1c45.cpl
c:\windows\system32\24z4ste5l2399.dll
c:\windows\system32\2529zvi5us395.ocx
c:\windows\system32\252z9wo5m519.cpl
c:\windows\system32\25352spy3z59.dll
c:\windows\system32\25479pzrse2002.cpl
c:\windows\system32\255z69pambot568.cpl
c:\windows\system32\255ztroj5c19.dll
c:\windows\system32\25856not-z-virus27f9.bin
c:\windows\system32\258ezownl9ader859.ocx
c:\windows\system32\25943h9cktoo5zf6.cpl
c:\windows\system32\25997spazbot1955.dll
c:\windows\system32\26615hac9tooz5d6.dll
c:\windows\system32\26637nzt9a-vi5us5f5.exe
c:\windows\system32\266abzc9doo5294.cpl
c:\windows\system32\26939tro93ze5.ocx
c:\windows\system32\26z485or9540.exe
c:\windows\system32\275235a9ktooz56c.exe
c:\windows\system32\276955ackzool693.exe
c:\windows\system32\2769doznloa5er150.bin
c:\windows\system32\27afd9wnloader53z0.ocx
c:\windows\system32\27z2bac5door9199.bin
c:\windows\system32\284z0troj3579.exe
c:\windows\system32\288599pambotzc0.exe
c:\windows\system32\2892not-a-9i5uszc.dll
c:\windows\system32\29181sz95bot63d.cpl
c:\windows\system32\2936s9ywarz5121.bin
c:\windows\system32\29559hac9tool7dz.exe
c:\windows\system32\295z0spy50c9.cpl
c:\windows\system32\2962zspy4a25.ocx
c:\windows\system32\2964zspy598.exe
c:\windows\system32\296525pyzd.ocx
c:\windows\system32\29903z5rm4.dll
c:\windows\system32\2995tzreat3316.exe
c:\windows\system32\2a41downloader29z59.dll
c:\windows\system32\2eb2zte5l6179.bin
c:\windows\system32\2fc4virz9255.bin
c:\windows\system32\2z029s5y299.cpl
c:\windows\system32\2z1d9teal225.bin
c:\windows\system32\2z349spam59t443.ocx
c:\windows\system32\2z36sp59are655.ocx
c:\windows\system32\2za55hr9at5694.dll
c:\windows\system32\2zf3thie9355.cpl
c:\windows\system32\301z59ot-a-vi5us2d6.exe
c:\windows\system32\30516not-a-virus93z.exe
c:\windows\system32\305z59o5m57b.bin
c:\windows\system32\3094not-a-v5rus7dcz.exe
c:\windows\system32\30z5thief23559.bin
c:\windows\system32\31306notza-95rus33c.exe
c:\windows\system32\31999zpy585.dll
c:\windows\system32\32334worz985.cpl
c:\windows\system32\3242dow5lza9er2018.cpl
c:\windows\system32\3245tz9ef912.dll
c:\windows\system32\3395spazb9t23c.ocx
c:\windows\system32\340db5zkdoor9394.ocx
c:\windows\system32\35a6zi92889.exe
c:\windows\system32\35b8szeal195.ocx
c:\windows\system32\35z6download9r20265.bin
c:\windows\system32\3660dz5nlo9der588.dll
c:\windows\system32\3783z5rm79.bin
c:\windows\system32\3795vizus90c.dll
c:\windows\system32\3849h9cktoolz5e.cpl
c:\windows\system32\3909z5py5e5.dll
c:\windows\system32\391z5worm520.cpl
c:\windows\system32\392665azktool594.exe
c:\windows\system32\3959thief1075z.ocx
c:\windows\system32\396c5ddwzre1456.cpl
c:\windows\system32\39830virus2z5.exe
c:\windows\system32\39999ormz9d5.cpl
c:\windows\system32\39a05zckdoor2330.cpl
c:\windows\system32\39f9spyware279z5.dll
c:\windows\system32\3a59vir275z9.exe
c:\windows\system32\3ba3dzwnloader29815.exe
c:\windows\system32\3c40downloa5er27z69.cpl
c:\windows\system32\3c57zhief1091.dll
c:\windows\system32\3d7zt59ef119.bin
c:\windows\system32\3deda5dwar923z2.ocx
c:\windows\system32\3dza9h5eat10527.dll
c:\windows\system32\3e529pzware2971.ocx
c:\windows\system32\3e7bspazse1895.exe
c:\windows\system32\3e95sparze59.dll
c:\windows\system32\3f09s5arsez9889.exe
c:\windows\system32\3f60zi5395.cpl
c:\windows\system32\3z57s5y298.cpl
c:\windows\system32\3z65backdoor2589.exe
c:\windows\system32\40e9ba5kdoo92z3.bin
c:\windows\system32\40zdaddwa5e1090.cpl
c:\windows\system32\4168a5dware2z79.ocx
c:\windows\system32\41e5paz9e1184.cpl
c:\windows\system32\444eaddw9re1z75.cpl
c:\windows\system32\44895rzj9f3.dll
c:\windows\system32\450etzie9521.dll
c:\windows\system32\4511back9zor857.ocx
c:\windows\system32\4554s9y1bz.dll
c:\windows\system32\45659or5zfb.ocx
c:\windows\system32\45f5zddware5899.dll
c:\windows\system32\4695spywaz51638.cpl
c:\windows\system32\46dezir58059.dll
c:\windows\system32\4795vzr3048.cpl
c:\windows\system32\47zvi5us789.bin
c:\windows\system32\4819thze5t26432.cpl
c:\windows\system32\49095ddw9ze463.ocx
c:\windows\system32\490spamz5t1b.ocx
c:\windows\system32\4971doz5loader3120.exe
c:\windows\system32\4aaespzrse985.bin
c:\windows\system32\4azesteal5592.dll
c:\windows\system32\4b6dadd5are3z99.exe
c:\windows\system32\4bdzba5kdo9r1942.ocx
c:\windows\system32\4c53zh5ef1914.dll
c:\windows\system32\4cb1a59ware9z8.cpl
c:\windows\system32\4e2cdow5lozde93253.ocx
c:\windows\system32\4ezedownlo95er1842.ocx
c:\windows\system32\4fc1szar952618.dll
c:\windows\system32\4z66s5ars92951.ocx
c:\windows\system32\4z84backd5o92338.cpl
c:\windows\system32\4za2addwa5e3229.exe
c:\windows\system32\50289not-a-zirus3ad.cpl
c:\windows\system32\505fdownlo9dez836.dll
c:\windows\system32\5065tzreat9671.dll
c:\windows\system32\50996not-a-vzrus7a8.bin
c:\windows\system32\drivers\MSIVXoyumaqocnjndwyuxpmioxqqkllrsuvpp.sys
c:\windows\system32\MSIVXcount
c:\windows\system32\MSIVXeylkdahsoddiqlsvswrihngxuvwlsubw.dll
c:\windows\system32\MSIVXyppxehbawmyluiwehuilyeubbeekpgdo.dll
c:\windows\z095spy142.exe
c:\windows\z0c6thi5f269.cpl
c:\windows\z1918s59695.bin
c:\windows\z2590wor55d9.exe
c:\windows\z284h5ckto9l1b4.bin
c:\windows\z3885spy695.bin
c:\windows\z4361tro595b.bin
c:\windows\z6145t9oj251.cpl
c:\windows\z9601hacktool9805.dll
c:\windows\z9923wo9m4b5.bin
c:\windows\z9d7thre5t15611.bin
c:\windows\z9e25parse158.exe
c:\windows\za8do5nlo9der2007.dll
c:\windows\zb95pyware3199.dll
c:\windows\ze0dsteal29085.ocx
c:\windows\ze959i52102.bin

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_MSIVXserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-25 to 2009-06-25 )))))))))))))))))))))))))))))))
.

2009-12-21 18:05 . 2009-12-21 18:05 13600 ----a-w- c:\windows\system32\9045vzr541.exe
2009-12-20 17:50 . 2009-12-20 17:50 3403 ----a-w- c:\windows\system32\57e9spyw5re2580z.bin
2009-12-15 20:24 . 2009-12-15 20:24 11435 ----a-w- c:\windows\system32\5z744hackto9l2b6.dll
2009-12-10 21:17 . 2009-12-10 21:17 15545 ----a-w- c:\windows\system32\7189v5r9s6ez.dll
2009-12-08 21:56 . 2009-12-08 21:56 9884 ----a-w- c:\windows\system32\91539spamboz748.dll
2009-11-23 10:48 . 2009-11-23 10:48 3416 ----a-w- c:\windows\system32\ea8tzi5f3924.bin
2009-11-21 18:43 . 2009-11-21 18:43 4234 ----a-w- c:\windows\system32\581azackdoor2981.exe
2009-11-19 18:29 . 2009-11-19 18:29 12562 ----a-w- c:\windows\system32\7dz7vir5190.exe
2009-11-17 16:31 . 2009-11-17 16:31 17221 ----a-w- c:\windows\system32\759spz74b.bin
2009-10-27 02:07 . 2009-10-27 02:07 12671 ----a-w- c:\windows\system32\5950virus75z.exe
2009-10-16 21:34 . 2009-10-16 21:34 2964 ----a-w- c:\windows\system32\68z3backdoo514749.bin
2009-10-12 06:09 . 2009-10-12 06:09 16447 ----a-w- c:\windows\system32\5379backdoor8z7.exe
2009-10-10 02:38 . 2009-10-10 02:38 5327 ----a-w- c:\windows\system32\5956not-a-zirus422.exe
2009-09-20 12:21 . 2009-09-20 12:21 5151 ----a-w- c:\windows\system32\7bz7spy9are2501.bin
2009-09-08 15:04 . 2009-09-08 15:04 10861 ----a-w- c:\windows\system32\780b59zef161.exe
2009-09-04 23:24 . 2009-09-04 23:24 15983 ----a-w- c:\windows\system32\50f9st5zl1507.dll
2009-08-24 05:00 . 2009-08-24 05:00 3610 ----a-w- c:\windows\system32\91215ir1941z.dll
2009-08-07 09:01 . 2009-08-07 09:01 6072 ----a-w- c:\windows\system32\6d29vi5z095.dll
2009-08-01 10:35 . 2009-08-01 10:35 16583 ----a-w- c:\windows\system32\5239zoj553.bin
2009-07-02 12:09 . 2009-07-02 12:09 3000 ----a-w- c:\windows\system32\5452dzwnloader3990.dll
2009-06-26 17:44 . 2009-06-26 17:44 4722 ----a-w- c:\windows\system32\527z5not-a-9irus5e4.dll
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-25 19:18 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-24 14:23 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-19 20:06 . 2009-06-19 20:06 6287 ----a-w- c:\windows\system32\92815nzt-a-vir5s73e.bin
2009-06-19 20:06 . 2009-06-19 20:06 8730 ----a-w- c:\windows\system32\9042sp9m5oz9.bin
2009-06-19 20:06 . 2009-06-19 20:06 7684 ----a-w- c:\windows\system32\z56c9ddware2465.dll
2009-06-19 20:06 . 2009-06-19 20:06 7205 ----a-w- c:\windows\system32\z5335not-a-v59us11b.dll
2009-06-19 20:06 . 2009-06-19 20:06 3180 ----a-w- c:\windows\system32\95160hacztool478.bin
2009-06-19 20:06 . 2009-06-19 20:06 16937 ----a-w- c:\windows\system32\ef8v5z14539.bin
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-06-16 11:34 . 2009-06-16 11:34 16235 ----a-w- c:\windows\system32\8170spa9bot5z5.exe
2009-06-13 21:51 . 2009-06-13 21:51 10137 ----a-w- c:\windows

\system32\5e93downzo5der3114.bin
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-28 04:56 . 2009-06-19 23:49 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-24 17:59 . 2009-06-24 17:59 11332 ----a-w- c:\windows\system32\z958worm15.dll
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-24 07:57 . 2009-05-24 07:57 2912 ----a-w- c:\windows\system32\ad6adz5are9007.bin
2009-05-08 08:51 . 2009-05-08 08:51 5163 ----a-w- c:\windows\system32\9fzspar5e1717.bin
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-05-04 06:13 . 2009-05-04 06:13 18264 ----a-w- c:\windows\system32\6a4dt5i9f2187z.bin
2009-05-03 22:21 . 2009-05-03 22:21 17836 ----a-w- c:\windows\system32\665fviz1947.exe
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-22 11:52 . 2009-04-08 17:38 0 -c--a-w- c:\windows\Wqixivegohekev.bin
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-16 02:03 . 2009-04-08 17:38 408 -c--a-w- c:\windows\Uxekap.dat
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-04-11 19:30 . 2009-04-11 19:30 3740 ----a-w- c:\windows\system32\9z69st5al1343.dll
2009-04-10 18:02 . 2009-04-10 18:02 15746 ----a-w- c:\windows\system32\c62b9ckdoorz0015.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-24 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-WebCamRT.exe - (no file)
HKLM-Run-WinBlueSoft - (no file)


.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://216.227.246.9:8063/activex/AMC.cab
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-25 14:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-25 14:37
ComboFix-quarantined-files.txt 2009-06-25 19:37

Pre-Run: 62,068,150,272 bytes free
Post-Run: 62,304,940,032 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

692 --- E O F --- 2009-06-19 15:36

Yeah so there's the log, so whats next? Oh and by the way thanks for helping well i guess its really just you getting this stupid thing off my computer, but at any rate thanks

Now open a new notepad file.
Input this into the notepad file:

c:\windows\system32\9045vzr541.exe
c:\windows\system32\57e9spyw5re2580z.bin
c:\windows\system32\5z744hackto9l2b6.dll
c:\windows\system32\7189v5r9s6ez.dll
c:\windows\system32\91539spamboz748.dll
c:\windows\system32\ea8tzi5f3924.bin
c:\windows\system32\581azackdoor2981.exe
c:\windows\system32\7dz7vir5190.exe
c:\windows\system32\759spz74b.bin
c:\windows\system32\5950virus75z.exe
c:\windows\system32\68z3backdoo514749.bin
c:\windows\system32\5379backdoor8z7.exe
c:\windows\system32\5956not-a-zirus422.exe
c:\windows\system32\7bz7spy9are2501.bin
c:\windows\system32\780b59zef161.exe
c:\windows\system32\50f9st5zl1507.dll
c:\windows\system32\91215ir1941z.dll
c:\windows\system32\6d29vi5z095.dll
c:\windows\system32\5239zoj553.bin
c:\windows\system32\5452dzwnloader3990.dll
c:\windows\system32\527z5not-a-9irus5e4.dll
c:\windows\system32\17286h5z9tool.bin
c:\windows\system32\92815nzt-a-vir5s73e.bin
c:\windows\system32\9042sp9m5oz9.bin
c:\windows\system32\z56c9ddware2465.dll
c:\windows\system32\z5335not-a-v59us11b.dll
c:\windows\system32\95160hacztool478.bin
c:\windows\system32\ef8v5z14539.bin
c:\windows\system32\8170spa9bot5z5.exe
c:\windows\system32\5e93downzo5der3114.bin
c:\windows\system32\z958worm15.dll
c:\windows\system32\ad6adz5are9007.bin
c:\windows\system32\9fzspar5e1717.bin
c:\windows\system32\6a4dt5i9f2187z.bin
c:\windows\system32\665fviz1947.exe
c:\windows\Wqixivegohekev.bin
c:\windows\Uxekap.dat
c:\windows\system32\9z69st5al1343.dll
c:\windows\system32\c62b9ckdoorz0015.bin

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=-
"UpdatesDisableNotify"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-06-25.06 - Administrator 06/26/2009 8:50.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.536 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome.manifest
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome\content\_cfg.js
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome\content\c.js
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\chrome\content\overlay.xul
c:\documents and settings\Administrator\Local Settings\Application Data\{00E33F6A-C72E-4415-AAB4-6130CE068BB3}\install.rdf
c:\windows\system32\50f9st5zl1507.dll
c:\windows\system32\514s9zal87.cpl
c:\windows\system32\51690not-a-vizus59.exe
c:\windows\system32\520csparse19z95.ocx
c:\windows\system32\5239znot-a-vi9us50.exe
c:\windows\system32\5239zoj553.bin
c:\windows\system32\52508spy395z.ocx
c:\windows\system32\527z5not-a-9irus5e4.dll
c:\windows\system32\52zevir26599.cpl
c:\windows\system32\535zvir1982.cpl
c:\windows\system32\5379backdoor8z7.exe
c:\windows\system32\53fa9dd5aze22.cpl
c:\windows\system32\5439not-z-virus212.ocx
c:\windows\system32\5452dzwnloader3990.dll
c:\windows\system32\5496back5oor1z48.ocx
c:\windows\system32\55119pzrse732.ocx
c:\windows\system32\55348v9zus2ac.dll
c:\windows\system32\5546zr955d9.dll
c:\windows\system32\555d5t9az1425.dll
c:\windows\system32\5620tr5j1z9.cpl
c:\windows\system32\569fbackdoor190z.ocx
c:\windows\system32\569tr954bz.cpl
c:\windows\system32\56z7s9yware543.ocx
c:\windows\system32\5778zor9216.bin
c:\windows\system32\579cbackdzor557.cpl
c:\windows\system32\57e9spyw5re2580z.bin
c:\windows\system32\581azackdoor2981.exe
c:\windows\system32\5850t95j1az.bin
c:\windows\system32\5927downloade5549z.cpl
c:\windows\system32\5950virus75z.exe
c:\windows\system32\5956not-a-zirus422.exe
c:\windows\system32\5984spywa5e30z3.cpl
c:\windows\system32\59bzvir570.cpl
c:\windows\system32\59c1backdooz9672.dll
c:\windows\system32\5a18downlza9er2535.ocx
c:\windows\system32\5az89ir2185.bin
c:\windows\system32\5b41s5az9e2122.bin
c:\windows\system32\5b53sz5al819.ocx
c:\windows\system32\5b6zth9eat24544.ocx
c:\windows\system32\5c9c5ackdoor9796z.dll
c:\windows\system32\5ca7thizf894.cpl
c:\windows\system32\5ccba9kdoor25z5.exe
c:\windows\system32\5de4s5yware4z9.bin
c:\windows\system32\5e93downzo5der3114.bin
c:\windows\system32\5f65spzware2169.ocx
c:\windows\system32\5f7zhief983.dll
c:\windows\system32\5z735spy9b3.bin
c:\windows\system32\5z744hackto9l2b6.dll
c:\windows\system32\6085v9r2z98.cpl
c:\windows\system32\6087zddw9re26735.ocx
c:\windows\system32\61aas9ealz5.bin
c:\windows\system32\61edstzal26159.ocx
c:\windows\system32\65baddwarez359.cpl
c:\windows\system32\65es9eal3091z.cpl
c:\windows\system32\665fviz1947.exe
c:\windows\system32\68z3backdoo514749.bin
c:\windows\system32\68zbbac9door1542.ocx
c:\windows\system32\6954vir2z90.exe
c:\windows\system32\6993downloa5ez1779.ocx
c:\windows\system32\69z8b5ckdoor578.ocx
c:\windows\system32\6a4dt5i9f2187z.bin
c:\windows\system32\6b3bad9wa5z3186.cpl
c:\windows\system32\6c5athreat914z.ocx
c:\windows\system32\6d29vi5z095.dll
c:\windows\system32\6ec2tzrea52956.exe
c:\windows\system32\6f0ezack9oor13705.cpl
c:\windows\system32\6ff5z5re9t17633.dll
c:\windows\system32\6z9download9r865.cpl
c:\windows\system32\703z5ac9door2330.dll
c:\windows\system32\70c8b9ckdoor2597z.exe
c:\windows\system32\7189v5r9s6ez.dll
c:\windows\system32\755a5tzal15539.bin
c:\windows\system32\759spz74b.bin
c:\windows\system32\7720thi5z490.cpl
c:\windows\system32\7755backdzor569.ocx
c:\windows\system32\780b59zef161.exe
c:\windows\system32\7858backdoor15z9.bin
c:\windows\system32\78z0thie51907.cpl
c:\windows\system32\790zstea52591.dll
c:\windows\system32\7995wormz5c.ocx
c:\windows\system32\79z6d5wnloader14959.ocx
c:\windows\system32\7a12thr59t5z81.bin
c:\windows\system32\7bcbthr9az36465.ocx
c:\windows\system32\7bz7spy9are2501.bin
c:\windows\system32\7dz7vir5190.exe
c:\windows\system32\7e20bazkdoor539.exe
c:\windows\system32\7e55b9ckdzor456.dll
c:\windows\system32\801spzw95e2048.cpl
c:\windows\system32\8170spa9bot5z5.exe
c:\windows\system32\81s5ywar91z78.cpl
c:\windows\system32\8232zot-9-viru5b2.exe
c:\windows\system32\9042sp9m5oz9.bin
c:\windows\system32\9045vzr541.exe
c:\windows\system32\906115rzj233.cpl
c:\windows\system32\90853not-a-virzs28a5.cpl
c:\windows\system32\91215ir1941z.dll
c:\windows\system32\91539spamboz748.dll
c:\windows\system32\9171vzr2568.cpl
c:\windows\system32\92803hazkt5ol32c.bin
c:\windows\system32\92815nzt-a-vir5s73e.bin
c:\windows\system32\9399not-z-v9rus25.ocx
c:\windows\system32\9402zir2592.dll
c:\windows\system32\95160hacztool478.bin
c:\windows\system32\9536sp5zbot9bd.exe
c:\windows\system32\9553bzckdoor963.exe
c:\windows\system32\9553spam9ot5ze.cpl
c:\windows\system32\9599spyz10.ocx
c:\windows\system32\95z7addware1622.cpl
c:\windows\system32\9705zspy30a.dll
c:\windows\system32\9752ha9ktzol2dc.exe
c:\windows\system32\9755vir234z.ocx
c:\windows\system32\9775szeal1538.bin
c:\windows\system32\98z2vir10785.dll
c:\windows\system32\9928noz-a-vi5us35e.dll
c:\windows\system32\99eds5eal2895z.bin
c:\windows\system32\9abcs5azse1366.ocx
c:\windows\system32\9c14do5nloadzr2407.bin
c:\windows\system32\9c55addware2z28.cpl
c:\windows\system32\9d075hiez675.bin
c:\windows\system32\9e0ctzre5t7193.cpl
c:\windows\system32\9ezdspyware5449.ocx
c:\windows\system32\9f3zvi51013.ocx
c:\windows\system32\9fzspar5e1717.bin
c:\windows\system32\9z69st5al1343.dll
c:\windows\system32\9zbste95331.ocx
c:\windows\system32\a05s9ywarz814.dll
c:\windows\system32\ad6adz5are9007.bin
c:\windows\system32\b81sp95ze2325.dll
c:\windows\system32\c62b9ckdoorz0015.bin
c:\windows\system32\ea8tzi5f3924.bin
c:\windows\system32\ed65ddwzre3759.bin
c:\windows\system32\ef8v5z14539.bin
c:\windows\system32\ff35i9z159.cpl
c:\windows\system32\ffedownlo9dez543.ocx
c:\windows\system32\fzcs5ar9e309.ocx
c:\windows\system32\z0319vir95299.ocx
c:\windows\system32\z1873spambot7695.ocx
c:\windows\system32\z3936s5y4d2.ocx
c:\windows\system32\z3a5st9al1785.cpl
c:\windows\system32\z486add9are18255.cpl
c:\windows\system32\z4b1t5ief394.cpl
c:\windows\system32\z506vir9s269.exe
c:\windows\system32\z5089hacktool6c2.ocx
c:\windows\system32\z518backdoor5695.cpl
c:\windows\system32\z5335not-a-v59us11b.dll
c:\windows\system32\z56c9ddware2465.dll
c:\windows\system32\z5bsteal9350.cpl
c:\windows\system32\z61dth59f462.ocx
c:\windows\system32\z6a4v59183.ocx
c:\windows\system32\z7495teal1670.dll
c:\windows\system32\z89fthreat17585.dll
c:\windows\system32\z903downloader1995.ocx
c:\windows\system32\z95539pambot464.cpl
c:\windows\system32\z9553vi9us4ce5.bin
c:\windows\system32\z958worm15.dll
c:\windows\system32\z975vir3236.bin
c:\windows\system32\z9d1vir5466.cpl
c:\windows\system32\zd30sp59are1036.cpl

.
((((((((((((((((((((((((( Files Created from 2009-05-26 to 2009-06-26 )))))))))))))))))))))))))))))))
.

2009-06-25 23:04 . 2009-06-25 23:04 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-06-25 23:02 . 2009-06-25 23:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-25 19:33 . 2009-06-25 19:33 -------- d-----w- c:\windows\system32\dllcache\cache
2009-06-23 21:41 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 21:41 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 17:00 . 2009-06-20 17:00 -------- d-----w- c:\program files\Sun
2009-06-19 23:48 . 2009-06-26 13:47 -------- d-----w- c:\windows\system32\CatRoot2
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-25 23:05 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-24 14:23 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-19 00:21 . 2009-06-19 00:21 -------- d-----w- c:\windows\system32\config\systemprofile\Application Data\Yahoo!
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-28 04:56 . 2009-06-19 23:49 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-20 17:03 . 2007-03-29 18:10 -------- d-----w- c:\program files\Java
2009-06-20 16:59 . 2009-01-11 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-19 21:05 . 2007-10-08 14:30 -------- d-----w- c:\program files\ScanSoft
2009-06-19 21:01 . 2007-03-29 18:13 -------- d-----w- c:\program files\Google
2009-06-19 20:31 . 2007-03-29 18:16 -------- d-----w- c:\program files\Compaq
2009-06-19 20:24 . 2007-10-08 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-06-19 15:48 . 2007-11-24 15:38 -------- d-----w- c:\program files\Yahoo!
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-22 11:52 . 2009-04-08 17:38 0 -c--a-w- c:\windows\Wqixivegohekev.bin
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-16 02:03 . 2009-04-08 17:38 408 -c--a-w- c:\windows\Uxekap.dat
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-06-25_19.32.44 )))))))))))))))))))))))))))))))))))))))))

.
+ 2009-06-25 19:33 . 2008-10-16 20:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 19:33 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 19:33 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 19:33 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 19:33 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 19:33 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 19:33 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 19:33 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 19:33 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 19:33 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 19:33 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-25 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://216.227.246.9:8063/activex/AMC.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-amo&p=
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 09:05
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-26 9:11
ComboFix-quarantined-files.txt 2009-06-26 14:11
ComboFix2.txt 2009-06-25 19:38

Pre-Run: 62,282,964,992 bytes free
Post-Run: 62,270,201,856 bytes free

369 --- E O F --- 2009-06-19 15:36

Hello.
Still more work to do.

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\Wqixivegohekev.bin
c:\windows\Uxekap.dat

Folder::
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

Firefox::
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.selectedEngine - Ask
FF - prefs.js: keyword.URL - hxxp://toolbar.ask.com/toolbarv/askRedirect?o=20008&gct=&gc=1&q=
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

Ok so here is the log, are we close it doesnt seem to be as bad as it was.
ComboFix 09-06-26.02 - Administrator 06/26/2009 21:10.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.643 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt

FILE ::
"c:\windows\Uxekap.dat"
"c:\windows\Wqixivegohekev.bin"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}\install.rdf
c:\windows\Uxekap.dat
c:\windows\Wqixivegohekev.bin

.
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-25 23:04 . 2009-06-25 23:04 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-06-25 23:02 . 2009-06-25 23:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-25 19:33 . 2009-06-25 19:33 -------- d-----w- c:\windows\system32\dllcache\cache
2009-06-23 21:41 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 21:41 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 17:00 . 2009-06-20 17:00 -------- d-----w- c:\program files\Sun
2009-06-19 23:48 . 2009-06-27 02:06 -------- d-----w- c:\windows\system32\CatRoot2
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-26 18:19 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-26 18:19 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe
2009-05-28 04:56 . 2009-06-19 23:49 -------- d-----w- c:\windows\system32\wbem\Repository

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-20 17:03 . 2007-03-29 18:10 -------- d-----w- c:\program files\Java
2009-06-20 16:59 . 2009-01-11 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-19 21:05 . 2007-10-08 14:30 -------- d-----w- c:\program files\ScanSoft
2009-06-19 21:01 . 2007-03-29 18:13 -------- d-----w- c:\program files\Google
2009-06-19 20:31 . 2007-03-29 18:16 -------- d-----w- c:\program files\Compaq
2009-06-19 20:24 . 2007-10-08 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-06-19 15:48 . 2007-11-24 15:38 -------- d-----w- c:\program files\Yahoo!
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-06-25_19.32.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-25 19:33 . 2008-10-16 20:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 19:33 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 19:33 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 19:33 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 19:33 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 19:33 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 19:33 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 19:33 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 19:33 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 19:33 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 19:33 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-27 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://216.227.246.9:8063/activex/AMC.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-amo&p=
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-26 21:21
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(744)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-27 21:28
ComboFix-quarantined-files.txt 2009-06-27 02:27
ComboFix2.txt 2009-06-26 14:11
ComboFix3.txt 2009-06-25 19:38

Pre-Run: 62,252,212,224 bytes free
Post-Run: 62,236,213,248 bytes free

219 --- E O F --- 2009-06-19 15:36

Hello.
I missed something about this infection, there's more than one folder.

Now open a new notepad file.
Input this into the notepad file:

Folder::
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-06-26.02 - Administrator 06/27/2009 13:01.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.958.538 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFScript.txt
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}\install.rdf
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome.manifest
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.js
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\content\ffjcext\ffjcext.xul
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\de-DE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\en-US\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\es-ES\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\fr-FR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\it-IT\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\ja-JP\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\ko-KR\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\sv-SE\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\zh-CN\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\chrome\locale\zh-TW\ffjcext\ffjcext.dtd
c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}\install.rdf

.
((((((((((((((((((((((((( Files Created from 2009-05-27 to 2009-06-27 )))))))))))))))))))))))))))))))
.

2009-06-25 23:04 . 2009-06-25 23:04 -------- d-----w- c:\documents and settings\LocalService\Application Data\Yahoo!
2009-06-25 23:02 . 2009-06-25 23:02 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-06-25 19:33 . 2009-06-25 19:33 -------- d-----w- c:\windows\system32\dllcache\cache
2009-06-23 21:41 . 2009-06-17 16:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 21:41 . 2009-06-23 21:41 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-23 21:41 . 2009-06-17 16:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-20 17:00 . 2009-06-20 17:00 -------- d-----w- c:\program files\Sun
2009-06-19 23:48 . 2009-06-27 02:32 -------- d-----w- c:\windows\system32\CatRoot2
2009-06-19 22:20 . 2008-12-11 13:38 159600 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
2009-06-19 22:19 . 2009-04-03 16:18 130936 ----a-w- c:\windows\system32\drivers\PCTCore.sys
2009-06-19 22:19 . 2008-12-18 17:16 73840 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
2009-06-19 22:19 . 2009-06-27 17:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\program files\Common Files\PC Tools
2009-06-19 22:19 . 2008-12-10 16:36 64392 ----a-w- c:\windows\system32\drivers\pctplsg.sys
2009-06-19 22:19 . 2009-06-26 18:19 -------- d-----w- c:\program files\Spyware Doctor
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\All Users\Application Data\PC Tools
2009-06-19 22:19 . 2009-06-19 22:19 -------- d-----w- c:\documents and settings\Administrator\Application Data\PC Tools
2009-06-19 20:06 . 2009-06-19 20:06 8997 ----a-w- c:\windows\system32\17286h5z9tool.bin
2009-06-18 23:22 . 2009-06-18 23:22 -------- d-----w- c:\program files\QuickTiming
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\documents and settings\All Users\Application Data\3DVIA
2009-06-16 17:08 . 2007-07-19 23:14 3727720 ----a-w- c:\windows\system32\d3dx9_35.dll
2009-06-16 17:08 . 2006-09-28 21:05 2414360 ----a-w- c:\windows\system32\d3dx9_31.dll
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\windows\Logs
2009-06-16 17:08 . 2009-06-16 17:08 -------- d-----w- c:\program files\Virtools
2009-05-30 21:17 . 2009-05-30 21:17 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Yahoo
2009-05-30 21:16 . 2009-05-30 21:16 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-05-30 21:15 . 2009-03-18 22:55 607472 ----a-w- c:\documents and settings\All Users\Application Data\Yahoo!\YUpdater\yupdater.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-25 19:05 . 2009-03-24 01:40 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-25 19:01 . 2009-03-24 01:40 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-25 18:53 . 2007-03-29 18:13 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-20 17:03 . 2007-03-29 18:10 -------- d-----w- c:\program files\Java
2009-06-20 16:59 . 2009-01-11 19:50 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-19 21:05 . 2007-10-08 14:30 -------- d-----w- c:\program files\ScanSoft
2009-06-19 21:01 . 2007-03-29 18:13 -------- d-----w- c:\program files\Google
2009-06-19 20:31 . 2007-03-29 18:16 -------- d-----w- c:\program files\Compaq
2009-06-19 20:24 . 2007-10-08 14:30 -------- d-----w- c:\documents and settings\All Users\Application Data\ScanSoft
2009-06-19 15:48 . 2007-11-24 15:38 -------- d-----w- c:\program files\Yahoo!
2009-05-30 21:15 . 2007-11-24 15:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
2009-05-07 15:32 . 2004-08-04 08:00 345600 ----a-w- c:\windows\system32\localspl.dll
2009-04-29 04:56 . 2004-08-04 08:00 827392 ----a-w- c:\windows\system32\wininet.dll
2009-04-29 04:55 . 2004-08-04 08:00 78336 ----a-w- c:\windows\system32\ieencode.dll
2009-04-19 15:13 . 2009-04-19 15:13 152576 -c--a-w- c:\documents and settings\Administrator\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-04-17 12:26 . 2004-08-04 08:00 1847168 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 14:51 . 2004-08-04 08:00 585216 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-12 00:07 . 2007-11-18 23:06 39336 -c--a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((( SnapShot@2009-06-25_19.32.44 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-06-27 15:31 . 2009-06-27 15:31 16384 c:\windows\Temp\Perflib_Perfdata_66c.dat
+ 2009-06-25 19:33 . 2008-10-16 20:09 51224 c:\windows\system32\dllcache\cache\wuauclt.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 82432 c:\windows\system32\dllcache\cache\ws2_32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 26112 c:\windows\system32\dllcache\cache\userinit.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 14336 c:\windows\system32\dllcache\cache\svchost.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 57856 c:\windows\system32\dllcache\cache\spoolsv.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 17408 c:\windows\system32\dllcache\cache\powrprof.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 13312 c:\windows\system32\dllcache\cache\lsass.exe
+ 2009-06-25 19:33 . 2008-04-13 18:39 24576 c:\windows\system32\dllcache\cache\kbdclass.sys
+ 2009-06-25 19:33 . 2008-04-13 18:53 36608 c:\windows\system32\dllcache\cache\ip6fw.sys
+ 2009-06-25 19:33 . 2008-04-14 00:12 15360 c:\windows\system32\dllcache\cache\ctfmon.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 507904 c:\windows\system32\dllcache\cache\winlogon.exe
+ 2009-06-25 19:33 . 2009-04-29 04:56 827392 c:\windows\system32\dllcache\cache\wininet.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 578560 c:\windows\system32\dllcache\cache\user32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 295424 c:\windows\system32\dllcache\cache\termsrv.dll
+ 2009-06-25 19:33 . 2008-06-20 11:51 361600 c:\windows\system32\dllcache\cache\tcpip.sys
+ 2009-06-25 19:33 . 2009-02-06 11:11 110592 c:\windows\system32\dllcache\cache\services.exe
+ 2009-06-25 19:33 . 2008-04-13 19:20 182656 c:\windows\system32\dllcache\cache\ndis.sys
+ 2009-06-25 19:33 . 2009-03-21 14:06 989696 c:\windows\system32\dllcache\cache\kernel32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 110080 c:\windows\system32\dllcache\cache\imm32.dll
+ 2009-06-25 19:33 . 2008-04-14 00:11 167936 c:\windows\system32\dllcache\cache\appmgmts.dll
+ 2009-06-25 19:33 . 2008-04-14 00:12 1614848 c:\windows\system32\dllcache\cache\sfcfiles.dll
+ 2009-06-25 19:33 . 2009-02-06 11:06 2145280 c:\windows\system32\dllcache\cache\ntoskrnl.exe
+ 2009-06-25 19:33 . 2009-02-06 10:32 2023936 c:\windows\system32\dllcache\cache\ntkrnlpa.exe
+ 2009-06-25 19:33 . 2008-04-14 00:12 1033728 c:\windows\system32\dllcache\cache\explorer.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"DW6"="c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2009-02-11 801904]
"Search Protection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2006-03-17 344064]
"PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2006-01-04 219648]
"SetRefresh"="c:\program files\Compaq\SetRefresh\SetRefresh.exe" [2003-11-20 525824]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2001-07-25 57344]
"LVCOMS"="c:\program files\Common Files\Logitech\QCDriver3\LVCOMS.EXE" [2002-12-10 127022]
"LogitechGalleryRepair"="c:\program files\Logitech\ImageStudio\ISStart.exe" [2002-12-10 155648]
"LogitechImageStudioTray"="c:\program files\Logitech\ImageStudio\LogiTray.exe" [2002-12-10 61440]
"CanonSolutionMenu"="c:\program files\Canon\SolutionMenu\CNSLMAIN.exe" [2007-05-15 644696]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2007-04-04 1603152]
"YSearchProtection"="c:\program files\Yahoo!\Search Protection\SearchProtection.exe" [2008-10-07 111856]
"FlyMonitor"="c:\program files\Leapfrog\FlyWorld\bin\FlyMonitor.exe" [2008-05-13 664904]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-04 185872]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 7\Drag to Disc\DrgToDsc.exe" [2004-01-28 1179648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
"ISTray"="c:\program files\Spyware Doctor\pctsTray.exe" [2009-06-12 1181576]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-20 148888]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-6-27 113664]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2007-5-13 212992]
Logitech Desktop Messenger.lnk - c:\program files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2007-5-14 169472]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
@=""

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\WINDOWS\\system32\\CIMSVR.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYMonitor.exe"=
"c:\\Program Files\\LeapFrog\\FlyWorld\\bin\\FLYWorld.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Sony\\Media Manager for PSP\\MediaManager.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [6/19/2009 5:19 PM 130936]
R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [6/19/2009 5:19 PM 348752]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [1/25/2008 5:38 PM 18560]
S3 NWUSBPort2;Novatel Wireless USB Status2 Port Driver;c:\windows\system32\drivers\nwusbser2.sys [4/19/2007 11:09 AM 99200]

--- Other Services/Drivers In Memory ---

*Deregistered* - mchInjDrv
.
Contents of the 'Scheduled Tasks' folder

2009-06-27 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job
- c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 17:20]
.
.
------- Supplementary Scan -------
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uInternet Connection Wizard,ShellNext = iexplore
IE: &Windows Live Search - c:\program files\Windows Live Toolbar\msntb.dll/search.htm
IE: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} - hxxp://216.227.246.9:8063/activex/AMC.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\ty36svtv.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-amo&p=
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\program files\Virtools\3D Life Player\npvirtools.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-27 13:13
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2526081773-1975879490-3789279395-500\Software\Sony Creative Software\M*e*d*i*a* *M*a*n*a*g*e*r* *f*o*r* *P*S*P*"!\3.0]
"Percents"="0 0.1262 0.2865 0.5488 0.7695 0.8496 0.8562 0.8562 "
"Increment"=".004630"
"FRT"="b/ng5VBtutJG3eua6DQZQ2+x4XweGqKOkDOUGEzy8Hqh9qIKaYBdfQ=="
"PLCK"="EH/lMORvPVE3PuVm/Pd4KsttqhMBugpG"
"PHSH"=""
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-06-27 13:19
ComboFix-quarantined-files.txt 2009-06-27 18:19
ComboFix2.txt 2009-06-27 02:28
ComboFix3.txt 2009-06-26 14:11
ComboFix4.txt 2009-06-25 19:38

Pre-Run: 62,213,152,768 bytes free
Post-Run: 62,231,228,416 bytes free

242 --- E O F --- 2009-06-19 15:36

Hello.
Please delete this file in bold:

c:\windows\system32\17286h5z9tool.bin

You aren't running Anti Virus Software

Please install Avira antivirus otherwise you won't be protected.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.

It is strongly recommended that you run only one antivirus program at a time. Having more than one antivirus program active in memory uses additional resources and can result in program conflicts and false virus alerts.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

Much Better! Thank very much, your the best