System Security 2009, half removed

Okay, sorry about the long response time, i've been out of state for the last few days. Here is that log file:

DDS (Ver_09-06-26.01) - NTFSx86
Run by Mitam at 13:57:52.21 on Fri 07/17/2009
Internet Explorer: 8.0.6001.18783
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.1982.1325 [GMT -5:00]

SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\rundll32.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\Explorer.EXE
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Windows\system32\svchost.exe -k bthsvcs
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\AIM6\aim6.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\System32\svchost.exe -k HPZ12
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Windows\system32\svchost.exe -k WindowsMobile
C:\Windows\system32\taskeng.exe
C:\Users\Mitam\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\progra~1\java\jre16~1.0_0\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\windows\windowsmobile\INetRepl.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} - hxxp://download.microsoft.com/download/e/4/9/e494c802-dd90-4c6b-a074-469358f075a6/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL

================= FIREFOX ===================

FF - ProfilePath - c:\users\mitam\appdata\roaming\mozilla\firefox\profiles\r1utmayd.default\
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - plugin: c:\users\mitam\appdata\roaming\move networks\plugins\npqmp071503000010.dll

============= SERVICES / DRIVERS ===============

R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2005-8-2 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-10-29 24652]

=============== Created Last 30 ================

2009-07-13 19:49 --ds---- C:\winlogon
2009-07-13 19:49 318,976 a------- c:\windows\system32\CF1991.exe
2009-07-13 19:14 219,648 a------- c:\windows\PEV.exe
2009-07-13 19:14 161,792 a------- c:\windows\SWREG.exe
2009-07-13 19:14 98,816 a------- c:\windows\sed.exe
2009-07-13 19:14 318,976 a------- c:\windows\system32\CF27901.exe
2009-07-12 18:47 --d----- c:\programdata\Spybot - Search & Destroy
2009-07-12 18:47 --d----- c:\program files\Spybot - Search & Destroy
2009-07-12 18:47 --d----- c:\progra~2\Spybot - Search & Destroy
2009-07-11 14:08 --d----- c:\users\mitam\appdata\roaming\Malwarebytes
2009-07-11 14:07 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 14:07 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-07-11 14:07 --d----- c:\programdata\Malwarebytes
2009-07-11 14:07 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 14:07 --d----- c:\progra~2\Malwarebytes
2009-07-10 16:11 --d----- c:\programdata\19924624
2009-07-10 16:11 --d----- c:\progra~2\19924624
2009-07-09 10:45 81 a------- C:\CTX.DAT
2009-07-09 10:45 --d----- c:\users\mitam\Citrix
2009-07-08 03:20 --d----- c:\program files\AviSynth 2.5
2009-07-08 03:20 --d----- c:\program files\Red Kawa
2009-07-08 03:18 --d----- c:\users\mitam\appdata\roaming\AVS4YOU
2009-07-08 03:18 --d----- c:\programdata\AVS4YOU
2009-07-08 03:18 --d----- c:\progra~2\AVS4YOU
2009-07-08 03:17 974,848 a------- c:\windows\system32\mfc70.dll
2009-07-08 03:17 --d----- c:\program files\common files\AVSMedia
2009-07-08 03:17 1,700,352 a------- c:\windows\system32\GdiPlus.dll
2009-07-08 03:17 24,576 a------- c:\windows\system32\msxml3a.dll
2009-07-08 03:17 --d----- c:\program files\AVS4YOU
2009-06-24 18:00 --d----- c:\programdata\acccore
2009-06-24 18:00 --d----- c:\progra~2\acccore
2009-06-24 17:59 --d----- c:\program files\AIM6
2009-06-24 11:03 --d----- c:\program files\CamStudio
2009-06-23 14:38 --d----- c:\users\mitam\appdata\roaming\Pamela
2009-06-23 14:38 176,128 a------- c:\windows\system32\RemoteControl.dll
2009-06-23 14:38 --d----- c:\program files\Pamela
2009-06-23 13:50 56 a---h--- c:\windows\system32\ezsidmv.dat
2009-06-23 13:48 --d--r-- c:\program files\Skype
2009-06-23 13:47 --d----- c:\programdata\Skype
2009-06-19 13:16 156,160 a------- c:\windows\system32\msls31.dll
2009-06-19 12:54 55,918 a------- c:\programdata\nvModes.dat
2009-06-19 12:54 55,918 a------- c:\progra~2\nvModes.dat
2009-06-19 12:43 105,016 a------- c:\windows\system32\PresentationCFFRasterizerNative_v0300.dll
2009-06-19 12:43 97,800 a------- c:\windows\system32\infocardapi.dll
2009-06-19 12:43 622,080 a------- c:\windows\system32\icardagt.exe
2009-06-19 12:43 43,544 a------- c:\windows\system32\PresentationHostProxy.dll
2009-06-19 12:43 37,384 a------- c:\windows\system32\infocardcpl.cpl
2009-06-19 12:43 11,264 a------- c:\windows\system32\icardres.dll
2009-06-19 12:43 781,344 a------- c:\windows\system32\PresentationNative_v0300.dll
2009-06-19 12:43 326,160 a------- c:\windows\system32\PresentationHost.exe
2009-06-19 12:29 96,760 a------- c:\windows\system32\dfshim.dll
2009-06-19 12:29 282,112 a------- c:\windows\system32\mscoree.dll
2009-06-19 12:29 41,984 a------- c:\windows\system32\netfxperf.dll
2009-06-19 12:28 158,720 a------- c:\windows\system32\mscorier.dll
2009-06-19 12:28 83,968 a------- c:\windows\system32\mscories.dll

==================== Find3M ====================

2009-06-19 12:55 143,360 a------- c:\windows\inf\infstrng.dat
2009-06-19 12:55 51,200 a------- c:\windows\inf\infpub.dat
2009-06-19 12:55 86,016 a------- c:\windows\inf\infstor.dat
2009-06-19 01:03 13,025 a------- c:\users\mitam\appdata\roaming\nvModes.dat
2009-05-09 00:50 915,456 a------- c:\windows\system32\wininet.dll
2009-05-09 00:34 71,680 a------- c:\windows\system32\iesetup.dll
2009-04-23 07:43 784,896 a------- c:\windows\system32\rpcrt4.dll
2009-04-23 07:42 636,928 a------- c:\windows\system32\localspl.dll
2009-04-21 06:55 2,033,152 a------- c:\windows\system32\win32k.sys
2009-01-30 13:29 174 a--sh--- c:\program files\desktop.ini
2009-01-30 13:02 665,600 a------- c:\windows\inf\drvindex.dat
2009-01-07 13:51 60,744 a------- c:\users\mitam\g2mdlhlpx.exe
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 07:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 07:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 04:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 04:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 13:59:12.16 ===============

Please download the OTMoveIt by OldTimer.

• Save it to your desktop.
  
• Please double-click OTM.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\windows\PEV.exe
  c:\windows\sed.exe
  c:\programdata\19924624
  c:\progra~2\19924624
  
  
  
  
• Return to OTMoveIt, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.



Also, run another Malwarebytes scan and post the log back here.

OTMOVEIT Log:

========== FILES ==========
c:\windows\PEV.exe moved successfully.
c:\windows\sed.exe moved successfully.
c:\programdata\19924624 moved successfully.
File/Folder c:\progra~2\19924624 not found.

OTM by OldTimer - Version 3.0.0.5 log created on 07182009_140012


Malwarebytes Scan to come

Here is a quick scan from Malwarebytes:

Malwarebytes' Anti-Malware 1.39
Database version: 2461
Windows 6.0.6001 Service Pack 1

7/18/2009 2:14:11 PM
mbam-log-2009-07-18 (14-14-07).txt

Scan type: Quick Scan
Objects scanned: 77922
Time elapsed: 3 minute(s), 52 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\UAC (Rootkit.Trace) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

I'm going to run a full scan to be sure. I deleted/quarantined the above infection (in the previous post)

How is the computer running?

Okay, here is the full scan:

Malwarebytes' Anti-Malware 1.39
Database version: 2461
Windows 6.0.6001 Service Pack 1

7/19/2009 12:17:47 PM
mbam-log-2009-07-19 (12-17-47).txt

Scan type: Full Scan (C:\|)
Objects scanned: 230039
Time elapsed: 50 minute(s), 39 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 9

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\Qoobox\quarantine\C\WINDOWS\System32\hjgruitokuefos.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\hjgruiwsppjawh.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACaeqscdppqgrwqacut.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACbvvtctrkeaqnpqcdy.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACopfqiriikhrtqwtuk.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACpqwenvvexbbdovrmm.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\UACyxttlgbnwntelbxvf.dll.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\drivers\hjgruiiruywbpm.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.
c:\Qoobox\quarantine\C\WINDOWS\System32\drivers\UACrfpcepyixmnmdyerl.sys.vir (Trojan.TDSS) -> Quarantined and deleted successfully.


Computer is still running a little slow

How is the computer running?

The computer is running better than it was when we first started.
I can open Adobe now, i don't get redirected to random sites, and
internet explorer isn't popping up at random times! Although
it seems like every time i run Malwarebytes i have more viruses.

See if you can run ComboFix now:

• Download combofix from here
  Link 1
  Link 2
  

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. We need to disable your local AV (Anti-virus) before running Combofix.

• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouse click combofix's window whilst it's running. That may cause it to stall.
  

Combo fix ran smoothly this time. Here is the long:

ComboFix 09-07-19.04 - Mitam 07/20/2009 13:01.3.2 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.1982.1199 [GMT -5:00]
Running from: c:\users\Mitam\Desktop\Combo-Fix.exe
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\$recycle.bin\S-1-5-21-2954942239-3376670357-2783907261-500
c:\$recycle.bin\S-1-5-21-4003641115-3550914113-3698931782-500
C:\WinLogon
c:\winlogon\catch_k.dat
c:\winlogon\CfReboot.dat
c:\winlogon\d-del2A.dat
c:\winlogon\d-del4AV.dat
c:\winlogon\drev.dat
c:\winlogon\ErrTrap1
c:\winlogon\mtee.cfexe
c:\winlogon\MUI
c:\winlogon\MWindows.dat
c:\winlogon\mynul.dat
c:\winlogon\mypictures.folder.dat
c:\winlogon\n.pif
c:\winlogon\N_\11032
c:\winlogon\N_\11255
c:\winlogon\N_\12467
c:\winlogon\N_\12797
c:\winlogon\N_\15600
c:\winlogon\N_\17644
c:\winlogon\N_\17763
c:\winlogon\N_\1806
c:\winlogon\N_\18382
c:\winlogon\N_\19282
c:\winlogon\N_\21061
c:\winlogon\N_\23244
c:\winlogon\N_\24002
c:\winlogon\N_\25245
c:\winlogon\N_\27881
c:\winlogon\N_\30564
c:\winlogon\N_\31479
c:\winlogon\N_\31494
c:\winlogon\N_\4221
c:\winlogon\N_\7031
c:\winlogon\ND_.bat
c:\winlogon\ndis_combofix.dat
c:\winlogon\netsvc.bad.dat
c:\winlogon\netsvc.dat
c:\winlogon\NetworkService.dat
c:\winlogon\NirCmd.cfexe
c:\winlogon\NircmdB.exe
c:\winlogon\NirCmdC.cfexe
c:\winlogon\NlsLanguageDefault
c:\winlogon\notifykeys.dat
c:\winlogon\NT-OS.cmd
c:\winlogon\NULL
c:\winlogon\Ori04
c:\winlogon\OriO4
c:\winlogon\OsId.txt
c:\winlogon\OSid.vbs
c:\winlogon\OsVer
c:\winlogon\patched.af
c:\winlogon\PathSearch
c:\winlogon\pend.txt
c:\winlogon\pev.cfexe
c:\winlogon\pev.exe
c:\winlogon\Policies.dat
c:\winlogon\PreDIR
c:\winlogon\Prep.inf
c:\winlogon\Profiles.Folder.dat
c:\winlogon\progfile.dat
c:\winlogon\Purity.dat
c:\winlogon\PV.cfexe
c:\winlogon\RCLink.dat
c:\winlogon\RcVer00
c:\winlogon\REGDACL.sed
c:\winlogon\RegDo.sed
c:\winlogon\region.dat
c:\winlogon\RegScan.cmd
c:\winlogon\regt.cfexe
c:\winlogon\RenVDel.dat
c:\winlogon\Resident.txt
c:\winlogon\RkDetectAA_tdssserv.dat
c:\winlogon\Rkey.cmd
c:\winlogon\rogues.dat
c:\winlogon\run.sed
c:\winlogon\run2.sed
c:\winlogon\Rust.str
c:\winlogon\safeboot.dat
c:\winlogon\safeboot.def.dat
c:\winlogon\safeboot.def.vista.dat
c:\winlogon\sed.cfexe
c:\winlogon\SetEnvmt.bat
c:\winlogon\SetPath.bat
c:\winlogon\setpath.cfexe
c:\winlogon\sfx.cmd
c:\winlogon\SnapShot.cmd
c:\winlogon\SRestore.cmd
c:\winlogon\srizbi.md5
c:\winlogon\startup.folder.dat
c:\winlogon\SuppScan.cmd
c:\winlogon\SuspectB_netsvc.dat
c:\winlogon\SuspectLegacy
c:\winlogon\suspectSvc.dat
c:\winlogon\svc_wht.dat
c:\winlogon\SvcCovered
c:\winlogon\SvcDiff
c:\winlogon\SvcDrv.vbs
c:\winlogon\SvcDump
c:\winlogon\SvcDumpB
c:\winlogon\SvcDumpFull
c:\winlogon\SvcFull
c:\winlogon\svchost.dat
c:\winlogon\svclist.dat
c:\winlogon\SvcTarget.dat
c:\winlogon\SWREG.cfexe
c:\winlogon\swreg.exe
c:\winlogon\swsc.cfexe
c:\winlogon\swxcacls.cfexe
c:\winlogon\SysPath.dat
c:\winlogon\system_ini.dat
c:\winlogon\tail.cfexe
c:\winlogon\temp2000
c:\winlogon\temp4900
c:\winlogon\temp4901
c:\winlogon\templates.folder.dat
c:\winlogon\toolbar.sed
c:\winlogon\unhand.dat
c:\winlogon\UploadThese
c:\winlogon\V-FilesB.dat
c:\winlogon\v-tmp.dat
c:\winlogon\v_str.dat
c:\winlogon\v_wht.dat
c:\winlogon\version.txt
c:\winlogon\Vista.mac
c:\winlogon\vRun_DLL
c:\winlogon\w_sock.dll
c:\winlogon\whitedir.dat
c:\winlogon\whitedirCreated.dat
c:\winlogon\Windir.dat
c:\winlogon\Wmi_rem.vbs
c:\winlogon\WrgNameDLL
c:\winlogon\wtf_tdssservB
c:\winlogon\zDomain.dat
c:\winlogon\zhsvc.dat
c:\winlogon\zip.cfexe
c:\winlogon\Zlob01

.
((((((((((((((((((((((((( Files Created from 2009-06-20 to 2009-07-20 )))))))))))))))))))))))))))))))
.

2009-07-20 18:07 . 2009-07-20 18:07 -------- d-----w- c:\users\Mitam\AppData\Local\temp
2009-07-20 18:07 . 2009-07-20 18:07 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2009-07-18 19:02 . 2009-07-18 19:02 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-18 19:00 . 2009-07-18 19:00 -------- d-----w- C:\_OTM
2009-07-16 14:34 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 14:34 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 14:34 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 14:34 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 23:47 . 2009-07-12 23:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-12 23:47 . 2009-07-12 23:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-11 19:08 . 2009-07-11 19:08 -------- d-----w- c:\users\Mitam\AppData\Roaming\Malwarebytes
2009-07-11 19:07 . 2009-07-13 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 19:07 . 2009-07-18 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 19:07 . 2009-07-13 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 19:07 . 2009-07-11 19:07 -------- d-----w- c:\programdata\Malwarebytes
2009-07-11 19:02 . 2009-07-11 19:02 680 ----a-w- c:\users\Mitam\AppData\Local\d3d9caps.dat
2009-07-10 04:30 . 2009-07-10 04:30 127872 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\uninstall.exe
2009-07-10 04:30 . 2009-07-10 04:31 -------- d-----w- c:\users\Mitam\AppData\Roaming\Move Networks
2009-07-09 15:45 . 2009-07-09 15:45 81 ----a-w- C:\CTX.DAT
2009-07-09 15:45 . 2009-07-09 15:45 -------- d-----w- c:\users\Mitam\Citrix
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\AviSynth 2.5
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\Red Kawa
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\users\Mitam\AppData\Roaming\AVS4YOU
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\programdata\AVS4YOU
2009-07-08 08:17 . 2009-07-08 08:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-08 08:17 . 2008-08-13 16:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-07-08 08:17 . 2009-07-08 08:20 -------- d-----w- c:\program files\AVS4YOU
2009-07-08 08:17 . 2008-08-13 16:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-07-08 08:17 . 2008-08-13 16:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-25 17:30 . 2009-06-25 17:40 4506256 ----a-w- c:\users\Mitam\AppData\Roaming\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
2009-06-24 23:02 . 2009-06-24 23:02 -------- d-----w- c:\users\Mitam\AppData\Roaming\acccore
2009-06-24 23:01 . 2009-06-24 23:01 -------- d-----w- c:\users\Mitam\AppData\Local\AOL OCP
2009-06-24 23:00 . 2009-06-24 23:00 -------- d-----w- c:\programdata\acccore
2009-06-24 22:59 . 2009-06-24 23:00 -------- d-----w- c:\program files\AIM6
2009-06-24 16:03 . 2009-06-24 19:00 -------- d-----w- c:\program files\CamStudio
2009-06-23 19:38 . 2009-06-23 19:41 -------- d-----w- c:\users\Mitam\AppData\Roaming\Pamela
2009-06-23 19:38 . 2009-06-23 19:38 176128 ----a-w- c:\windows\system32\RemoteControl.dll
2009-06-23 19:38 . 2009-06-23 19:38 -------- d-----w- c:\program files\Pamela
2009-06-23 18:50 . 2009-06-23 18:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-23 18:50 . 2009-07-11 18:24 -------- d-----w- c:\users\Mitam\AppData\Roaming\skypePM
2009-06-23 18:48 . 2009-07-10 21:27 -------- d-----w- c:\users\Mitam\AppData\Roaming\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----w- c:\program files\Common Files\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----r- c:\program files\Skype
2009-06-23 18:47 . 2009-06-23 18:48 -------- d-----w- c:\programdata\Skype

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-20 17:42 . 2009-06-19 17:54 55918 ----a-w- c:\programdata\nvModes.dat
2009-07-20 04:06 . 2009-02-07 15:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-17 01:28 . 2008-10-24 06:58 -------- d-----w- c:\program files\LimeWire
2009-07-16 14:42 . 2008-10-24 06:14 -------- d-----w- c:\users\Mitam\AppData\Roaming\Azureus
2009-07-12 06:32 . 2008-10-24 07:42 -------- d-----w- c:\program files\Warcraft III
2009-07-10 04:30 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-06-24 23:00 . 2008-10-29 20:05 -------- d-----w- c:\programdata\Viewpoint
2009-06-24 22:59 . 2008-10-29 20:05 -------- d-----w- c:\program files\Common Files\AOL
2009-06-20 08:02 . 2008-10-24 03:34 76984 ----a-w- c:\users\Mitam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-19 18:50 . 2008-10-24 07:55 -------- d-----w- c:\programdata\NVIDIA
2009-06-19 18:03 . 2008-07-14 02:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-19 18:00 . 2008-07-14 02:55 -------- d-----w- c:\program files\Microsoft Works
2009-06-19 06:03 . 2008-10-24 07:57 13025 ----a-w- c:\users\Mitam\AppData\Roaming\nvModes.dat
2009-06-17 04:45 . 2009-06-17 04:45 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 22:05 . 2008-10-24 06:58 -------- d-----w- c:\users\Mitam\AppData\Roaming\LimeWire
2009-06-09 17:00 . 2009-06-02 19:58 -------- d-----w- c:\programdata\FLEXnet
2009-06-02 19:54 . 2008-07-14 03:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 05:50 . 2009-06-19 18:18 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-19 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-11 06:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-12 19:30 . 2008-10-24 06:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mitam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Mitam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9D7A51B4-1ADE-4856-B496-3C398698BF01}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80DD3954-7E43-49A8-A599-BD740C0EACDE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73F8EB6E-7E17-4725-9182-B38B7283DA0C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{A7DB3633-1AA8-4129-8FC4-53D2B15DDCBD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{859BFBF2-8299-4F19-8F89-638C280BC252}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{56C3BF16-0580-478A-9DB5-C2D10146020E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5E8A0479-9B27-452D-AAEC-37D0C4F6AFC8}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{17E010E9-F214-46EB-ADB8-593154CA519E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{606E5035-9832-4170-9280-9B9B79044CE1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{19373767-1236-480A-8416-4909E02376F1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0D5F17B6-FB99-4C45-8A27-095A18602B7C}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0F232F3B-E633-456A-8794-0C458C5DAA85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBBD76F9-6810-40BC-A156-BCA1C7CC0F7B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F6F4509-14D8-4693-8582-7B5AE64F6B48}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{AF7C0D04-74D2-4711-ACB9-203BFFE75E6B}c:\\program files\\vuze\\azureus.exe"= UDP:c:\program files\vuze\azureus.exe:Azureus
"UDP Query User{577555FB-3FBC-4F43-84F1-406D41ACFE61}c:\\program files\\vuze\\azureus.exe"= TCP:c:\program files\vuze\azureus.exe:Azureus
"{DE4314D7-2351-4345-A1BA-A4400E245E94}"= UDP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"{0BD380BC-B3EB-4564-9A6F-1FF263735333}"= TCP:c:\program files\LimeWire\LimeWire.exe:LimeWire
"TCP Query User{5518BBB3-AFFE-4D97-9DDC-D1FDA0DEDF5A}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{374C5C6B-D5E9-4FF4-8301-01D549041FF7}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{CDF50E01-77A5-4FF1-A8DF-4D0089D9D37B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7485E0E5-5A0B-4C0B-9D2E-C13AA7AA1316}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F81C8404-E972-4213-816F-9D2AC8D95575}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{501D2856-05FC-487B-9686-11011CDB682A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E5AFD565-800F-4FF1-B3CF-F65F9A4F1A09}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{969F0BA1-AA22-46AF-96B8-C33449FB0BB5}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{A3B9F169-42F4-4A8E-9E6A-A9B4CC9A990D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B3B4CA29-05CC-47A8-843E-6284A9DF4ABF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{73DA009F-4370-4D31-8E5C-2D4A8E13CAF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B3535CEF-7740-4B21-8FC9-269A4EE51717}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{441013F6-DEB1-4C4E-B611-8DDD4A2D6E40}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{51CAFA8E-73A8-4220-A3AD-FD729A765304}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{91644312-00F8-41DA-925B-D15DC7A41F48}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB4A6135-FC6A-4645-B657-40DA3D9471A4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C79DB1F1-7277-4487-9F8B-0ADE5C9EB14A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F6405534-88E5-4EA2-9698-01D75031CC00}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B11E90E3-0245-4E8C-B22C-7D51C1748B0F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{352DB064-03A4-40E8-8A34-774910FA7BBA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{11420C5A-AC8E-4FA4-9A2A-B09D2113ED9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C659DDF-DBB2-40E4-BD24-65181AA1835A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6210DD36-0D54-481E-BCD7-28B50923CAD1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8AB07A11-330B-446A-A638-C7FB7BFDC22F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3785C76A-AA33-443C-9447-CE2A4A5AA3DE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0465D557-C130-4C98-B986-671BCBC96E83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{571A3EC3-FEEC-4EF9-91D6-226076CE6DAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{96119DC4-3517-409C-BD3A-B4AE2510F6DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{608EAB65-E4A8-4B61-887B-8D7939DE4955}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FC525F68-15FD-4412-83AF-41B62F7E3A88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8A4B07E3-F3C8-4B7E-8A3B-89BC5B675F24}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EAACC13B-D578-43AD-BE37-CBF2D1E8632D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EACA67FC-9A53-4B47-BEEF-98DCAF9255E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B269906B-3804-469B-93AA-74BE7B4FE88D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F62F350-7962-4A39-AB7D-23E8DB5654EE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2A5861F-37D8-4B75-8D5A-BFB43F7FA6BD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A760EAAA-D37C-432C-B71A-E9046ED64450}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{26A6B476-0055-4021-851B-CF2FD0B8BB17}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1C8C36E5-A389-4843-AAF0-480023103836}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8BC1E25-FDC3-4285-9D8F-15AD5B985C43}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DE5C24D-6790-4B79-9471-11A836398E98}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A3F35C3A-DE3D-4204-AE6B-35A73B6D2A91}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EEA1B18F-5CB6-47F6-8692-9CC6360CC4DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F230D5BC-21BE-4F5B-B6E6-E3BDE32DE202}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F645FE1-5621-481E-A6F0-29E43299D856}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B1E6354F-15D5-4C49-9D42-0D3DE86E68EB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9E1E4BF-2807-4F0E-B3FE-7D9AC37F2B6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32CEC970-7B9D-4C97-AD99-36F62F2F027A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF28384C-A20B-4379-AF2C-72754BB16B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/29/2008 3:05 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.

------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Mitam\AppData\Roaming\Mozilla\Firefox\Profiles\r1utmayd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-20 13:07
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-20 13:10
ComboFix-quarantined-files.txt 2009-07-20 18:10

Pre-Run: 43,290,333,184 bytes free
Post-Run: 43,300,876,288 bytes free

388 --- E O F --- 2009-07-20 17:31

Now open a new notepad file.
Input this into the notepad file:

Folder::
c:\program files\LimeWire
c:\programdata\Viewpoint

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"TCP Query User{AF7C0D04-74D2-4711-ACB9-203BFFE75E6B}c:\\program files\\vuze\\azureus.exe"=-
"UDP Query User{577555FB-3FBC-4F43-84F1-406D41ACFE61}c:\\program files\\vuze\\azureus.exe"=-
"{DE4314D7-2351-4345-A1BA-A4400E245E94}"=-
"{0BD380BC-B3EB-4564-9A6F-1FF263735333}"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-07-20.05 - Mitam 07/21/2009 14:06.4.2 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.1982.1077 [GMT -5:00]
Running from: c:\users\Mitam\Desktop\Combo-Fix.exe
Command switches used :: c:\users\Mitam\Desktop\CFScript.txt
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\LimeWire
c:\program files\LimeWire\clink.jar
c:\program files\LimeWire\commons-httpclient.jar
c:\program files\LimeWire\commons-logging.jar
c:\program files\LimeWire\commons-net.jar
c:\program files\LimeWire\COPYING
c:\program files\LimeWire\daap.jar
c:\program files\LimeWire\data.ser
c:\program files\LimeWire\donotremove.htm
c:\program files\LimeWire\GenericWindowsUtils.dll
c:\program files\LimeWire\hashes
c:\program files\LimeWire\hs_err_pid3624.log
c:\program files\LimeWire\hs_err_pid3920.log
c:\program files\LimeWire\hs_err_pid3984.log
c:\program files\LimeWire\hs_err_pid4072.log
c:\program files\LimeWire\i18n.jar
c:\program files\LimeWire\icu4j.jar
c:\program files\LimeWire\id3v2.jar
c:\program files\LimeWire\install.log
c:\program files\LimeWire\jcraft.jar
c:\program files\LimeWire\jl011.jar
c:\program files\LimeWire\jmdns.jar
c:\program files\LimeWire\language.prop
c:\program files\LimeWire\LimeWire On Startup.lnk
c:\program files\LimeWire\LimeWire.exe
c:\program files\LimeWire\LimeWire.ico
c:\program files\LimeWire\LimeWire.jar
c:\program files\LimeWire\LimeWire20.dll
c:\program files\LimeWire\log4j.jar
c:\program files\LimeWire\log4j.properties
c:\program files\LimeWire\looks.jar
c:\program files\LimeWire\MessagesBundle.properties
c:\program files\LimeWire\MessagesBundles.jar
c:\program files\LimeWire\mp3sp14.jar
c:\program files\LimeWire\pmf.ico
c:\program files\LimeWire\ProgressTabs.jar
c:\program files\LimeWire\root\magnet10\badge.img
c:\program files\LimeWire\root\magnet10\canHandle.img
c:\program files\LimeWire\root\magnet10\limewire.gif
c:\program files\LimeWire\root\magnet10\options.js
c:\program files\LimeWire\root\magnet10\silentdetect.js
c:\program files\LimeWire\SOURCE
c:\program files\LimeWire\spacer.gif
c:\program files\LimeWire\themes.jar
c:\program files\LimeWire\tritonus.jar
c:\program files\LimeWire\uninstall.exe
c:\program files\LimeWire\update.ver
c:\program files\LimeWire\vorbis.jar
c:\program files\LimeWire\WindowsFirewall.dll
c:\program files\LimeWire\WindowsV5PlusUtils.dll
c:\program files\LimeWire\xerces.jar
c:\program files\LimeWire\xml-apis.jar
c:\program files\LimeWire\xml.war
c:\programdata\Viewpoint

.
((((((((((((((((((((((((( Files Created from 2009-06-21 to 2009-07-21 )))))))))))))))))))))))))))))))
.

2009-07-21 19:12 . 2009-07-21 19:12 -------- d-----w- c:\users\Mitam\AppData\Local\temp
2009-07-21 19:12 . 2009-07-21 19:12 -------- d-----w- c:\windows\system32\config\systemprofile\AppData\Local\temp
2009-07-21 00:19 . 2008-12-03 05:41 38200 ----a-w- c:\users\Mitam\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-07-18 19:02 . 2009-07-18 19:02 3775176 ----a-w- c:\programdata\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-07-18 19:00 . 2009-07-18 19:00 -------- d-----w- C:\_OTM
2009-07-16 14:34 . 2009-06-15 15:24 156672 ----a-w- c:\windows\system32\t2embed.dll
2009-07-16 14:34 . 2009-06-15 15:20 72704 ----a-w- c:\windows\system32\fontsub.dll
2009-07-16 14:34 . 2009-06-15 15:20 10240 ----a-w- c:\windows\system32\dciman32.dll
2009-07-16 14:34 . 2009-06-15 12:52 289792 ----a-w- c:\windows\system32\atmfd.dll
2009-07-12 23:47 . 2009-07-12 23:52 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-07-12 23:47 . 2009-07-12 23:47 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2009-07-11 19:08 . 2009-07-11 19:08 -------- d-----w- c:\users\Mitam\AppData\Roaming\Malwarebytes
2009-07-11 19:07 . 2009-07-13 18:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-07-11 19:07 . 2009-07-18 19:04 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-07-11 19:07 . 2009-07-13 18:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-11 19:07 . 2009-07-11 19:07 -------- d-----w- c:\programdata\Malwarebytes
2009-07-11 19:02 . 2009-07-11 19:02 680 ----a-w- c:\users\Mitam\AppData\Local\d3d9caps.dat
2009-07-10 04:30 . 2009-07-10 04:30 127872 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\uninstall.exe
2009-07-10 04:30 . 2009-07-10 04:31 -------- d-----w- c:\users\Mitam\AppData\Roaming\Move Networks
2009-07-09 15:45 . 2009-07-09 15:45 81 ----a-w- C:\CTX.DAT
2009-07-09 15:45 . 2009-07-09 15:45 -------- d-----w- c:\users\Mitam\Citrix
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\AviSynth 2.5
2009-07-08 08:20 . 2009-07-08 08:20 -------- d-----w- c:\program files\Red Kawa
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\users\Mitam\AppData\Roaming\AVS4YOU
2009-07-08 08:18 . 2009-07-08 08:18 -------- d-----w- c:\programdata\AVS4YOU
2009-07-08 08:17 . 2009-07-08 08:18 -------- d-----w- c:\program files\Common Files\AVSMedia
2009-07-08 08:17 . 2008-08-13 16:22 974848 ----a-w- c:\windows\system32\mfc70.dll
2009-07-08 08:17 . 2009-07-08 08:20 -------- d-----w- c:\program files\AVS4YOU
2009-07-08 08:17 . 2008-08-13 16:22 1700352 ----a-w- c:\windows\system32\GdiPlus.dll
2009-07-08 08:17 . 2008-08-13 16:22 24576 ----a-w- c:\windows\system32\msxml3a.dll
2009-06-25 17:30 . 2009-06-25 17:40 4506256 ----a-w- c:\users\Mitam\AppData\Roaming\LimeWire\.NetworkShare\LimeWireWin4.16.6.exe
2009-06-24 23:02 . 2009-06-24 23:02 -------- d-----w- c:\users\Mitam\AppData\Roaming\acccore
2009-06-24 23:01 . 2009-06-24 23:01 -------- d-----w- c:\users\Mitam\AppData\Local\AOL OCP
2009-06-24 23:00 . 2009-06-24 23:00 -------- d-----w- c:\programdata\acccore
2009-06-24 22:59 . 2009-06-24 23:00 -------- d-----w- c:\program files\AIM6
2009-06-24 16:03 . 2009-06-24 19:00 -------- d-----w- c:\program files\CamStudio
2009-06-23 19:38 . 2009-06-23 19:41 -------- d-----w- c:\users\Mitam\AppData\Roaming\Pamela
2009-06-23 19:38 . 2009-06-23 19:38 176128 ----a-w- c:\windows\system32\RemoteControl.dll
2009-06-23 19:38 . 2009-06-23 19:38 -------- d-----w- c:\program files\Pamela
2009-06-23 18:50 . 2009-06-23 18:50 56 ---ha-w- c:\windows\system32\ezsidmv.dat
2009-06-23 18:50 . 2009-07-11 18:24 -------- d-----w- c:\users\Mitam\AppData\Roaming\skypePM
2009-06-23 18:48 . 2009-07-10 21:27 -------- d-----w- c:\users\Mitam\AppData\Roaming\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----w- c:\program files\Common Files\Skype
2009-06-23 18:48 . 2009-06-23 18:48 -------- d-----r- c:\program files\Skype
2009-06-23 18:47 . 2009-06-23 18:48 -------- d-----w- c:\programdata\Skype

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-21 18:59 . 2009-06-19 17:54 55918 ----a-w- c:\programdata\nvModes.dat
2009-07-21 15:50 . 2009-02-07 15:53 12 ----a-w- c:\windows\bthservsdp.dat
2009-07-16 14:42 . 2008-10-24 06:14 -------- d-----w- c:\users\Mitam\AppData\Roaming\Azureus
2009-07-12 06:32 . 2008-10-24 07:42 -------- d-----w- c:\program files\Warcraft III
2009-07-10 04:30 . 2009-06-16 06:35 4183416 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
2009-06-24 22:59 . 2008-10-29 20:05 -------- d-----w- c:\program files\Common Files\AOL
2009-06-20 08:02 . 2008-10-24 03:34 76984 ----a-w- c:\users\Mitam\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-19 18:50 . 2008-10-24 07:55 -------- d-----w- c:\programdata\NVIDIA
2009-06-19 18:03 . 2008-07-14 02:57 -------- d-----w- c:\programdata\Microsoft Help
2009-06-19 18:00 . 2008-07-14 02:55 -------- d-----w- c:\program files\Microsoft Works
2009-06-19 06:03 . 2008-10-24 07:57 13025 ----a-w- c:\users\Mitam\AppData\Roaming\nvModes.dat
2009-06-17 04:45 . 2009-06-17 04:45 -------- d-----w- c:\program files\Microsoft Silverlight
2009-06-16 06:35 . 2009-06-16 06:35 97144 ----a-w- c:\users\Mitam\AppData\Roaming\Move Networks\ie_bin\MovePlayerUpgrade.exe
2009-06-10 22:05 . 2008-10-24 06:58 -------- d-----w- c:\users\Mitam\AppData\Roaming\LimeWire
2009-06-09 17:00 . 2009-06-02 19:58 -------- d-----w- c:\programdata\FLEXnet
2009-06-02 19:54 . 2008-07-14 03:17 -------- d-----w- c:\program files\Common Files\Adobe
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Macrovision Shared
2009-06-02 19:50 . 2009-06-02 19:50 -------- d-----w- c:\program files\Common Files\Adobe AIR
2009-05-09 05:50 . 2009-06-19 18:18 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-09 05:34 . 2009-06-19 18:18 71680 ----a-w- c:\windows\system32\iesetup.dll
2009-04-23 12:43 . 2009-06-11 06:46 784896 ----a-w- c:\windows\system32\rpcrt4.dll
2009-04-23 12:42 . 2009-06-11 06:46 636928 ----a-w- c:\windows\system32\localspl.dll
2009-06-12 19:30 . 2008-10-24 06:03 134648 ----a-w- c:\program files\mozilla firefox\components\brwsrcmp.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-07-20_18.08.15 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-07-20 16:20 . 2009-07-20 16:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-21 16:17 . 2009-07-21 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2009-07-21 16:17 . 2009-07-21 16:17 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-20 16:20 . 2009-07-20 16:20 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Aim6"="c:\program files\AIM6\aim6.exe" [2009-05-19 49968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-03-01 472776]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"Launcher"="c:\windows\SMINST\launcher.exe" [2006-11-08 44128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Adobe Reader Synchronizer.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Reader Synchronizer.lnk
backup=c:\windows\pss\Adobe Reader Synchronizer.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^Mitam^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OneNote 2007 Screen Clipper and Launcher.lnk]
path=c:\users\Mitam\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Screen Clipper and Launcher.lnk
backup=c:\windows\pss\OneNote 2007 Screen Clipper and Launcher.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{9D7A51B4-1ADE-4856-B496-3C398698BF01}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{80DD3954-7E43-49A8-A599-BD740C0EACDE}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{73F8EB6E-7E17-4725-9182-B38B7283DA0C}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{A7DB3633-1AA8-4129-8FC4-53D2B15DDCBD}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{859BFBF2-8299-4F19-8F89-638C280BC252}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{56C3BF16-0580-478A-9DB5-C2D10146020E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5E8A0479-9B27-452D-AAEC-37D0C4F6AFC8}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{17E010E9-F214-46EB-ADB8-593154CA519E}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{606E5035-9832-4170-9280-9B9B79044CE1}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{19373767-1236-480A-8416-4909E02376F1}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{0D5F17B6-FB99-4C45-8A27-095A18602B7C}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{0F232F3B-E633-456A-8794-0C458C5DAA85}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{DBBD76F9-6810-40BC-A156-BCA1C7CC0F7B}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{9F6F4509-14D8-4693-8582-7B5AE64F6B48}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes
"TCP Query User{5518BBB3-AFFE-4D97-9DDC-D1FDA0DEDF5A}c:\\program files\\warcraft iii\\war3.exe"= UDP:c:\program files\warcraft iii\war3.exe:Warcraft III
"UDP Query User{374C5C6B-D5E9-4FF4-8301-01D549041FF7}c:\\program files\\warcraft iii\\war3.exe"= TCP:c:\program files\warcraft iii\war3.exe:Warcraft III
"{CDF50E01-77A5-4FF1-A8DF-4D0089D9D37B}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{7485E0E5-5A0B-4C0B-9D2E-C13AA7AA1316}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{F81C8404-E972-4213-816F-9D2AC8D95575}"= UDP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{501D2856-05FC-487B-9686-11011CDB682A}"= TCP:c:\program files\Common Files\AOL\Loader\aolload.exe:AOL Loader
"{E5AFD565-800F-4FF1-B3CF-F65F9A4F1A09}"= UDP:c:\program files\AIM6\aim6.exe:AIM
"{969F0BA1-AA22-46AF-96B8-C33449FB0BB5}"= TCP:c:\program files\AIM6\aim6.exe:AIM
"TCP Query User{A3B9F169-42F4-4A8E-9E6A-A9B4CC9A990D}c:\\program files\\internet explorer\\iexplore.exe"= UDP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"UDP Query User{B3B4CA29-05CC-47A8-843E-6284A9DF4ABF}c:\\program files\\internet explorer\\iexplore.exe"= TCP:c:\program files\internet explorer\iexplore.exe:Internet Explorer
"{73DA009F-4370-4D31-8E5C-2D4A8E13CAF7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B3535CEF-7740-4B21-8FC9-269A4EE51717}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{441013F6-DEB1-4C4E-B611-8DDD4A2D6E40}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{51CAFA8E-73A8-4220-A3AD-FD729A765304}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{91644312-00F8-41DA-925B-D15DC7A41F48}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CB4A6135-FC6A-4645-B657-40DA3D9471A4}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C79DB1F1-7277-4487-9F8B-0ADE5C9EB14A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F6405534-88E5-4EA2-9698-01D75031CC00}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B11E90E3-0245-4E8C-B22C-7D51C1748B0F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{352DB064-03A4-40E8-8A34-774910FA7BBA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{11420C5A-AC8E-4FA4-9A2A-B09D2113ED9E}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6C659DDF-DBB2-40E4-BD24-65181AA1835A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6210DD36-0D54-481E-BCD7-28B50923CAD1}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8AB07A11-330B-446A-A638-C7FB7BFDC22F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3785C76A-AA33-443C-9447-CE2A4A5AA3DE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{0465D557-C130-4C98-B986-671BCBC96E83}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{571A3EC3-FEEC-4EF9-91D6-226076CE6DAA}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{96119DC4-3517-409C-BD3A-B4AE2510F6DC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{608EAB65-E4A8-4B61-887B-8D7939DE4955}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{FC525F68-15FD-4412-83AF-41B62F7E3A88}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{8A4B07E3-F3C8-4B7E-8A3B-89BC5B675F24}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EAACC13B-D578-43AD-BE37-CBF2D1E8632D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EACA67FC-9A53-4B47-BEEF-98DCAF9255E7}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B269906B-3804-469B-93AA-74BE7B4FE88D}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{6F62F350-7962-4A39-AB7D-23E8DB5654EE}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F2A5861F-37D8-4B75-8D5A-BFB43F7FA6BD}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A760EAAA-D37C-432C-B71A-E9046ED64450}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{26A6B476-0055-4021-851B-CF2FD0B8BB17}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1C8C36E5-A389-4843-AAF0-480023103836}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{C8BC1E25-FDC3-4285-9D8F-15AD5B985C43}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1DE5C24D-6790-4B79-9471-11A836398E98}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{A3F35C3A-DE3D-4204-AE6B-35A73B6D2A91}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{EEA1B18F-5CB6-47F6-8692-9CC6360CC4DF}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{F230D5BC-21BE-4F5B-B6E6-E3BDE32DE202}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{7F645FE1-5621-481E-A6F0-29E43299D856}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{B1E6354F-15D5-4C49-9D42-0D3DE86E68EB}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{D9E1E4BF-2807-4F0E-B3FE-7D9AC37F2B6F}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{32CEC970-7B9D-4C97-AD99-36F62F2F027A}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{CF28384C-A20B-4379-AF2C-72754BB16B5C}"= c:\program files\Skype\Phone\Skype.exe:Skype

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink

R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\System32\drivers\npf.sys [8/2/2005 4:10 PM 32512]
S4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [10/29/2008 3:05 PM 24652]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
bthsvcs REG_MULTI_SZ BthServ
WindowsMobile REG_MULTI_SZ wcescomm rapimgr
LocalServiceRestricted REG_MULTI_SZ WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\users\Mitam\AppData\Roaming\Mozilla\Firefox\Profiles\r1utmayd.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{B13721C7-F507-4982-B2E5-502A71474FED}\components\NPComponent.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - plugin: c:\users\Mitam\AppData\Roaming\Move Networks\plugins\npqmp071503000010.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-21 14:12
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\RNG*]
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\
"Seed"=hex:49,31,f4,88,04,28,01,14,c5,ca,fa,5f,f5,cf,66,6e,1f,6c,42,48,3b,1d,
bb,84,6e,c3,98,a3,07,68,b8,a1,8e,3f,71,ca,a8,53,6d,af,a8,e5,29,51,a3,e5,99,\

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Completion time: 2009-07-21 14:14
ComboFix-quarantined-files.txt 2009-07-21 19:14
ComboFix2.txt 2009-07-20 18:10

Pre-Run: 42,932,330,496 bytes free
Post-Run: 42,905,620,480 bytes free

308 --- E O F --- 2009-07-20 17:31

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.39
Database version: 2475
Windows 6.0.6001 Service Pack 1

7/21/2009 2:27:40 PM
mbam-log-2009-07-21 (14-27-40).txt

Scan type: Quick Scan
Objects scanned: 78181
Time elapsed: 3 minute(s), 20 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

I don't know if it's because of the virus or something else, but my Internet seems to be running very slow.
Alot slower than usual

32 Bit HP CIO Components Installer
Adobe AIR
Adobe AIR
Adobe Anchor Service CS4
Adobe Captivate 4
Adobe Captivate 4
Adobe Captivate Reviewer 1.0
Adobe Flash Player 10 Plugin
Adobe Flash Player 9 ActiveX
Adobe Flash Player ActiveX
Adobe Help Viewer 2
Adobe Reader 8
Adobe Setup
Adobe Update Manager CS4
AIM 6
AnswerWorks 5.0 English Runtime
Apple Mobile Device Support
Apple Software Update
Articulate Studio '09 Pro
AviSynth 2.5
Bonjour
CamStudio
Conexant HD Audio
dBpoweramp FLAC Codec
ESU for Microsoft Vista
Hewlett-Packard Active Check
Hewlett-Packard Asset Agent
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Active Support Library
HP Active Support Library 32 bit components
HP Customer Experience Enhancements
HP Easy Setup - Frontend
HP Help and Support
HP Pavilion Webcam Driver for Vista v061.001.00005
HP Photosmart All-In-One Software 9.0
HP Photosmart Essential 2.0
HP Quick Launch Buttons 6.20 B1
HP QuickPlay 3.2
HP Total Care Advisor
HP Update
HP User Guides 0041
HP Wireless Assistant
HPNetworkAssistant
iTunes
Java(TM) 6 Update 7
Java(TM) SE Runtime Environment 6
LimeWire PRO 4.12.4
Malwarebytes' Anti-Malware
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office 2007 Service Pack 2 (SP2)
Microsoft Office Excel MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office Home and Student 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server Compact 3.5 ENU
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 Redistributable
Mozilla Firefox (3.0.12)
MP3 Player Utilities 4.19
MSCU for Microsoft Vista
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
NVIDIA Drivers
Pamela Pro 4.5
PocketNester
QuickTime
Recover Files 2.1
Rhapsody Player Engine
Roxio Activation Module
Security Update for 2007 Microsoft Office System (KB969559)
Security Update for 2007 Microsoft Office System (KB969679)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Microsoft Office Excel 2007 (KB969682)
Security Update for Microsoft Office PowerPoint 2007 (KB957789)
Security Update for Microsoft Office system 2007 (KB969613)
Security Update for Microsoft Office Word 2007 (KB969604)
Skype 4.0
Soft Data Fax Modem with SmartCP
Spybot - Search & Destroy
Suite Shared Configuration CS4
Synaptics Pointing Device Driver
System Requirements Lab
TurboTax 2008
TurboTax 2008 wiliper
TurboTax 2008 WinPerFedFormset
TurboTax 2008 WinPerProgramHelp
TurboTax 2008 WinPerReleaseEngine
TurboTax 2008 WinPerTaxSupport
TurboTax 2008 WinPerUserEducation
TurboTax 2008 wrapper
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
VDMSound 2.0.4
Videora iPod Converter 4.08
Viewpoint Media Player
VLC media player 0.9.4
Vuze
Warcraft III
WavePad Sound Editor
WC3Banlist
Windows Mobile Device Center
Windows Mobile Device Center Driver Update
WinPcap 3.1
WinRAR archiver
Yahoo! Messenger

I see that you are running Limewire.
P2P(Peer to peer) applications are designed to help you easily share and distribute files between you and a group of people. But they can also be used to distribute malware, and thus are not considered safe.
The removal of these programs is optional, but highly recommended.

If Limewire is not removed, then I won't help you.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

• Limewire
  
• Java(TM) 6 Update 7
  
• Java(TM) SE Runtime Environment 6
  
• LimeWire PRO 4.12.4
  
• Viewpoint Media Player
  
• Vuze
  

There is a new version of Firefox out, version 3.5.1, please download it here:
http://download.mozilla.org/?product=firefox-3.5.1&os=win&lang=en-GB

Did that fix your problem?