OOZEBO~1.EXE hogging ~100% cpu

yeah, i'm new here so I hope you guys can help me, just tell me what I need to do, I don't really understand how to do the "hijack this log". Have you ever heard of oozebo~1.exe, the reason I know this is the problem, b/c my computer will run incredibly slow at times freeze up on me, so I open task manager and I see the problem, it shows internet explorer running at 90-100% of my cpu, it usually happens at start up, so I have to kill the process, then I see this "oozebo~1.exe open up for like 2 seconds then it hides itself under internet explorer and starts hogging my cpu again using up to 190,000K page file memory, it does this about 3 or 4 times until finally it stops after I kill the process like 3 times. so I'd greatly appriciate any help!! thanks.

Hello.
Hopefully my instructions will more clear.

Please download the current version of HijackThis from HERE

• Double click and run the installer.
  
• It will install to C:\Program Files\Trend Micro\HijackThis\hijackthis.exe
  
• After installing, you should get the user agreement, press accept and Hijack This will run.
  
• Select Do a system scan and save a log file. This will open a notepad file of everything Hijack This found, copy and paste it back here.
  

thanks, that was very easy: here's my file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:45:44 PM, on 11/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\lxczcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Atari\Atari Arcade Hits 2\Atari icon.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Common Files\AOL\1187814962\ee\AOLSoftware.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Java\jre1.6.0_04\bin\jucheck.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Microsoft Picture It! 7\Pip.exe
C:\Program Files\Microsoft Works\MSWorks.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\America Online 8.0\aol.exe
C:\Program Files\America Online 8.0\waol.exe
C:\Program Files\America Online 8.0\aolwbspd.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.eezbfbewyduwcbxfl.com/OQ_MgPpSeqye3GryuGEwCRjxWWs5PwZpIGTE618ZvUVS66x/ahhx4_7OoSZeCjw1.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kkzbaubosajcasuexhntrq.com/OQ_MgPpSeqz9xYOB_mzBNDFJhmHmXkS7EV/YQyolxIU.cgi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.medion.com
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {d948adb6-42cc-42fa-b83b-91be447c002e} - C:\WINDOWS\system32\zomisula.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Atari\Atari Arcade Hits 2\Atari icon.exe
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1187814962\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [zesemaheja] Rundll32.exe "C:\WINDOWS\system32\jeribejo.dll",s
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [WARN POP TRUST LIES] C:\Documents and Settings\All Users\Application Data\Camp Mess Warn Pop\Stupid idol.exe
O4 - HKLM\..\Run: [0802c683] rundll32.exe "C:\WINDOWS\system32\benituyo.dll",b
O4 - HKLM\..\Run: [CPM0b31f51f] Rundll32.exe "C:\WINDOWS\system32\fapawozi.dll",a
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ShockmachineReminder] C:\Program Files\shockwave.com\Shockmachine\SmReminder.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [COALSOFTWARE] C:\DOCUME~1\Toyes\APPLIC~1\COMPBA~1\pure aim settings.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKUS\S-1-5-19\..\Run: [OSSProxy] C:\WINDOWS\System32\ossproxy.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [NSCheck] C:\WINDOWS\System32\nscheck.exe /check (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [OSSProxy] C:\WINDOWS\System32\ossproxy.exe (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [OSSProxy] C:\WINDOWS\System32\ossproxy.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [OSSProxy] C:\WINDOWS\System32\ossproxy.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-18 Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE (User 'Default user')
O4 - .DEFAULT Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Default user')
O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')
O4 - .DEFAULT Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'Default user')
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {33331111-1111-1111-1111-611111193457} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-611111193458} - file://c:\ex.cab
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k29811.sckr.com
O17 - HKLM\Software\..\Telephony: DomainName = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F222E62-11BB-4955-A822-946892860BE1}: Domain = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C9D3AAA-D9F8-402A-8776-A9497737E20E}: Domain = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{B3D89DC5-E8C2-4237-8EFA-BD75D518ACEA}: NameServer = 205.188.146.145
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC4F8FC7-06FD-4247-ACF3-51CBBFA1AB75}: Domain = k29811.sckr.com
O20 - AppInit_DLLs: C:\WINDOWS\system32\rejufopa.dll lcweib.dll c:\windows\system32\fapawozi.dll
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\fapawozi.dll
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\windows\system32\fapawozi.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: lxcz_device - - C:\WINDOWS\System32\lxczcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 11339 bytes

Hello.
You have a pretty nasty infection, this could take more than one round to kill, so stay with me on this.

• Download combofix from here, use the top links - combofix.exe
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 08-11-23.02 - Toyes 2008-11-24 15:39:07.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.358 [GMT -5:00]
Running from: c:\documents and settings\Toyes\Desktop\soundefx\halloween\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\NDNuninstall4_88.exe
c:\windows\NDNuninstall4_94.exe
c:\windows\NDNuninstall5_20.exe
c:\windows\NDNuninstall5_40.exe
c:\windows\NDNuninstall5_48.exe
c:\windows\NDNuninstall5_64.exe
c:\windows\NDNuninstall6_10.exe
c:\windows\NDNuninstall6_22.exe
c:\windows\NDNuninstall6_30.exe
c:\windows\NDNuninstall6_38.exe
c:\windows\Readme.txt
c:\windows\system32\~.exe
c:\windows\system32\acdglw.dll
c:\windows\system32\anfwhany.ini
c:\windows\system32\atwidmuo.ini
c:\windows\system32\benituyo.dll
c:\windows\system32\bijqnx.dll
c:\windows\system32\bixpikxy.ini
c:\windows\system32\blvaqekr.dll
c:\windows\system32\byosqhln.ini
c:\windows\system32\cwxiufdg.ini
c:\windows\system32\dafanole.dll
c:\windows\system32\dkoquyvj.ini
c:\windows\system32\eufpucpg.ini
c:\windows\system32\EV02
c:\windows\system32\fapawozi.dll
c:\windows\system32\fgzhfy.dll
c:\windows\system32\fhwvdkhx.ini
c:\windows\system32\fldifphb.dll
c:\windows\system32\fwdjncfx.ini
c:\windows\system32\gmyfln.dll
c:\windows\system32\gvdsiqgh.ini
c:\windows\system32\hcxxhhav.dll
c:\windows\system32\hfvekhgn.ini
c:\windows\system32\hjseacjm.dll
c:\windows\system32\iubfgy.dll
c:\windows\system32\iyancgio.ini
c:\windows\system32\jgyaldek.ini
c:\windows\system32\jjmeceot.ini
c:\windows\system32\knjvudav.dll
c:\windows\system32\kohajawu.dll
c:\windows\system32\lbusfnbe.dll
c:\windows\system32\meojjcju.dll
c:\windows\system32\mngftjps.ini
c:\windows\system32\moolau.dll
c:\windows\system32\mxqtcu.dll
c:\windows\system32\myhrcasr.ini
c:\windows\system32\nomadefe.dll
c:\windows\system32\nwbikynf.dll
c:\windows\system32\ofibhq.dll
c:\windows\system32\oyutineb.ini
c:\windows\system32\pruhuo.dll
c:\windows\system32\rejufopa.dll
c:\windows\system32\rhoxuyuk.ini
c:\windows\system32\rmoc3260.dll
c:\windows\system32\sdwkdrbb.dll
c:\windows\system32\smixrq.dll
c:\windows\system32\stskgmbj.ini
c:\windows\system32\tipukuvu.exe
c:\windows\system32\uhikatiz.ini
c:\windows\system32\uppxkgnn.ini
c:\windows\system32\uwajahok.ini
c:\windows\system32\vhiruryy.ini
c:\windows\system32\vjysplhd.dll
c:\windows\system32\vuranune.dll
c:\windows\system32\wcluvvhl.ini
c:\windows\system32\xcscpspo.ini
c:\windows\system32\xkxeuqky.ini
c:\windows\system32\xqoytahf.ini
c:\windows\system32\xsqtokoi.ini
c:\windows\system32\yavubcyx.ini
c:\windows\system32\yclxatri.ini
c:\windows\system32\yrreaoiv.dll
c:\windows\system32\zejosofe.dll
c:\windows\system32\zitakihu.dll
c:\windows\system32\zvbdnd.dll
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat . . . . failed to delete
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat . . . . failed to delete

----- BITS: Possible infected sites -----

hxxp://77.74.48.101
.
((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 )))))))))))))))))))))))))))))))
.

2008-11-24 11:59 . 2008-11-24 11:59 d-------- c:\program files\comp barb face
2008-11-22 08:28 . 2008-11-22 08:28 2,098 ---hs---- c:\windows\system32\vijohato.exe
2008-11-19 21:00 . 2008-11-19 21:00 d-------- c:\program files\Avira
2008-11-19 21:00 . 2008-11-19 21:00 d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-18 21:43 . 2008-11-24 15:57 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-18 21:43 . 2008-11-24 15:45 1,409 --a------ c:\windows\QTFont.for
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\documents and settings\Toyes\Application Data\Malwarebytes
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-18 21:22 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-18 21:22 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-07 10:11 . 2008-11-07 10:11 d-------- C:\rsit
2008-11-07 10:11 . 2008-11-24 14:45 d-------- c:\program files\trend micro
2008-11-07 09:32 . 2008-11-07 10:19 250 --a------ c:\windows\gmer.ini
2008-11-06 20:33 . 2008-11-06 20:33 1,409 --a------ c:\windows\system\hebii.fot
2008-11-06 20:32 . 2008-11-06 20:32 1,409 --a------ c:\windows\system\grii.fot

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 20:59 --------- d-----w c:\documents and settings\Toyes\Application Data\OpenOffice.org2
2008-11-24 20:58 --------- d-----w c:\program files\Greetings Workshop
2008-11-24 20:15 --------- d-----w c:\program files\America Online 8.0
2008-11-24 17:07 --------- d-----w c:\documents and settings\Toyes\Application Data\comp barb face
2008-11-24 17:03 --------- d-----w c:\documents and settings\All Users\Application Data\Camp Mess Warn Pop
2008-11-24 02:33 --------- d-----w c:\program files\America Online 9.0
2008-11-23 21:52 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-22 14:42 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-11-20 02:14 --------- d-----w c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault
2008-11-19 01:35 --------- d-----w c:\documents and settings\Toyes\Application Data\FrostWire
2008-10-21 18:11 8,552 ----a-w c:\windows\system32\drivers\asctrm.sys
2008-10-21 18:10 --------- d-----w c:\program files\Common Files\Real
2008-10-20 21:44 --------- d-----w c:\program files\Lavasoft
2008-10-20 21:44 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-20 21:43 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-14 00:20 --------- d-----w c:\program files\Common Files\aolshare
2008-10-14 00:20 --------- d-----w c:\program files\Common Files\AOL
2008-10-13 19:22 114,688 ----a-w c:\windows\system32\ridurwsx.dll
2008-10-13 19:22 114,688 ----a-w c:\windows\system32\kjneth.dll
2008-10-13 19:12 147,456 ----a-w c:\windows\system32\vbzip10.dll
2008-10-13 19:09 68 ----a-w c:\documents and settings\Toyes\z.bat
2008-10-07 20:06 --------- d-----w c:\program files\LimeWire
2008-07-25 17:06 97,448 ----a-w c:\documents and settings\Toyes\Application Data\GDIPFONTCACHEV1.DAT
2003-04-30 03:26 127,665 ----a-w c:\documents and settings\Toyes\Application Data\xfoalicr.exe
2003-04-30 03:26 11,776 ----a-w c:\documents and settings\Toyes\Application Data\crdroathfssfg.dll
2003-04-30 01:29 40 ----a-w c:\documents and settings\Toyes\language.dat
2002-09-19 03:42 3,178,828 -c----w c:\program files\E.msi
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"ShockmachineReminder"="c:\program files\shockwave.com\Shockmachine\SmReminder.exe" [2001-05-03 98304]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 200767]
"AIM"="c:\program files\AIM\aim.exe" [2004-04-27 61440]
"COALSOFTWARE"="c:\docume~1\Toyes\APPLIC~1\COMPBA~1\pure aim settings.exe" [2008-11-24 647680]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"Atari Launcher 2"="c:\program files\Atari\Atari Arcade Hits 2\Atari icon.exe" [2000-03-08 55296]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 74672]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 295856]
"HostManager"="c:\program files\Common Files\AOL\1187814962\ee\AOLSoftware.exe" [2006-09-25 50736]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-03-24 3309568]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-03-24 46080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-08 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2008-10-21 26112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"WARN POP TRUST LIES"="c:\documents and settings\All Users\Application Data\Camp Mess Warn Pop\Stupid idol.exe" [2008-11-24 1979392]
"SoundMan"="SOUNDMAN.EXE" [2002-08-15 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2004-03-24 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\Toyes\Start Menu\Programs\Startup\
Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1997-09-03 50688]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
PowerReg Scheduler.exe [2003-08-28 256000]
Webshots.lnk - c:\program files\Webshots\WebshotsTray.exe [2003-04-02 208896]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-24 98304]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-24 98304]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2003-10-14 36953]
AOL Companion.lnk - c:\program files\AOL Companion\companion.exe [2003-03-31 229450]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-01-09 200704]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msvideo9"= SDVC03.drv
"msacm.dvacm"= dvacm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2002-07-08 23:45 28672 c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--------- 2002-10-01 03:31 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-10-08 20:10 77824 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2008-10-21 13:10 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dit]
--a------ 2002-08-28 14:43 73728 c:\windows\Dit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\JavaSoft\\JRE\\1.3.1_04\\bin\\javaw.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\America Online 8.0\\waol.exe"=
"c:\\Program Files\\EA Games\\Need For Speed Underground\\Speed.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=

R2 lxcz_device;lxcz_device;c:\windows\System32\lxczcoms.exe -service []
R3 msloop;Microsoft Loopback Adapter Driver;c:\windows\system32\DRIVERS\loop.sys [2005-08-01 4992]
S3 ewdmaudn;ewdmaudn;\??\c:\docume~1\Toyes\LOCALS~1\Temp\ewdmaudn.sys []
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\Drivers\iiusbisp.sys []
S3 SDVC05;USB SDVC05;c:\windows\system32\Drivers\SDVC05.sys [2005-01-19 18088]
.
Contents of the 'Scheduled Tasks' folder

2008-11-24 c:\windows\Tasks\A8C8E0C491939898.job
- c:\docume~1\toyes\applic~1\compba~1\dumb type free.exe [2008-11-24 12:07]
.
- - - - ORPHANS REMOVED - - - -

BHO-{d948adb6-42cc-42fa-b83b-91be447c002e} - c:\windows\system32\zomisula.dll
HKLM-Run-zesemaheja - c:\windows\system32\jeribejo.dll
HKU-Default-Run-OSSProxy - c:\windows\System32\ossproxy.exe
HKU-Default-Run-NSCheck - c:\windows\System32\nscheck.exe
MSConfigStartUp-DM_Server - c:\progra~1\COMETS~1\DM\bin\dmserver.exe
MSConfigStartUp-HP Software Update - c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
MSConfigStartUp-WinStart001 - c:\windows\System\WinStart001.EXE

Here's the rest of the file, I accidentally missed the part about installing the recovery console, is it still nesscary? this infection is slowing me down, I just had to kill IE 20 times until I just let it run for a few minutes and it went away, I sure hope we can clean this up. thanks

.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.kkzbaubosajcasuexhntrq.com/OQ_MgPpSeqz9xYOB_mzBNDFJhmHmXkS7EV/YQyolxIU.cgi
uInternet Settings,ProxyOverride = 127.0.0.1

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
c:\windows\Downloaded Program Files\start.INF
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-24 15:57:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\rsaenh.dll

- - - - - - - > 'lsass.exe'(524)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\windows\system32\lxczcoms.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lexmark 1200 Series\LXCZbmon.exe
c:\windows\system32\rundll32.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
c:\program files\Internet Explorer\iexplore.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
c:\program files\Java\jre1.6.0_04\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-11-24 16:03:16 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-24 21:03:13

Pre-Run: 13,920,284,672 bytes free
Post-Run: 16,119,910,400 bytes free

289 --- E O F --- 2007-08-30 01:38:57

Nearly there.

Now open a new notepad file.
Input this into the notepad file:

Driver::
ewdmaudn

File::
c:\windows\system32\vijohato.exe
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\windows\system\hebii.fot
c:\windows\system\grii.fot
c:\windows\system32\ridurwsx.dll
c:\windows\system32\kjneth.dll
c:\windows\system32\vbzip10.dll
c:\documents and settings\Toyes\z.bat
c:\windows\Tasks\A8C8E0C491939898.job
c:\ex.cab

Folder::
c:\program files\comp barb face
C:\rsit
c:\documents and settings\Toyes\Application Data\comp barb face
c:\documents and settings\All Users\Application Data\Camp Mess Warn Pop
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WARN POP TRUST LIES"=-

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

i think that fixed it!! here's the log it made

ComboFix 08-11-23.02 - Toyes 2008-11-24 18:00:31.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.367 [GMT -5:00]
Running from: c:\documents and settings\Toyes\Desktop\soundefx\halloween\ComboFix.exe
Command switches used :: c:\documents and settings\Toyes\Desktop\CFscript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\documents and settings\Toyes\z.bat
c:\ex.cab
c:\windows\system\grii.fot
c:\windows\system\hebii.fot
c:\windows\system32\kjneth.dll
c:\windows\system32\ridurwsx.dll
c:\windows\system32\vbzip10.dll
c:\windows\system32\vijohato.exe
c:\windows\Tasks\A8C8E0C491939898.job
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault\Debug second.exe
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault\Noun Memo.exe
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault\peak store.exe
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault\Program Mapi.exe
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault\settingsiso.exe
c:\documents and settings\All Users\Application Data\BoltOwnsBuildDefault\The Funk.exe
c:\documents and settings\All Users\Application Data\Camp Mess Warn Pop
c:\documents and settings\All Users\Application Data\Camp Mess Warn Pop\bits vc.exe
c:\documents and settings\All Users\Application Data\Camp Mess Warn Pop\Stupid idol.exe
c:\documents and settings\Toyes\Application Data\comp barb face
c:\documents and settings\Toyes\Application Data\comp barb face\0
c:\documents and settings\Toyes\Application Data\comp barb face\aolznanc.exe
c:\documents and settings\Toyes\Application Data\comp barb face\bqydbzhb.exe
c:\documents and settings\Toyes\Application Data\comp barb face\ctixempt.exe
c:\documents and settings\Toyes\Application Data\comp barb face\delete slow loud ante.exe
c:\documents and settings\Toyes\Application Data\comp barb face\dumb type free.exe
c:\documents and settings\Toyes\Application Data\comp barb face\felvhuds.exe
c:\documents and settings\Toyes\Application Data\comp barb face\gopavhtv.exe
c:\documents and settings\Toyes\Application Data\comp barb face\gvjfhqdj.exe
c:\documents and settings\Toyes\Application Data\comp barb face\kxnfwvkm.exe
c:\documents and settings\Toyes\Application Data\comp barb face\nusqxwri.exe
c:\documents and settings\Toyes\Application Data\comp barb face\pmxwoeyl.exe
c:\documents and settings\Toyes\Application Data\comp barb face\pure aim settings.exe
c:\documents and settings\Toyes\Application Data\comp barb face\qjljagvm.exe
c:\documents and settings\Toyes\z.bat
c:\program files\comp barb face
C:\rsit
c:\rsit\info.txt
c:\rsit\log.txt
c:\windows\system\grii.fot
c:\windows\system\hebii.fot
c:\windows\system32\bodizeya.dll
c:\windows\system32\kjneth.dll
c:\windows\system32\loyejosu.dll
c:\windows\system32\pokihuyi.dll
c:\windows\system32\ridurwsx.dll
c:\windows\system32\vbzip10.dll
c:\windows\system32\vijohato.exe
c:\windows\Tasks\A8C8E0C491939898.job
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat . . . . failed to delete
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_EWDMAUDN
-------\Service_ewdmaudn


((((((((((((((((((((((((( Files Created from 2008-10-24 to 2008-11-24 )))))))))))))))))))))))))))))))
.

2008-11-19 21:00 . 2008-11-19 21:00 d-------- c:\program files\Avira
2008-11-19 21:00 . 2008-11-19 21:00 d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-18 21:43 . 2008-11-24 18:07 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-18 21:43 . 2008-11-24 18:04 1,409 --a------ c:\windows\QTFont.for
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\documents and settings\Toyes\Application Data\Malwarebytes
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-18 21:22 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-18 21:22 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-07 10:11 . 2008-11-24 14:45 d-------- c:\program files\trend micro
2008-11-07 09:32 . 2008-11-07 10:19 250 --a------ c:\windows\gmer.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-24 23:09 --------- d-----w c:\documents and settings\Toyes\Application Data\OpenOffice.org2
2008-11-24 23:08 --------- d-----w c:\program files\Greetings Workshop
2008-11-24 22:38 --------- d-----w c:\program files\America Online 8.0
2008-11-24 02:33 --------- d-----w c:\program files\America Online 9.0
2008-11-23 21:52 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-22 14:42 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-11-19 01:35 --------- d-----w c:\documents and settings\Toyes\Application Data\FrostWire
2008-10-21 18:11 8,552 ----a-w c:\windows\system32\drivers\asctrm.sys
2008-10-21 18:10 --------- d-----w c:\program files\Common Files\Real
2008-10-20 21:44 --------- d-----w c:\program files\Lavasoft
2008-10-20 21:44 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-20 21:43 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-14 00:20 --------- d-----w c:\program files\Common Files\aolshare
2008-10-14 00:20 --------- d-----w c:\program files\Common Files\AOL
2008-10-07 20:06 --------- d-----w c:\program files\LimeWire
2008-07-25 17:06 97,448 ----a-w c:\documents and settings\Toyes\Application Data\GDIPFONTCACHEV1.DAT
2003-04-30 03:26 127,665 ----a-w c:\documents and settings\Toyes\Application Data\xfoalicr.exe
2003-04-30 03:26 11,776 ----a-w c:\documents and settings\Toyes\Application Data\crdroathfssfg.dll
2003-04-30 01:29 40 ----a-w c:\documents and settings\Toyes\language.dat
2002-09-19 03:42 3,178,828 -c----w c:\program files\E.msi
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{d948adb6-42cc-42fa-b83b-91be447c002e}]
c:\windows\system32\zomisula.dll [BU]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"ShockmachineReminder"="c:\program files\shockwave.com\Shockmachine\SmReminder.exe" [2001-05-03 98304]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 200767]
"AIM"="c:\program files\AIM\aim.exe" [2004-04-27 61440]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"Atari Launcher 2"="c:\program files\Atari\Atari Arcade Hits 2\Atari icon.exe" [2000-03-08 55296]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 74672]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 295856]
"HostManager"="c:\program files\Common Files\AOL\1187814962\ee\AOLSoftware.exe" [2006-09-25 50736]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-03-24 3309568]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-03-24 46080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-08 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2008-10-21 26112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"zesemaheja"="c:\windows\system32\jeribejo.dll" [BU]
"SoundMan"="SOUNDMAN.EXE" [2002-08-15 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2004-03-24 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\Toyes\Start Menu\Programs\Startup\
Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1997-09-03 50688]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
PowerReg Scheduler.exe [2003-08-28 256000]
Webshots.lnk - c:\program files\Webshots\WebshotsTray.exe [2003-04-02 208896]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-24 98304]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-24 98304]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2003-10-14 36953]
AOL Companion.lnk - c:\program files\AOL Companion\companion.exe [2003-03-31 229450]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-01-09 200704]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msvideo9"= SDVC03.drv
"msacm.dvacm"= dvacm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2002-07-08 23:45 28672 c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--------- 2002-10-01 03:31 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-10-08 20:10 77824 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2008-10-21 13:10 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dit]
--a------ 2002-08-28 14:43 73728 c:\windows\Dit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\JavaSoft\\JRE\\1.3.1_04\\bin\\javaw.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\America Online 8.0\\waol.exe"=
"c:\\Program Files\\EA Games\\Need For Speed Underground\\Speed.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=

R2 lxcz_device;lxcz_device;c:\windows\System32\lxczcoms.exe -service []
R3 msloop;Microsoft Loopback Adapter Driver;c:\windows\system32\DRIVERS\loop.sys [2005-08-01 4992]
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\Drivers\iiusbisp.sys []
S3 SDVC05;USB SDVC05;c:\windows\system32\Drivers\SDVC05.sys [2005-01-19 18088]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-COALSOFTWARE - c:\docume~1\Toyes\APPLIC~1\COMPBA~1\pure aim settings.exe



**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-24 18:06:56
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(468)
c:\windows\system32\rsaenh.dll

- - - - - - - > 'lsass.exe'(524)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe
c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe
c:\progra~1\COMMON~1\AOL\ACS\acsd.exe
c:\windows\system32\lxczcoms.exe
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\windows\system32\nvsvc32.exe
c:\windows\wanmpsvc.exe
c:\windows\system32\wscntfy.exe
c:\program files\Lexmark 1200 Series\LXCZbmon.exe
c:\windows\system32\rundll32.exe
c:\program files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe
c:\program files\OpenOffice.org 2.4\program\soffice.exe
c:\program files\OpenOffice.org 2.4\program\soffice.bin
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
c:\program files\Java\jre1.6.0_04\bin\jucheck.exe
.
**************************************************************************
.
Completion time: 2008-11-24 18:12:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-24 23:12:39
ComboFix2.txt 2008-11-24 21:03:17

Pre-Run: 16,088,924,160 bytes free
Post-Run: 16,072,617,984 bytes free

231 --- E O F --- 2007-08-30 01:38:57

DO NOT surf the internet.
Your homepage is hijacked, you'll get infected.

Post a new Hijack This log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:59:36 PM, on 11/24/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\WINDOWS\System32\lxczcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Atari\Atari Arcade Hits 2\Atari icon.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Common Files\AOL\1187814962\ee\AOLSoftware.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\explorer.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\trend micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kkzbaubosajcasuexhntrq.com/OQ_MgPpSeqz9xYOB_mzBNDFJhmHmXkS7EV/YQyolxIU.cgi
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O2 - BHO: (no name) - {d948adb6-42cc-42fa-b83b-91be447c002e} - C:\WINDOWS\system32\zomisula.dll (file missing)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Atari\Atari Arcade Hits 2\Atari icon.exe
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1187814962\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [zesemaheja] Rundll32.exe "C:\WINDOWS\system32\jeribejo.dll",s
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ShockmachineReminder] C:\Program Files\shockwave.com\Shockmachine\SmReminder.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-18 Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE (User 'Default user')
O4 - .DEFAULT Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Default user')
O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')
O4 - .DEFAULT Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'Default user')
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k29811.sckr.com
O17 - HKLM\Software\..\Telephony: DomainName = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F222E62-11BB-4955-A822-946892860BE1}: Domain = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C9D3AAA-D9F8-402A-8776-A9497737E20E}: Domain = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC4F8FC7-06FD-4247-ACF3-51CBBFA1AB75}: Domain = k29811.sckr.com
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: lxcz_device - - C:\WINDOWS\System32\lxczcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9638 bytes

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.kkzbaubosajcasuexhntrq.com/OQ_MgPpSeqz9xYOB_mzBNDFJhmHmXkS7EV/YQyolxIU.cgi
  O2 - BHO: (no name) - {d948adb6-42cc-42fa-b83b-91be447c002e} - C:\WINDOWS\system32\zomisula.dll (file missing)
  O4 - HKLM\..\Run: [zesemaheja] Rundll32.exe "C:\WINDOWS\system32\jeribejo.dll",s
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

How is everything now?

I did what you said and everything looks great now, my cpu is running at it's lowest levels 0%-5% in A LONG time. It used to hover around 10% a lot and then at 100% when this infection was hogging cpu, and internet explorer isn't in my processes list FINALLY. So is it okay to surf the web now? I browse with AOL, and actually this even fixed an issue i had with AOL 9.0, I couldn't get it to open before, I had to use 8.0 but 9.0 opens right up now. What program do you recommend I run to help protect my pc more b/c this was such a headache until I found this site? thanks so much!!!!

We've only cleaned the malware, we need to do some updates before I can let you go. We'll start with updating your Java.

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

• Download the latest version of Java SE Runtime Environment (JRE) 6 Update 10.
  
• Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 10".
  
• Click the "Download" button to the right.
  
• In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  
• Click on the link to download Windows Offline Installation and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  - Examples of older versions in Add or Remove Programs:
  - Java 2 Runtime Environment, SE v1.4.2
  - J2SE Runtime Environment 5.0
  - J2SE Runtime Environment 5.0 Update 2
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u10-windows-i586-p.exe that you downloaded to install the newest version.
  

Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from here

• First, unzip it.
  
• Then run JavaRa.
  
• Select English from the drop down menu and press Select.
  
• This will open JavaRa.
  
• Press Remove older versions
  
• Press yes to the prompt.
  
• It will make a log file of what it's removed.
  
• Copy and paste the log back here.
  

I'm downloading the java update, I do have dialup so it'll take a while I come back as soon as i can.

Okay.

here you go

JavaRa 1.11 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Mon Nov 24 22:51:54 2008

Found and removed: C:\Program Files\Java\jre1.6.0_04

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBC}

Found and removed: SOFTWARE\Classes\Installer\Features\8A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Classes\Installer\Products\8A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Classes\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Classes\JavaPlugin.160_04

Found and removed: SOFTWARE\JavaSoft\Java Plug-in\1.6.0_04

Found and removed: SOFTWARE\JavaSoft\Java Runtime Environment\1.6.0_04

Found and removed: SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UpgradeCodes\7A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\ACBB9B2318A96D117A58000B0D610004

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\8A0F842331866D117AB7000B0D610004

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{3248F0A8-6813-11D6-A77B-00B0D0160040}

Found and removed: Software\Classes\JavaPlugin.160_04

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_04\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.6.0_04\bin\

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\C:\Program Files\Common Files\Java\Update\Base Images\jre1.6.0.b105\patch-jre1.6.0_04.b12\

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.6.0_04

Found and removed: Software\JavaSoft\Java2D\1.6.0_04

Found and removed: Software\JavaSoft\Java Runtime Environment\1.6.0_04

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

------------------------------------

Finished reporting.

Looks good, what problems remain?

I don't see any other problems. I did have a few persistent pop-ups for a while but I haven't experienced them since I fixed the IE problem. I used to get like 50 pop ups at once, do you think that was from the malware? B/c so far I haven't had any popups since I ran the final combo fix.

Yep.
You had quite a nasty vundo infection, but CF takes down vundo easily.
Please delete this folder in bold.
C:\Qoobox

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.
=====

Everything looks great --- your HijackThis log appears to be clean.
Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Uh oh, I just had 60 simultaneous IE pop ups right after I posted to you. I exited out of the first 60, but then they kept coming back and I had to do a hard restart b/c it was unresponsive with all the pop ups windows attempting to open. The wierd thing is, in task manager it said the pop up windows were this page's title. As I said I use AOL's browser if that makes any difference. But I still don't see IE running until the pop ups come. could I disable IE and use AOL's browser?

You had a mix of vundo and LOP. LOP is installed by Messenger Plus!, if you just installed this again, that's probably it.
Or maybe something I missed.

Please download combofix again and run it again.

i didn't install messenger plus!, I don't know what that is really. But here's 1st part of the combo fix log
ComboFix 08-11-23.02 - Toyes 2008-11-25 15:01:20.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.455 [GMT -5:00]
Running from: c:\documents and settings\Toyes\Desktop\soundefx\halloween\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-10-25 to 2008-11-25 )))))))))))))))))))))))))))))))
.

2008-11-24 21:17 . 2008-11-24 21:16 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-19 21:00 . 2008-11-19 21:00 d-------- c:\program files\Avira
2008-11-19 21:00 . 2008-11-19 21:00 d-------- c:\documents and settings\All Users\Application Data\Avira
2008-11-18 21:43 . 2008-11-25 14:28 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-18 21:43 . 2008-11-24 18:04 1,409 --a------ c:\windows\QTFont.for
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\documents and settings\Toyes\Application Data\Malwarebytes
2008-11-18 21:22 . 2008-11-18 21:22 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-18 21:22 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-11-18 21:22 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-11-07 10:11 . 2008-11-24 14:45 d-------- c:\program files\trend micro
2008-11-07 09:32 . 2008-11-07 10:19 250 --a------ c:\windows\gmer.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-25 19:32 --------- d-----w c:\program files\America Online 8.0
2008-11-25 19:29 --------- d-----w c:\program files\Greetings Workshop
2008-11-25 19:29 --------- d-----w c:\documents and settings\Toyes\Application Data\OpenOffice.org2
2008-11-25 19:14 --------- d-----w c:\program files\America Online 9.0
2008-11-25 03:51 --------- d-----w c:\program files\Java
2008-11-23 21:52 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-11-22 14:42 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-11-19 01:35 --------- d-----w c:\documents and settings\Toyes\Application Data\FrostWire
2008-10-21 18:11 8,552 ----a-w c:\windows\system32\drivers\asctrm.sys
2008-10-21 18:10 --------- d-----w c:\program files\Common Files\Real
2008-10-20 21:44 --------- d-----w c:\program files\Lavasoft
2008-10-20 21:44 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-10-20 21:43 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-14 00:20 --------- d-----w c:\program files\Common Files\aolshare
2008-10-14 00:20 --------- d-----w c:\program files\Common Files\AOL
2008-10-07 20:06 --------- d-----w c:\program files\LimeWire
2008-07-25 17:06 97,448 ----a-w c:\documents and settings\Toyes\Application Data\GDIPFONTCACHEV1.DAT
2003-04-30 03:26 127,665 ----a-w c:\documents and settings\Toyes\Application Data\xfoalicr.exe
2003-04-30 03:26 11,776 ----a-w c:\documents and settings\Toyes\Application Data\crdroathfssfg.dll
2003-04-30 01:29 40 ----a-w c:\documents and settings\Toyes\language.dat
2002-09-19 03:42 3,178,828 -c----w c:\program files\E.msi
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584]
"ShockmachineReminder"="c:\program files\shockwave.com\Shockmachine\SmReminder.exe" [2001-05-03 98304]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 200767]
"AIM"="c:\program files\AIM\aim.exe" [2004-04-27 61440]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"PopUpStopperFreeEdition"="c:\progra~1\PANICW~1\POP-UP~1\PSFree.exe" [2005-03-17 536576]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"REGSHAVE"="c:\program files\REGSHAVE\REGSHAVE.EXE" [2002-02-04 53248]
"Atari Launcher 2"="c:\program files\Atari\Atari Arcade Hits 2\Atari icon.exe" [2000-03-08 55296]
"lxczbmgr.exe"="c:\program files\Lexmark 1200 Series\lxczbmgr.exe" [2007-02-08 74672]
"FaxCenterServer"="c:\program files\Lexmark Fax Solutions\fm3032.exe" [2007-02-08 295856]
"HostManager"="c:\program files\Common Files\AOL\1187814962\ee\AOLSoftware.exe" [2006-09-25 50736]
"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2004-03-24 3309568]
"NvMediaCenter"="c:\windows\System32\NvMcTray.dll" [2004-03-24 46080]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 39792]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-10-08 77824]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-24 136600]
"RealTray"="c:\program files\Real\RealPlayer\RealPlay.exe" [2008-10-21 26112]
"avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 266497]
"SoundMan"="SOUNDMAN.EXE" [2002-08-15 c:\windows\SOUNDMAN.EXE]
"nwiz"="nwiz.exe" [2004-03-24 c:\windows\system32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

c:\documents and settings\Toyes\Start Menu\Programs\Startup\
Greetings Workshop Reminders.lnk - c:\program files\Greetings Workshop\GWREMIND.EXE [1997-09-03 50688]
OpenOffice.org 2.4.lnk - c:\program files\OpenOffice.org 2.4\program\quickstart.exe [2008-01-21 393216]
PowerReg Scheduler.exe [2003-08-28 256000]
Webshots.lnk - c:\program files\Webshots\WebshotsTray.exe [2003-04-02 208896]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.exe.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-24 98304]
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-03-24 98304]
America Online 9.0 Tray Icon.lnk - c:\program files\America Online 9.0\aoltray.exe [2003-10-14 36953]
AOL Companion.lnk - c:\program files\AOL Companion\companion.exe [2003-03-31 229450]
Exif Launcher.lnk - c:\program files\FinePixViewer\QuickDCF.exe [2002-01-09 200704]
HP Digital Imaging Monitor.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624]
HP Photosmart Premier Fast Start.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msvideo9"= SDVC03.drv
"msacm.dvacm"= dvacm.acm

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Find Fast.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Find Fast.lnk
backup=c:\windows\pss\Microsoft Find Fast.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Office Startup.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Office Startup.lnk
backup=c:\windows\pss\Office Startup.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection]
--a------ 2002-07-08 23:45 28672 c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
--------- 2002-10-01 03:31 155648 c:\windows\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2006-10-08 20:10 77824 c:\program files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2008-10-21 13:10 26112 c:\program files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dit]
--a------ 2002-08-28 14:43 73728 c:\windows\Dit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Quake III Arena\\quake3.exe"=
"c:\\Program Files\\America Online 8.0\\waol.exe"=
"c:\\Program Files\\EA Games\\Need For Speed Underground\\Speed.exe"=
"c:\\WINDOWS\\system32\\taskmgr.exe"=
"c:\\Program Files\\Lavasoft\\Ad-Aware\\aawservice.exe"=

R2 lxcz_device;lxcz_device;c:\windows\System32\lxczcoms.exe -service []
R3 msloop;Microsoft Loopback Adapter Driver;c:\windows\system32\DRIVERS\loop.sys [2005-08-01 4992]
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\Drivers\iiusbisp.sys []
S3 SDVC05;USB SDVC05;c:\windows\system32\Drivers\SDVC05.sys [2005-01-19 18088]

*Newly Created Service* - ATWPKT2
.
.
------- Supplementary Scan -------

2nd half...
------- Supplementary Scan -------
.

O16 -: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
c:\windows\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd

O16 -: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
c:\windows\Downloaded Program Files\start.INF
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-25 15:04:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(452)
c:\windows\system32\rsaenh.dll

- - - - - - - > 'lsass.exe'(508)
c:\windows\system32\msprivs.dll
c:\windows\system32\rsaenh.dll
.
Completion time: 2008-11-25 15:05:36
ComboFix-quarantined-files.txt 2008-11-25 20:05:01
ComboFix2.txt 2008-11-24 23:12:44

Pre-Run: 16,098,885,632 bytes free
Post-Run: 16,099,708,928 bytes free

154 --- E O F --- 2007-08-30 01:38:57

CFScript failed to delete two files last time, so lets use this.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
c:\windows\system32\DRIVERS\loop.sys
c:\documents and settings\Toyes\Application Data\xfoalicr.exe
c:\documents and settings\Toyes\Application Data\crdroathfssfg.dll
c:\windows\system32\DRIVERS\loop.sys
c:\ex.cab
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\Downloaded Program Files\start.INF

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Don't tick the box below.
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log.

avenger.txt
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!

File "c:\windows\system32\DRIVERS\loop.sys" deleted successfully.
File "c:\documents and settings\Toyes\Application Data\xfoalicr.exe" deleted successfully.
File "c:\documents and settings\Toyes\Application Data\crdroathfssfg.dll" deleted successfully.

Error: file "c:\windows\system32\DRIVERS\loop.sys" not found!
Deletion of file "c:\windows\system32\DRIVERS\loop.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Error: file "c:\ex.cab" not found!
Deletion of file "c:\ex.cab" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

File "c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat" deleted successfully.
File "c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat" deleted successfully.

Error: file "c:\windows\Downloaded Program Files\start.INF" not found!
Deletion of file "c:\windows\Downloaded Program Files\start.INF" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist


Completed script processing.

*******************

Finished! Terminate.

Hijackthis.log
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:17:54 PM, on 11/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\System32\lxczcoms.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Atari\Atari Arcade Hits 2\Atari icon.exe
C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe
C:\Program Files\Common Files\AOL\1187814962\ee\AOLSoftware.exe
C:\Program Files\Lexmark 1200 Series\lxczbmon.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\AIM\aim.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe
C:\Program Files\AOL Companion\companion.exe
C:\Program Files\FinePixViewer\QuickDCF.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Greetings Workshop\GWREMIND.EXE
C:\Program Files\Webshots\WebshotsTray.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\OpenOffice.org 2.4\program\soffice.BIN
C:\Program Files\trend micro\HijackThis\HijackThis.exe
C:\WINDOWS\SoftwareDistribution\Download\5652d934eec8bfa4dc68c4e256a23d5e\update\update.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll
O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\WINDOWS\Downloaded Program Files\ycomp5_1_5_0.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [Atari Launcher 2] C:\Program Files\Atari\Atari Arcade Hits 2\Atari icon.exe
O4 - HKLM\..\Run: [lxczbmgr.exe] "C:\Program Files\Lexmark 1200 Series\lxczbmgr.exe"
O4 - HKLM\..\Run: [FaxCenterServer] "C:\Program Files\Lexmark Fax Solutions\fm3032.exe" /s
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1187814962\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ShockmachineReminder] C:\Program Files\shockwave.com\Shockmachine\SmReminder.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [AIM] C:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PopUpStopperFreeEdition] "C:\PROGRA~1\PANICW~1\POP-UP~1\PSFree.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - S-1-5-18 Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE (User 'SYSTEM')
O4 - S-1-5-18 Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')
O4 - S-1-5-18 Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE (User 'Default user')
O4 - .DEFAULT Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe (User 'Default user')
O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')
O4 - .DEFAULT Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe (User 'Default user')
O4 - Startup: Greetings Workshop Reminders.lnk = C:\Program Files\Greetings Workshop\GWREMIND.EXE
O4 - Startup: OpenOffice.org 2.4.lnk = C:\Program Files\OpenOffice.org 2.4\program\quickstart.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\WebshotsTray.exe
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: America Online 9.0 Tray Icon.lnk = C:\Program Files\America Online 9.0\aoltray.exe
O4 - Global Startup: AOL Companion.lnk = C:\Program Files\AOL Companion\companion.exe
O4 - Global Startup: Exif Launcher.lnk = C:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqthb08.exe
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.medion.com
O16 - DPF: {33331111-1111-1111-1111-622221193458} - file://c:\ex.cab
O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (&Yahoo! Companion) - http://us.dl1.yimg.com/download.yahoo.com/dl/toolbar/yiebio5_1_5_0.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k29811.sckr.com
O17 - HKLM\Software\..\Telephony: DomainName = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{6F222E62-11BB-4955-A822-946892860BE1}: Domain = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{9C9D3AAA-D9F8-402A-8776-A9497737E20E}: Domain = k29811.sckr.com
O17 - HKLM\System\CCS\Services\Tcpip\..\{FC4F8FC7-06FD-4247-ACF3-51CBBFA1AB75}: Domain = k29811.sckr.com
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: lxcz_device - - C:\WINDOWS\System32\lxczcoms.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

--
End of file - 9673 bytes

The avenger got the files CF couldn't delete and the leftovers.
Do you know this domain?

k29811.sckr.com

no i don't know k29811.sckr.com

If you do not recognize the name and they are not your ISP, please do this.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = k29811.sckr.com
  O17 - HKLM\Software\..\Telephony: DomainName = k29811.sckr.com
  O17 - HKLM\System\CCS\Services\Tcpip\..\{6F222E62-11BB-4955-A822-946892860BE1}: Domain = k29811.sckr.com
  O17 - HKLM\System\CCS\Services\Tcpip\..\{9C9D3AAA-D9F8-402A-8776-A9497737E20E}: Domain = k29811.sckr.com
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FC4F8FC7-06FD-4247-ACF3-51CBBFA1AB75}: Domain = k29811.sckr.com
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

How do I find out if it's my ISP# b/c I don't know it.

A quick google search tells me it's malware.
Please use HJT with my instructions above to kill it.

okay I did what you said, do you want me to post anything else for you?

My mistake.

Please delete this folder in bold.
C:\Qoobox
===

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.
===

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Last edited by Belahzur on 25th November 2008, 9:59 pm; edited 1 time in total

i thought i already did that? should i reinstall it?

My mistake, i've edited my post.

thanks for all you're help, i'll try to do everything you said to prevent another infection!! great site!

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.