netsecuritytech.com malware virus

I started getting the following popup message when I open my Google Chrome browser.
This message started coming after clicking on a link (dont rememner the link) in google search results from Google Chrome browser.

Warning!!!Your computer contains various signs of viruses and malware programs presence.Your system requires immediate anti viruses check!Winweb Security will perform a quick and free scanning of your PC for viruses and malicious programs.

The title of the pop-up alert message box is : Alert hxxp://netsecurityhcet.com/ with OK and Cancel button.
I clicked Cancel and immediately closed the browser.

This message comes only in Google Chrome but not in other browsers like IE or firefox.

Please help me in resolving this problem.

Below is the content of hijackthis.log when I ran the Hijack(GP)This tool:

---------------------------------------------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:03:24 PM, on 12/15/2008
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v7.00 (7.00.6001.18000)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Windows\System32\rundll32.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Users\Jayashree\AppData\Local\Google\Update\GoogleUpdate.exe
C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Jayashree\Desktop\Hijack(GP)This.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.comcast.net/toolbar2.0/search/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.comcast.net/toolbar2.0/search/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Comcast Toolbar - {4E7BD74F-2B8D-469E-93BE-BE2DF4D9AE29} - C:\PROGRA~1\COMCAS~1\COMCAS~1.DLL
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [PD0620 STISvc] RunDLL32.exe P0620Pin.dll,RunDLL32EP 513
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [McAfee Backup] C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
O4 - HKLM\..\Run: [MBkLogOnHook] C:\Program Files\McAfee\MBK\LogOnHook.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKCU\..\Run: [googletalk] C:\Users\Basker\AppData\Roaming\Google\Google Talk\googletalk.exe /autostart
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Google Update] "C:\Users\Basker\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-2459442420-2940108781-1886066833-1001\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'Jayashree')
O4 - Global Startup: HP Connections.lnk = C:\Program Files\HP Connections\6811507\Program\HP Connections.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O13 - Gopher Prefix:
O15 - Trusted Zone: http://www.techsatish.tv
O16 - DPF: {3EA4FA88-E0BE-419A-A732-9B79B87A6ED0} (CTVUAxCtrl Object) - http://isaitamil.net/isaitv/tv/TVUAx.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www2.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1198529041350
O16 - DPF: {71D413D7-38C5-4035-8548-976522CF11D5} (Crucial cpcScan) - http://www.crucial.com/controls/cpcVistaBeta.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://tcs.webex.com/client/T25L/webex/ieatgpc1.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 11541 bytes


---------------------------------------------------------------------------------------------

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts, but select NO when asked to install the recovery console.
3. When finished, it shall produce a log for you. Post that log in your next reply.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.

Please find the below log from Combo run.exe-part1

ComboFix 08-12-15.08 - Basker 12/16/2008 12:10:56.1 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.2037.1248 [GMT -8:00]
Running from: c:\users\Jayashree\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\cr2c40jp.dll
c:\windows\system32\implode.dll
c:\windows\system32\x64

.
((((((((((((((((((((((((( Files Created from 2008-11-16 to 2008-12-16 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-16 17:22 --------- d-----w c:\users\Basker\AppData\Roaming\UseNeXT
2008-12-15 17:17 --------- d-----w c:\users\Jayashree\AppData\Roaming\UseNeXT
2008-12-13 21:48 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-13 21:48 --------- d-----w c:\program files\iTunes
2008-12-13 21:47 --------- d-----w c:\program files\iPod
2008-12-13 21:47 --------- d-----w c:\program files\Common Files\Apple
2008-12-13 21:43 --------- d-----w c:\program files\QuickTime
2008-12-13 04:07 --------- d-----w c:\program files\DivX
2008-12-13 03:57 --------- d-----w c:\program files\Google
2008-12-11 16:54 --------- d-----w c:\program files\Windows Mail
2008-12-08 18:09 --------- d-----w c:\programdata\WinZip
2008-12-07 08:51 --------- d-----w c:\program files\UseNeXT
2008-11-25 05:26 --------- d-----w c:\program files\AVS4YOU
2008-11-25 05:16 --------- d-----w c:\program files\CloneCD
2008-11-21 21:47 524,288 ----a-w c:\windows\System32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\System32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\System32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\System32\libdivx.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\System32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\System32\DivXWMPExtType.dll
2008-11-19 04:18 --------- d-----w c:\users\Jayashree\AppData\Roaming\DivX
2008-11-19 03:51 --------- d-----w c:\program files\Common Files\Adobe
2008-11-17 20:04 2,306,113 ----a-w c:\windows\System32\GPhotos.scr
2008-11-17 03:42 --------- d-----w c:\program files\Common Files\Mercury Interactive
2008-11-17 03:27 --------- d-----w c:\users\Jayashree\AppData\Roaming\uTorrent
2008-11-17 03:06 --------- d-----w c:\program files\Mercury Interactive
2008-11-17 03:04 --------- d-----w c:\users\Jayashree\AppData\Roaming\DeepBurner
2008-11-17 02:17 --------- d-----w c:\program files\uTorrent
2008-11-16 19:07 --------- d-----w c:\users\Basker\AppData\Roaming\DeepBurner
2008-11-16 19:07 --------- d-----w c:\program files\Astonsoft
2008-11-16 18:57 --------- d-----w c:\users\Basker\AppData\Roaming\Skype
2008-11-16 18:56 --------- d-----w c:\users\Basker\AppData\Roaming\skypePM
2008-11-09 02:32 --------- d-----w c:\users\Jayashree\AppData\Roaming\Skype
2008-11-09 00:05 --------- d-----w c:\users\Jayashree\AppData\Roaming\skypePM
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-27 02:05 --------- d-----w c:\programdata\Roxio
2008-10-25 03:50 --------- d-----w c:\users\Basker\AppData\Roaming\McAfee
2008-10-23 03:50 --------- d-----w c:\users\Jayashree\AppData\Roaming\McAfee
2008-10-23 03:50 --------- d-----w c:\programdata\McAfee
2008-10-23 03:42 --------- d-----w c:\users\Jayashree\AppData\Roaming\COMCASTTOOLBAR
2008-10-22 17:25 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-10-20 01:51 --------- d-----w c:\users\Basker\AppData\Roaming\ComcastToolbar
2008-10-20 01:44 --------- d-----w c:\program files\Common Files\Scanner
2008-10-20 01:32 --------- d-----w c:\program files\ComcastToolbar
2008-10-19 19:37 --------- d-----w c:\program files\McAfee
2008-10-19 01:49 --------- d-----w c:\program files\Common Files\McAfee
2008-10-19 01:48 --------- d-----w c:\program files\McAfee.com
2008-10-19 00:58 --------- d-----w c:\program files\support.com
2008-10-19 00:57 --------- d-----w c:\program files\Common Files\SupportSoft
2008-10-16 22:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 21:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-01 00:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-29 05:32 410,976 ----a-w c:\windows\System32\deploytk.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-08-30 20:59 174 --sha-w c:\program files\desktop.ini
2008-08-29 01:50 56 ---ha-w c:\users\All Users\ezsidmv.dat
2008-08-29 01:50 56 ---ha-w c:\programdata\ezsidmv.dat
2008-01-29 15:38 28,672 ----a-w c:\users\Jayashree\atwbxdet.dll
2007-08-26 19:51 262,144 ----a-w c:\programdata\ntuser.dat
2007-08-07 14:29 93,774 ----a-w c:\users\Jayashree\atgpcext.dll
2007-08-07 14:29 80,973 ----a-w c:\users\Jayashree\ieatgpc.dll
2007-08-07 14:29 13,390 ----a-w c:\users\Jayashree\atgpcdec.dll
2007-07-17 14:34 93,774 ----a-w c:\users\Basker\atgpcext.dll
2007-07-17 14:34 80,973 ----a-w c:\users\Basker\ieatgpc.dll
2007-07-17 14:34 13,390 ----a-w c:\users\Basker\atgpcdec.dll
2008-06-08 20:41 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-06-08 20:41 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-06-08 20:41 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-06-08 20:41 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-06-08 20:41 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-06-10 14:41 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-06-10 14:41 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-06-10 14:41 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-05-08 07:28 22 --sha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [02/16/2005 04:15 PM 221184]
"googletalk"="c:\users\Basker\AppData\Roaming\Google\Google Talk\googletalk.exe" [01/01/2007 01:22 PM 3739648]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 04:43 PM 4670704]
"Google Update"="c:\users\Basker\AppData\Local\Google\Update\GoogleUpdate.exe" [11/16/2008 11:00 AM 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [01/18/2008 11:38 PM 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [09/15/2007 02:50 AM 1021224]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [11/06/2006 10:58 AM 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [06/05/2007 09:12 AM 71176]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [10/18/2006 09:56 AM 317152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [10/18/2006 09:32 AM 472800]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [03/12/2007 05:30 PM 517768]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [09/15/2007 02:29 AM 102400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [02/11/2008 07:13 PM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [02/11/2008 07:13 PM 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [02/11/2008 07:13 PM 133656]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [09/03/2008 07:12 PM 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [09/28/2008 09:35 PM 144792]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [11/01/2007 05:12 PM 582992]
"McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [01/16/2007 12:59 PM 4838952]
"MBkLogOnHook"="c:\program files\McAfee\MBK\LogOnHook.exe" [01/08/2007 10:22 AM 20480]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/15/2008 01:04 AM 39792]
"CloneCDElbyCDFL"="c:\program files\CloneCD\ElbyCheck.exe" [12/06/2001 04:09 AM 45056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [11/04/2008 10:30 AM 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [11/20/2008 01:20 PM 290088]
"PD0620 STISvc"="P0620Pin.dll" [05/10/2005 09:03 AM 36864 c:\windows\System32\P0620Pin.dll]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Connections.lnk - c:\program files\HP Connections\6811507\Program\HP Connections.exe [2006-12-17 34520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

Please find the below log after Combofix.exe-part2

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FF410DC1-9B89-450A-9149-56091397F842}"= UDP:c:\program files\HP\QuickPlay\QP.exe:QP
"{1527A20A-9856-4DE3-852A-10E73B707B3C}"= TCP:c:\program files\HP\QuickPlay\QP.exe:QP
"{F68661BE-C072-4C3F-8437-B845A302674C}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{C1729459-FF53-4016-955F-F16A89461BFD}"= c:\program files\HP Connections\6811507\Program\HP Connections:HP Connections
"{1F01BF90-4230-48B1-A759-7E8251A1C816}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{0D26767E-1200-4714-8D7B-5D0C17D364BA}"= TCP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{344114AA-9FB4-48B5-84B2-7994E04D8AC4}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{E76B4AC4-ED29-487A-AE3B-AD101B503B38}"= TCP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{209DD644-EE5B-41B3-9983-74E3DBF635F0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F5FAE2A8-D534-43B4-8A75-DFB5F4F8B543}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5D752E3B-9435-4FE8-88BA-783E9B4F4ED7}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{97C35DD8-5A0B-4BB2-8E8D-46F3ADD03644}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{85E113F6-2BAD-472B-BF41-FECD2C1E6B22}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5D4E537E-DEF2-4B74-B555-EF473F2CC5F4}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2E88D055-4E13-401D-8A99-40C719506794}"= UDP:c:\program files\uTorrent\utorrent.exe:µTorrent
"{641B948F-5B20-42B4-8A53-F4BC71F15B7E}"= TCP:c:\program files\uTorrent\utorrent.exe:µTorrent
"{FEF8002C-46B5-451F-99C5-78826175A04C}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{5D0491D8-3266-4E4B-99AA-4C02CD4A39ED}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{3160BF2C-D0E6-4205-90D8-2A71876A1429}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{290EE5A7-6285-4702-962D-D6C450FE68FE}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{805900D9-B374-40FA-B297-F4C33FB56886}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{C53FE7F1-22DE-429A-B9B2-8F091A386131}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1D3EC3F4-B409-4360-92C7-68AE2D9E313B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{AF6DC9B3-BE1C-4C25-AEF7-7591BC56B02C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{6CD71335-F95B-4872-B64C-1D3EAAC3AC4C}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"TCP Query User{ED4F8FFC-8234-4B23-B4C8-CD135D5DC607}c:\\program files\\mcafee\\mbk\\mcafeedatabackup.exe"= UDP:c:\program files\mcafee\mbk\mcafeedatabackup.exe:McAfee Data Backup
"UDP Query User{17D2B0EC-451E-4CF9-A081-344503C812D9}c:\\program files\\mcafee\\mbk\\mcafeedatabackup.exe"= TCP:c:\program files\mcafee\mbk\mcafeedatabackup.exe:McAfee Data Backup
"{A3BB1529-2ABF-4EB2-8DA2-2411626D8424}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{8DD60113-0A2D-4C7A-BFAD-F627413FF6C6}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{9E516E98-7313-4A98-8953-D8148B98744C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{92B9E243-6058-4772-83B3-02B65E385CF3}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"= c:\program files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox

R2 paldrv;paldrv;\??\c:\windows\system32\pal_drv.sys [2008-11-16 5536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c015421-44b5-11dd-a93c-001636ff9aba}]
\shell\AutoRun\command - f:\wd_windows_tools\Setup.exe

*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1F92EBFD-3382-4747-BF58-B6B1BB2B996C}]
"c:\program files\UninstallScripts\IPSec 06_01.054\Install.wsf" //job:ActiveSetup
.
Contents of the 'Scheduled Tasks' folder

2008-12-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Jayashree\AppData\Local\Google\Update\GoogleUpdate.exe [09/07/2008 07:56 PM]

2008-12-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [12/04/2007 12:32 PM]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [12/04/2007 12:32 PM]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{4F11ACBB-393F-4C86-A214-FF3D0D155CC3} - (no file)



**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 12:16:22
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
McAfee Backup = c:\program files\McAfee\MBK\McAfeeDataBackup.exe?????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 12/16/2008 12:24:47
ComboFix-quarantined-files.txt 2008-12-16 20:24:44

Pre-Run: 10,764,238,848 bytes free
Post-Run: 11,922,972,672 bytes free

236 --- E O F --- 2008-12-11 16:25:33

Looks okay, how is everything now?

Hi Belahzur,
After i was getting the popup message from Google Chrome, I uninstalled the Google Chrome and I was running the Hijackthis.exe and Combofix.exe (when the google chrome was uninstalled).
Now after running the combofix.exe, I installed the Google chrome and I still get the same problem when I open the google chrome browser.(Pop up alert box to install Winweb Security).

Do I have to run the hijackthis.exe and comboFix.exe again now (With google chrome installed.)?

Please advice...

Yes, you may have to.
The zlob stuff this forum is flooded with, it hides in the Google folder, so re-install it and run CF again, see what happens.

Hi Belazhur,
Acutally the home page of google chrome is set to a url which pops up the message. I changed it. now the pop up is not coming.
I have attached the logs of CF.
Please see is it ok?

---------------PART-1 of 2-------------------------
ComboFix 08-12-15.08 - Basker 12/16/2008 20:18:04.2 - NTFSx86
Microsoft Windows Vista Home Premium 6.0.6001.1.1252.1.1033.18.2037.869 [GMT -8:00]
Running from: c:\users\Jayashree\Desktop\ComboFix.exe
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2008-11-17 to 2008-12-17 )))))))))))))))))))))))))))))))
.

No new files created in this timespan

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-17 04:17 6,736 ----a-w c:\windows\system32\drivers\PROCEXP90.SYS
2008-12-16 17:22 --------- d-----w c:\users\Basker\AppData\Roaming\UseNeXT
2008-12-15 17:17 --------- d-----w c:\users\Jayashree\AppData\Roaming\UseNeXT
2008-12-13 21:48 --------- d-----w c:\programdata\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}
2008-12-13 21:48 --------- d-----w c:\program files\iTunes
2008-12-13 21:47 --------- d-----w c:\program files\iPod
2008-12-13 21:47 --------- d-----w c:\program files\Common Files\Apple
2008-12-13 21:43 --------- d-----w c:\program files\QuickTime
2008-12-13 04:07 --------- d-----w c:\program files\DivX
2008-12-13 03:57 --------- d-----w c:\program files\Google
2008-12-11 16:54 --------- d-----w c:\program files\Windows Mail
2008-12-08 18:09 --------- d-----w c:\programdata\WinZip
2008-12-07 08:51 --------- d-----w c:\program files\UseNeXT
2008-11-25 05:26 --------- d-----w c:\program files\AVS4YOU
2008-11-25 05:16 --------- d-----w c:\program files\CloneCD
2008-11-21 21:47 524,288 ----a-w c:\windows\System32\DivXsm.exe
2008-11-21 21:47 3,596,288 ----a-w c:\windows\System32\qt-dx331.dll
2008-11-21 21:46 200,704 ----a-w c:\windows\System32\ssldivx.dll
2008-11-21 21:46 1,044,480 ----a-w c:\windows\System32\libdivx.dll
2008-11-21 21:44 161,096 ----a-w c:\windows\System32\DivXCodecVersionChecker.exe
2008-11-21 21:44 12,288 ----a-w c:\windows\System32\DivXWMPExtType.dll
2008-11-19 04:18 --------- d-----w c:\users\Jayashree\AppData\Roaming\DivX
2008-11-19 03:51 --------- d-----w c:\program files\Common Files\Adobe
2008-11-17 20:04 2,306,113 ----a-w c:\windows\System32\GPhotos.scr
2008-11-17 03:42 --------- d-----w c:\program files\Common Files\Mercury Interactive
2008-11-17 03:27 --------- d-----w c:\users\Jayashree\AppData\Roaming\uTorrent
2008-11-17 03:06 --------- d-----w c:\program files\Mercury Interactive
2008-11-17 03:04 --------- d-----w c:\users\Jayashree\AppData\Roaming\DeepBurner
2008-11-17 02:17 --------- d-----w c:\program files\uTorrent
2008-11-16 19:07 --------- d-----w c:\users\Basker\AppData\Roaming\DeepBurner
2008-11-16 19:07 --------- d-----w c:\program files\Astonsoft
2008-11-16 18:57 --------- d-----w c:\users\Basker\AppData\Roaming\Skype
2008-11-16 18:56 --------- d-----w c:\users\Basker\AppData\Roaming\skypePM
2008-11-09 02:32 --------- d-----w c:\users\Jayashree\AppData\Roaming\Skype
2008-11-09 00:05 --------- d-----w c:\users\Jayashree\AppData\Roaming\skypePM
2008-11-01 03:44 541,696 ----a-w c:\windows\AppPatch\AcLayers.dll
2008-11-01 03:44 52,736 ----a-w c:\windows\AppPatch\iebrshim.dll
2008-11-01 03:44 460,288 ----a-w c:\windows\AppPatch\AcSpecfc.dll
2008-11-01 03:44 28,672 ----a-w c:\windows\System32\Apphlpdm.dll
2008-11-01 03:44 2,154,496 ----a-w c:\windows\AppPatch\AcGenral.dll
2008-11-01 03:44 173,056 ----a-w c:\windows\AppPatch\AcXtrnal.dll
2008-11-01 01:21 4,240,384 ----a-w c:\windows\System32\GameUXLegacyGDFs.dll
2008-10-29 06:29 2,927,104 ----a-w c:\windows\explorer.exe
2008-10-27 02:05 --------- d-----w c:\programdata\Roxio
2008-10-25 03:50 --------- d-----w c:\users\Basker\AppData\Roaming\McAfee
2008-10-23 03:50 --------- d-----w c:\users\Jayashree\AppData\Roaming\McAfee
2008-10-23 03:50 --------- d-----w c:\programdata\McAfee
2008-10-23 03:42 --------- d-----w c:\users\Jayashree\AppData\Roaming\COMCASTTOOLBAR
2008-10-22 17:25 --------- d-----w c:\program files\Microsoft Silverlight
2008-10-22 03:57 241,152 ----a-w c:\windows\System32\PortableDeviceApi.dll
2008-10-22 01:22 2,048 ----a-w c:\windows\System32\tzres.dll
2008-10-21 05:25 296,960 ----a-w c:\windows\System32\gdi32.dll
2008-10-21 05:25 1,645,568 ----a-w c:\windows\System32\connect.dll
2008-10-20 01:51 --------- d-----w c:\users\Basker\AppData\Roaming\ComcastToolbar
2008-10-20 01:44 --------- d-----w c:\program files\Common Files\Scanner
2008-10-20 01:32 --------- d-----w c:\program files\ComcastToolbar
2008-10-19 19:37 --------- d-----w c:\program files\McAfee
2008-10-19 01:49 --------- d-----w c:\program files\Common Files\McAfee
2008-10-19 01:48 --------- d-----w c:\program files\McAfee.com
2008-10-19 00:58 --------- d-----w c:\program files\support.com
2008-10-19 00:57 --------- d-----w c:\program files\Common Files\SupportSoft
2008-10-16 22:08 162,064 ----a-w c:\windows\System32\wuwebv.dll
2008-10-16 21:56 31,232 ----a-w c:\windows\System32\wuapp.exe
2008-10-16 21:13 1,809,944 ----a-w c:\windows\System32\wuaueng.dll
2008-10-16 21:12 561,688 ----a-w c:\windows\System32\wuapi.dll
2008-10-16 21:09 51,224 ----a-w c:\windows\System32\wuauclt.exe
2008-10-16 21:09 43,544 ----a-w c:\windows\System32\wups2.dll
2008-10-16 21:08 34,328 ----a-w c:\windows\System32\wups.dll
2008-10-16 20:56 1,524,736 ----a-w c:\windows\System32\wucltux.dll
2008-10-16 20:55 83,456 ----a-w c:\windows\System32\wudriver.dll
2008-10-16 04:47 827,392 ----a-w c:\windows\System32\wininet.dll
2008-10-01 00:43 1,286,152 ----a-w c:\windows\System32\msxml4.dll
2008-09-29 05:32 410,976 ----a-w c:\windows\System32\deploytk.dll
2008-09-18 05:09 3,601,464 ----a-w c:\windows\System32\ntkrnlpa.exe
2008-09-18 05:09 3,549,240 ----a-w c:\windows\System32\ntoskrnl.exe
2008-09-18 04:56 147,456 ----a-w c:\windows\System32\Faultrep.dll
2008-09-18 04:56 125,952 ----a-w c:\windows\System32\wersvc.dll
2008-09-18 02:16 2,032,640 ----a-w c:\windows\System32\win32k.sys
2008-08-30 20:59 174 --sha-w c:\program files\desktop.ini
2008-08-29 01:50 56 ---ha-w c:\users\All Users\ezsidmv.dat
2008-08-29 01:50 56 ---ha-w c:\programdata\ezsidmv.dat
2008-01-29 15:38 28,672 ----a-w c:\users\Jayashree\atwbxdet.dll
2007-08-26 19:51 262,144 ----a-w c:\programdata\ntuser.dat
2007-08-07 14:29 93,774 ----a-w c:\users\Jayashree\atgpcext.dll
2007-08-07 14:29 80,973 ----a-w c:\users\Jayashree\ieatgpc.dll
2007-08-07 14:29 13,390 ----a-w c:\users\Jayashree\atgpcdec.dll
2007-07-17 14:34 93,774 ----a-w c:\users\Basker\atgpcext.dll
2007-07-17 14:34 80,973 ----a-w c:\users\Basker\ieatgpc.dll
2007-07-17 14:34 13,390 ----a-w c:\users\Basker\atgpcdec.dll
2008-06-08 20:41 67,696 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-06-08 20:41 54,376 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-06-08 20:41 34,952 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-06-08 20:41 46,720 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-06-08 20:41 172,144 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2008-06-10 14:41 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
2008-06-10 14:41 32,768 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
2008-06-10 14:41 16,384 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
2007-05-08 07:28 22 --sha-w c:\windows\SMINST\HPCD.sys
.

((((((((((((((((((((((((((((( snapshot@Tue 12-16-2008_12.17.10.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-16 19:57:27 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2008-12-16 20:45:19 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2008-12-16 19:57:27 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2008-12-16 20:45:19 2,048 --sha-w c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2008-12-16 20:16:32 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
+ 2008-12-16 20:47:11 262,144 --sha-w c:\windows\ServiceProfiles\LocalService\NTUSER.DAT
- 2008-12-16 20:16:26 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
+ 2008-12-16 20:47:05 262,144 --sha-w c:\windows\ServiceProfiles\NetworkService\NTUSER.DAT
- 2008-12-16 20:02:31 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2008-12-17 03:24:22 16,384 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2008-12-16 20:02:31 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-17 03:24:22 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2008-12-16 20:02:31 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2008-12-17 03:24:22 32,768 --sha-w c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2008-12-16 19:59:23 16,402 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2459442420-2940108781-1886066833-1001_UserData.bin
+ 2008-12-16 20:47:13 16,402 ----a-w c:\windows\System32\WDI\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2459442420-2940108781-1886066833-1001_UserData.bin
- 2008-12-16 19:59:23 66,264 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
+ 2008-12-16 20:47:13 66,264 ----a-w c:\windows\System32\WDI\BootPerformanceDiagnostics_SystemData.bin
- 2008-12-16 19:59:22 68,522 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2008-12-16 20:47:11 68,692 ----a-w c:\windows\System32\WDI\ShutdownPerformanceDiagnostics_SystemData.bin
- 2008-12-16 00:59:24 271,788 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2008-12-17 03:18:07 272,054 ----a-w c:\windows\System32\WDI\SuspendPerformanceDiagnostics_SystemData_S3.bin
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

-----------------------PART-2 of 2------------------------
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [02/16/2005 04:15 PM 221184]
"googletalk"="c:\users\Basker\AppData\Roaming\Google\Google Talk\googletalk.exe" [01/01/2007 01:22 PM 3739648]
"Yahoo! Pager"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [08/30/2007 04:43 PM 4670704]
"Google Update"="c:\users\Basker\AppData\Local\Google\Update\GoogleUpdate.exe" [11/16/2008 11:00 AM 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [09/15/2007 02:50 AM 1021224]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [11/06/2006 10:58 AM 159744]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [06/05/2007 09:12 AM 71176]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [10/18/2006 09:56 AM 317152]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [10/18/2006 09:32 AM 472800]
"Symantec PIF AlertEng"="c:\program files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [03/12/2007 05:30 PM 517768]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [09/15/2007 02:29 AM 102400]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [02/11/2008 07:13 PM 141848]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [02/11/2008 07:13 PM 166424]
"Persistence"="c:\windows\system32\igfxpers.exe" [02/11/2008 07:13 PM 133656]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [09/03/2008 07:12 PM 111936]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [09/28/2008 09:35 PM 144792]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [11/01/2007 05:12 PM 582992]
"McAfee Backup"="c:\program files\McAfee\MBK\McAfeeDataBackup.exe" [01/16/2007 12:59 PM 4838952]
"MBkLogOnHook"="c:\program files\McAfee\MBK\LogOnHook.exe" [01/08/2007 10:22 AM 20480]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/15/2008 01:04 AM 39792]
"CloneCDElbyCDFL"="c:\program files\CloneCD\ElbyCheck.exe" [12/06/2001 04:09 AM 45056]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [11/04/2008 10:30 AM 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [11/20/2008 01:20 PM 290088]
"PD0620 STISvc"="P0620Pin.dll" [05/10/2005 09:03 AM 36864 c:\windows\System32\P0620Pin.dll]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Connections.lnk - c:\program files\HP Connections\6811507\Program\HP Connections.exe [2006-12-17 34520]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{FF410DC1-9B89-450A-9149-56091397F842}"= UDP:c:\program files\HP\QuickPlay\QP.exe:QP
"{1527A20A-9856-4DE3-852A-10E73B707B3C}"= TCP:c:\program files\HP\QuickPlay\QP.exe:QP
"{F68661BE-C072-4C3F-8437-B845A302674C}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{C1729459-FF53-4016-955F-F16A89461BFD}"= c:\program files\HP Connections\6811507\Program\HP Connections:HP Connections
"{1F01BF90-4230-48B1-A759-7E8251A1C816}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{0D26767E-1200-4714-8D7B-5D0C17D364BA}"= TCP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{344114AA-9FB4-48B5-84B2-7994E04D8AC4}"= UDP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{E76B4AC4-ED29-487A-AE3B-AD101B503B38}"= TCP:c:\program files\HP Connections\6811507\Program\HP Connections.exe:HP Connections
"{209DD644-EE5B-41B3-9983-74E3DBF635F0}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{F5FAE2A8-D534-43B4-8A75-DFB5F4F8B543}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5D752E3B-9435-4FE8-88BA-783E9B4F4ED7}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{97C35DD8-5A0B-4BB2-8E8D-46F3ADD03644}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{85E113F6-2BAD-472B-BF41-FECD2C1E6B22}"= UDP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{5D4E537E-DEF2-4B74-B555-EF473F2CC5F4}"= TCP:c:\program files\earthlink totalaccess\TaskPanl.exe:taskpanl
"{2E88D055-4E13-401D-8A99-40C719506794}"= UDP:c:\program files\uTorrent\utorrent.exe:µTorrent
"{641B948F-5B20-42B4-8A53-F4BC71F15B7E}"= TCP:c:\program files\uTorrent\utorrent.exe:µTorrent
"{FEF8002C-46B5-451F-99C5-78826175A04C}"= UDP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{5D0491D8-3266-4E4B-99AA-4C02CD4A39ED}"= TCP:c:\program files\Yahoo!\Messenger\YahooMessenger.exe:Yahoo! Messenger
"{3160BF2C-D0E6-4205-90D8-2A71876A1429}"= UDP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{290EE5A7-6285-4702-962D-D6C450FE68FE}"= TCP:c:\program files\Yahoo!\Messenger\YServer.exe:Yahoo! FT Server
"{805900D9-B374-40FA-B297-F4C33FB56886}"= c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{C53FE7F1-22DE-429A-B9B2-8F091A386131}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{1D3EC3F4-B409-4360-92C7-68AE2D9E313B}"= UDP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{AF6DC9B3-BE1C-4C25-AEF7-7591BC56B02C}"= TCP:c:\program files\Bonjour\mDNSResponder.exe:Bonjour
"{6CD71335-F95B-4872-B64C-1D3EAAC3AC4C}"= Profile=Private|Profile=Public|c:\program files\Common Files\Mcafee\MNA\McNaSvc.exe:McAfee Network Agent
"TCP Query User{ED4F8FFC-8234-4B23-B4C8-CD135D5DC607}c:\\program files\\mcafee\\mbk\\mcafeedatabackup.exe"= UDP:c:\program files\mcafee\mbk\mcafeedatabackup.exe:McAfee Data Backup
"UDP Query User{17D2B0EC-451E-4CF9-A081-344503C812D9}c:\\program files\\mcafee\\mbk\\mcafeedatabackup.exe"= TCP:c:\program files\mcafee\mbk\mcafeedatabackup.exe:McAfee Data Backup
"{A3BB1529-2ABF-4EB2-8DA2-2411626D8424}"= UDP:c:\program files\uTorrent\uTorrent.exe:µTorrent (TCP-In)
"{8DD60113-0A2D-4C7A-BFAD-F627413FF6C6}"= TCP:c:\program files\uTorrent\uTorrent.exe:µTorrent (UDP-In)
"{9E516E98-7313-4A98-8953-D8148B98744C}"= UDP:c:\program files\iTunes\iTunes.exe:iTunes
"{92B9E243-6058-4772-83B3-02B65E385CF3}"= TCP:c:\program files\iTunes\iTunes.exe:iTunes

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile\AuthorizedApplications\List]
"c:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= c:\program files\EarthLink TotalAccess\TaskPanl.exe:*:Enabled:Earthlink
"c:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"= c:\program files\Yahoo!\Yahoo! Music Jukebox\YahooMusicEngine.exe:*:Enabled:Yahoo! Music Jukebox

R2 paldrv;paldrv;\??\c:\windows\system32\pal_drv.sys [2008-11-16 5536]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c015421-44b5-11dd-a93c-001636ff9aba}]
\shell\AutoRun\command - f:\wd_windows_tools\Setup.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{1F92EBFD-3382-4747-BF58-B6B1BB2B996C}]
"c:\program files\UninstallScripts\IPSec 06_01.054\Install.wsf" //job:ActiveSetup
.
Contents of the 'Scheduled Tasks' folder

2008-12-16 c:\windows\Tasks\GoogleUpdateTaskUser.job
- c:\users\Jayashree\AppData\Local\Google\Update\GoogleUpdate.exe [09/07/2008 07:56 PM]

2008-12-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [12/04/2007 12:32 PM]

2008-11-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [12/04/2007 12:32 PM]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-16 20:21:57
Windows 6.0.6001 Service Pack 1 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
McAfee Backup = c:\program files\McAfee\MBK\McAfeeDataBackup.exe?????????????????????????????????????????????????????????????????????????????????

scanning hidden files ...


c:\users\Basker\AppData\Local\Temp\catchme.dll


**************************************************************************
.
Completion time: 12/16/2008 20:31:20
ComboFix-quarantined-files.txt 2008-12-17 04:29:58
ComboFix2.txt 2008-12-16 20:24:49

Pre-Run: 12,160,798,720 bytes free
Post-Run: 12,307,726,336 bytes free

252 --- E O F --- 2008-12-11 16:25:33

Thanks for letting me know, guess the zlob has changed tactics now.
Looks clean.
What problems remain?

As of now, no problem.
Thanks for all your support and help.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.


Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.