HELP Antivirus 2009 AGAIN

It has disabled my virus software and sound this time.....how do I keep getting this??? Popups are horrible!


Here is my HijackThis log file

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:34, on 2008-12-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\RealVNC\WinVNC\WinVNC.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe
C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\kbiggerstaff\Desktop\hijackgpthis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\Webtools\webtools.dll
O2 - BHO: (no name) - {6101022B-EC69-4AD3-A383-9013EFA2A7D0} - C:\WINDOWS\system32\efccYRlI.dll
O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnooLDV.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: {59a976f7-cb9a-f9c9-d2a4-9a197ead45dc} - {cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95} - C:\WINDOWS\system32\yddwiq.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\RealVNC\WinVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKLM\..\Run: [0cbfd446] rundll32.exe "C:\WINDOWS\system32\kkwghuok.dll",b
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe
O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe
O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.tes.monroe.k12.ky.us
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1229264744031
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O17 - HKLM\Software\..\Telephony: DomainName = monroe.ketsds.net
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
O20 - AppInit_DLLs: yddwiq.dll
O20 - Winlogon Notify: opnooLDV - C:\WINDOWS\SYSTEM32\opnooLDV.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - McAfee, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: VNC Server (winvnc) - RealVNC Ltd. - C:\Program Files\RealVNC\WinVNC\WinVNC.exe
O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

--
End of file - 8570 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = proxy.mcs.monroe.k12.ky.us:80
  R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.monroe.k12.ky.us;*.ketsmail.us;
  O2 - BHO: testCPV6 - {15421B84-3488-49A7-AD18-CBF84A3EFAF6} - C:\Program Files\Webtools\webtools.dll
  O2 - BHO: (no name) - {6101022B-EC69-4AD3-A383-9013EFA2A7D0} - C:\WINDOWS\system32\efccYRlI.dll
  O2 - BHO: (no name) - {6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - C:\WINDOWS\system32\opnooLDV.dll
  O2 - BHO: {59a976f7-cb9a-f9c9-d2a4-9a197ead45dc} - {cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95} - C:\WINDOWS\system32\yddwiq.dll
  O4 - HKLM\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
  O4 - HKLM\..\Run: [0cbfd446] rundll32.exe "C:\WINDOWS\system32\kkwghuok.dll",b
  O4 - HKCU\..\Run: [prunnet] "C:\WINDOWS\system32\prunnet.exe"
  O4 - HKCU\..\Run: [gadcom] "C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe" 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
  O4 - HKCU\..\Run: [Twain] C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe
  O4 - HKCU\..\Run: [SpeedRunner] C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe
  O4 - HKCU\..\Run: [SfKg6wIP] C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe
  O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
  O17 - HKLM\Software\..\Telephony: DomainName = monroe.ketsds.net
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = monroe.ketsds.net
  See my note below on these 017 items
  O20 - AppInit_DLLs: yddwiq.dll
  O20 - Winlogon Notify: opnooLDV - C:\WINDOWS\SYSTEM32\opnooLDV.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Note: If monroe.ketsds.net is not your ISP and you do not know the domain, fix the item.


Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.31
Database version: 1500
Windows 5.1.2600 Service Pack 2

12/14/2008 10:44:59 AM
mbam-log-2008-12-14 (10-44-59).txt

Scan type: Quick Scan
Objects scanned: 15068
Time elapsed: 2 minute(s), 7 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\karna.dat (Trojan.FakeAlert) -> Quarantined and deleted successfully.

sorry --- wrong log...will post again

Okay.
Standing by.

Malwarebytes' Anti-Malware 1.31
Database version: 1500
Windows 5.1.2600 Service Pack 2

2008-12-28 17:30:57
mbam-log-2008-12-28 (17-30-56).txt

Scan type: Quick Scan
Objects scanned: 64893
Time elapsed: 16 minute(s), 39 second(s)

Memory Processes Infected: 4
Memory Modules Infected: 4
Registry Keys Infected: 33
Registry Values Infected: 8
Registry Data Items Infected: 2
Folders Infected: 4
Files Infected: 23

Memory Processes Infected:
C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe (Adware.Agent) -> Unloaded process successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe (Trojan.Vundo) -> Unloaded process successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe (Trojan.Agent) -> Unloaded process successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe (Trojan.Agent) -> Unloaded process successfully.

Memory Modules Infected:
C:\WINDOWS\system32\efccYRlI.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kkwghuok.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\opnooLDV.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{63bce468-62fa-43ec-990f-8a22ac444cbe} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{63bce468-62fa-43ec-990f-8a22ac444cbe} (Trojan.Vundo.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{63bce468-62fa-43ec-990f-8a22ac444cbe} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{15421b84-3488-49a7-ad18-cbf84a3efaf6} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bho_myjavacore.mjcore.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{17e44256-51e0-4d46-a0c8-44e80ab4ba5b} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\opnooldv (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\Typelib\{e0f01490-dcf3-4357-95aa-169a8c2b2190} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{80ef304a-b1c4-425c-8535-95ab6f1eefb8} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BHO_MyJavaCore.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\extra antivir (Rogue.Extraantivir) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\antiviruspro2009 (Rogue.Antivirus2008) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\SpeedRunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Track System (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0cbfd446 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\speedrunner (Adware.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sfkg6wip (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\prunnet (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\twain (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efccyrli -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo.H) -> Data: c:\windows\system32\efccyrli -> Delete on reboot.

Folders Infected:
C:\Program Files\Webtools (Trojan.Agent) -> Delete on reboot.
C:\Program Files\Mjcore (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\speedrunner (Adware.SurfAccuracy) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\efccYRlI.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\IlRYccfe.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\IlRYccfe.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\kkwghuok.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\kouhgwkk.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\SpeedRunner\SpeedRunner.exe (Adware.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Microsoft\Windows\fyjlwr.exe (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Program Files\Webtools\webtools.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\system32\opnooLDV.dll (Trojan.Vundo) -> Delete on reboot.
C:\Program Files\Mjcore\Mjcore.dll (Trojan.BHO) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\__A.tmp (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\__B.tmp (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\IHKN2D2H\155[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\J1BGLFVG\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\Temporary Internet Files\Content.IE5\J1BGLFVG\157[1].net (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\gadcom\gadcom.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\speedrunner\config.cfg (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\speedrunner\SRUninstall.exe (Adware.SurfAccuracy) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\prunnet.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\fccDWNHY.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Application Data\Twain\Twain.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\xpre.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\kbiggerstaff\Local Settings\temp\winvsnet.tmp (Rogue.Installer) -> Quarantined and deleted successfully.

Hello.
That should of taken the weight off, one last lookaround.

• Download combofix from here, use the top links - combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

-Virus Scan is still disabled and Popups here and there......

Here is the CmboFix log


ComboFix 08-11-18.03 - kbiggerstaff 2008-12-28 17:55:21.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1588 [GMT -6:00]
Running from: c:\documents and settings\kbiggerstaff\Desktop\-Combo-Fix-.exe
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\KBIGGE~1\LOCALS~1\Temp\tmp2.tmp
c:\windows\IE4 Error Log.txt

.
((((((((((((((((((((((((( Files Created from 2008-11-28 to 2008-12-28 )))))))))))))))))))))))))))))))
.

2008-12-28 17:54 . 2008-12-28 17:56 d-------- C:\-Combo-Fix-
2008-12-27 12:53 . 2008-12-28 17:30 d-------- c:\documents and settings\kbiggerstaff\Application Data\Twain
2008-12-27 12:44 . 2008-12-27 12:44 134,656 --a------ c:\windows\system32\yddwiq.dll
2008-12-27 12:44 . 2008-12-27 12:44 134,656 --a------ c:\windows\system32\ohpfhxtq.dll
2008-12-26 11:54 . 2008-12-26 11:54 1,299,082 ---hs---- c:\windows\system32\eqvotfvf.ini
2008-12-26 11:48 . 2008-12-26 11:48 135,680 --a------ c:\windows\system32\urogvn.dll
2008-12-26 11:48 . 2008-12-26 11:48 135,680 --a------ c:\windows\system32\ttvmckgf.dll
2008-12-22 21:51 . 2008-04-17 13:12 107,368 --a------ c:\windows\system32\GEARAspi.dll
2008-12-22 21:51 . 2008-04-17 13:12 15,464 --a------ c:\windows\system32\drivers\GEARAspiWDM.sys
2008-12-22 21:48 . 2008-12-22 21:48 d-------- c:\program files\Bonjour
2008-12-22 21:46 . 2008-12-22 22:37 d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-12-22 21:43 . 2008-12-22 21:43 d-------- c:\program files\Apple Software Update
2008-12-22 21:42 . 2008-11-07 14:23 32,000 --a------ c:\windows\system32\drivers\usbaapl.sys
2008-12-22 21:41 . 2008-12-22 22:37 d-------- c:\program files\Common Files\Apple
2008-12-22 21:37 . 2008-12-22 21:38 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-22 21:37 . 2008-12-22 21:38 1,409 --a------ c:\windows\QTFont.for
2008-12-22 21:30 . 2004-08-04 00:56 159,232 --a------ c:\windows\system32\ptpusd.dll
2008-12-22 21:30 . 2004-08-03 22:58 15,104 --a------ c:\windows\system32\drivers\usbscan.sys
2008-12-22 21:30 . 2004-08-03 22:58 15,104 --a--c--- c:\windows\system32\dllcache\usbscan.sys
2008-12-22 21:30 . 2001-08-17 22:36 5,632 --a------ c:\windows\system32\ptpusb.dll
2008-12-14 15:13 . 2008-12-14 15:12 410,984 --a------ c:\windows\system32\deploytk.dll
2008-12-14 11:29 . 2008-12-12 00:57 78,336 --a------ c:\windows\system32\Agent.OMZ.Fix.exe
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\kbiggerstaff\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-14 10:21 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-14 10:21 . 2008-12-03 19:59 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-14 10:21 . 2008-12-03 19:59 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-14 09:00 . 2008-12-14 09:00 d-------- c:\windows\5DF3D1BB894E4DCD8275159AC9829B43.TMP
2008-12-14 08:59 . 2008-12-14 08:59 19,136 --a------ c:\documents and settings\kbiggerstaff\Application Data\lojo.reg
2008-12-14 08:26 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-12-14 08:26 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-12-14 08:26 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-12-13 22:50 . 2008-12-13 22:50 d-------- c:\documents and settings\kbiggerstaff\Application Data\s_6002_fHx8fHx8fDEyNDE4MTMwNTZ8_

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-23 03:54 --------- d-----w c:\documents and settings\kbiggerstaff\Application Data\Apple Computer
2008-12-23 03:48 --------- d-----w c:\program files\QuickTime
2008-12-22 18:03 --------- d-----w c:\documents and settings\kbiggerstaff\Application Data\Video DVD Maker PRO
2008-12-14 21:12 --------- d-----w c:\program files\Java
2008-11-04 20:21 --------- d-----w c:\program files\Google
2008-10-16 20:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 20:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 20:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 20:12 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 20:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 20:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 20:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 20:08 34,328 ----a-w c:\windows\system32\wups.dll
.

((((((((((((((((((((((((((((( snapshot@2008-12-14_14.29.17.18 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-12-23 03:43:35 27,136 ----a-r c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
+ 2008-12-23 03:48:47 86,016 ----a-r c:\windows\Installer\{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}\PrntWzrdIco.exe
- 2006-09-27 12:50:12 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2008-12-28 22:01:41 16,384 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2006-09-27 12:50:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-12-28 22:01:41 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-27 12:50:12 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-12-28 22:01:41 32,768 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-29 16:18:58 87,336 ----a-w c:\windows\system32\dns-sd.exe
+ 2008-08-29 15:53:50 61,440 ----a-w c:\windows\system32\dnssd.dll
+ 2008-04-17 19:12:54 107,368 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspi.dll
+ 2008-04-17 19:12:54 15,464 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_D213663B6381F01E45A131159A9DEFE018321CB3\x86\GEARAspiWDM.sys
+ 2008-11-07 20:23:30 32,000 -c--a-w c:\windows\system32\DRVSTORE\usbaapl_246F92BBD6449C86FC3F3F28C40D59AC1F69C558\usbaapl.sys
- 2007-09-25 04:30:28 135,168 ----a-w c:\windows\system32\java.exe
+ 2008-12-14 21:12:28 144,792 ----a-w c:\windows\system32\java.exe
- 2007-09-25 04:30:30 135,168 ----a-w c:\windows\system32\javaw.exe
+ 2008-12-14 21:12:28 144,792 ----a-w c:\windows\system32\javaw.exe
- 2007-09-25 05:31:42 139,264 ----a-w c:\windows\system32\javaws.exe
+ 2008-12-14 21:12:28 148,888 ----a-w c:\windows\system32\javaws.exe
- 2008-12-14 18:38:42 116,097 ----a-w c:\windows\system32\nvModes.dat
+ 2008-12-24 23:37:58 116,097 ----a-w c:\windows\system32\nvModes.dat
- 2008-12-14 19:04:12 40,836 ----a-w c:\windows\system32\perfc009.dat
+ 2008-12-28 23:37:03 41,238 ----a-w c:\windows\system32\perfc009.dat
- 2008-12-14 19:04:12 314,508 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-28 23:37:03 315,076 ----a-w c:\windows\system32\perfh009.dat
+ 2008-12-28 23:32:59 16,384 ----atw c:\windows\temp\Perflib_Perfdata_7dc.dat
+ 2006-12-02 04:54:32 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-02 04:54:34 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-02 04:54:32 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95}]
2008-12-27 12:44 134656 --a------ c:\windows\system32\yddwiq.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"updateMgr"="c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 307200]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-03-21 7557120]
"IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-28 667718]
"IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-12-28 602182]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2004-08-04 143360]
"WinVNC"="c:\program files\RealVNC\WinVNC\WinVNC.exe" [2003-03-05 335872]
"McAfeeUpdaterUI"="c:\program files\Network Associates\Common Framework\UpdaterUI.exe" [2004-06-15 135224]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-14 136600]
"ShStatEXE"="c:\program files\Network Associates\VirusScan\SHSTAT.EXE" [2004-09-22 98304]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"nwiz"="nwiz.exe" [2006-03-21 c:\windows\system32\nwiz.exe]
"NVHotkey"="nvHotkey.dll" [2006-03-21 c:\windows\system32\nvhotkey.dll]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 c:\windows\stsystra.exe]

c:\documents and settings\kbiggerstaff\Start Menu\Programs\Startup\
LimeWire On Startup.lnk - c:\program files\LimeWire\LimeWire.exe [2008-06-18 147456]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2006-09-11 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\0\0]
"script"=checkuser.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\1\0]
"script"=MONROEDSA.VBS

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\0]
"script"=Create_TrackUsrDir.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\scripts\Startup\2\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-1402\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logoff\0\0]
"script"=usrLogOff.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\0]
"script"=usrLogon.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-633537362-1140134473-879972363-5705\scripts\Logon\0\1]
"script"=CompInv_MySQL.vbs

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 Eacfilt;Eacfilt Miniport;c:\windows\system32\DRIVERS\eacfilt.sys [2006-09-29 9817]
R3 IPSECSHM;Nortel IPSECSHM Adapter;c:\windows\system32\DRIVERS\ipsecw2k.sys [2006-09-29 117760]
S2 IPSECEXT;Nortel Extranet Access Protocol;c:\windows\system32\DRIVERS\ipsecw2k.sys [2006-09-29 117760]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ba23b58-5d14-11dd-aad8-444553544200}]
\Shell\AutoRun\command - E:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-12-24 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-12-28 c:\windows\Tasks\fvsuezwh.job
- c:\windows\system32\rundll32.exe [2004-08-04 06:00]

2008-12-28 c:\windows\Tasks\SDMsgUpdate (TE).job
- c:\progra~1\SMARTD~1\Messages\SDNotify.exe [2008-08-11 06:29]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\kbiggerstaff\Application Data\Mozilla\Firefox\Profiles\dqcqp3ui.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-28 17:56:40
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: c:\windows\system32\winlogon.exe
-> c:\windows\system32\yddwiq.dll

PROCESS: c:\windows\system32\lsass.exe
-> c:\windows\system32\yddwiq.dll
.
Completion time: 2008-12-28 18:00:01
ComboFix-quarantined-files.txt 2008-12-28 23:59:51
ComboFix2.txt 2008-12-14 20:54:14
ComboFix3.txt 2008-12-14 20:30:07

Pre-Run: 87,903,477,760 bytes free
Post-Run: 88,091,160,576 bytes free

204

- REDUCED FUNCTIONALITY MODE -

Were you not able to access the top links of the combofix page?

No....it would come up " can not open combo fix numerically....

Antivirus popup just happened agian....dang it

Okay, please do not use combofix now.
The next tool we are gonna use maybe flagged as "riskware" by Mcafee because of the script blocking feature, if Mcafee warns you about a script trying to run, please allow it to.

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :processes
  explorer.exe
  
  :files
  c:\documents and settings\kbiggerstaff\Application Data\Twain
  c:\windows\system32\yddwiq.dll
  c:\windows\system32\ohpfhxtq.dll
  c:\windows\system32\eqvotfvf.ini
  c:\windows\system32\urogvn.dll
  c:\windows\system32\ttvmckgf.dll
  c:\windows\Tasks\fvsuezwh.job
  
  :reg
  [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95}]
  
  :commands
  [purity]
  [emptytemp]
  [start explorer]
  [reboot]
  
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

I did....but it is froze at the moment and I can't paste ....hold on

PROCESSES ==========
Process explorer.exe killed successfully.
========== FILES ==========
c:\documents and settings\kbiggerstaff\Application Data\Twain moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\yddwiq.dll
c:\windows\system32\yddwiq.dll NOT unregistered.
c:\windows\system32\yddwiq.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\ohpfhxtq.dll
c:\windows\system32\ohpfhxtq.dll NOT unregistered.
c:\windows\system32\ohpfhxtq.dll moved successfully.
c:\windows\system32\eqvotfvf.ini moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\urogvn.dll
c:\windows\system32\urogvn.dll NOT unregistered.
c:\windows\system32\urogvn.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\ttvmckgf.dll
c:\windows\system32\ttvmckgf.dll NOT unregistered.
c:\windows\system32\ttvmckgf.dll moved successfully.
c:\windows\Tasks\fvsuezwh.job moved successfully.
========== REGISTRY ==========
Registry key HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cd54dae7-91a9-4a2d-9c9f-a9bc7f679a95}\\ not found.
========== COMMANDS ==========
File delete failed. C:\DOCUME~1\KBIGGE~1\LOCALS~1\Temp\hsperfdata_kbiggerstaff\2836 scheduled to be deleted on reboot.
User's Temp folder emptied.
User's Temporary Internet Files folder emptied.
User's Internet Explorer cache folder emptied.
Local Service Temp folder emptied.
Local Service Temporary Internet Files folder emptied.
File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_7dc.dat scheduled to be deleted on reboot.
Windows Temp folder emptied.
Java cache emptied.
FireFox cache emptied.
Temp folders emptied.
Explorer started successfully

OTMoveIt3 by OldTimer - Version 1.0.7.2 log created on 12282008_183131

Hello.
What problems remain?

My VirusScan is still disbaled...should I reboot after the OTMoveit3?

• Now open a new notepad file.
  
• Input this into the notepad file:
  

  
  Windows Registry Editor Version 5.00
  
  [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
  "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusDisableNotify"=dword:00000000
  "UpdatesDisableNotify"=dword:00000000
  "AntiVirusOverride"=dword:00000000
  [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
  "EnableFirewall"=dword:00000001
  
  

  
  
• Save this as fix.reg, save it to your desktop.
  
• Double click fix.reg to run it.
  
• Select yes to the registry merge prompt.
  

Reboot now.
Is virus scan still disabled?

I did....yep it is still disabled.

Is there anyway to enable manually in the AV control panel?

I try but it is blank when I open it up from the icon on the bottom of my screen....I can't find it in my programs

Is your AV Mcafee?

Try uninstalling it and re-install it.

I have a thing in my programs called Wave Systems Corp...Embassy Security Center is in this program file...I have no idea what it is??

In the C:\Program Files folder?
Uninstall it if you don't use it.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

• Wave system corp security
  

Did you try uninstalling your AV and installing it again?

Due to lack of feedback, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.