virus/spyware/trojan and malware

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:00:40 PM, on 2/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Dell Support Center\bin\sprtcmd.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\System32\regsvr32.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Kevin\Desktop\hijackgpthis.exe
C:\Program Files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: worldadmarketplace - {05699739-0292-6a8d-8617-a470f5662f87} - C:\WINDOWS\system32\nsi93.dll
O2 - BHO: worldadmarketplace browser enhancer - {0A24317D-C6F0-08C6-2B5E-084EB680C3EF} - C:\WINDOWS\system32\tczglyahbwldhhknm.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\Dell\BAE\BAE.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [QUICKCARE] C:\Program Files\Qwest\QuickCare\bin\sprtcmd.exe /P QUICKCARE
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [OneCareUI] "C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe"
O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKLM\..\Run: [PivotSoftware] "C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe"
O4 - HKLM\..\Run: [DT ACR] C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe -startup_folder
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [hpqSRMon] C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [uqjufnuaxcjfi] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\tczglyahbwldhhknm.dll"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [GetModule36] C:\Program Files\GetModule\GetModule36.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: NETGEAR WPN311 Smart Wizard.lnk = C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: HP Smart Select - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe
O23 - Service: Portrait Displays Display Tune Service (DTSRVC) - Unknown owner - C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe


I have these viruses trojan and malware, windows one care does not detect them unless they are active.

I appreciate your help thanks

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: worldadmarketplace - {05699739-0292-6a8d-8617-a470f5662f87} - C:\WINDOWS\system32\nsi93.dll
  O2 - BHO: worldadmarketplace browser enhancer - {0A24317D-C6F0-08C6-2B5E-084EB680C3EF} - C:\WINDOWS\system32\tczglyahbwldhhknm.dll
  O4 - HKLM\..\Run: [uqjufnuaxcjfi] C:\WINDOWS\System32\regsvr32.exe /s "C:\WINDOWS\system32\tczglyahbwldhhknm.dll"
  O4 - HKCU\..\Run: [GetModule36] C:\Program Files\GetModule\GetModule36.exe
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.33
Database version: 1729
Windows 5.1.2600 Service Pack 3

2/4/2009 5:39:12 PM
mbam-log-2009-02-04 (17-39-12).txt

Scan type: Quick Scan
Objects scanned: 72408
Time elapsed: 6 minute(s), 25 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 3
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\icheck (Trojan.Agent) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\GetModule (Adware.Agent) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\iCheck (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kevin\Application Data\GetModule (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\system32\wpv081233435391.cpx (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files\iCheck\Uninstall.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\GetModule\GetModule36.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kevin\Application Data\GetModule\dicik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kevin\Application Data\GetModule\kwdik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kevin\Application Data\GetModule\ofadik.gz (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Kevin\Local Settings\Temp\cd112.tmp (Heuristics.Malware) -> Quarantined and deleted successfully.


Thanks for the help Belahzur

Lets make sure we got it all.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

DDS (Ver_09-02-01.01) - NTFSx86
Run by Kevin at 18:51:53.71 on Wed 02/04/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2558 [GMT -7:00]

AV: Windows Live OneCare *On-access scanning enabled* (Updated)
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Outdated)
FW: Windows Live OneCare Firewall *disabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
C:\Program Files\Common Files\Portrait Displays\Shared\DTSRVC.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Microsoft Windows OneCare Live\OcHealthMon.exe
C:\WINDOWS\System32\svchost.exe -k HPZ12
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
C:\Program Files\Dell Support Center\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Microsoft Windows OneCare Live\winss.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe
C:\Program Files\Roxio\Drag-to-Disc\DrgToDsc.exe
C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Microsoft Windows OneCare Live\winssnotify.exe
C:\Program Files\Portrait Displays\Pivot Software\wpctrl.exe
C:\Program Files\Portrait Displays\Pivot Software\floater.exe
C:\Program Files\Acer Display\eDisplay Management\DTHtml.exe
C:\Program Files\Common Files\Portrait Displays\Shared\HookManager.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\NETGEAR\WPN311\wlancfg5.exe
C:\Program Files\Windows Desktop Search\WindowsSearch.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
C:\WINDOWS\system32\svchost.exe -k HPService
C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\SearchProtocolHost.exe
C:\Documents and Settings\Kevin\Desktop\dds.com

============== Pseudo HJT Report ===============

uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
uSearch Page = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uDefault_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
uSearch Bar = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
mSearchAssistant = hxxp://www.google.com/hws/sb/dell-usuk/en/side.html?channel=us
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: NoExplorer - No File
BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: AcroIEToolbarHelper Class: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: CBrowserHelperObject Object: {ca6319c0-31b7-401e-a518-a07c3db8f777} - c:\program files\dell\bae\BAE.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 6.0\acrobat\AcroIEFavClient.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [RTHDCPL] RTHDCPL.EXE
mRun: [Alcmtr] ALCMTR.EXE
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: []
mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\9.0\sharedcom\RoxWatchTray9.exe"
mRun: [RoxioDragToDisc] "c:\program files\roxio\drag-to-disc\DrgToDsc.exe"
mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [QUICKCARE] c:\program files\qwest\quickcare\bin\sprtcmd.exe /P QUICKCARE
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [OneCareUI] "c:\program files\microsoft windows onecare live\winssnotify.exe"
mRun: [DellSupportCenter] "c:\program files\dell support center\bin\sprtcmd.exe" /P DellSupportCenter
mRun: [PivotSoftware] "c:\program files\portrait displays\pivot software\wpctrl.exe"
mRun: [DT ACR] c:\program files\acer display\edisplay management\DTHtml.exe -startup_folder
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\acroba~1.lnk - c:\program files\adobe\acrobat 6.0\distillr\acrotray.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpimag~1.lnk - c:\program files\hp\digital imaging\bin\hpqthb08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\netgea~1.lnk - c:\program files\netgear\wpn311\wlancfg5.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab
Notify: igfxcui - igfxdev.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
SecurityProviders: msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, digeste.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kevin\applic~1\mozilla\firefox\profiles\6nlfqmfo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - component: c:\program files\mozilla firefox\components\nsworldadmarketplace.dll
FF - plugin: c:\program files\google\google updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\microsoft\office live\npOLW.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=

============= SERVICES / DRIVERS ===============

R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\microsoft windows onecare live\OcHealthMon.exe [2008-11-5 25968]
S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\drivers\blkwgdv7.sys --> c:\windows\system32\drivers\BLKWGDv7.sys [?]
S3 SjyPkt;SjyPkt;\??\c:\windows\system32\drivers\sjypkt.sys --> c:\windows\system32\drivers\SjyPkt.sys [?]

=============== Created Last 30 ================

2009-02-04 17:27 --d----- c:\docume~1\kevin\applic~1\Malwarebytes
2009-02-04 17:27 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-04 17:27 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-04 17:27 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-04 17:27 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-03 16:15 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-03 16:15 73,728 a------- c:\windows\system32\javacpl.cpl
2009-02-03 16:08 --d----- c:\documents and settings\kevin\.SunDownloadManager
2009-02-02 16:12 85,301 a------- c:\windows\system32\cont_worldadmarketplace-remove.exe
2009-02-02 16:12 48,266 a------- c:\windows\system32\vhzxzgufeipa.exe
2009-02-01 08:32 --d----- c:\program files\Microsoft
2009-02-01 08:32 201,050 a------- c:\windows\system32\nvapps.nvb
2009-02-01 08:32 --d----- c:\windows\NV1083216.TMP
2009-02-01 08:31 --d----- c:\docume~1\kevin\applic~1\Windows Desktop Search
2009-02-01 08:31 --d----- c:\windows\system32\GroupPolicy
2009-02-01 08:31 --d----- c:\program files\Windows Desktop Search
2009-02-01 08:30 192,000 -------- c:\windows\system32\dllcache\offfilt.dll
2009-02-01 08:30 98,304 -------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-01 08:30 29,696 -------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-01 08:30 --d----- c:\program files\Windows Media Connect 2
2009-02-01 07:51 --d----- c:\windows\system32\XPSViewer
2009-02-01 07:51 597,504 -------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 07:51 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-01 07:51 89,088 -------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-01 07:51 --d----- C:\fddc9e38afd64cce7afa8c1f2004
2009-02-01 07:51 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-01 07:51 1,676,288 -------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 07:51 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-01 07:51 575,488 -------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-01-23 18:39 304,640 a------- c:\windows\system32\tczglyahbwldhhknm.dll
2009-01-09 16:35 --d----- c:\windows\system32\NtmsData
2009-01-09 13:04 --d----- C:\OEMSettings
2009-01-08 23:18 165,140 -------- c:\windows\hpoins21.dat.temp
2009-01-08 23:18 7,262 -------- c:\windows\hpomdl21.dat.temp
2009-01-08 23:14 --d----- c:\docume~1\alluse~1\applic~1\WEBREG
2009-01-08 23:11 271,704 a----r-- c:\windows\system32\hpzids01.dll
2009-01-08 23:11 118,272 a------- c:\windows\system32\hpz3l5ha.dll
2009-01-08 23:10 970,752 a----r-- c:\windows\system32\hpotiop5.dll
2009-01-08 23:10 729,088 a----r-- c:\windows\system32\hpowiax5.dll
2009-01-08 23:10 364,544 a----r-- c:\windows\system32\hppldcoi.dll
2009-01-08 23:10 303,104 a----r-- c:\windows\system32\hpovst12.dll
2009-01-08 22:47 --d----- c:\program files\Yahoo!
2009-01-08 22:39 25,856 a------- c:\windows\system32\drivers\usbprint.sys
2009-01-08 22:39 25,856 a------- c:\windows\system32\dllcache\usbprint.sys
2009-01-08 22:39 32,128 a------- c:\windows\system32\drivers\usbccgp.sys
2009-01-08 22:39 32,128 a------- c:\windows\system32\dllcache\usbccgp.sys
2009-01-08 22:37 164,413 a------- c:\windows\hpoins21.dat
2009-01-08 22:37 7,262 -------- c:\windows\hpomdl21.dat
2009-01-06 18:37 --d----- C:\MDT
2009-01-05 19:15 --d----- c:\program files\Axiom Technologies

==================== Find3M ====================

2008-12-29 09:31 681,984 a------- c:\windows\system32\nsi93.dll
2008-12-12 23:40 3,593,216 -------- c:\windows\system32\dllcache\mshtml.dll
2008-12-11 03:57 333,952 a------- c:\windows\system32\drivers\srv.sys
2008-12-11 03:57 333,952 -------- c:\windows\system32\dllcache\srv.sys
2008-03-01 08:34 0 a------- c:\docume~1\kevin\applic~1\wklnhst.dat
2006-12-04 11:57 35,232 a------- c:\windows\inf\wpn311\ME_INST.EXE
2006-12-04 11:57 26,112 a------- c:\windows\inf\wpn311\install.exe
2006-07-05 05:33 472,000 a------- c:\windows\inf\wpn311\WPN311.sys
2008-10-26 15:26 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008102620081027\index.dat

============= FINISH: 18:52:13.85 ===============

Hello.
You have a Firefox hijacker, and it needs to be removed.

• Download combofix from here combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-02-05.01 - Kevin 2009-02-05 15:49:55.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2661 [GMT -7:00]
Running from: c:\documents and settings\Kevin\Desktop\Combo-Fix.exe
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Outdated)
AV: Windows Live OneCare *On-access scanning disabled* (Updated)
FW: Windows Live OneCare Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\tczglyahbwldhhknm.dll
c:\windows\system32\x64
c:\windows\wiaserviv.log

.
((((((((((((((((((((((((( Files Created from 2009-01-05 to 2009-02-05 )))))))))))))))))))))))))))))))
.

2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\Kevin\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-04 17:27 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-03 21:27 . 2009-02-03 21:27 d-------- c:\documents and settings\Janis\Application Data\Windows Desktop Search
2009-02-03 17:00 . 2009-02-03 17:00 d-------- c:\program files\Common Files\Adobe AIR
2009-02-03 16:15 . 2009-02-03 16:15 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 16:15 . 2009-02-03 16:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-03 16:08 . 2009-02-03 16:11 d-------- c:\documents and settings\Kevin\.SunDownloadManager
2009-02-02 16:12 . 2009-02-02 16:12 85,301 --a------ c:\windows\system32\cont_worldadmarketplace-remove.exe
2009-02-02 16:12 . 2009-02-02 16:12 48,266 --a------ c:\windows\system32\vhzxzgufeipa.exe
2009-02-01 08:32 . 2009-02-01 08:37 d-------- c:\windows\NV1083216.TMP
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft Silverlight
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft
2009-02-01 08:32 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\windows\system32\GroupPolicy
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\program files\Windows Desktop Search
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\documents and settings\Kevin\Application Data\Windows Desktop Search
2009-02-01 08:30 . 2009-02-01 08:30 d-------- c:\program files\Windows Media Connect 2
2009-02-01 08:30 . 2008-03-07 10:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-01 08:30 . 2008-03-07 10:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-01 08:30 . 2008-03-07 10:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-01 08:29 . 2009-02-01 08:29 d-------- c:\windows\system32\drivers\UMDF
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\windows\system32\XPSViewer
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\Reference Assemblies
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\MSBuild
2009-02-01 07:51 . 2009-02-01 07:51 d-------- C:\fddc9e38afd64cce7afa8c1f2004
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 03:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-01 07:51 . 2008-07-06 05:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-09 16:35 . 2009-01-09 16:36 d-------- c:\windows\system32\NtmsData
2009-01-09 13:54 . 2009-01-09 13:54 d-------- c:\documents and settings\Kevin\Application Data\Yahoo!
2009-01-09 13:54 . 2009-02-04 16:41 d-------- c:\documents and settings\Kevin\Application Data\HPAppData
2009-01-09 13:04 . 2009-01-09 13:04 d-------- C:\OEMSettings
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\Janis\Application Data\Yahoo!
2009-01-09 09:33 . 2009-02-05 10:58 d-------- c:\documents and settings\Janis\Application Data\HPAppData
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-08 23:18 . 2009-01-08 23:14 165,140 --------- c:\windows\hpoins21.dat.temp
2009-01-08 23:18 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat.temp
2009-01-08 23:14 . 2009-01-08 23:14 d-------- c:\documents and settings\All Users\Application Data\WEBREG
2009-01-08 23:13 . 2009-01-19 18:15 d-------- c:\documents and settings\Kevin\Application Data\HP
2009-01-08 23:12 . 2009-01-08 23:12 d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-01-08 23:11 . 2007-12-06 16:55 271,704 -ra------ c:\windows\system32\hpzids01.dll
2009-01-08 23:11 . 2007-03-15 15:32 118,272 --a------ c:\windows\system32\hpz3l5ha.dll
2009-01-08 23:10 . 2007-11-01 04:28 970,752 -ra------ c:\windows\system32\hpotiop5.dll
2009-01-08 23:10 . 2007-11-01 04:28 729,088 -ra------ c:\windows\system32\hpowiax5.dll
2009-01-08 23:10 . 2007-11-01 04:28 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2009-01-08 23:10 . 2007-11-01 04:28 303,104 -ra------ c:\windows\system32\hpovst12.dll
2009-01-08 22:47 . 2009-01-08 22:47 d-------- c:\program files\Yahoo!
2009-01-08 22:43 . 2009-01-08 22:43 d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys
2009-01-08 22:37 . 2009-01-09 18:54 164,413 --a------ c:\windows\hpoins21.dat
2009-01-08 22:37 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat
2009-01-06 18:37 . 2009-02-05 15:38 d-------- C:\MDT
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\Kevin\Application Data\CyberLink
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\All Users\Application Data\CyberLink
2009-01-05 19:15 . 2009-01-05 19:15 d-------- c:\program files\Axiom Technologies

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-05 22:45 --------- d-----w c:\program files\Microsoft Windows OneCare Live
2009-02-05 03:02 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-03 23:55 --------- d-----w c:\program files\Common Files\Adobe
2009-02-03 23:34 --------- d-----w c:\program files\Java
2009-01-19 22:33 --------- d-----w c:\program files\Quicken
2009-01-09 21:50 --------- d-----w c:\documents and settings\Kevin\Application Data\Roxio
2009-01-09 20:04 --------- d-----w c:\program files\NETGEAR
2009-01-09 20:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 05:42 --------- d-----w c:\program files\HP
2008-12-29 16:31 681,984 ----a-w c:\windows\system32\nsi93.dll
2008-12-13 06:40 3,593,216 ------w c:\windows\system32\dllcache\mshtml.dll
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-12-11 10:57 333,952 ------w c:\windows\system32\dllcache\srv.sys
2008-03-01 15:34 0 ----a-w c:\documents and settings\Kevin\Application Data\wklnhst.dat
2006-12-04 18:57 35,232 ----a-w c:\windows\inf\WPN311\ME_INST.EXE
2006-12-04 18:57 26,112 ----a-w c:\windows\inf\WPN311\install.exe
2006-07-05 12:33 472,000 ----a-w c:\windows\inf\WPN311\WPN311.sys
2008-12-29 16:31 653,312 ----a-w c:\program files\mozilla firefox\components\nsworldadmarketplace.dll
2008-10-26 22:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008102620081027\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-16 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-16 138008]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2007-05-09 198800]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-11-05 64880]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR"="c:\program files\Acer Display\eDisplay Management\DTHtml.exe" [2007-09-20 305664]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-25 98304]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-02-25 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
NETGEAR WPN311 Smart Wizard.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2006-12-04 1503232]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-11-05 25968]
S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\DRIVERS\BLKWGDv7.sys --> c:\windows\system32\DRIVERS\BLKWGDv7.sys [?]
S3 SjyPkt;SjyPkt;\??\c:\windows\System32\Drivers\SjyPkt.sys --> c:\windows\System32\Drivers\SjyPkt.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
.
.
------- Supplementary Scan -------
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - component: c:\program files\Mozilla Firefox\components\nsworldadmarketplace.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

---- FIREFOX POLICIES ----
FF - user.js: browser.search.selectedEngine - Yoog Search
FF - user.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - user.js: keyword.enabled - true
FF - user.js: browser.search.defaultenginename - Yoog Search
FF - user.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-05 15:50:59
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-05 15:51:51
ComboFix-quarantined-files.txt 2009-02-05 22:51:49

Pre-Run: 456,158,306,304 bytes free
Post-Run: 456,320,421,888 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

209 --- E O F --- 2009-01-13 23:52:26

Hello.
Lets remove this Firefox hijacker now.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
SjyPkt

File::
c:\windows\system32\cont_worldadmarketplace-remove.exe
c:\windows\system32\vhzxzgufeipa.exe
c:\program files\mozilla firefox\components\nsworldadmarketplace.dll
c:\windows\System32\Drivers\SjyPkt.sys
c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js

DirLook::
C:\fddc9e38afd64cce7afa8c1f2004

Firefox::
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

ComboFix 09-02-05.02 - Kevin 2009-02-06 6:20:51.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2626 [GMT -7:00]
Running from: c:\documents and settings\Kevin\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Kevin\Desktop\CFscript.txt
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Outdated)
AV: Windows Live OneCare *On-access scanning disabled* (Updated)
FW: Windows Live OneCare Firewall *disabled*
* Created a new restore point

FILE ::
c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js
c:\program files\mozilla firefox\components\nsworldadmarketplace.dll
c:\windows\system32\cont_worldadmarketplace-remove.exe
c:\windows\System32\Drivers\SjyPkt.sys
c:\windows\system32\vhzxzgufeipa.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js
c:\program files\mozilla firefox\components\nsworldadmarketplace.dll
c:\windows\system32\cont_worldadmarketplace-remove.exe
c:\windows\system32\vhzxzgufeipa.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SjyPkt


((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-06 06:13 . 2009-02-06 06:13 85,637 --a------ c:\windows\system32\55f4cedf-2e8d-78ca-ae3f-9342fbaa53be.exe
2009-02-05 14:16 . 2009-02-05 14:16 673,280 --a------ c:\windows\system32\nst13.dll
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\Kevin\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-04 17:27 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-03 21:27 . 2009-02-03 21:27 d-------- c:\documents and settings\Janis\Application Data\Windows Desktop Search
2009-02-03 17:00 . 2009-02-03 17:00 d-------- c:\program files\Common Files\Adobe AIR
2009-02-03 16:15 . 2009-02-03 16:15 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 16:15 . 2009-02-03 16:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-03 16:08 . 2009-02-03 16:11 d-------- c:\documents and settings\Kevin\.SunDownloadManager
2009-02-01 08:32 . 2009-02-01 08:37 d-------- c:\windows\NV1083216.TMP
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft Silverlight
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft
2009-02-01 08:32 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\windows\system32\GroupPolicy
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\program files\Windows Desktop Search
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\documents and settings\Kevin\Application Data\Windows Desktop Search
2009-02-01 08:30 . 2009-02-01 08:30 d-------- c:\program files\Windows Media Connect 2
2009-02-01 08:30 . 2008-03-07 10:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-01 08:30 . 2008-03-07 10:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-01 08:30 . 2008-03-07 10:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-01 08:29 . 2009-02-01 08:29 d-------- c:\windows\system32\drivers\UMDF
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\windows\system32\XPSViewer
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\Reference Assemblies
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\MSBuild
2009-02-01 07:51 . 2009-02-01 07:51 d-------- C:\fddc9e38afd64cce7afa8c1f2004
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 03:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-01 07:51 . 2008-07-06 05:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-09 16:35 . 2009-01-09 16:36 d-------- c:\windows\system32\NtmsData
2009-01-09 13:54 . 2009-01-09 13:54 d-------- c:\documents and settings\Kevin\Application Data\Yahoo!
2009-01-09 13:54 . 2009-02-04 16:41 d-------- c:\documents and settings\Kevin\Application Data\HPAppData
2009-01-09 13:04 . 2009-01-09 13:04 d-------- C:\OEMSettings
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\Janis\Application Data\Yahoo!
2009-01-09 09:33 . 2009-02-05 10:58 d-------- c:\documents and settings\Janis\Application Data\HPAppData
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-08 23:18 . 2009-01-08 23:14 165,140 --------- c:\windows\hpoins21.dat.temp
2009-01-08 23:18 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat.temp
2009-01-08 23:14 . 2009-01-08 23:14 d-------- c:\documents and settings\All Users\Application Data\WEBREG
2009-01-08 23:13 . 2009-01-19 18:15 d-------- c:\documents and settings\Kevin\Application Data\HP
2009-01-08 23:12 . 2009-01-08 23:12 d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-01-08 23:11 . 2007-12-06 16:55 271,704 -ra------ c:\windows\system32\hpzids01.dll
2009-01-08 23:11 . 2007-03-15 15:32 118,272 --a------ c:\windows\system32\hpz3l5ha.dll
2009-01-08 23:10 . 2007-11-01 04:28 970,752 -ra------ c:\windows\system32\hpotiop5.dll
2009-01-08 23:10 . 2007-11-01 04:28 729,088 -ra------ c:\windows\system32\hpowiax5.dll
2009-01-08 23:10 . 2007-11-01 04:28 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2009-01-08 23:10 . 2007-11-01 04:28 303,104 -ra------ c:\windows\system32\hpovst12.dll
2009-01-08 22:47 . 2009-01-08 22:47 d-------- c:\program files\Yahoo!
2009-01-08 22:43 . 2009-01-08 22:43 d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys
2009-01-08 22:37 . 2009-01-09 18:54 164,413 --a------ c:\windows\hpoins21.dat
2009-01-08 22:37 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat
2009-01-06 18:37 . 2009-02-06 06:25 d-------- C:\MDT
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\Kevin\Application Data\CyberLink
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\All Users\Application Data\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 12:45 --------- d-----w c:\program files\Microsoft Windows OneCare Live
2009-02-05 03:02 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-03 23:55 --------- d-----w c:\program files\Common Files\Adobe
2009-02-03 23:34 --------- d-----w c:\program files\Java
2009-01-19 22:33 --------- d-----w c:\program files\Quicken
2009-01-09 21:50 --------- d-----w c:\documents and settings\Kevin\Application Data\Roxio
2009-01-09 20:04 --------- d-----w c:\program files\NETGEAR
2009-01-09 20:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 05:42 --------- d-----w c:\program files\HP
2009-01-06 02:15 --------- d-----w c:\program files\Axiom Technologies
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-03-01 15:34 0 ----a-w c:\documents and settings\Kevin\Application Data\wklnhst.dat
2009-02-05 21:16 677,888 ----a-w c:\program files\mozilla firefox\components\11212c3c-763d-a8a9-1c7c-e839d2a22d2d.dll
2008-10-26 22:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008102620081027\index.dat
.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.

---- Directory of C:\fddc9e38afd64cce7afa8c1f2004 ----

2008-07-06 17:36 2936832 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\xpssvcs.dll
2008-07-06 05:06 89088 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\filterpipelineprintproc.dll
2008-07-06 05:06 765440 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\mxdwdrv.dll
2008-07-06 05:06 748032 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\mxdwdrv.dll
2008-07-06 05:06 1676288 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\xpssvcs.dll
2008-07-06 05:06 147456 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\filterpipelineprintproc.dll
2008-07-06 05:06 10929 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\msxpsdrv.cat
2008-07-06 05:06 10929 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\msxpsdrv.cat
2008-06-19 11:03 73 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\msxpsinc.gpd
2008-06-19 11:03 73 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\msxpsinc.gpd
2008-06-18 22:33 72 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\msxpsinc.ppd
2008-06-18 22:33 72 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\msxpsinc.ppd
2008-06-18 22:33 2204 --------- c:\fddc9e38afd64cce7afa8c1f2004\i386\msxpsdrv.inf
2008-06-18 22:33 2204 --------- c:\fddc9e38afd64cce7afa8c1f2004\amd64\msxpsdrv.inf


((((((((((((((((((((((((((((( SnapShot@2009-02-05_15.51.19.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 03:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-02-05 22:42:12 78,690 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-06 13:14:39 78,690 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-05 22:42:12 464,766 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-06 13:14:39 464,766 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-06 13:24:32 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5d8.dat

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05699739-0292-6a8d-8617-a470f5662f87}]
2009-02-05 14:16 673280 --a------ c:\windows\system32\nst13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-16 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-16 138008]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2007-05-09 198800]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-11-05 64880]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR"="c:\program files\Acer Display\eDisplay Management\DTHtml.exe" [2007-09-20 305664]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-25 98304]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-02-25 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
NETGEAR WPN311 Smart Wizard.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2006-12-04 1503232]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-11-05 25968]
S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\DRIVERS\BLKWGDv7.sys --> c:\windows\system32\DRIVERS\BLKWGDv7.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
.
.
------- Supplementary Scan -------
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 06:24:49
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
c:\windows\system32\acs.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Microsoft Windows OneCare Live\winss.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\Dell Support Center\gs_agent\dsc.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
.
**************************************************************************
.
Completion time: 2009-02-06 6:26:45 - machine was rebooted [Kevin]
ComboFix-quarantined-files.txt 2009-02-06 13:26:43
ComboFix2.txt 2009-02-05 22:51:52

Pre-Run: 456,296,919,040 bytes free
Post-Run: 456,195,035,136 bytes free

256 --- E O F --- 2009-01-13 23:52:26

More malware got in.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
c:\windows\system32\nst13.dll
c:\windows\system32\55f4cedf-2e8d-78ca-ae3f-9342fbaa53be.exe
c:\program files\mozilla firefox\components\11212c3c-763d-a8a9-1c7c-e839d2a22d2d.dll
c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{05699739-0292-6a8d-8617-a470f5662f87}]

Firefox::
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

ComboFix 09-02-06.01 - Kevin 2009-02-06 13:04:19.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2703 [GMT -7:00]
Running from: c:\documents and settings\Kevin\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Kevin\Desktop\CFscript.txt
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Outdated)
AV: Windows Live OneCare *On-access scanning disabled* (Updated)
FW: Windows Live OneCare Firewall *disabled*
* Created a new restore point

FILE ::
c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js
c:\program files\mozilla firefox\components\11212c3c-763d-a8a9-1c7c-e839d2a22d2d.dll
c:\windows\system32\55f4cedf-2e8d-78ca-ae3f-9342fbaa53be.exe
c:\windows\system32\nst13.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js
c:\program files\mozilla firefox\components\11212c3c-763d-a8a9-1c7c-e839d2a22d2d.dll
c:\windows\system32\55f4cedf-2e8d-78ca-ae3f-9342fbaa53be.exe
c:\windows\system32\nst13.dll

.
((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\Kevin\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-04 17:27 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-03 21:27 . 2009-02-03 21:27 d-------- c:\documents and settings\Janis\Application Data\Windows Desktop Search
2009-02-03 17:00 . 2009-02-03 17:00 d-------- c:\program files\Common Files\Adobe AIR
2009-02-03 16:15 . 2009-02-03 16:15 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 16:15 . 2009-02-03 16:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-03 16:08 . 2009-02-03 16:11 d-------- c:\documents and settings\Kevin\.SunDownloadManager
2009-02-01 08:32 . 2009-02-01 08:37 d-------- c:\windows\NV1083216.TMP
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft Silverlight
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft
2009-02-01 08:32 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\windows\system32\GroupPolicy
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\program files\Windows Desktop Search
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\documents and settings\Kevin\Application Data\Windows Desktop Search
2009-02-01 08:30 . 2009-02-01 08:30 d-------- c:\program files\Windows Media Connect 2
2009-02-01 08:30 . 2008-03-07 10:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-01 08:30 . 2008-03-07 10:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-01 08:30 . 2008-03-07 10:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-01 08:29 . 2009-02-01 08:29 d-------- c:\windows\system32\drivers\UMDF
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\windows\system32\XPSViewer
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\Reference Assemblies
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\MSBuild
2009-02-01 07:51 . 2009-02-01 07:51 d-------- C:\fddc9e38afd64cce7afa8c1f2004
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 03:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-01 07:51 . 2008-07-06 05:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-09 16:35 . 2009-01-09 16:36 d-------- c:\windows\system32\NtmsData
2009-01-09 13:54 . 2009-01-09 13:54 d-------- c:\documents and settings\Kevin\Application Data\Yahoo!
2009-01-09 13:54 . 2009-02-04 16:41 d-------- c:\documents and settings\Kevin\Application Data\HPAppData
2009-01-09 13:04 . 2009-01-09 13:04 d-------- C:\OEMSettings
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\Janis\Application Data\Yahoo!
2009-01-09 09:33 . 2009-02-06 12:05 d-------- c:\documents and settings\Janis\Application Data\HPAppData
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-08 23:18 . 2009-01-08 23:14 165,140 --------- c:\windows\hpoins21.dat.temp
2009-01-08 23:18 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat.temp
2009-01-08 23:14 . 2009-01-08 23:14 d-------- c:\documents and settings\All Users\Application Data\WEBREG
2009-01-08 23:13 . 2009-01-19 18:15 d-------- c:\documents and settings\Kevin\Application Data\HP
2009-01-08 23:12 . 2009-01-08 23:12 d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-01-08 23:11 . 2007-12-06 16:55 271,704 -ra------ c:\windows\system32\hpzids01.dll
2009-01-08 23:11 . 2007-03-15 15:32 118,272 --a------ c:\windows\system32\hpz3l5ha.dll
2009-01-08 23:10 . 2007-11-01 04:28 970,752 -ra------ c:\windows\system32\hpotiop5.dll
2009-01-08 23:10 . 2007-11-01 04:28 729,088 -ra------ c:\windows\system32\hpowiax5.dll
2009-01-08 23:10 . 2007-11-01 04:28 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2009-01-08 23:10 . 2007-11-01 04:28 303,104 -ra------ c:\windows\system32\hpovst12.dll
2009-01-08 22:47 . 2009-01-08 22:47 d-------- c:\program files\Yahoo!
2009-01-08 22:43 . 2009-01-08 22:43 d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys
2009-01-08 22:37 . 2009-01-09 18:54 164,413 --a------ c:\windows\hpoins21.dat
2009-01-08 22:37 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat
2009-01-06 18:37 . 2009-02-06 13:08 d-------- C:\MDT
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\Kevin\Application Data\CyberLink
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\All Users\Application Data\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 19:01 --------- d-----w c:\program files\Microsoft Windows OneCare Live
2009-02-06 18:00 --------- d-----w c:\program files\Quicken
2009-02-05 03:02 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-03 23:55 --------- d-----w c:\program files\Common Files\Adobe
2009-02-03 23:34 --------- d-----w c:\program files\Java
2009-01-09 21:50 --------- d-----w c:\documents and settings\Kevin\Application Data\Roxio
2009-01-09 20:04 --------- d-----w c:\program files\NETGEAR
2009-01-09 20:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 05:42 --------- d-----w c:\program files\HP
2009-01-06 02:15 --------- d-----w c:\program files\Axiom Technologies
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-03-01 15:34 0 ----a-w c:\documents and settings\Kevin\Application Data\wklnhst.dat
2006-12-04 18:57 35,232 ----a-w c:\windows\inf\WPN311\ME_INST.EXE
2006-12-04 18:57 26,112 ----a-w c:\windows\inf\WPN311\install.exe
2006-07-05 12:33 472,000 ----a-w c:\windows\inf\WPN311\WPN311.sys
2008-10-26 22:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008102620081027\index.dat
.

((((((((((((((((((((((((((((( SnapShot@2009-02-05_15.51.19.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 03:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-02-05 22:42:12 78,690 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-06 19:59:55 78,690 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-05 22:42:12 464,766 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-06 19:59:55 464,766 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-06 20:07:45 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5d8.dat

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-16 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-16 138008]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2007-05-09 198800]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-11-05 64880]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR"="c:\program files\Acer Display\eDisplay Management\DTHtml.exe" [2007-09-20 305664]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-25 98304]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-02-25 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
NETGEAR WPN311 Smart Wizard.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2006-12-04 1503232]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-11-05 25968]
S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\DRIVERS\BLKWGDv7.sys --> c:\windows\system32\DRIVERS\BLKWGDv7.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
.
.
------- Supplementary Scan -------
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 13:08:07
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
c:\windows\system32\acs.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Microsoft Windows OneCare Live\winss.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Completion time: 2009-02-06 13:10:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-06 20:10:29
ComboFix2.txt 2009-02-06 13:26:46
ComboFix3.txt 2009-02-05 22:51:52

Pre-Run: 456,165,019,648 bytes free
Post-Run: 456,168,620,032 bytes free

232 --- E O F --- 2009-01-13 23:52:26

Hello again.
Pesky little thing isn't it?
I think I know why it isn't going away, and this one last CF run should do it hopefully.

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js

Firefox::
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www13.yoog.com/search.php?q=
FF - prefs.js: browser.search.selectedEngine - Yoog Search
FF - prefs.js: keyword.URL - hxxp://www13.yoog.com/search.php?q=

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

ComboFix 09-02-06.01 - Kevin 2009-02-06 15:09:45.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.3326.2702 [GMT -7:00]
Running from: c:\documents and settings\Kevin\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Kevin\Desktop\CFscript.txt
AV: PC-cillin Internet Security - Virus Protection *On-access scanning disabled* (Outdated)
AV: Windows Live OneCare *On-access scanning disabled* (Updated)
FW: Windows Live OneCare Firewall *disabled*
* Created a new restore point

FILE ::
c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\user.js
.

((((((((((((((((((((((((( Files Created from 2009-01-06 to 2009-02-06 )))))))))))))))))))))))))))))))
.

2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\Kevin\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-02-04 17:27 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-04 17:27 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-04 17:27 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-03 21:27 . 2009-02-03 21:27 d-------- c:\documents and settings\Janis\Application Data\Windows Desktop Search
2009-02-03 17:00 . 2009-02-03 17:00 d-------- c:\program files\Common Files\Adobe AIR
2009-02-03 16:15 . 2009-02-03 16:15 410,984 --a------ c:\windows\system32\deploytk.dll
2009-02-03 16:15 . 2009-02-03 16:15 73,728 --a------ c:\windows\system32\javacpl.cpl
2009-02-03 16:08 . 2009-02-03 16:11 d-------- c:\documents and settings\Kevin\.SunDownloadManager
2009-02-01 08:32 . 2009-02-01 08:37 d-------- c:\windows\NV1083216.TMP
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft Silverlight
2009-02-01 08:32 . 2009-02-01 08:32 d-------- c:\program files\Microsoft
2009-02-01 08:32 . 2008-09-17 23:55 201,050 --a------ c:\windows\system32\nvapps.nvb
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\windows\system32\GroupPolicy
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\program files\Windows Desktop Search
2009-02-01 08:31 . 2009-02-01 08:31 d-------- c:\documents and settings\Kevin\Application Data\Windows Desktop Search
2009-02-01 08:30 . 2009-02-01 08:30 d-------- c:\program files\Windows Media Connect 2
2009-02-01 08:30 . 2008-03-07 10:02 192,000 --------- c:\windows\system32\dllcache\offfilt.dll
2009-02-01 08:30 . 2008-03-07 10:02 98,304 --------- c:\windows\system32\dllcache\nlhtml.dll
2009-02-01 08:30 . 2008-03-07 10:02 29,696 --------- c:\windows\system32\dllcache\mimefilt.dll
2009-02-01 08:29 . 2009-02-01 08:29 d-------- c:\windows\system32\drivers\UMDF
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\windows\system32\XPSViewer
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\Reference Assemblies
2009-02-01 07:51 . 2009-02-01 07:51 d-------- c:\program files\MSBuild
2009-02-01 07:51 . 2009-02-01 07:51 d-------- C:\fddc9e38afd64cce7afa8c1f2004
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-01 07:51 . 2008-07-06 03:50 597,504 --------- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-01 07:51 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-01 07:51 . 2008-07-06 05:06 89,088 --------- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-01-09 16:35 . 2009-01-09 16:36 d-------- c:\windows\system32\NtmsData
2009-01-09 13:54 . 2009-01-09 13:54 d-------- c:\documents and settings\Kevin\Application Data\Yahoo!
2009-01-09 13:54 . 2009-02-04 16:41 d-------- c:\documents and settings\Kevin\Application Data\HPAppData
2009-01-09 13:04 . 2009-01-09 13:04 d-------- C:\OEMSettings
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\Janis\Application Data\Yahoo!
2009-01-09 09:33 . 2009-02-06 12:05 d-------- c:\documents and settings\Janis\Application Data\HPAppData
2009-01-09 09:33 . 2009-01-09 09:33 d-------- c:\documents and settings\All Users\Application Data\Yahoo! Companion
2009-01-08 23:18 . 2009-01-08 23:14 165,140 --------- c:\windows\hpoins21.dat.temp
2009-01-08 23:18 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat.temp
2009-01-08 23:14 . 2009-01-08 23:14 d-------- c:\documents and settings\All Users\Application Data\WEBREG
2009-01-08 23:13 . 2009-01-19 18:15 d-------- c:\documents and settings\Kevin\Application Data\HP
2009-01-08 23:12 . 2009-01-08 23:12 d-------- c:\documents and settings\All Users\Application Data\Hewlett-Packard
2009-01-08 23:11 . 2007-12-06 16:55 271,704 -ra------ c:\windows\system32\hpzids01.dll
2009-01-08 23:11 . 2007-03-15 15:32 118,272 --a------ c:\windows\system32\hpz3l5ha.dll
2009-01-08 23:10 . 2007-11-01 04:28 970,752 -ra------ c:\windows\system32\hpotiop5.dll
2009-01-08 23:10 . 2007-11-01 04:28 729,088 -ra------ c:\windows\system32\hpowiax5.dll
2009-01-08 23:10 . 2007-11-01 04:28 364,544 -ra------ c:\windows\system32\hppldcoi.dll
2009-01-08 23:10 . 2007-11-01 04:28 303,104 -ra------ c:\windows\system32\hpovst12.dll
2009-01-08 22:47 . 2009-01-08 22:47 d-------- c:\program files\Yahoo!
2009-01-08 22:43 . 2009-01-08 22:43 d-------- c:\documents and settings\All Users\Application Data\HP Product Assistant
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\drivers\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:45 32,128 --a------ c:\windows\system32\dllcache\usbccgp.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\drivers\usbprint.sys
2009-01-08 22:39 . 2008-04-13 12:47 25,856 --a------ c:\windows\system32\dllcache\usbprint.sys
2009-01-08 22:37 . 2009-01-09 18:54 164,413 --a------ c:\windows\hpoins21.dat
2009-01-08 22:37 . 2008-02-13 02:18 7,262 --------- c:\windows\hpomdl21.dat
2009-01-06 18:37 . 2009-02-06 15:13 d-------- C:\MDT
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\Kevin\Application Data\CyberLink
2009-01-06 18:36 . 2009-01-06 18:36 d-------- c:\documents and settings\All Users\Application Data\CyberLink

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-06 19:01 --------- d-----w c:\program files\Microsoft Windows OneCare Live
2009-02-06 18:00 --------- d-----w c:\program files\Quicken
2009-02-05 03:02 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater
2009-02-03 23:55 --------- d-----w c:\program files\Common Files\Adobe
2009-02-03 23:34 --------- d-----w c:\program files\Java
2009-01-09 21:50 --------- d-----w c:\documents and settings\Kevin\Application Data\Roxio
2009-01-09 20:04 --------- d-----w c:\program files\NETGEAR
2009-01-09 20:00 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-09 05:42 --------- d-----w c:\program files\HP
2009-01-06 02:15 --------- d-----w c:\program files\Axiom Technologies
2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys
2008-03-01 15:34 0 ----a-w c:\documents and settings\Kevin\Application Data\wklnhst.dat
2008-10-26 22:26 32,768 --sha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008102620081027\index.dat

.

((((((((((((((((((((((((((((( SnapShot@2009-02-05_15.51.19.26 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 03:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
- 2009-02-05 22:42:12 78,690 ----a-w c:\windows\system32\perfc009.dat
+ 2009-02-06 22:05:49 78,690 ----a-w c:\windows\system32\perfc009.dat
- 2009-02-05 22:42:12 464,766 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-06 22:05:49 464,766 ----a-w c:\windows\system32\perfh009.dat
+ 2009-02-06 22:13:11 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_5d0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-31 39408]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-07-16 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-07-16 138008]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2006-10-03 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2006-10-03 81920]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2006-11-05 221184]
"RoxioDragToDisc"="c:\program files\Roxio\Drag-to-Disc\DrgToDsc.exe" [2006-08-17 1116920]
"PDVDDXSrv"="c:\program files\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2006-10-20 118784]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"QUICKCARE"="c:\program files\Qwest\QuickCare\bin\sprtcmd.exe" [2007-05-09 198800]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-14 49152]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-09-17 13574144]
"OneCareUI"="c:\program files\Microsoft Windows OneCare Live\winssnotify.exe" [2008-11-05 64880]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-08-13 206064]
"PivotSoftware"="c:\program files\Portrait Displays\Pivot Software\wpctrl.exe" [2007-02-09 694008]
"DT ACR"="c:\program files\Acer Display\eDisplay Management\DTHtml.exe" [2007-09-20 305664]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-02-25 98304]
"hpqSRMon"="c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2007-08-22 80896]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-09-17 86016]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-03 136600]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"RTHDCPL"="RTHDCPL.EXE" [2007-07-16 c:\windows\RTHDCPL.EXE]
"nwiz"="nwiz.exe" [2008-09-17 c:\windows\system32\nwiz.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-02-25 24576]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-10-14 214360]
HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 53248]
NETGEAR WPN311 Smart Wizard.lnk - c:\program files\NETGEAR\WPN311\wlancfg5.exe [2006-12-04 1503232]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-05-26 123904]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2008-05-26 304128]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\OneCareMP]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=

R2 OcHealthMon;Windows Live OneCare Health Monitor;c:\program files\Microsoft Windows OneCare Live\OcHealthMon.exe [2008-11-05 25968]
S3 Belkin700F;Belkin Wireless G Desktop Card Service v7;c:\windows\system32\DRIVERS\BLKWGDv7.sys --> c:\windows\system32\DRIVERS\BLKWGDv7.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
HPService REG_MULTI_SZ HPSLPSVC
.
.
------- Supplementary Scan -------
.
uStart Page = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
uInternet Connection Wizard,ShellNext = hxxp://www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us&ibd=5080225
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Kevin\Application Data\Mozilla\Firefox\Profiles\6nlfqmfo.default\
FF - prefs.js: browser.startup.homepage - hxxp://en-us.start.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF - plugin: c:\program files\Google\Google Updater\2.4.1399.3742\npCIDetect13.dll
FF - plugin: c:\program files\Microsoft\Office Live\npOLW.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-06 15:13:29
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Windows OneCare Live\Antivirus\MsMpEng.exe
c:\windows\system32\acs.exe
c:\program files\Common Files\Portrait Displays\Shared\DTSRVC.exe
c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
c:\program files\Dell Support Center\bin\sprtsvc.exe
c:\program files\Microsoft Windows OneCare Live\winss.exe
c:\windows\system32\searchindexer.exe
c:\windows\system32\wscntfy.exe
c:\program files\Portrait Displays\Pivot Software\Floater.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\Portrait Displays\Shared\HookManager.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
c:\program files\Common Files\Roxio Shared\9.0\SharedCOM\CPSHelpRunner.exe
c:\program files\HP\Digital Imaging\bin\hpqste08.exe
c:\program files\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files\HP\Digital Imaging\bin\hpqgpc01.exe
c:\program files\Microsoft Windows OneCare Live\Firewall\msfwsvc.exe
.
**************************************************************************
.
Completion time: 2009-02-06 15:15:43 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-06 22:15:41
ComboFix2.txt 2009-02-06 20:10:32
ComboFix3.txt 2009-02-06 13:26:46
ComboFix4.txt 2009-02-05 22:51:52

Pre-Run: 456,137,080,832 bytes free
Post-Run: 456,120,782,848 bytes free

218 --- E O F --- 2009-01-13 23:52:26

It's gone finally.
Log looks okay now, how is everything for you?

Everything seams to be good. Thanks for all your help. That is by far the worse virus I have had to deal with. I use windows one care does it not provide that good of virus protection or are these new viruses just undetectable to all virus protection software? Thanks again for all your help with this.

It does provide basic protection, it's just malware is so sneaky these days.
Instead of malware downloading more malware [which an AV would notice], it downloads the malware in parts. [which it doesn't notice]

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

Please enable Windows one care anti-virus and firewall now we are done.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

Belahzur completed all your suggestions. Thanks again for all your help with this one.

Since this issue has been addressed, a "solved" tag will be added and this topic will be closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.