spywareprotect 2009 / bankerfox.a / nugel.e

Been fighting these nasties the last few days. Thought I needed some more experienced help. Thanks in advance.

Here is my HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:23:57 AM, on 2/7/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1202191963\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Alwil Software\Avast4\setup\avast.setup

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://bfc.myway.com/search/de_srchlft.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.excite.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe,
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_5_7_0.dll
O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
O4 - HKLM\..\Run: [mmtask] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1202191963\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKLM\..\Policies\Explorer\Run: [services] friendly error page -->

O4 - HKUS\S-1-5-18\..\Run: [hdhdiygv.exe] C:\WINDOWS\hdhdiygv.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [dbhdbvrx.exe] C:\WINDOWS\dbhdbvrx.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [jrcigohc.exe] C:\WINDOWS\jrcigohc.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [services] friendly error page -->
(User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [rvesiczg.exe] C:\WINDOWS\rvesiczg.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [vxsyvjdi.exe] C:\WINDOWS\vxsyvjdi.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [lfwbpofq.exe] C:\WINDOWS\lfwbpofq.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [vxsrwdbm.exe] C:\WINDOWS\vxsrwdbm.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [services] friendly error page -->
(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [hdhdiygv.exe] C:\WINDOWS\hdhdiygv.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [services] friendly error page -->
(User 'Default user')
O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: LUMIX Simple Viewer.lnk = ?
O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} (AOL Pictures Uploader Class) - http://o.aolcdn.com/pictures/ap/Resources/v2.14/cab/aolpPlugins.10.6.0.8.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181657776453
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs: ayafjs.dll smkgvv.dll yzgpye.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Firefly Media Server - Ron Pedde - C:\Program Files\Firefly Media Server\firefly.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
O23 - Service: Washer Security Access (wwSecSvc) - Webroot Software, Inc. - C:\WINDOWS\system32\wwSecure.exe

--
End of file - 13464 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe,
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: (no name) - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - (no file)
  O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
  O4 - HKLM\..\Policies\Explorer\Run: [services] friendly error page -->
  
  O4 - HKUS\S-1-5-18\..\Run: [hdhdiygv.exe] C:\WINDOWS\hdhdiygv.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [dbhdbvrx.exe] C:\WINDOWS\dbhdbvrx.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [jrcigohc.exe] C:\WINDOWS\jrcigohc.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [services] friendly error page -->
  (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [rvesiczg.exe] C:\WINDOWS\rvesiczg.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [vxsyvjdi.exe] C:\WINDOWS\vxsyvjdi.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [lfwbpofq.exe] C:\WINDOWS\lfwbpofq.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Run: [vxsrwdbm.exe] C:\WINDOWS\vxsrwdbm.exe (User 'SYSTEM')
  O4 - HKUS\S-1-5-18\..\Policies\Explorer\Run: [services] friendly error page -->
  (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\Run: [hdhdiygv.exe] C:\WINDOWS\hdhdiygv.exe (User 'Default user')
  O4 - HKUS\.DEFAULT\..\Policies\Explorer\Run: [services] friendly error page -->
  (User 'Default user')
  O4 - S-1-5-18 Startup: PowerReg Scheduler.exe (User 'SYSTEM')
  O4 - .DEFAULT Startup: PowerReg Scheduler.exe (User 'Default user')
  O4 - Startup: PowerReg Scheduler.exe
  O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
  O20 - AppInit_DLLs: ayafjs.dll smkgvv.dll yzgpye.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Contents of MBAM log:

Malwarebytes' Anti-Malware 1.33
Database version: 1736
Windows 5.1.2600 Service Pack 3

2/7/2009 11:17:10 AM
mbam-log-2009-02-07 (11-17-10).txt

Scan type: Quick Scan
Objects scanned: 67879
Time elapsed: 15 minute(s), 50 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 4
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\vrzxdicr (Rootkit.Pakes) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\vrzxdicr (Rootkit.Pakes) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\vrzxdicr (Rootkit.Pakes) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\vrzxdicr (Rootkit.Pakes) -> Delete on reboot.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\rytrvspc.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\cpsvrtyr.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\vrzxdicr.sys (Rootkit.Pakes) -> Delete on reboot.
C:\Documents and Settings\Jim\Local Settings\Temporary Internet Files\Content.IE5\87ZWQVZB\upd105320[1] (Trojan.Vundo.H) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\drivers\seneka.sys (Trojan.Agent) -> Quarantined and deleted successfully.

Thanks for your help. Here is the DDS.txt report (Part 1):


DDS (Ver_09-02-01.01) - NTFSx86
Run by Jim at 12:08:44.17 on Sat 02/07/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_05
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.488 [GMT -5:00]

AV: avast! antivirus 4.8.1296 [VPS 090207-0] *On-access scanning enabled* (Updated)
FW: ZoneAlarm Firewall *disabled*

============== Running Processes ===============

C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\wwSecure.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\Ati2evxx.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe
C:\Program Files\Musicmatch\Musicmatch Jukebox\mmtask.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\AOL\1202191963\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe
C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Jim\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.excite.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://bfc.myway.com/search/de_srchlft.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
TB: &Yahoo! Companion: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\progra~1\yahoo!\compan~1\installs\cpn\ycomp5_5_7_0.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - No File
EB: &Yahoo! Messenger: {4528bbe0-4e08-11d5-ad55-00010333d0ad} - c:\program files\yahoo!\messenger\yhexbmes0521.dll
EB: Real.com: {fe54fa40-d68c-11d2-98fa-00c0f0318afe} - c:\windows\system32\Shdocvw.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre1.6.0_05\bin\jusched.exe"
mRun: [Apoint] c:\program files\apoint\Apoint.exe
mRun: [ATIPTA] "c:\program files\ati technologies\ati control panel\atiptaxx.exe"
mRun: [PCMService] "c:\program files\dell\media experience\PCMService.exe"
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] c:\program files\google\gmail notifier\g001-1.0.25.0\gnotify.exe
mRun: [mmtask] "c:\program files\musicmatch\musicmatch jukebox\mmtask.exe"
mRun: [Logitech Utility] Logi_MwX.Exe
mRun: [AOLDialer] c:\program files\common files\aol\acs\AOLDial.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HostManager] c:\program files\common files\aol\1202191963\ee\AOLSoftware.exe
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [avast!] c:\progra~1\alwils~1\avast4\ashDisp.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\lumixs~1.lnk - c:\program files\panasonic\lumixsimpleviewer\PhLeAutoRun.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\nkbmon~1.lnk - c:\program files\nikon\pictureproject\NkbMonitor.exe
dPolicies-explorer: NoFolderOptions = 1 (0x1)
dPolicies-system: DisableRegistryTools = 1 (0x1)
IE: &AOL Toolbar search - c:\program files\aol toolbar\toolbar.dll/SEARCH.HTML
IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_05\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - {4C171D40-8277-11D5-AD55-00010333D0AD} - c:\program files\yahoo!\messenger\yhexbmes0521.dll
IE: {4982D40A-C53B-4615-B15B-B5B5E98D167C} - {4982D40A-C53B-4615-B15B-B5B5E98D167C}
IE: {7F9DB11C-E358-4ca6-A83D-ACC663939424} - {9999A076-A9E2-4C99-8A2B-632FC9429223} - c:\program files\bonjour\ExplorerPlugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office12\REFIEBAR.DLL
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - {FE54FA40-D68C-11d2-98FA-00C0F0318AFE} - c:\windows\system32\Shdocvw.dll
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {26FCCDF9-A7E1-452A-A73D-7BF7B4D0BA6C} - hxxp://o.aolcdn.com/pictures/ap/Resources/v2.14/cab/aolpPlugins.10.6.0.8.cab
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\yinsthelper.dll
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/en-us/4,0,0,90/mcinsctl.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181657776453
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_02-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0006-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_06-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab
DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} - hxxp://chat.msn.com/controls/msnchat45.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll
Notify: AtiExtEvent - Ati2evxx.dll
AppInit_DLLs: ayafjs.dll smkgvv.dll yzgpye.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
LSA: Authentication Packages = msv1_0 c:\windows\system32\tuvVPfcd

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\jim\applic~1\mozilla\firefox\profiles\k99end0r.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.excite.com
FF - prefs.js: network.proxy.type - 4
FF - HiddenExtension: XUL Cache: {595BC9FF-3C1B-4681-B754-FCEEB358E01B} - c:\documents and settings\jim\local settings\application data\{595BC9FF-3C1B-4681-B754-FCEEB358E01B}

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-2-5 28544]
R0 vrzxdicr;vrzxdicr;c:\windows\system32\drivers\vrzxdicr.sys --> c:\windows\system32\drivers\vrzxdicr.sys [?]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-2-5 111184]
R1 KLIF;KLIF;c:\windows\system32\drivers\klif.sys [2008-6-3 127768]
R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2009-1-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2009-1-15 55024]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2005-5-7 394952]
R2 aawservice;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\aawservice.exe [2008-9-10 611664]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-2-5 20560]
R2 avast! Antivirus;avast! Antivirus;c:\program files\alwil software\avast4\ashServ.exe [2009-2-5 155160]
R3 avast! Mail Scanner;avast! Mail Scanner;c:\program files\alwil software\avast4\ashMaiSv.exe [2009-2-5 254040]
R3 avast! Web Scanner;avast! Web Scanner;c:\program files\alwil software\avast4\ashWebSv.exe [2009-2-5 352920]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-2-3 38496]
S0 djxjhccx;djxjhccx;c:\windows\system32\drivers\djxjhccx.sys --> c:\windows\system32\drivers\djxjhccx.sys [?]
S1 ethiycdc;ethiycdc;c:\windows\system32\drivers\ethiycdc.sys [2009-2-5 137536]
S3 cel90xbe;cel90xbe;c:\docume~1\jim\locals~1\temp\cel90xbe.sys [2004-1-15 31744]
S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\dcalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]
S3 Firefly Media Server;Firefly Media Server;c:\program files\firefly media server\firefly.exe [2007-5-17 544360]
S3 IKFileSec;File Security Driver;c:\windows\system32\drivers\ikfilesec.sys [2009-2-3 40840]
S3 IKSysFlt;System Filter Driver;c:\windows\system32\drivers\iksysflt.sys [2009-2-3 66952]
S3 IKSysSec;System Security Driver;c:\windows\system32\drivers\iksyssec.sys [2009-2-3 81288]
S3 SASENUM;SASENUM;c:\program files\superantispyware\SASENUM.SYS [2009-1-15 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\spyware doctor\pctsAuxs.exe [2009-2-3 356920]
S3 sdCoreService;PC Tools Security Service;c:\program files\spyware doctor\pctsSvc.exe [2009-2-3 1079176]
S3 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]

DDS.txt (Part 2):

=============== Created Last 30 ================

2009-02-07 01:00 --d----- c:\program files\Trend Micro
2009-02-07 00:02 102,400 a------- c:\windows\system32\_yzgpye.dll
2009-02-07 00:02 102,400 a------- c:\windows\system32\yvxskrti.dll
2009-02-06 23:59 437,969 a--sh--- c:\windows\system32\dcfPVvut.ini2
2009-02-06 23:59 437,969 a--sh--- c:\windows\system32\dcfPVvut.ini
2009-02-06 23:59 237,056 a------- c:\windows\system32\_tuvVPfcd.dll
2009-02-06 17:45 529 a------- c:\windows\system32\winlogon2.exe
2009-02-06 04:11 102,912 a------- c:\windows\system32\uwjpqcej.dll
2009-02-06 04:11 474,162 a--sh--- c:\windows\system32\NVwGNqru.ini
2009-02-06 04:11 473,635 a--sh--- c:\windows\system32\NVwGNqru.ini2
2009-02-06 04:11 237,056 a------- c:\windows\system32\_urqNGwVN.dll
2009-02-06 02:42 67,585 a------- c:\windows\system32\37.tmp
2009-02-06 02:39 163,908 a------- c:\windows\system32\19.tmp
2009-02-06 02:39 168 a------- c:\windows\system32\18.tmp
2009-02-06 01:07 67,585 a------- c:\windows\system32\32.tmp
2009-02-06 01:04 162,756 a------- c:\windows\system32\17.tmp
2009-02-06 01:04 168 a------- c:\windows\system32\15.tmp
2009-02-06 00:59 67,585 a------- c:\windows\system32\2E.tmp
2009-02-06 00:56 162,756 a------- c:\windows\system32\16.tmp
2009-02-06 00:56 168 a------- c:\windows\system32\14.tmp
2009-02-06 00:52 71,270 a------- c:\windows\system32\35.tmp
2009-02-06 00:52 67,585 a------- c:\windows\system32\34.tmp
2009-02-06 00:50 162,756 a------- c:\windows\system32\13.tmp
2009-02-06 00:49 168 a------- c:\windows\system32\12.tmp
2009-02-05 22:17 67,585 a------- c:\windows\system32\2B.tmp
2009-02-05 22:14 163,364 a------- c:\windows\system32\11.tmp
2009-02-05 22:14 168 a------- c:\windows\system32\10.tmp
2009-02-05 22:11 67,585 a------- c:\windows\system32\33.tmp
2009-02-05 22:08 163,364 a------- c:\windows\system32\26.tmp
2009-02-05 21:17 67,585 a------- c:\windows\system32\30.tmp
2009-02-05 21:10 0 a------- c:\windows\system32\2F.tmp
2009-02-05 20:53 28,544 a------- c:\windows\system32\drivers\pavboot.sys
2009-02-05 20:51 --d----- c:\program files\Panda Security
2009-02-05 20:49 67,585 a------- c:\windows\system32\31.tmp
2009-02-05 20:46 163,364 a------- c:\windows\system32\24.tmp
2009-02-05 20:46 168 a------- c:\windows\system32\23.tmp
2009-02-05 20:13 67,585 a------- c:\windows\system32\27.tmp
2009-02-05 20:06 67,585 a------- c:\windows\system32\2D.tmp
2009-02-05 20:02 163,364 a------- c:\windows\system32\22.tmp
2009-02-05 20:02 168 a------- c:\windows\system32\1C.tmp
2009-02-05 19:56 67,585 a------- c:\windows\system32\3D3.tmp
2009-02-05 19:53 164,708 a------- c:\windows\system32\29.tmp
2009-02-05 19:52 168 a------- c:\windows\system32\25.tmp
2009-02-05 19:51 1,262 a--sh--- c:\windows\system32\YbddKkkj.ini2
2009-02-05 19:51 1,262 a--sh--- c:\windows\system32\YbddKkkj.ini
2009-02-05 07:53 53,248 a------- c:\windows\system32\drivers\ndisio.sys
2009-02-05 07:51 137,536 a------- c:\windows\system32\drivers\ethiycdc.sys
2009-02-05 05:12 101,376 a------- c:\windows\system32\9C4.tmp
2009-02-05 05:12 44 a------- c:\windows\system32\9C3.tmp
2009-02-05 04:02 --d----- C:\Registry Backup
2009-02-05 03:40 2,732,032 a------- c:\windows\system32\Netw2r32.dll
2009-02-05 03:40 557,056 a------- c:\windows\system32\Netw2c32.dll
2009-02-05 03:26 --d----- c:\windows\A8B9466986544126BD28D0D2412CDED6.TMP
2009-02-04 19:50 434,252 a------- c:\windows\system32\MSVCRTD.dll
2009-02-03 22:32 --d----- c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com
2009-02-03 22:31 --d----- c:\program files\SUPERAntiSpyware
2009-02-03 22:31 --d----- c:\docume~1\jim\applic~1\SUPERAntiSpyware.com
2009-02-03 22:27 --d----- c:\program files\CCleaner
2009-02-03 22:22 --d----- c:\docume~1\jim\applic~1\Malwarebytes
2009-02-03 22:22 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-03 22:22 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-03 22:22 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-03 22:22 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-03 22:20 81,288 a------- c:\windows\system32\drivers\iksyssec.sys
2009-02-03 22:20 40,840 a------- c:\windows\system32\drivers\ikfilesec.sys
2009-02-03 22:20 29,576 a------- c:\windows\system32\drivers\kcom.sys
2009-02-03 22:20 66,952 a------- c:\windows\system32\drivers\iksysflt.sys
2009-02-03 22:19 --d----- c:\program files\Spyware Doctor
2009-02-03 21:37 32,256 a---h--- c:\documents and settings\jim\tkrifi.exe
2009-02-03 21:37 66,560 ----h--- c:\windows\system32\secupdat.dat
2009-02-03 19:27 5 a------- c:\windows\_id.dat
2009-02-03 19:26 128 a------- c:\windows\adobe.bat
2009-02-03 18:43 102,912 a------- C:\wgqjqf.exe
2009-02-03 18:43 39,936 a------- C:\nwurjr.exe
2009-02-03 18:43 2 a------- C:\-131658845
2009-02-03 16:53 72,704 a------- c:\windows\system32\tssvxayl.dll
2009-02-02 16:56 1,574,438 a--sh--- c:\windows\system32\dkevruyr.ini
2009-02-01 16:55 1,529,950 a--sh--- c:\windows\system32\bcqdhnjv.ini
2009-01-29 23:28 1,529,950 a--sh--- c:\windows\system32\wgvcgjbq.ini
2009-01-28 23:28 1,529,507 a--sh--- c:\windows\system32\xfxeknqo.ini
2009-01-27 23:25 1,529,507 a--sh--- c:\windows\system32\hoaljqew.ini
2009-01-26 23:25 1,525,122 a--sh--- c:\windows\system32\rppsbaow.ini
2009-01-25 23:22 1,525,122 a--sh--- c:\windows\system32\diamjuah.ini
2009-01-23 23:23 1,434,638 a--sh--- c:\windows\system32\qejssdbd.ini
2009-01-22 23:25 1,434,638 a--sh--- c:\windows\system32\paksreit.ini
2009-01-21 23:19 1,434,638 a--sh--- c:\windows\system32\uccssomh.ini
2009-01-20 23:22 1,432,143 a--sh--- c:\windows\system32\utkvsbae.ini
2009-01-18 23:16 1,403,021 a--sh--- c:\windows\system32\pkowydpd.ini
2009-01-17 23:16 1,403,021 a--sh--- c:\windows\system32\qlqbbfip.ini
2009-01-16 23:15 1,403,021 a--sh--- c:\windows\system32\vbpfstyo.ini
2009-01-15 19:57 1,384,152 a--sh--- c:\windows\system32\llukagfu.ini
2009-01-14 19:57 1,374,396 a--sh--- c:\windows\system32\kptjhglb.ini
2009-01-13 19:57 1,354,217 a--sh--- c:\windows\system32\hvjxssua.ini
2009-01-12 19:54 1,354,217 a--sh--- c:\windows\system32\whpcuepm.ini
2009-01-11 19:52 1,268,985 a--sh--- c:\windows\system32\sdpirupt.ini
2009-01-10 19:54 1,256,329 a--sh--- c:\windows\system32\vqelpqlc.ini
2009-01-10 14:06 --d----- c:\docume~1\jim\applic~1\CVS
2009-01-10 14:05 --dsh--- c:\windows\ftpcache
2009-01-08 19:54 1,328,950 a--sh--- c:\windows\system32\agmjpyow.ini

==================== Find3M ====================

2009-02-07 12:08 9,065,760 a--sh--- c:\windows\system32\drivers\fidbox.dat
2009-02-07 11:19 122,252 a--sh--- c:\windows\system32\drivers\fidbox.idx
2009-02-07 01:09 98,304 a------- c:\windows\DUMP8387.tmp
2009-02-06 03:27 98,304 a------- c:\windows\DUMP9eef.tmp
2009-02-05 21:02 98,304 a------- c:\windows\DUMPa96f.tmp
2009-02-05 20:42 98,304 a------- c:\windows\DUMP8db9.tmp
2009-02-05 19:50 98,304 a------- c:\windows\DUMPc3fb.tmp
2009-02-03 16:51 299,071 a--sh--- c:\windows\system32\dfgfPXbc.ini2
2008-11-24 22:19 88,375 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2008-06-03 10:10 20 ----h--- c:\docume~1\alluse~1\applic~1\PKP_DLds.DAT
2007-06-12 21:28 73,360 a------- c:\docume~1\jim\applic~1\GDIPFONTCACHEV1.DAT
2007-06-16 23:53 237,344 a--sh--- c:\windows\system32\drivers\fidbox2.dat

============= FINISH: 12:09:44.34 ===============

Omg, I have never seen such a mess.
Lets get this cleaned up.

Warning: stay OFFLINE until this is cleaned, there is so much malware present right now.

Please download GooredFix and save it to your Desktop. Please double-click GooredFix.exe on your Desktop to run it. Select 2. Fix Goored by typing 2 and pressing Enter. Make sure all instances of Firefox are closed at this point. Type y at the prompt and press Enter again. A log will open, please post the contents of that log in your next reply (it can also be found on your desktop, called GooredLog.txt).

GooredLog.txt contents:

GooredFix v1.83 by jpshortstuff
Log created at 12:37 on 07/02/2009 running Option #2 (Jim)
Firefox version 2.0.0.20 (en-US)

=====Goored Deletions=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Firefox\extensions]
"{595BC9FF-3C1B-4681-B754-FCEEB358E01B}"="C:\Documents and Settings\Jim\Local Settings\Application Data\{595BC9FF-3C1B-4681-B754-FCEEB358E01B}"
->Backing up value... Done.
->Deleting value... Done.

C:\Documents and Settings\Jim\Local Settings\Application Data\{595BC9FF-3C1B-4681-B754-FCEEB358E01B}
->Backing up folder... Done.
->Emptying folder... Done.
->Deleting folder... Done.

=====Dumping Registry Values=====

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 2.0.0.20\extensions]
"Plugins"="C:\Program Files\Mozilla Firefox\plugins"

[HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla Firefox 2.0.0.20\extensions]
"Components"="C:\Program Files\Mozilla Firefox\components"

Now lets clean out the rest.

• Download combofix from here combofix.exe
  
• Please disable your local AV (Anti-virus) by right clicking it's icon in the tray, and exit it. See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix.exe (part 1):

ComboFix 09-02-06.04 - Jim 2009-02-07 12:58:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.490 [GMT -5:00]
Running from: c:\documents and settings\Jim\Desktop\Combo-Fix.exe
AV: avast! antivirus 4.8.1296 [VPS 090207-0] *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *disabled*
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\_tuvVPfcd.dll
c:\windows\system32\_urqNGwVN.dll
c:\windows\system32\_yzgpye.dll
c:\windows\system32\agmjpyow.ini
c:\windows\system32\bcqdhnjv.ini
c:\windows\system32\brrcdcwp.ini
c:\windows\system32\cbrapqie.ini
c:\windows\system32\dcfPVvut.ini
c:\windows\system32\dcfPVvut.ini2
c:\windows\system32\dfcacece7_s.dll
c:\windows\system32\dfgfPXbc.ini
c:\windows\system32\dfgfPXbc.ini2
c:\windows\system32\diamjuah.ini
c:\windows\system32\dkevruyr.ini
c:\windows\system32\elrhsoin.ini
c:\windows\system32\hoaljqew.ini
c:\windows\system32\hvjxssua.ini
c:\windows\system32\kptjhglb.ini
c:\windows\system32\llukagfu.ini
c:\windows\system32\mimfgyaq.ini
c:\windows\system32\NVwGNqru.ini
c:\windows\system32\NVwGNqru.ini2
c:\windows\system32\onnrjfqv.ini
c:\windows\system32\paksreit.ini
c:\windows\system32\pkowydpd.ini
c:\windows\system32\qdsklilu.ini
c:\windows\system32\qejssdbd.ini
c:\windows\system32\qiumqpoq.ini
c:\windows\system32\qlqbbfip.ini
c:\windows\system32\rppsbaow.ini
c:\windows\system32\sdpirupt.ini
c:\windows\system32\tbdkiuar.ini
c:\windows\system32\trshesdf.ini
c:\windows\system32\uccssomh.ini
c:\windows\system32\utkvsbae.ini
c:\windows\system32\uwjpqcej.dll
c:\windows\system32\vbpfstyo.ini
c:\windows\system32\vpfiddfc.ini
c:\windows\system32\vqelpqlc.ini
c:\windows\system32\wgvcgjbq.ini
c:\windows\system32\whpcuepm.ini
c:\windows\system32\winlogon2.exe
c:\windows\system32\xfxeknqo.ini
c:\windows\system32\yaqloitu.ini
c:\windows\system32\YbddKkkj.ini
c:\windows\system32\YbddKkkj.ini2
c:\windows\system32\yuxphlwy.ini
c:\windows\system32\yvxskrti.dll

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PROTECT
-------\Legacy_TDSSSERV.SYS
-------\Service_Passthru
-------\Service_seneka


((((((((((((((((((((((((( Files Created from 2009-01-07 to 2009-02-07 )))))))))))))))))))))))))))))))
.

2009-02-07 01:00 . 2009-02-07 01:00 d-------- c:\program files\Trend Micro
2009-02-06 02:42 . 2009-02-06 02:42 67,585 --a------ c:\windows\system32\37.tmp
2009-02-06 02:39 . 2009-02-06 02:42 163,908 --a------ c:\windows\system32\19.tmp
2009-02-06 02:39 . 2009-02-06 02:39 168 --a------ c:\windows\system32\18.tmp
2009-02-06 01:07 . 2009-02-06 01:07 67,585 --a------ c:\windows\system32\32.tmp
2009-02-06 01:04 . 2009-02-06 01:07 162,756 --a------ c:\windows\system32\17.tmp
2009-02-06 01:04 . 2009-02-06 01:04 168 --a------ c:\windows\system32\15.tmp
2009-02-06 00:59 . 2009-02-06 00:59 67,585 --a------ c:\windows\system32\2E.tmp
2009-02-06 00:56 . 2009-02-06 00:59 162,756 --a------ c:\windows\system32\16.tmp
2009-02-06 00:56 . 2009-02-06 00:56 168 --a------ c:\windows\system32\14.tmp
2009-02-06 00:52 . 2009-02-06 00:52 71,270 --a------ c:\windows\system32\35.tmp
2009-02-06 00:52 . 2009-02-06 00:52 67,585 --a------ c:\windows\system32\34.tmp
2009-02-06 00:50 . 2009-02-06 00:52 162,756 --a------ c:\windows\system32\13.tmp
2009-02-06 00:49 . 2009-02-06 00:50 168 --a------ c:\windows\system32\12.tmp
2009-02-05 22:17 . 2009-02-05 22:17 d-------- c:\program files\Alwil Software
2009-02-05 22:17 . 2009-02-05 22:17 67,585 --a------ c:\windows\system32\2B.tmp
2009-02-05 22:14 . 2009-02-05 22:17 163,364 --a------ c:\windows\system32\11.tmp
2009-02-05 22:14 . 2009-02-05 22:14 168 --a------ c:\windows\system32\10.tmp
2009-02-05 22:11 . 2009-02-05 22:11 67,585 --a------ c:\windows\system32\33.tmp
2009-02-05 22:08 . 2009-02-05 22:11 163,364 --a------ c:\windows\system32\26.tmp
2009-02-05 21:17 . 2009-02-05 21:17 67,585 --a------ c:\windows\system32\30.tmp
2009-02-05 21:10 . 2009-02-05 21:10 0 --a------ c:\windows\system32\2F.tmp
2009-02-05 20:53 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-05 20:51 . 2009-02-05 20:51 d-------- c:\program files\Panda Security
2009-02-05 20:49 . 2009-02-05 20:49 67,585 --a------ c:\windows\system32\31.tmp
2009-02-05 20:46 . 2009-02-05 20:49 163,364 --a------ c:\windows\system32\24.tmp
2009-02-05 20:46 . 2009-02-05 20:46 168 --a------ c:\windows\system32\23.tmp
2009-02-05 20:13 . 2009-02-05 20:13 67,585 --a------ c:\windows\system32\27.tmp
2009-02-05 20:06 . 2009-02-05 20:06 67,585 --a------ c:\windows\system32\2D.tmp
2009-02-05 20:02 . 2009-02-05 20:06 163,364 --a------ c:\windows\system32\22.tmp
2009-02-05 20:02 . 2009-02-05 20:02 168 --a------ c:\windows\system32\1C.tmp
2009-02-05 19:56 . 2009-02-05 19:56 67,585 --a------ c:\windows\system32\3D3.tmp
2009-02-05 19:53 . 2009-02-05 19:56 164,708 --a------ c:\windows\system32\29.tmp
2009-02-05 19:52 . 2009-02-05 19:53 168 --a------ c:\windows\system32\25.tmp
2009-02-05 07:53 . 2009-02-05 12:30 53,248 --a------ c:\windows\system32\drivers\ndisio.sys
2009-02-05 07:51 . 2009-02-06 02:42 137,536 --a------ c:\windows\system32\drivers\ethiycdc.sys
2009-02-05 05:12 . 2009-02-05 05:12 101,376 --a------ c:\windows\system32\9C4.tmp
2009-02-05 05:12 . 2009-02-05 05:12 44 --a------ c:\windows\system32\9C3.tmp
2009-02-05 04:02 . 2009-02-05 04:03 d-------- C:\Registry Backup
2009-02-05 03:40 . 2009-02-05 03:40 d-------- c:\program files\DIFX
2009-02-05 03:40 . 2007-02-12 11:41 2,732,032 --a------ c:\windows\system32\Netw2r32.dll
2009-02-05 03:40 . 2007-02-12 11:40 557,056 --a------ c:\windows\system32\Netw2c32.dll
2009-02-05 03:26 . 2009-02-05 03:26 d-------- c:\windows\A8B9466986544126BD28D0D2412CDED6.TMP
2009-02-04 19:50 . 2003-01-06 06:44 434,252 --a------ c:\windows\system32\MSVCRTD.dll
2009-02-03 22:32 . 2009-02-03 22:32 d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-03 22:31 . 2009-02-03 22:32 d-------- c:\program files\SUPERAntiSpyware
2009-02-03 22:31 . 2009-02-03 22:31 d-------- c:\documents and settings\Jim\Application Data\SUPERAntiSpyware.com
2009-02-03 22:27 . 2009-02-03 22:28 d-------- c:\program files\CCleaner
2009-02-03 22:22 . 2009-02-03 22:22 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-03 22:22 . 2009-02-03 22:22 d-------- c:\documents and settings\Jim\Application Data\Malwarebytes
2009-02-03 22:22 . 2009-02-03 22:22 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-03 22:22 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-03 22:22 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-03 22:20 . 2009-02-03 22:50 d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 22:20 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-03 22:20 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-03 22:20 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-03 22:20 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-03 22:19 . 2009-02-03 22:22 d-------- c:\program files\Spyware Doctor
2009-02-03 21:37 . 2009-02-05 07:54 66,560 ---h----- c:\windows\system32\secupdat.dat
2009-02-03 21:37 . 2009-02-03 21:37 32,256 --ah----- c:\documents and settings\Jim\tkrifi.exe
2009-02-03 19:27 . 2009-02-03 21:37 5 --a------ c:\windows\_id.dat
2009-02-03 19:26 . 2009-02-05 07:51 128 --a------ c:\windows\adobe.bat
2009-02-03 18:43 . 2009-02-03 18:43 102,912 --a------ C:\wgqjqf.exe
2009-02-03 18:43 . 2009-02-03 18:43 39,936 --a------ C:\nwurjr.exe
2009-02-03 18:43 . 2009-02-03 18:43 2 --a------ C:\-131658845
2009-02-03 16:53 . 2009-02-03 16:53 72,704 --a------ c:\windows\system32\tssvxayl.dll
2009-01-10 14:06 . 2009-01-10 14:06 d-------- c:\documents and settings\Jim\Application Data\CVS
2009-01-10 14:05 . 2009-01-10 14:05 d--hs---- c:\windows\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 18:23 9,149,984 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-07 18:04 123,452 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-02-07 06:16 --------- d-----w c:\program files\Logitech
2009-02-07 06:09 98,304 ----a-w c:\windows\DUMP8387.tmp
2009-02-06 08:27 98,304 ----a-w c:\windows\DUMP9eef.tmp
2009-02-06 04:01 --------- d-----w c:\program files\MagicISO
2009-02-06 04:01 --------- d-----w c:\program files\jv16 PowerTools 2006
2009-02-06 03:55 --------- d-----w c:\program files\Diploma 6
2009-02-06 03:01 --------- d-----w c:\program files\Symantec AntiVirus
2009-02-06 03:01 --------- d-----w c:\program files\Symantec
2009-02-06 03:01 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-06 03:01 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-02-06 02:02 98,304 ----a-w c:\windows\DUMPa96f.tmp
2009-02-06 01:42 98,304 ----a-w c:\windows\DUMP8db9.tmp
2009-02-06 00:50 98,304 ----a-w c:\windows\DUMPc3fb.tmp
2009-02-05 02:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-05 02:46 --------- d-----w c:\program files\Broadcom
2009-02-04 03:31 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-17 19:06 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-17 19:02 --------- d-----w c:\program files\Lavasoft
2008-12-17 19:01 --------- d-----w c:\documents and settings\Jim\Application Data\Lavasoft
2008-12-14 05:56 --------- d-----w c:\documents and settings\Jim\Application Data\Roxio
2008-12-11 08:08 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-06-03 15:10 20 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLds.DAT
2007-06-13 02:28 73,360 ----a-w c:\documents and settings\Jim\Application Data\GDIPFONTCACHEV1.DAT
2008-12-23 04:18 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-23 04:18 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-23 04:18 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-23 04:18 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-23 04:18 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2007-06-17 04:53 237,344 --sha-w c:\windows\system32\drivers\fidbox2.dat
.

ComboFix (part 2):

------- Sigcheck -------

2004-08-04 05:00 31232 d3a8a76958a63eef4a4a66f1fc2a5a60 c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-13 19:12 31232 b93a622002297566b858a987b2586c2b c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-13 19:12 31232 893dddedde39f92c37982210c143cd78 c:\windows\system32\svchost.exe

2008-04-13 19:12 1050624 74840c41b7b75e8684ed8190969e8626 c:\windows\explorer.exe
2007-06-13 06:26 1050112 84445a662d6c12edd9d50bca8a1c94ed c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 05:23 1050112 a0103d198f5d5077e67464b5d7663fdb c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-04 05:00 1049088 bfc7280e1ce7b5abcba5455dbf22f528 c:\windows\$NtUninstallKB938828$\explorer.exe
2008-04-13 19:12 1050624 bf2eba9fb773f4c7a7f15974434d646e c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-04 05:00 32256 d106bfff9806abea7ed8966a79c7086b c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-13 19:12 32256 be6cd40d872ce1f969bec81887a7ca88 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-13 19:12 32256 779bb2dca4f20fca1a778251bbe00301 c:\windows\system32\ctfmon.exe

2005-06-10 19:17 74752 6112bc776599dfc2fd95a05594bdcb53 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-10 18:53 74752 39bd9db0c984bf5326191ba593849308 c:\windows\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 05:00 74752 8291fb749cdd6b3aa2b64667386f327e c:\windows\$NtUninstallKB896423$\spoolsv.exe
2008-04-13 19:12 74752 16e052147f8f7233c3a3b3a6b98e84d0 c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-13 19:12 74752 f43a1cd19224f7d783a68eccfcdf47d6 c:\windows\system32\spoolsv.exe

2004-08-04 05:00 41472 876a9135a626a82d20fce03d919d9355 c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-13 19:12 43008 69d85988432c6b20cd14eea19c6d60e4 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-13 19:12 43008 99257486bd4d7ab6ebc78116b3befd32 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 32256]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 176128]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 364544]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 311296]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 77824]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 131072]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe" [2005-07-15 499712]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 73728]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 307200]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-10 270648]
"HostManager"="c:\program files\Common Files\AOL\1202191963\ee\AOLSoftware.exe" [2007-10-08 41824]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-21 185896]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-04-25 45056]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-12-25 77824]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-06-03 139264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=ayafjs.dll smkgvv.dll yzgpye.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= pdvcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\djxjhccx.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vrzxdicr.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Firefly Media Server\\firefly.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\1202191963\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1202191963\\ee\\AOLDesktop.exe"=
"c:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-05 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-05 111184]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-05 20560]
S0 djxjhccx;djxjhccx;c:\windows\system32\Drivers\djxjhccx.sys --> c:\windows\system32\Drivers\djxjhccx.sys [?]
S0 vrzxdicr;vrzxdicr;c:\windows\system32\Drivers\vrzxdicr.sys --> c:\windows\system32\Drivers\vrzxdicr.sys [?]
S1 ethiycdc;ethiycdc;c:\windows\system32\drivers\ethiycdc.sys [2009-02-05 137536]
S3 cel90xbe;cel90xbe;\??\c:\docume~1\Jim\LOCALS~1\Temp\cel90xbe.sys --> c:\docume~1\Jim\LOCALS~1\Temp\cel90xbe.sys [?]
S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\DCalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]
S3 Firefly Media Server;Firefly Media Server;c:\program files\Firefly Media Server\firefly.exe [2007-05-17 544360]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-03 356920]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11483ebc-0c9e-11db-8c0a-001143796593}]
\Shell\AutoRun\command - E:\AutoLoad.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8075fdde-13af-11dc-8cc1-0012f0483695}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]
.
- - - - ORPHANS REMOVED - - - -

Notify-NavLogon - (no file)
SafeBoot-pvyyiaup.sys


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
FF - ProfilePath - c:\documents and settings\Jim\Application Data\Mozilla\Firefox\Profiles\k99end0r.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.excite.com
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 13:22:42
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32]
@DACL=(02 0000)
@="c:\\Program Files\\MyWaySA\\SrchAsDe\\1.bin\\deSrcAs.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\Programmable]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(884)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wwSecure.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-07 13:28:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-07 18:27:58

Pre-Run: 13,093,675,008 bytes free
Post-Run: 13,797,793,792 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

370 --- E O F --- 2008-12-11 08:08:58

Hello.
Some of your legit files are damaged, do you have your XP disc incase we need it?

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

Driver::
djxjhccx
vrzxdicr
ethiycdc
cel90xbe
DCALEXICO

File::
c:\windows\system32\drivers\ethiycdc.sys
c:\windows\system32\secupdat.dat
c:\documents and settings\Jim\tkrifi.exe
c:\windows\_id.dat
c:\windows\adobe.bat
C:\wgqjqf.exe
C:\nwurjr.exe
c:\windows\system32\tssvxayl.dll
c:\windows\DUMP8387.tmp
c:\windows\DUMP9eef.tmp
c:\windows\DUMPa96f.tmp
c:\windows\DUMP8db9.tmp
c:\windows\DUMPc3fb.tmp
c:\windows\system32\37.tmp
c:\windows\system32\19.tmp
c:\windows\system32\18.tmp
c:\windows\system32\32.tmp
c:\windows\system32\17.tmp
c:\windows\system32\15.tmp
c:\windows\system32\2E.tmp
c:\windows\system32\16.tmp
c:\windows\system32\14.tmp
c:\windows\system32\35.tmp
c:\windows\system32\34.tmp
c:\windows\system32\13.tmp
c:\windows\system32\12.tmp
c:\windows\system32\2B.tmp
c:\windows\system32\11.tmp
c:\windows\system32\10.tmp
c:\windows\system32\33.tmp
c:\windows\system32\26.tmp
c:\windows\system32\30.tmp
c:\windows\system32\2F.tmp
c:\windows\system32\31.tmp
c:\windows\system32\24.tmp
c:\windows\system32\23.tmp
c:\windows\system32\27.tmp
c:\windows\system32\2D.tmp
c:\windows\system32\22.tmp
c:\windows\system32\1C.tmp
c:\windows\system32\3D3.tmp
c:\windows\system32\29.tmp
c:\windows\system32\25.tmp
c:\windows\system32\9C4.tmp
c:\windows\system32\9C3.tmp
c:\windows\system32\drivers\ndisio.sys
c:\windows\system32\drivers\ethiycdc.sys

Folder::
C:\-131658845

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\djxjhccx.sys]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vrzxdicr.sys]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=""

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

Short Answer: I don't have the XP Pro disks available right now.

Longer Answer: I have an OEM version installed, and have not been able to easily locate them (if I ever had them). I have contacted Dell for replacement disks, which may be a possibility).

Here is the most recent log (part 1):

ComboFix 09-02-06.04 - Jim 2009-02-07 13:49:10.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1023.572 [GMT -5:00]
Running from: c:\documents and settings\Jim\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Jim\Desktop\CFscript.txt
AV: avast! antivirus 4.8.1296 [VPS 090207-0] *On-access scanning disabled* (Updated)
FW: ZoneAlarm Firewall *disabled*
* Created a new restore point

FILE ::
c:\documents and settings\Jim\tkrifi.exe
C:\nwurjr.exe
C:\wgqjqf.exe
c:\windows\_id.dat
c:\windows\adobe.bat
c:\windows\DUMP8387.tmp
c:\windows\DUMP8db9.tmp
c:\windows\DUMP9eef.tmp
c:\windows\DUMPa96f.tmp
c:\windows\DUMPc3fb.tmp
c:\windows\system32\10.tmp
c:\windows\system32\11.tmp
c:\windows\system32\12.tmp
c:\windows\system32\13.tmp
c:\windows\system32\14.tmp
c:\windows\system32\15.tmp
c:\windows\system32\16.tmp
c:\windows\system32\17.tmp
c:\windows\system32\18.tmp
c:\windows\system32\19.tmp
c:\windows\system32\1C.tmp
c:\windows\system32\22.tmp
c:\windows\system32\23.tmp
c:\windows\system32\24.tmp
c:\windows\system32\25.tmp
c:\windows\system32\26.tmp
c:\windows\system32\27.tmp
c:\windows\system32\29.tmp
c:\windows\system32\2B.tmp
c:\windows\system32\2D.tmp
c:\windows\system32\2E.tmp
c:\windows\system32\2F.tmp
c:\windows\system32\30.tmp
c:\windows\system32\31.tmp
c:\windows\system32\32.tmp
c:\windows\system32\33.tmp
c:\windows\system32\34.tmp
c:\windows\system32\35.tmp
c:\windows\system32\37.tmp
c:\windows\system32\3D3.tmp
c:\windows\system32\9C3.tmp
c:\windows\system32\9C4.tmp
c:\windows\system32\drivers\ethiycdc.sys
c:\windows\system32\drivers\ndisio.sys
c:\windows\system32\secupdat.dat
c:\windows\system32\tssvxayl.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\-131658845\
c:\documents and settings\Jim\tkrifi.exe
C:\nwurjr.exe
C:\wgqjqf.exe
c:\windows\_id.dat
c:\windows\adobe.bat
c:\windows\DUMP8387.tmp
c:\windows\DUMP8db9.tmp
c:\windows\DUMP9eef.tmp
c:\windows\DUMPa96f.tmp
c:\windows\DUMPc3fb.tmp
c:\windows\system32\10.tmp
c:\windows\system32\11.tmp
c:\windows\system32\12.tmp
c:\windows\system32\13.tmp
c:\windows\system32\14.tmp
c:\windows\system32\15.tmp
c:\windows\system32\16.tmp
c:\windows\system32\17.tmp
c:\windows\system32\18.tmp
c:\windows\system32\19.tmp
c:\windows\system32\1C.tmp
c:\windows\system32\22.tmp
c:\windows\system32\23.tmp
c:\windows\system32\24.tmp
c:\windows\system32\25.tmp
c:\windows\system32\26.tmp
c:\windows\system32\27.tmp
c:\windows\system32\29.tmp
c:\windows\system32\2B.tmp
c:\windows\system32\2D.tmp
c:\windows\system32\2E.tmp
c:\windows\system32\2F.tmp
c:\windows\system32\30.tmp
c:\windows\system32\31.tmp
c:\windows\system32\32.tmp
c:\windows\system32\33.tmp
c:\windows\system32\34.tmp
c:\windows\system32\35.tmp
c:\windows\system32\37.tmp
c:\windows\system32\3D3.tmp
c:\windows\system32\9C3.tmp
c:\windows\system32\9C4.tmp
c:\windows\system32\drivers\ethiycdc.sys
c:\windows\system32\drivers\ndisio.sys
c:\windows\system32\secupdat.dat
c:\windows\system32\tssvxayl.dll

c:\windows\system32\userinit.exe . . . is infected!!

c:\windows\system32\svchost.exe . . . is infected!!

c:\windows\system32\spoolsv.exe . . . is infected!!

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_CEL90XBE
-------\Legacy_DJXJHCCX
-------\Legacy_VRZXDICR
-------\Service_cel90xbe
-------\Service_DCALEXICO
-------\Service_djxjhccx
-------\Service_ethiycdc
-------\Service_vrzxdicr


((((((((((((((((((((((((( Files Created from 2009-01-07 to 2009-02-07 )))))))))))))))))))))))))))))))
.

2009-02-07 01:00 . 2009-02-07 01:00 d-------- c:\program files\Trend Micro
2009-02-05 22:17 . 2009-02-05 22:17 d-------- c:\program files\Alwil Software
2009-02-05 20:53 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys
2009-02-05 20:51 . 2009-02-05 20:51 d-------- c:\program files\Panda Security
2009-02-05 04:02 . 2009-02-05 04:03 d-------- C:\Registry Backup
2009-02-05 03:40 . 2009-02-05 03:40 d-------- c:\program files\DIFX
2009-02-05 03:40 . 2007-02-12 11:41 2,732,032 --a------ c:\windows\system32\Netw2r32.dll
2009-02-05 03:40 . 2007-02-12 11:40 557,056 --a------ c:\windows\system32\Netw2c32.dll
2009-02-05 03:26 . 2009-02-05 03:26 d-------- c:\windows\A8B9466986544126BD28D0D2412CDED6.TMP
2009-02-04 19:50 . 2003-01-06 06:44 434,252 --a------ c:\windows\system32\MSVCRTD.dll
2009-02-03 22:32 . 2009-02-03 22:32 d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2009-02-03 22:31 . 2009-02-03 22:32 d-------- c:\program files\SUPERAntiSpyware
2009-02-03 22:31 . 2009-02-03 22:31 d-------- c:\documents and settings\Jim\Application Data\SUPERAntiSpyware.com
2009-02-03 22:27 . 2009-02-03 22:28 d-------- c:\program files\CCleaner
2009-02-03 22:22 . 2009-02-03 22:22 d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-03 22:22 . 2009-02-03 22:22 d-------- c:\documents and settings\Jim\Application Data\Malwarebytes
2009-02-03 22:22 . 2009-02-03 22:22 d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-03 22:22 . 2009-01-14 16:11 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-03 22:22 . 2009-01-14 16:11 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-03 22:20 . 2009-02-03 22:50 d-a------ c:\documents and settings\All Users\Application Data\TEMP
2009-02-03 22:20 . 2008-08-25 12:36 81,288 --a------ c:\windows\system32\drivers\iksyssec.sys
2009-02-03 22:20 . 2008-08-25 12:36 66,952 --a------ c:\windows\system32\drivers\iksysflt.sys
2009-02-03 22:20 . 2008-08-25 12:36 40,840 --a------ c:\windows\system32\drivers\ikfilesec.sys
2009-02-03 22:20 . 2008-06-02 16:19 29,576 --a------ c:\windows\system32\drivers\kcom.sys
2009-02-03 22:19 . 2009-02-03 22:22 d-------- c:\program files\Spyware Doctor
2009-02-03 18:43 . 2009-02-03 18:43 2 --a------ C:\-131658845
2009-01-10 14:06 . 2009-01-10 14:06 d-------- c:\documents and settings\Jim\Application Data\CVS
2009-01-10 14:05 . 2009-01-10 14:05 d--hs---- c:\windows\ftpcache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-02-07 19:00 9,216,288 --sha-w c:\windows\system32\drivers\fidbox.dat
2009-02-07 18:53 124,388 --sha-w c:\windows\system32\drivers\fidbox.idx
2009-02-07 06:16 --------- d-----w c:\program files\Logitech
2009-02-06 04:01 --------- d-----w c:\program files\MagicISO
2009-02-06 04:01 --------- d-----w c:\program files\jv16 PowerTools 2006
2009-02-06 03:55 --------- d-----w c:\program files\Diploma 6
2009-02-06 03:01 --------- d-----w c:\program files\Symantec AntiVirus
2009-02-06 03:01 --------- d-----w c:\program files\Symantec
2009-02-06 03:01 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-02-06 03:01 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-02-05 02:47 --------- d--h--w c:\program files\InstallShield Installation Information
2009-02-05 02:46 --------- d-----w c:\program files\Broadcom
2009-02-04 03:31 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-17 19:06 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft
2008-12-17 19:02 --------- d-----w c:\program files\Lavasoft
2008-12-17 19:01 --------- d-----w c:\documents and settings\Jim\Application Data\Lavasoft
2008-12-14 05:56 --------- d-----w c:\documents and settings\Jim\Application Data\Roxio
2008-12-11 08:08 --------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2008-06-03 15:10 20 ---h--w c:\documents and settings\All Users\Application Data\PKP_DLds.DAT
2007-06-13 02:28 73,360 ----a-w c:\documents and settings\Jim\Application Data\GDIPFONTCACHEV1.DAT
2008-12-23 04:18 67,688 ----a-w c:\program files\mozilla firefox\components\jar50.dll
2008-12-23 04:18 54,368 ----a-w c:\program files\mozilla firefox\components\jsd3250.dll
2008-12-23 04:18 34,944 ----a-w c:\program files\mozilla firefox\components\myspell.dll
2008-12-23 04:18 46,712 ----a-w c:\program files\mozilla firefox\components\spellchk.dll
2008-12-23 04:18 172,136 ----a-w c:\program files\mozilla firefox\components\xpinstal.dll
2007-06-17 04:53 237,344 --sha-w c:\windows\system32\drivers\fidbox2.dat
.

Part (2):

------- Sigcheck -------

2004-08-04 05:00 31232 d3a8a76958a63eef4a4a66f1fc2a5a60 c:\windows\$NtServicePackUninstall$\svchost.exe
2008-04-13 19:12 31232 b93a622002297566b858a987b2586c2b c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-13 19:12 31232 893dddedde39f92c37982210c143cd78 c:\windows\system32\svchost.exe

2008-04-13 19:12 1050624 74840c41b7b75e8684ed8190969e8626 c:\windows\explorer.exe
2007-06-13 06:26 1050112 84445a662d6c12edd9d50bca8a1c94ed c:\windows\$hf_mig$\KB938828\SP2QFE\explorer.exe
2007-06-13 05:23 1050112 a0103d198f5d5077e67464b5d7663fdb c:\windows\$NtServicePackUninstall$\explorer.exe
2004-08-04 05:00 1049088 bfc7280e1ce7b5abcba5455dbf22f528 c:\windows\$NtUninstallKB938828$\explorer.exe
2008-04-13 19:12 1050624 bf2eba9fb773f4c7a7f15974434d646e c:\windows\ServicePackFiles\i386\explorer.exe

2004-08-04 05:00 32256 d106bfff9806abea7ed8966a79c7086b c:\windows\$NtServicePackUninstall$\ctfmon.exe
2008-04-13 19:12 32256 be6cd40d872ce1f969bec81887a7ca88 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-13 19:12 32256 779bb2dca4f20fca1a778251bbe00301 c:\windows\system32\ctfmon.exe

2005-06-10 19:17 74752 6112bc776599dfc2fd95a05594bdcb53 c:\windows\$hf_mig$\KB896423\SP2QFE\spoolsv.exe
2005-06-10 18:53 74752 39bd9db0c984bf5326191ba593849308 c:\windows\$NtServicePackUninstall$\spoolsv.exe
2004-08-04 05:00 74752 8291fb749cdd6b3aa2b64667386f327e c:\windows\$NtUninstallKB896423$\spoolsv.exe
2008-04-13 19:12 74752 16e052147f8f7233c3a3b3a6b98e84d0 c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-13 19:12 74752 f43a1cd19224f7d783a68eccfcdf47d6 c:\windows\system32\spoolsv.exe

2004-08-04 05:00 41472 876a9135a626a82d20fce03d919d9355 c:\windows\$NtServicePackUninstall$\userinit.exe
2008-04-13 19:12 43008 69d85988432c6b20cd14eea19c6d60e4 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-13 19:12 43008 99257486bd4d7ab6ebc78116b3befd32 c:\windows\system32\userinit.exe
.
((((((((((((((((((((((((((((( SnapShot@2009-02-07_13.26.44.31 )))))))))))))))))))))))))))))))))))))))))
.
- 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE
+ 2005-10-21 01:02:28 183,808 ----a-w c:\windows\ERDNT\Hiv-backup\ERDNT.EXE
- 2009-02-07 18:05:30 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-02-07 18:54:58 32,768 ----a-w c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2009-02-07 18:05:30 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-02-07 18:54:58 49,152 ----a-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-02-07 18:05:30 65,536 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-07 18:54:58 65,536 ----a-w c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-02-07 18:55:16 16,384 ----atw c:\windows\temp\Perflib_Perfdata_5dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 32256]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-07-14 68856]
"AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2007-03-01 2321600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 176128]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 364544]
"PCMService"="c:\program files\Dell\Media Experience\PCMService.exe" [2004-04-11 311296]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-10-12 77824]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 131072]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="c:\program files\Google\Gmail Notifier\G001-1.0.25.0\gnotify.exe" [2005-07-15 499712]
"mmtask"="c:\program files\Musicmatch\Musicmatch Jukebox\mmtask.exe" [2006-01-17 73728]
"AOLDialer"="c:\program files\Common Files\AOL\ACS\AOLDial.exe" [2006-10-23 71216]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 307200]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-07-10 270648]
"HostManager"="c:\program files\Common Files\AOL\1202191963\ee\AOLSoftware.exe" [2007-10-08 41824]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-05-21 185896]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-17 c:\windows\LOGI_MWX.EXE]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-04-25 45056]
LUMIX Simple Viewer.lnk - c:\program files\Panasonic\LUMIXSimpleViewer\PhLeAutoRun.exe [2007-12-25 77824]
NkbMonitor.exe.lnk - c:\program files\Nikon\PictureProject\NkbMonitor.exe [2008-06-03 139264]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="c:\windows\explorer.exe,"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-12-22 11:05 356352 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= pdvcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YPager.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.5.6320-enUS-downloader.exe"=
"c:\\Program Files\\Microsoft Games\\Age of Empires III\\age3x.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Firefly Media Server\\firefly.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\AOL\\1202191963\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1202191963\\ee\\AOLDesktop.exe"=
"c:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=

R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-02-05 28544]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2009-02-05 111184]
R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [2009-01-15 8944]
R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [2009-01-15 55024]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\drivers\aswFsBlk.sys [2009-02-05 20560]
S3 Firefly Media Server;Firefly Media Server;c:\program files\Firefly Media Server\firefly.exe [2007-05-17 544360]
S3 SASENUM;SASENUM;c:\program files\SUPERAntiSpyware\SASENUM.SYS [2009-01-15 7408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [2009-02-03 356920]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{11483ebc-0c9e-11db-8c0a-001143796593}]
\Shell\AutoRun\command - E:\AutoLoad.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8075fdde-13af-11dc-8cc1-0012f0483695}]
\Shell\AutoRun\command - F:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder

2009-01-30 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 12:42]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.excite.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Connection Wizard,ShellNext = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: &AOL Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: &Yahoo! Search - file:///c:\program files\Yahoo!\Common/ycsrch.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office12\EXCEL.EXE/3000
IE: Yahoo! &Dictionary - file:///c:\program files\Yahoo!\Common/ycdict.htm
IE: Yahoo! &Maps - file:///c:\program files\Yahoo!\Common/ycmap.htm
FF - ProfilePath - c:\documents and settings\Jim\Application Data\Mozilla\Firefox\Profiles\k99end0r.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.excite.com
FF - prefs.js: network.proxy.type - 4
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-07 13:59:58
Windows 5.1.2600 Service Pack 3 NTFS

detected NTDLL code modification:
ZwOpenFile

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\InprocServer32]
@DACL=(02 0000)
@="c:\\Program Files\\MyWaySA\\SrchAsDe\\1.bin\\deSrcAs.dll"
"ThreadingModel"="Apartment"

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{4D25F921-B9FE-4682-BF72-8AB8210D6D75}\Programmable]
@DACL=(02 0000)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(656)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\wwSecure.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Logitech\MouseWare\system\EM_EXEC.EXE
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-02-07 14:05:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-02-07 19:05:18
ComboFix2.txt 2009-02-07 18:28:08

Pre-Run: 13,784,965,120 bytes free
Post-Run: 13,767,020,544 bytes free

367 --- E O F --- 2008-12-11 08:08:58

Hello.
Something funny is going on here.

Please submit these files in bold below:
c:\windows\system32\userinit.exe
c:\windows\system32\svchost.exe
c:\windows\system32\spoolsv.exe
c:\windows\explorer.exe
To this site for a scan:
http://virusscan.jotti.org/
Copy and paste the results back here.
Use more than one post if needed.

Results from c:\windows\system32\userinit.exe:

Scan taken on 07 Feb 2009 19:31:05 (GMT)
A-Squared
Found nothing
AntiVir
Found W32/Virut.Gen
ArcaVir
Found nothing
Avast
Found nothing
AVG Antivirus
Found nothing
BitDefender
Found nothing
ClamAV
Found nothing
CPsecure
Found nothing
Dr.Web
Found nothing
F-Prot Antivirus
Found W32/Patched.E.gen!Eldorado
F-Secure Anti-Virus
Found nothing
G DATA
Found nothing
Ikarus
Found nothing
Kaspersky Anti-Virus
Found nothing
NOD32
Found Win32/Virut.NBK
Norman Virus Control
Found Sandbox: W32/Virut.BS; [ General information ]

* File length: 43008 bytes.
Panda Antivirus
Found nothing
Sophos Antivirus
Found W32/Scribble-A
VirusBuster
Found nothing
VBA32
Found nothing

Okay, we can't go any further, I don't need the results now.

Very bad news.

The files are infected by Virut.
Virut is a file infector, but the bad news is, it doesn't infect them correctly and they become corrupt.
There is no way of cleaning this, the only escape from Virut is formatting.

When the files become corrupt, they can't be fixed, so if these files give out from the damage they have taken, your machine will be junk.

Do not backup any .EXE files or .SCR files, also, DO NOT backup any zipped files that contain exe or scr files.

Will do. Thanks for your help. I was expecting the worst. I appreciate your time and insights.

Once you have formatted, here is some prevention tips.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

Since this issue has been addressed, a "solved" tag will be added and this topic will be closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.

Everyone else, please open a new topic for your questions.