Please help!!

A virus has attacked. A mimic of Windows Live Alert keeps poping up, along with random pop ups on both sides of my screen saying password safety and malware. I also cant update AVG because of this. Please help!!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:54:22 PM, on 19/04/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16809)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\VMware\VMware Player\hqtray.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\System32\setup2.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Vongo\Tray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\BitLord\BitLord.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Chantal\Desktop\JavaRa.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Chantal\Documents\hijackgpthis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.facebook.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Player\hqtray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Vongo Tray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{38A424D5-B4BD-4DB2-979D-FE2B2040A872}: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CCS\Services\Tcpip\..\{EC555894-C4D2-44D6-8C15-B245AEC2B050}: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CCS\Services\Tcpip\..\{EFC14176-A26F-4B19-8B0B-4D1960B7B5DD}: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CCS\Services\Tcpip\..\{FA4DED8A-B2E8-44F4-943E-349B9405F788}: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CS1\Services\Tcpip\..\{38A424D5-B4BD-4DB2-979D-FE2B2040A872}: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CS2\Services\Tcpip\..\{38A424D5-B4BD-4DB2-979D-FE2B2040A872}: NameServer = 85.255.112.178,85.255.112.99
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.178,85.255.112.99
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 9536 bytes

Hello.

Please disable Ad-Watch, as it may hinder the removal of some HijackThis entries. You can re-enable it after your computer is clean. Please see here for instructions on how to disable it:

1. Right-click on the Ad-Watch icon in the system tray (located down by the system clock for most configurations)
2. Choose *Settings* from the dropdown menu
3. Under the *General Settings* tab turn OFF (red x) the option to "Load Ad-Watch at Startup" (if enabled)

4. Click on the *Status* button in the left hand menu
5. Turn OFF (red x) the option for *Regshield*
6. Close that window, then right-click on the Ad-Watch icon shield again down in the system tray next to the clock.
7. Choose *Turn off Ad-Watch* from the drop menu

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O4 - HKCU\..\Run: [setup2.exe] C:\Windows\system32\setup2.exe
  O17 - HKLM\System\CCS\Services\Tcpip\..\{38A424D5-B4BD-4DB2-979D-FE2B2040A872}: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CCS\Services\Tcpip\..\{EC555894-C4D2-44D6-8C15-B245AEC2B050}: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CCS\Services\Tcpip\..\{EFC14176-A26F-4B19-8B0B-4D1960B7B5DD}: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CCS\Services\Tcpip\..\{FA4DED8A-B2E8-44F4-943E-349B9405F788}: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CS1\Services\Tcpip\..\{38A424D5-B4BD-4DB2-979D-FE2B2040A872}: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CS2\Services\Tcpip\..\{38A424D5-B4BD-4DB2-979D-FE2B2040A872}: NameServer = 85.255.112.178,85.255.112.99
  O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.178,85.255.112.99
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE or HERE.

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

Note: This tool was posted specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.[/color][/b][/i]

2. Now, start The Avenger program by clicking on its icon on your desktop.

• Leave the script box empty.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

3. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows Vista

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.
No rootkits found!


Completed script processing.

*******************

Finished! Terminate.

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

link does not work?

The link should go to cnet.com
This link will work better (or should anyway)

http://www.majorgeeks.com/download5756.html

Malwarebytes' Anti-Malware 1.36
Database version: 1945
Windows 6.0.6000

19/04/2009 8:48:46 PM
mbam-log-2009-04-19 (20-48-46).txt

Scan type: Quick Scan
Objects scanned: 62517
Time elapsed: 4 minute(s), 36 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 18
Folders Infected: 2
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{38a424d5-b4bd-4db2-979d-fe2b2040a872}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ec555894-c4d2-44d6-8c15-b245aec2b050}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{efc14176-a26f-4b19-8b0b-4d1960b7b5dd}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{efc14176-a26f-4b19-8b0b-4d1960b7b5dd}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{fa4ded8a-b2e8-44f4-943e-349b9405f788}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{38a424d5-b4bd-4db2-979d-fe2b2040a872}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{ec555894-c4d2-44d6-8c15-b245aec2b050}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{efc14176-a26f-4b19-8b0b-4d1960b7b5dd}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{efc14176-a26f-4b19-8b0b-4d1960b7b5dd}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Interfaces\{fa4ded8a-b2e8-44f4-943e-349b9405f788}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{38a424d5-b4bd-4db2-979d-fe2b2040a872}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{ec555894-c4d2-44d6-8c15-b245aec2b050}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{efc14176-a26f-4b19-8b0b-4d1960b7b5dd}\DhcpNameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{efc14176-a26f-4b19-8b0b-4d1960b7b5dd}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Tcpip\Parameters\Interfaces\{fa4ded8a-b2e8-44f4-943e-349b9405f788}\NameServer (Trojan.DNSChanger) -> Data: 85.255.112.178,85.255.112.99 -> Quarantined and deleted successfully.

Folders Infected:
C:\Users\Chantal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\DigitalHQ (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DigitalHQ (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Files Infected:
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DigitalHQ\Uninstall.lnk (Trojan.DNSChanger) -> Quarantined and deleted successfully.
C:\RECYCLER\S-7-1-67-100029655-100030324-100024462-4027.com (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\drivers\gaopdxserv.sys (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\gaopdxcounter (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\System32\46b3zhr95t7080.dll (Trojan.Agent) -> Quarantined and deleted successfully.

DDS (Ver_09-03-16.01) - NTFSx86
Run by Chantal at 22:16:33.60 on 19/04/2009
Internet Explorer: 7.0.6000.16809 BrowserJavaVersion: 1.6.0_12
Microsoft Windows Vista Home Premium 6.0.6000.0.1252.2.1033.18.1982.1013 [GMT -3:00]

AV: AVG Anti-Virus *On-access scanning enabled* (Outdated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\Windows\system32\vmnat.exe
C:\Program Files\Vongo\VongoService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\VMware\VMware Player\vmware-authd.exe
C:\Windows\system32\vmnetdhcp.exe
C:\Windows\system32\taskeng.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\VMware\VMware Player\hqtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Vongo\Tray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\explorer.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\Chantal\Downloads\dds.pif
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.facebook.com/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [VMware hqtray] "c:\program files\vmware\vmware player\hqtray.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [WiniBlueSoft] c:\program files\winibluesoft software\winibluesoft\WiniBlueSoft.exe -min
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\users\chantal\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\vongot~1.lnk - c:\windows\installer\{8c3ae2d1-854d-4650-a73d-c7cc7ee36b80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\MSMSGS.EXE
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\chantal\appdata\roaming\mozilla\firefox\profiles\5n3erpa0.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-4-19 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-19 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-19 90632]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2009-4-19 874776]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-4-19 231704]

=============== Created Last 30 ================

2009-04-19 20:43 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-19 20:43 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-19 14:53 --d----- C:\Sandbox
2009-04-19 14:45 --d----- c:\program files\Sandboxie
2009-04-19 13:51 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-04-19 13:51 12,936 a------- c:\windows\system32\drivers\avgrkx86.sys
2009-04-19 13:50 90,632 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-19 13:50 98,440 a------- c:\windows\system32\drivers\avgldx86.sys
2009-04-19 13:50 --d----- c:\windows\system32\drivers\Avg
2009-04-19 13:50 --d----- c:\programdata\avg8
2009-04-19 13:50 --d----- c:\progra~2\avg8
2009-04-17 15:46 --d----- c:\programdata\Lavasoft
2009-04-17 14:51 3,398 a------- c:\windows\438zthi5f32029.dll
2009-04-17 05:32 8,679 a------- c:\windows\system32\96z91tro51c4.exe
2009-04-16 23:27 8,477 a------- c:\windows\system32\c59zparse559.cpl
2009-04-16 15:46 18,134 a------- c:\windows\390135pamboz4a8.dll
2009-04-15 02:43 6,929 a------- c:\windows\system32\214zdow5load9r2299.dll
2009-04-14 19:03 16,998 a------- c:\windows\system32\96735spy1z4.ocx
2009-04-13 19:38 15,236 a------- c:\windows\system32\z939viru5b8.exe
2009-04-13 18:23 9,143 a------- c:\windows\2940zvirus352.cpl
2009-04-13 02:24 11,535 a------- c:\windows\system32\z5072not-a-virus36a9.exe
2009-04-10 18:53 13,196 a------- c:\windows\system32\539zhacktool411.dll
2009-04-10 07:51 4,906 a------- c:\windows\56zasteal9818.cpl
2009-04-09 11:08 --d----- c:\programdata\MumboJumbo
2009-04-09 11:08 --d----- c:\progra~2\MumboJumbo
2009-04-08 21:04 16,025 a------- c:\windows\36e9do5nlozde91310.exe
2009-04-08 21:03 9,190 a------- c:\windows\system32\96810hack5ool48z.cpl
2009-04-08 02:27 3,108 a------- c:\windows\724f5ownlo9dzr626.ocx
2009-04-07 18:51 10,719 a------- c:\windows\system32\f06t5ie9103z.bin
2009-04-07 01:52 3,422 a------- c:\windows\system32\79ebzpywa9e356.ocx
2009-04-06 23:44 3,103 a------- c:\windows\97c0downlozder12525.bin
2009-04-06 08:35 6,136 a------- c:\windows\1329sparze1755.ocx
2009-04-05 23:53 7,869 a------- c:\windows\19031wz5m5cb.cpl
2009-04-05 12:18 2,810 a------- c:\windows\system32\2z89threat559.cpl
2009-04-05 07:29 7,494 a------- c:\windows\system32\276039ackto5lz0.dll
2009-04-03 02:58 16,507 a------- c:\windows\71c795yzare2110.ocx
2009-04-02 23:06 10,073 a------- c:\windows\system32\16453not-a-vzrus923.dll
2009-03-28 12:11 --d----- c:\users\chantal\appdata\roaming\Total Eclipse
2009-03-28 12:10 --d----- c:\program files\Games
2009-03-28 11:47 --d----- c:\windows\Art Detective
2009-03-28 11:47 --d----- c:\program files\Art Detective
2009-03-26 18:31 17,431 a------- c:\windows\system32\69z2addware2595.exe
2009-03-26 05:37 13,180 a------- c:\windows\5fethrzat29175.cpl
2009-03-25 19:45 10,207 a------- c:\windows\system32\2198zspy345.ocx
2009-03-24 23:00 15,412 a------- c:\windows\system32\10859wzrm7c2.exe
2009-03-23 18:09 9,627 a------- c:\windows\system32\zc35th9eat22605.dll
2009-03-23 13:46 15,919 a------- c:\windows\system32\509thzeat113515.cpl
2009-03-23 12:34 11,974 a------- c:\windows\system32\199225pamboz69b.cpl
2009-03-23 03:56 18,098 a------- c:\windows\system32\442s9y6cz5.ocx

==================== Find3M ====================

2009-04-19 20:55 67,193 a------- c:\users\chantal\appdata\roaming\nvModes.dat
2009-04-17 14:52 11,639 a------- c:\windows\system32\z2939spamb9t15f.exe
2009-04-17 14:51 13,423 a------- c:\windows\5d0z5r2892.exe
2009-03-18 11:07 3,913 a------- c:\windows\system32\29215vizus392.exe
2009-03-18 00:12 4,693 a------- c:\windows\system32\5a8zst9al98.exe
2009-03-12 14:18 12,737 a------- c:\windows\7530spzm59t761.dll
2009-03-04 01:14 17,974 a------- c:\windows\94214hackt5oz526.exe
2009-02-28 07:13 5,257 a------- c:\windows\5d6a5z9al2081.bin
2009-02-27 16:51 12,679 a------- c:\windows\6fz5ste592990.exe
2009-02-25 07:06 8,098 a------- c:\windows\29z24n5t-a-virus722.bin
2009-02-24 10:10 16,556 a------- c:\windows\system32\c89threzt1759.exe
2009-02-21 19:38 17,638 a------- c:\windows\system32\3fa9sp5waze1549.bin
2009-02-19 20:03 2,884 a------- c:\windows\550asp9r5ez299.exe
2009-02-19 17:48 14,594 a------- c:\windows\system32\8c95zdwar9228.exe
2009-02-15 00:17 14,987 a------- c:\windows\system32\55za9teal2562.bin
2009-02-10 00:40 16,992 a------- c:\windows\system32\29299spam5ot14z.exe
2009-02-09 23:23 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-09 16:21 100 a------- c:\program files\jgqrg.txt
2009-02-09 15:15 100 a------- c:\program files\iizuo.txt
2009-02-09 09:53 14,878 a------- c:\windows\system32\13635worm1z89.dll
2009-02-08 22:59 2,028,032 a------- c:\windows\system32\win32k.sys
2009-02-08 08:53 15,155 a------- c:\windows\system32\19z47not-a-5irus41c.bin
2009-02-07 00:31 18,198 a------- c:\windows\system32\5z482not-a-virus5f99.dll
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2009-02-06 15:43 12,981 a------- c:\windows\system32\39230spz58c.dll
2009-02-05 22:36 5,153 a------- c:\windows\z5da5dware9932.dll
2009-02-02 04:14 3,080 a------- c:\windows\system32\5z54spar9e2139.dll
2009-02-01 17:21 5,672 a------- c:\windows\54zbthie531349.dll
2009-01-23 14:15 12,815 a------- c:\windows\system32\29ddowzl5a9er2389.bin
2009-01-21 23:24 9,558 a------- c:\windows\system32\35a5sp9wa5e505z.exe
2009-01-20 00:45 15,369 a------- c:\windows\system32\9852spywarz657.exe
2008-12-10 14:34 174 a--sh--- c:\program files\desktop.ini
2008-09-10 07:53 51,200 a------- c:\windows\inf\infpub.dat
2008-09-10 07:53 86,016 a------- c:\windows\inf\infstrng.dat
2008-09-10 07:52 665,600 a------- c:\windows\inf\drvindex.dat
2008-09-10 07:52 86,016 a------- c:\windows\inf\infstor.dat
2006-11-02 09:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 09:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 09:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 06:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 06:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 06:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 06:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 22:17:38.88 ===============

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\windows\438zthi5f32029.dll
  c:\windows\system32\96z91tro51c4.exe
  c:\windows\system32\c59zparse559.cpl
  c:\windows\390135pamboz4a8.dll
  c:\windows\system32\214zdow5load9r2299.dll
  c:\windows\system32\96735spy1z4.ocx
  c:\windows\system32\z939viru5b8.exe
  c:\windows\2940zvirus352.cpl
  c:\windows\system32\z5072not-a-virus36a9.exe
  c:\windows\system32\539zhacktool411.dll
  c:\windows\56zasteal9818.cpl
  c:\windows\36e9do5nlozde91310.exe
  c:\windows\system32\96810hack5ool48z.cpl
  c:\windows\724f5ownlo9dzr626.ocx
  c:\windows\system32\f06t5ie9103z.bin
  c:\windows\system32\79ebzpywa9e356.ocx
  c:\windows\97c0downlozder12525.bin
  c:\windows\1329sparze1755.ocx
  c:\windows\19031wz5m5cb.cpl
  c:\windows\system32\2z89threat559.cpl
  c:\windows\system32\276039ackto5lz0.dll
  c:\windows\71c795yzare2110.ocx
  c:\windows\system32\16453not-a-vzrus923.dll
  c:\windows\system32\69z2addware2595.exe
  c:\windows\5fethrzat29175.cpl
  c:\windows\system32\2198zspy345.ocx
  c:\windows\system32\10859wzrm7c2.exe
  c:\windows\system32\zc35th9eat22605.dll
  c:\windows\system32\509thzeat113515.cpl
  c:\windows\system32\199225pamboz69b.cpl
  c:\windows\system32\442s9y6cz5.ocx
  c:\windows\system32\z2939spamb9t15f.exe
  c:\windows\5d0z5r2892.exe
  c:\windows\system32\29215vizus392.exe
  c:\windows\system32\5a8zst9al98.exe
  c:\windows\7530spzm59t761.dll
  c:\windows\94214hackt5oz526.exe
  c:\windows\5d6a5z9al2081.bin
  c:\windows\6fz5ste592990.exe
  c:\windows\29z24n5t-a-virus722.bin
  c:\windows\system32\c89threzt1759.exe
  c:\windows\system32\3fa9sp5waze1549.bin
  c:\windows\550asp9r5ez299.exe
  c:\windows\system32\8c95zdwar9228.exe
  c:\windows\system32\55za9teal2562.bin
  c:\windows\system32\29299spam5ot14z.exe
  c:\program files\jgqrg.txt
  c:\program files\iizuo.txt
  c:\windows\system32\13635worm1z89.dll
  c:\windows\system32\win32k.sys
  c:\windows\system32\19z47not-a-5irus41c.bin
  c:\windows\system32\5z482not-a-virus5f99.dll
  c:\windows\system32\sirenacm.dll
  c:\windows\system32\39230spz58c.dll
  c:\windows\z5da5dware9932.dll
  c:\windows\system32\5z54spar9e2139.dll
  c:\windows\54zbthie531349.dll
  c:\windows\system32\29ddowzl5a9er2389.bin
  c:\windows\system32\35a5sp9wa5e505z.exe
  c:\windows\system32\9852spywarz657.exe
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
LoadLibrary failed for c:\windows\438zthi5f32029.dll
c:\windows\438zthi5f32029.dll NOT unregistered.
c:\windows\438zthi5f32029.dll moved successfully.
c:\windows\system32\96z91tro51c4.exe moved successfully.
c:\windows\system32\c59zparse559.cpl moved successfully.
LoadLibrary failed for c:\windows\390135pamboz4a8.dll
c:\windows\390135pamboz4a8.dll NOT unregistered.
c:\windows\390135pamboz4a8.dll moved successfully.
LoadLibrary failed for c:\windows\system32\214zdow5load9r2299.dll
c:\windows\system32\214zdow5load9r2299.dll NOT unregistered.
c:\windows\system32\214zdow5load9r2299.dll moved successfully.
LoadLibrary failed for c:\windows\system32\96735spy1z4.ocx
c:\windows\system32\96735spy1z4.ocx NOT unregistered.
c:\windows\system32\96735spy1z4.ocx moved successfully.
c:\windows\system32\z939viru5b8.exe moved successfully.
c:\windows\2940zvirus352.cpl moved successfully.
c:\windows\system32\z5072not-a-virus36a9.exe moved successfully.
LoadLibrary failed for c:\windows\system32\539zhacktool411.dll
c:\windows\system32\539zhacktool411.dll NOT unregistered.
c:\windows\system32\539zhacktool411.dll moved successfully.
c:\windows\56zasteal9818.cpl moved successfully.
c:\windows\36e9do5nlozde91310.exe moved successfully.
c:\windows\system32\96810hack5ool48z.cpl moved successfully.
LoadLibrary failed for c:\windows\724f5ownlo9dzr626.ocx
c:\windows\724f5ownlo9dzr626.ocx NOT unregistered.
c:\windows\724f5ownlo9dzr626.ocx moved successfully.
c:\windows\system32\f06t5ie9103z.bin moved successfully.
LoadLibrary failed for c:\windows\system32\79ebzpywa9e356.ocx
c:\windows\system32\79ebzpywa9e356.ocx NOT unregistered.
c:\windows\system32\79ebzpywa9e356.ocx moved successfully.
c:\windows\97c0downlozder12525.bin moved successfully.
LoadLibrary failed for c:\windows\1329sparze1755.ocx
c:\windows\1329sparze1755.ocx NOT unregistered.
c:\windows\1329sparze1755.ocx moved successfully.
c:\windows\19031wz5m5cb.cpl moved successfully.
c:\windows\system32\2z89threat559.cpl moved successfully.
LoadLibrary failed for c:\windows\system32\276039ackto5lz0.dll
c:\windows\system32\276039ackto5lz0.dll NOT unregistered.
c:\windows\system32\276039ackto5lz0.dll moved successfully.
LoadLibrary failed for c:\windows\71c795yzare2110.ocx
c:\windows\71c795yzare2110.ocx NOT unregistered.
c:\windows\71c795yzare2110.ocx moved successfully.
LoadLibrary failed for c:\windows\system32\16453not-a-vzrus923.dll
c:\windows\system32\16453not-a-vzrus923.dll NOT unregistered.
c:\windows\system32\16453not-a-vzrus923.dll moved successfully.
c:\windows\system32\69z2addware2595.exe moved successfully.
c:\windows\5fethrzat29175.cpl moved successfully.
LoadLibrary failed for c:\windows\system32\2198zspy345.ocx
c:\windows\system32\2198zspy345.ocx NOT unregistered.
c:\windows\system32\2198zspy345.ocx moved successfully.
c:\windows\system32\10859wzrm7c2.exe moved successfully.
LoadLibrary failed for c:\windows\system32\zc35th9eat22605.dll
c:\windows\system32\zc35th9eat22605.dll NOT unregistered.
c:\windows\system32\zc35th9eat22605.dll moved successfully.
c:\windows\system32\509thzeat113515.cpl moved successfully.
c:\windows\system32\199225pamboz69b.cpl moved successfully.
LoadLibrary failed for c:\windows\system32\442s9y6cz5.ocx
c:\windows\system32\442s9y6cz5.ocx NOT unregistered.
c:\windows\system32\442s9y6cz5.ocx moved successfully.
c:\windows\system32\z2939spamb9t15f.exe moved successfully.
c:\windows\5d0z5r2892.exe moved successfully.
c:\windows\system32\29215vizus392.exe moved successfully.
c:\windows\system32\5a8zst9al98.exe moved successfully.
LoadLibrary failed for c:\windows\7530spzm59t761.dll
c:\windows\7530spzm59t761.dll NOT unregistered.
c:\windows\7530spzm59t761.dll moved successfully.
c:\windows\94214hackt5oz526.exe moved successfully.
c:\windows\5d6a5z9al2081.bin moved successfully.
c:\windows\6fz5ste592990.exe moved successfully.
c:\windows\29z24n5t-a-virus722.bin moved successfully.
c:\windows\system32\c89threzt1759.exe moved successfully.
c:\windows\system32\3fa9sp5waze1549.bin moved successfully.
c:\windows\550asp9r5ez299.exe moved successfully.
c:\windows\system32\8c95zdwar9228.exe moved successfully.
c:\windows\system32\55za9teal2562.bin moved successfully.
c:\windows\system32\29299spam5ot14z.exe moved successfully.
c:\program files\jgqrg.txt moved successfully.
c:\program files\iizuo.txt moved successfully.
LoadLibrary failed for c:\windows\system32\13635worm1z89.dll
c:\windows\system32\13635worm1z89.dll NOT unregistered.
c:\windows\system32\13635worm1z89.dll moved successfully.
File move failed. c:\windows\system32\win32k.sys scheduled to be moved on reboot.
c:\windows\system32\19z47not-a-5irus41c.bin moved successfully.
LoadLibrary failed for c:\windows\system32\5z482not-a-virus5f99.dll
c:\windows\system32\5z482not-a-virus5f99.dll NOT unregistered.
c:\windows\system32\5z482not-a-virus5f99.dll moved successfully.
DllUnregisterServer procedure not found in c:\windows\system32\sirenacm.dll
c:\windows\system32\sirenacm.dll NOT unregistered.
File move failed. c:\windows\system32\sirenacm.dll scheduled to be moved on reboot.
LoadLibrary failed for c:\windows\system32\39230spz58c.dll
c:\windows\system32\39230spz58c.dll NOT unregistered.
c:\windows\system32\39230spz58c.dll moved successfully.
LoadLibrary failed for c:\windows\z5da5dware9932.dll
c:\windows\z5da5dware9932.dll NOT unregistered.
c:\windows\z5da5dware9932.dll moved successfully.
LoadLibrary failed for c:\windows\system32\5z54spar9e2139.dll
c:\windows\system32\5z54spar9e2139.dll NOT unregistered.
c:\windows\system32\5z54spar9e2139.dll moved successfully.
LoadLibrary failed for c:\windows\54zbthie531349.dll
c:\windows\54zbthie531349.dll NOT unregistered.
c:\windows\54zbthie531349.dll moved successfully.
c:\windows\system32\29ddowzl5a9er2389.bin moved successfully.
c:\windows\system32\35a5sp9wa5e505z.exe moved successfully.
c:\windows\system32\9852spywarz657.exe moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04192009_231206

Files moved on Reboot...
File move failed. c:\windows\system32\win32k.sys scheduled to be moved on reboot.
DllUnregisterServer procedure not found in c:\windows\system32\sirenacm.dll
c:\windows\system32\sirenacm.dll NOT unregistered.
File move failed. c:\windows\system32\sirenacm.dll scheduled to be moved on reboot.

Hello.
How is the machine running now?

Machine is slower than normal, the pop-ups stopped but some programs still wont work. I'm blamming it on the virus, but I could be wrong?

Could be, I need a new DDS log please.

DDS (Ver_09-03-16.01) - NTFSx86
Run by Chantal at 10:57:46.77 on 20/04/2009
Internet Explorer: 7.0.6000.16830 BrowserJavaVersion: 1.6.0_12
Microsoft Windows Vista Home Premium 6.0.6000.0.1252.2.1033.18.1982.208 [GMT -3:00]

AV: AVG Anti-Virus *On-access scanning enabled* (Outdated)

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
C:\PROGRA~1\AVG\AVG8\avgam.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\Windows\system32\vmnat.exe
C:\Program Files\Vongo\VongoService.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\VMware\VMware Player\vmware-authd.exe
C:\Windows\system32\vmnetdhcp.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\VMware\VMware Player\hqtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Vongo\Tray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\VMware\VMware Player\vmplayer.exe
C:\Program Files\VMware\VMware Player\bin\vmware-vmx.exe
C:\Windows\system32\Macromed\Flash\FlashUtil9f.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Users\Chantal\Documents\dds.scr
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
uRun: [Sidebar] c:\program files\windows sidebar\sidebar.exe /autoRun
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
mRun: [NvSvc] RUNDLL32.EXE c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SynTPEnh] c:\program files\synaptics\syntp\SynTPEnh.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
mRun: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
mRun: [VMware hqtray] "c:\program files\vmware\vmware player\hqtray.exe"
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [WiniBlueSoft] c:\program files\winibluesoft software\winibluesoft\WiniBlueSoft.exe -min
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\users\chantal\appdata\roaming\micros~1\windows\startm~1\programs\startup\onenot~1.lnk - c:\program files\microsoft office\office12\ONENOTEM.EXE
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\reader 8.0\reader\reader_sl.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adober~2.lnk - c:\program files\adobe\reader 8.0\reader\AdobeCollabSync.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\vongot~1.lnk - c:\windows\installer\{8c3ae2d1-854d-4650-a73d-c7cc7ee36b80}\NewShortcut2_DB7E00C96DEF489A8112D8F81614F45A.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\MSMSGS.EXE
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} - hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} - hxxp://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
AppInit_DLLs: avgrsstx.dll

================= FIREFOX ===================

FF - ProfilePath - c:\users\chantal\appdata\roaming\mozilla\firefox\profiles\5n3erpa0.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.facebook.com/
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll

============= SERVICES / DRIVERS ===============

R0 AvgRkx86;avgrkx86.sys;c:\windows\system32\drivers\avgrkx86.sys [2009-4-19 12936]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-4-19 98440]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-4-19 90632]

=============== Created Last 30 ================

2009-04-19 23:12 --d----- C:\_OTMoveIt
2009-04-19 23:01 376,832 a------- c:\windows\system32\winhttp.dll
2009-04-19 23:01 500,736 a------- c:\windows\system32\msdtcprx.dll
2009-04-19 23:01 30,208 a------- c:\windows\system32\xolehlp.dll
2009-04-19 23:01 549,888 a------- c:\windows\system32\rpcss.dll
2009-04-19 23:01 3,469,280 a------- c:\windows\system32\ntoskrnl.exe
2009-04-19 23:01 3,503,584 a------- c:\windows\system32\ntkrnlpa.exe
2009-04-19 23:01 654,336 a------- c:\windows\system32\printfilterpipelinesvc.exe
2009-04-19 23:01 158,720 a------- c:\windows\system32\sdohlp.dll
2009-04-19 23:01 97,280 a------- c:\windows\system32\iasrecst.dll
2009-04-19 23:01 53,248 a------- c:\windows\system32\iasads.dll
2009-04-19 23:01 37,888 a------- c:\windows\system32\iasdatastore.dll
2009-04-19 23:01 24,576 a------- c:\windows\system32\printfilterpipelineprxy.dll
2009-04-19 22:59 --d----- c:\program files\Microsoft
2009-04-19 22:59 --d----- c:\program files\Windows Live SkyDrive
2009-04-19 20:43 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-04-19 20:43 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-04-19 14:53 --d----- C:\Sandbox
2009-04-19 14:45 --d----- c:\program files\Sandboxie
2009-04-19 13:51 10,520 a------- c:\windows\system32\avgrsstx.dll
2009-04-19 13:51 12,936 a------- c:\windows\system32\drivers\avgrkx86.sys
2009-04-19 13:50 90,632 a------- c:\windows\system32\drivers\avgtdix.sys
2009-04-19 13:50 98,440 a------- c:\windows\system32\drivers\avgldx86.sys
2009-04-19 13:50 --d----- c:\windows\system32\drivers\Avg
2009-04-19 13:50 --d----- c:\programdata\avg8
2009-04-19 13:50 --d----- c:\progra~2\avg8
2009-04-17 15:46 --d----- c:\programdata\Lavasoft
2009-04-17 14:51 11,542 a------- c:\windows\579cvzr27455.bin
2009-04-09 11:08 --d----- c:\programdata\MumboJumbo
2009-04-09 11:08 --d----- c:\progra~2\MumboJumbo
2009-03-28 12:11 --d----- c:\users\chantal\appdata\roaming\Total Eclipse
2009-03-28 12:10 --d----- c:\program files\Games
2009-03-28 11:47 --d----- c:\windows\Art Detective
2009-03-28 11:47 --d----- c:\program files\Art Detective

==================== Find3M ====================

2009-04-20 09:20 67,193 a------- c:\users\chantal\appdata\roaming\nvModes.dat
2009-04-17 14:52 10,831 a------- c:\windows\system32\7f95t5r9at1z532.dll
2009-04-17 14:51 6,423 a------- c:\windows\94585ormz3.bin
2009-03-17 00:16 40,960 a------- c:\windows\apppatch\apihex86.dll
2009-03-17 00:16 14,848 a------- c:\windows\system32\apilogen.dll
2009-03-17 00:16 25,600 a------- c:\windows\system32\amxread.dll
2009-03-03 01:20 826,368 a------- c:\windows\system32\wininet.dll
2009-03-03 01:16 56,320 a------- c:\windows\system32\iesetup.dll
2009-03-03 01:16 78,336 a------- c:\windows\system32\ieencode.dll
2009-03-03 01:16 52,736 a------- c:\windows\apppatch\iebrshim.dll
2009-03-03 01:15 72,704 a------- c:\windows\system32\admparse.dll
2009-03-02 23:08 26,624 a------- c:\windows\system32\ieUnatt.exe
2009-03-02 21:44 48,128 a------- c:\windows\system32\mshtmler.dll
2009-02-13 04:26 72,704 a------- c:\windows\system32\secur32.dll
2009-02-13 04:26 1,233,408 a------- c:\windows\system32\lsasrv.dll
2009-02-13 04:26 7,680 a------- c:\windows\system32\lsass.exe
2009-02-09 23:23 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-09 16:21 100 a------- c:\program files\jgqrg.txt
2009-02-09 15:15 100 a------- c:\program files\iizuo.txt
2009-02-08 22:59 2,028,032 a------- c:\windows\system32\win32k.sys
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2008-12-10 14:34 174 a--sh--- c:\program files\desktop.ini
2008-09-10 07:53 51,200 a------- c:\windows\inf\infpub.dat
2008-09-10 07:53 86,016 a------- c:\windows\inf\infstrng.dat
2008-09-10 07:52 665,600 a------- c:\windows\inf\drvindex.dat
2008-09-10 07:52 86,016 a------- c:\windows\inf\infstor.dat
2006-11-02 09:42 287,440 a------- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 09:42 287,440 a------- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:42 30,674 a------- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 09:42 30,674 a------- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 06:20 287,440 a------- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 06:20 287,440 a------- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 06:20 30,674 a------- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 06:20 30,674 a------- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 11:02:00.98 ===============

Hello.
Please run this next script.

• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\windows\579cvzr27455.bin
  c:\windows\system32\7f95t5r9at1z532.dll
  c:\windows\94585ormz3.bin
  c:\program files\jgqrg.txt
  c:\program files\iizuo.txt
  C:\Users\Chantal\Documents\dds.scr
  
  :reg
  [-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
c:\windows\579cvzr27455.bin moved successfully.
LoadLibrary failed for c:\windows\system32\7f95t5r9at1z532.dll
c:\windows\system32\7f95t5r9at1z532.dll NOT unregistered.
c:\windows\system32\7f95t5r9at1z532.dll moved successfully.
c:\windows\94585ormz3.bin moved successfully.
c:\program files\jgqrg.txt moved successfully.
c:\program files\iizuo.txt moved successfully.
C:\Users\Chantal\Documents\dds.scr moved successfully.
========== REGISTRY ==========
Unable to delete registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}\\ .

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 04202009_115454

We can remove OTMoveIt now.

• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes cleanup process prompt, do the same for the reboot prompt.
  

How is the machine running now?

If it's still slow, post a new Hijack This log and we'll kill some startup stuff.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:18:28 PM, on 20/04/2009
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16830)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hp\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\VMware\VMware Player\hqtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Vongo\Tray.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Users\Chantal\Documents\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [VMware hqtray] "C:\Program Files\VMware\VMware Player\hqtray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: Vongo Tray.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O13 - Gopher Prefix:
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\HP Games\My HP Game Console\GameConsoleService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: stllssvr - Unknown owner - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe (file missing)
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - C:\Program Files\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\Windows\system32\vmnetdhcp.exe
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\Windows\system32\vmnat.exe
O23 - Service: Vongo Service - Starz Entertainment Group LLC - C:\Program Files\Vongo\VongoService.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8436 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
  O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
  O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
  O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
  O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
  O4 - HKLM\..\Run: [WiniBlueSoft] C:\Program Files\WiniBlueSoft Software\WiniBlueSoft\WiniBlueSoft.exe -min
  O4 - HKLM\..\RunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
  O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
  O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
  O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
  O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
  O4 - Global Startup: Vongo Tray.lnk = ?
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Reboot normally.
Let me know if performance is any better.

Computer is going relatively faster, but programs such as "msn" which I use almost everyday, doesn't seem to work anymore?

You might need to uninstall it, then re-install it.

Already did, twice.

What error are you getting with msn then?

Error code: 8100030d

I never had this problem before the virus hit!

Press Start > Run.
Type in cmd, then press enter.

At the DOS prompt execute the following commands, one by one.
Press the enter key after each entry.

regsvr32 wintrust.dll
regsvr32 initpki.dll
regsvr32 MSXML3.dll
regsvr32 softpub.dll

Type Exit press enter to return the operating mode.

Reboot normally.

Does MSN work now?

The first three didnt work.

"The module "wintrust.dll" was loaded but the call to DLLRegisterServer failed with the error code 0x80070005"