Okay, thnx....here is the log from ComboFix:
ComboFix 09-05-22.05 - Myles Belitsky 22/05/2009 19:29.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2038.1636 [GMT -6:00]
Running from: c:\documents and settings\Myles Belitsky\Desktop\Combo-Fix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\ieocx.dll
c:\windows\system32\drivers\UACrmqlvbobqobiuru.sys
c:\windows\system32\UACbqtklftdfuuqrdy.dll
c:\windows\system32\UACdoaxaiygyidrwpi.log
c:\windows\system32\UACfvdbqighbvbgfnm.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UACnarqswxqwlkxgwi.log
c:\windows\system32\UACpvrtktapsbyowec.dll
c:\windows\system32\UACrjnkdhywtshsoey.dll
c:\windows\system32\UACtiwupoaoevppjnk.dat
c:\windows\system32\UACusahobrqkoyirow.dll
c:\windows\system32\UACyonaipvklrhirxj.log
c:\windows\system32\x64
----- BITS: Possible infected sites -----
hxxp://softwaredownloadcentercom.com.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Service_UACd.sys
((((((((((((((((((((((((( Files Created from 2009-04-23 to 2009-05-23 )))))))))))))))))))))))))))))))
.
2009-05-23 00:58 . 2009-05-23 00:58 -------- d-----w C:\_OTMoveIt
2009-05-22 18:49 . 2009-05-23 00:00 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-22 18:49 . 2009-05-22 23:59 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-22 18:30 . 2009-05-22 18:30 -------- d-----w c:\windows\system32\LogFiles
2009-05-22 16:38 . 2009-04-06 21:32 15504 ----a-w c:\windows\system32\drivers\mbam.sys
2009-05-22 16:38 . 2009-04-06 21:32 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-22 16:38 . 2009-05-22 23:04 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
2009-05-22 16:38 . 2009-05-22 16:38 -------- d-----w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-22 05:52 . 2009-05-23 00:18 -------- d--h--w C:\$AVG8.VAULT$
2009-05-22 05:50 . 2009-05-22 05:50 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-22 05:50 . 2009-05-22 05:50 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-22 05:50 . 2009-05-22 05:50 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-22 05:50 . 2009-05-22 21:16 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-22 05:50 . 2009-05-22 15:41 -------- d-----w c:\documents and settings\Myles Belitsky\Application Data\AVGTOOLBAR
2009-05-22 05:50 . 2009-05-22 05:50 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-22 05:50 . 2009-05-22 18:20 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-22 05:50 . 2009-05-22 05:50 -------- d-----w c:\program files\AVG
2009-05-19 06:09 . 2009-05-19 06:09 195 ----a-w c:\documents and settings\Myles Belitsky\Application Data\asd.bat
2009-05-19 06:04 . 2009-03-06 14:22 284160 ------w c:\windows\system32\dllcache\pdh.dll
2009-05-19 06:04 . 2009-02-09 12:10 401408 ------w c:\windows\system32\dllcache\rpcss.dll
2009-05-19 06:04 . 2009-02-06 10:39 35328 ------w c:\windows\system32\dllcache\sc.exe
2009-05-19 06:04 . 2009-02-09 12:10 473600 ------w c:\windows\system32\dllcache\fastprox.dll
2009-05-19 06:04 . 2009-02-09 12:10 453120 ------w c:\windows\system32\dllcache\wmiprvsd.dll
2009-05-19 06:04 . 2009-02-06 11:11 110592 ------w c:\windows\system32\dllcache\services.exe
2009-05-19 06:04 . 2009-02-06 10:10 227840 ------w c:\windows\system32\dllcache\wmiprvse.exe
2009-05-19 06:04 . 2009-02-09 12:10 729088 ------w c:\windows\system32\dllcache\lsasrv.dll
2009-05-19 06:04 . 2009-02-09 12:10 714752 ------w c:\windows\system32\dllcache\ntdll.dll
2009-05-19 06:04 . 2009-02-09 12:10 617472 ------w c:\windows\system32\dllcache\advapi32.dll
2009-05-19 05:31 . 2009-05-19 05:31 152576 ----a-w c:\documents and settings\Myles Belitsky\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-19 05:30 . 2008-05-03 11:55 2560 ------w c:\windows\system32\xpsp4res.dll
2009-05-19 05:30 . 2008-04-21 12:08 215552 ------w c:\windows\system32\dllcache\wordpad.exe
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-22 22:35 . 2008-04-03 03:30 -------- d-----w c:\program files\Google
2009-05-22 18:32 . 2008-04-03 03:34 -------- d-----w c:\program files\Common Files\Symantec Shared
2009-05-22 18:31 . 2008-04-03 03:34 -------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2009-05-20 02:47 . 2008-04-03 03:26 -------- d-----w c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-19 05:25 . 2008-12-22 08:45 57480 ----a-w c:\windows\system32\zaeyeowkwyeawshds.dll-uninst.exe
2009-05-19 05:23 . 2008-10-29 14:09 -------- d-----w c:\program files\dl_Cats
2009-03-06 14:22 . 2004-08-10 18:51 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-10 18:51 826368 ----a-w c:\windows\system32\wininet.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-02-14 202544]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-03 851968]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2007-06-06 138008]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2007-06-06 162584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2007-06-06 138008]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-12-22 136600]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2007-05-14 1191936]
"Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2007-12-11 2183168]
"KADxMain"="c:\windows\system32\KADxMain.exe" [2006-11-02 282624]
"ECenter"="c:\dell\E-Center\EULALauncher.exe" [2008-01-18 17920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2008-02-14 16384]
"PCMService"="c:\program files\Dell\MediaDirect\PCMService.exe" [2007-11-01 189736]
"DellSupportCenter"="c:\program files\Dell Support Center\bin\sprtcmd.exe" [2008-02-14 202544]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-12 39792]
"Synchronization Manager"="c:\windows\system32\mobsync.exe" [2008-04-14 143360]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-22 1947928]
"SigmatelSysTrayApp"="stsystra.exe" - c:\windows\stsystra.exe [2007-06-06 405504]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2008-4-2 50688]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-22 05:50 11952 ----a-w c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Dell\\MediaDirect\\PCMService.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"10421:UDP"= 10421:UDP:SingleClick Discovery Protocol
"10426:UDP"= 10426:UDP:SingleClick ICC
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [21/05/2009 11:50 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [21/05/2009 11:50 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [21/05/2009 11:50 PM 298776]
R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [10/08/2004 12:51 PM 14336]
.
Contents of the 'Scheduled Tasks' folder
.
- - - - ORPHANS REMOVED - - - -
SafeBoot-procexp90.Sys
.
------- Supplementary Scan -------
.
uStart Page =
hxxp://partnerpage.google.com/smallbiz.dell.com/en_ca?hl=en&client=dell-row&channel=ca-smb&ibd=1080403IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2009-05-22 19:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
- - - - - - - > 'winlogon.exe'(868)
c:\windows\System32\BCMLogon.dll
.
Completion time: 2009-05-23 19:33
ComboFix-quarantined-files.txt 2009-05-23 01:33
Pre-Run: 144,490,369,024 bytes free
Post-Run: 144,910,258,176 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
161 --- E O F --- 2009-05-20 02:48