Started with many virii, worms, adware that were hard to ID

The computer system starts up, gets to logins, allows selection of login, and logs off login. Safe Boot has no effect. Cannot run Task Manager. After running various tools from a boot CD, I bought an external enclosure so that I would be able to hook the drive up to a USB port on my main computer. That is where it is now as the H: and I: drives. I ran NIS 2009 and came up with the following three virii/worms: Backdoor.Rustock.B, Backdoor.Tidserv, and HackTool.Rootkit. These were incurable. Ran Multi Virus Cleaner 2009, Dr Web, and MBAM which seemed to clean up more problems. Ran NIS 2009 again and it showed no infections found. Tried reinstalling and rebooting problem computer, but results in same behavior as mentioned above. Again, attached to main computer and reran NIS 2009. Nothing found. Reran Dr Web and found SymXPep2Interface.vbs -- Probably script.virus. Then found you. Here is my HJT log, but I fear it only shows my main computer. I would like to try to keep my problem computer's stuff intact if at all possible. Thanks for any assistance you can provide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:43:34 AM, on 9/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\System32\drivers\CDAC11BA.EXE
C:\Windows\Cpqdiag\Cpqdfwag.exe
C:\Program Files\MATCO\DirmsService\DirmsService.exe
C:\Windows\System32\GEARSec.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Windows\system32\drivers\KodakCCS.exe
C:\Windows\System32\NMSSvc.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\nvsvc32.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Windows\StartupMonitor.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Windows\system32\taskswitch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\System32\svchost.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
D:\giveaway\Sticky Password\stpass.exe
G:\Spybot - Search & Destroy\TeaTimer.exe
G:\NBC Direct\DirectPlayerCore.exe
C:\Program Files\Pando Networks\Media Booster\pmb.exe
G:\program files\Reader 8\Reader\AcroRd32.exe
C:\Windows\System32\mmc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\Lavasoft\Ad-Aware\AAWService.exe
G:\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\L3MCTB42\launch[1].exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\z6m27r.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\ns39rXP.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Administrator\Desktop\winlogon.scr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = [You must be registered and logged in to see this link.]*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r5.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3B1191EE-EF43-4ADB-BF52-12D0A83F7727} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\common\yiesrvc.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\Windows\system32\taskswitch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Ad-Watch] G:\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\program files\Reader 8\Reader\Reader_sl.exe"
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\Windows\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [StickyPassword] D:\giveaway\Sticky Password\stpass.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DirectPlayerCore] "G:\NBC Direct\DirectPlayerCore.exe"
O4 - HKLM\..\Policies\Explorer\Run: []

O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'ASPNET')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1006\..\RunOnce: [] (User 'ASPNET')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1007\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'admin')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1007\..\RunOnce: [] (User 'admin')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1008\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'kids')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1008\..\RunOnce: [] (User 'kids')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1009\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Eileen')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1009\..\RunOnce: [] (User 'Eileen')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - [You must be registered and logged in to see this link.]\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0F11C315-352D-47EB-A383-2225BCA40D97} - [You must be registered and logged in to see this link.] (file missing) (HKCU)
O9 - Extra button: Help - {45712049-617C-4945-8CB9-7A57CA190440} - [You must be registered and logged in to see this link.] (file missing) (HKCU)
O9 - Extra button: Support - {7D99D985-4E94-4116-A93B-E058C9024522} - [You must be registered and logged in to see this link.] (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - [You must be registered and logged in to see this link.]
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - [You must be registered and logged in to see this link.]
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - [You must be registered and logged in to see this link.]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - [You must be registered and logged in to see this link.]
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - [You must be registered and logged in to see this link.]
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - [You must be registered and logged in to see this link.]
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - [You must be registered and logged in to see this link.]
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {FA91DF8D-53AB-455D-AB20-F2F023E498D3} (RSClientPrint Class) - [You must be registered and logged in to see this link.]
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O18 - Filter: application/hta - {D962EF38-5FB0-4761-8638-C86F085E25E6} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O19 - User stylesheet: (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\System32\drivers\CDAC11BA.EXE
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\Windows\Cpqdiag\Cpqdfwag.exe
O23 - Service: DirMS_Defragmentation - Unknown owner - C:\Program Files\MATCO\DirmsService\DirmsService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\Windows\System32\GEARSec.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\Windows\system32\drivers\KodakCCS.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - G:\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
O24 - Desktop Component 0: (no name) - [You must be registered and logged in to see this link.]

--
End of file - 17821 bytes

Hello.

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.

• Open HijackThis.
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O4 - HKLM\..\Policies\Explorer\Run: []
  
  O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Thank you, Belahzur, for your quick reply. I am running the scan now and will post the results when I get them.

Scan just completed. I did not take any action yet, because it appears to have found HJT:
Malwarebytes' Anti-Malware 1.41
Database version: 2837
Windows 5.1.2600 Service Pack 3

9/21/2009 10:03:36 AM
mbam-log-2009-09-21 (10-03-30).txt

Scan type: Quick Scan
Objects scanned: 128347
Time elapsed: 11 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Administrator\Desktop\winlogon.scr (Heuristics.Reserved.Word.Exploit) -> No action taken.

DDS (Ver_09-07-30.01) - FAT32x86
Run by Administrator at 13:43:44.33 on Mon 09/21/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.271 [GMT -5:00]

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\Windows\system32\svchost -k DcomLaunch
C:\Windows\system32\svchost -k rpcss
C:\Windows\System32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalService
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\svchost.exe -k LocalService
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\System32\drivers\CDAC11BA.EXE
C:\Windows\Cpqdiag\Cpqdfwag.exe
C:\Program Files\MATCO\DirmsService\DirmsService.exe
C:\Windows\System32\GEARSec.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Windows\system32\drivers\KodakCCS.exe
C:\Windows\System32\NMSSvc.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\nvsvc32.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Windows\StartupMonitor.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\alg.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Windows\system32\taskswitch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\System32\svchost.exe -k HTTPFilter
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
D:\giveaway\Sticky Password\stpass.exe
G:\NBC Direct\DirectPlayerCore.exe
C:\Program Files\Pando Networks\Media Booster\pmb.exe
G:\program files\Reader 8\Reader\AcroRd32.exe
C:\Windows\System32\mmc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
G:\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\L3MCTB42\launch[1].exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\z6m27r.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\ns39rXP.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\JGsoft\EditPadLite\EditPad.exe
C:\Program Files\Mozilla Firefox3\firefox.exe
G:\program files\mbam\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\CyberAC Software\NotePadXP\NotePadXP.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3NZGD26B\dds[1].scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = [You must be registered and logged in to see this link.]
uSearch Page = [You must be registered and logged in to see this link.]
uWindow Title = Microsoft Internet Explorer provided by Comcast
uSearch Bar = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]{searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = sas.r5.attbi.com:8000
uInternet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {3B1191EE-EF43-4ADB-BF52-12D0A83F7727} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - g:\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\IPSBHO.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: ZoneAlarm Spy Blocker BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\1.bin\SPYBLOCK.DLL
BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: ZoneAlarm Spy Blocker: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\1.bin\SPYBLOCK.DLL
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [StickyPassword] d:\giveaway\sticky password\stpass.exe
uRun: [DirectPlayerCore] "g:\nbc direct\DirectPlayerCore.exe"
mRun: [CPQEASYACC] c:\program files\compaq\easy access button support\StartEAK.exe
mRun: [Run StartupMonitor] StartupMonitor.exe
mRun: [Acronis True Image Monitor] "c:\program files\acronis\trueimage\TrueImageMonitor.exe"
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [CoolSwitch] c:\windows\system32\taskswitch.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [Ad-Watch] g:\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "g:\program files\reader 8\reader\Reader_sl.exe"
mRunOnce: [Malwarebytes' Anti-Malware] g:\program files\mbam\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunServices: [CPQDFWAG] c:\windows\cpqdiag\CpqDfwAg.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0)
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
uPolicies-system: HideFastUserSwitching = 0 (0x0)
IE: E&xport to Microsoft Excel - g:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - g:\progra~1\micros~1\office12\ONBttnIE.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - g:\spybot~1\SDHelper.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\cg4ym9cr.default\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Ask.com (Virtus Designs)
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - component: d:\giveaway\sticky password\spautofill\components\SPAutofill.dll
FF - plugin: c:\documents and settings\administrator\application data\idm\bin\flash\platform\winnt\plugins\npidmdcp.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\cg4ym9cr.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\cg4ym9cr.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: g:\nbc direct\npDirectPlayerMozilla.dll
FF - plugin: g:\program files\reader 8\reader\browser\nppdf32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox3\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox3\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox3\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox3\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox3\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox3\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox3\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox3\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox3\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox3\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox3\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2003-4-3 9344]
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [2009-4-8 40496]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-11 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-9-1 28544]
R0 RVSDISK;RVSDISK;c:\windows\system32\drivers\RVSDISK.sys [2008-4-26 11904]
R0 RVSYSTEM;RVSYSTEM;c:\windows\system32\drivers\RVSYSTEM.sys [2008-4-26 38272]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1007020.00b\SymEFA.sys [2009-8-31 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1007020.00b\BHDrvx86.sys [2009-8-31 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1007020.00b\cchpx86.sys [2009-8-31 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090916.003\IDSXpx86.sys [2009-9-16 329080]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2008-3-28 95592]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-6-23 353672]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;d:\giveaway\astra32\astra32.sys [2007-2-22 30864]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2003-4-3 454144]
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;c:\windows\cpqdiag\CPQDFWAG.EXE [2003-3-22 212992]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\norton internet security\engine\16.7.2.11\ccSvcHst.exe [2009-8-31 117640]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [2006-8-23 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [2006-8-23 670128]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-27 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [2006-8-23 2041904]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-9-17 38224]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090921.002\NAVENG.SYS [2009-9-21 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090921.002\NAVEX15.SYS [2009-9-21 1323568]
S0 PQV2i;PQV2i; [x]
S1 PQIMount;PQIMount; [x]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2001-8-18 14336]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [2006-8-23 14924]

============== File Associations ===============

inffile=c:\windows\$ntservicepackuninstall$\notepad.exe %1

=============== Created Last 30 ================

2009-09-17 17:21 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 17:21 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-09 11:07 153,088 -------- c:\windows\system32\dllcache\triedit.dll

==================== Find3M ====================

2009-08-31 18:01 124,976 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-31 18:01 60,808 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-31 18:01 7,456 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-31 18:01 806 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-22 02:21 36,400 a----r-- c:\windows\system32\drivers\SymIM.sys
2009-08-13 10:16 512,000 -------- c:\windows\system32\dllcache\jscript.dll
2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 04:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-19 08:33 3,597,824 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-19 08:33 6,067,200 -------- c:\windows\system32\dllcache\ieframe.dll
2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 14:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 10,841,088 -------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 -------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-10 08:27 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-06-29 06:07 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-29 06:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-06-29 03:35 634,632 -------- c:\windows\system32\dllcache\iexplore.exe
2009-06-29 03:33 2,452,872 -------- c:\windows\system32\dllcache\ieapfltr.dat
2009-06-29 03:33 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2009-06-25 03:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 03:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 03:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 03:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 03:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 03:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-25 03:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 03:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 03:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 03:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 03:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-25 03:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-24 06:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-03-09 01:15 81,920 a------- c:\docume~1\admini~1\applic~1\ezpinst.exe
2009-03-09 01:15 47,360 a------- c:\docume~1\admini~1\applic~1\pcouffin.sys
2003-04-12 15:49 723 a------- c:\program files\INSTALL.LOG
2008-09-13 09:38 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091320080914\index.dat
2007-05-03 09:59 16,384 a--sh--- c:\windows\temp\cookies\index.dat
2007-05-03 09:59 16,384 a--sh--- c:\windows\temp\history\history.ie5\index.dat
2007-05-03 09:59 32,768 a--sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 13:45:38.19 ===============

Hello.
That log looks fine.

Can you post attach.txt? there is one thing I need to see from that log.

Two questions. One, should it be zipped and attached as it says? Two, it looks like all this has been diagnosing my main computer and not the bootable drive that I have piggybacked and that I mentioned at the beginning of my post (which was a separate computer's hard drive that had the issues). Am I wrong? I just would hate to see you going through all this work and not getting what you really need to diagnose it. Thanks!

No, your not wrong.
Just I had to make sure the machine was okay first, I can't know what's on the bootable external drive, if it's bad, it may screw the machine up even worse.

Is the bootable drive a USB drive?

Yes. It is a SATA hard drive that I have put into an external enclosure that has a USB 2.0 interface. By the way, I did experience a system panic yesterday on my main computer that resulted in an immediate shutdown (i.e. crash). I removed the external hard drive and rebooted the main machine and let it go through the chkdsk procedure. It found a few files that were either cross-linked or had allocation issues, which it resolved. Normal boot-up continued and I seem to be OK (I am using it now). I have not attached the USB external yet. At this point, I will wait until I hear back from you. And, as always, thanks for your help. Do you still need the attach.txt file? If so, should I zip and attach it or just post it?

Hi Belahzur,

I know you are very busy and have a lot going but I would like to know if there is anything I can do (when I get the time to work on it, too!) that will help move this issue along? My main computer's system panic was apparently caused by me denying Firefox to act as a server. I still have not reattached the other machine's hard drive. Any direction you can provide would be great. Please see my previous post's last few sentences for questions that I was hoping to get answers for. Thank you!

Hello.
Sorry for the delay; your post got overlooked. Please attach the external USB device.

Hello.

• Download combofix from here
  [You must be registered and logged in to see this link.]
  [You must be registered and logged in to see this link.]
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See [You must be registered and logged in to see this link.] for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Sorry, Belahzur, for taking so long. Here are the results of combofix.

ComboFix 09-10-06.03 - Administrator 10/07/2009 1:26.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.934 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\recycled\NPROTECT
c:\windows\Installer\12aecf.msi
c:\windows\Installer\14b38b.msi
c:\windows\Installer\3447c.msp
c:\windows\Installer\38b385.msp
c:\windows\Installer\eb54b.msp
c:\windows\system32\Cache
c:\windows\system32\com.dll
c:\windows\winini.exe
G:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-09-07 to 2009-10-07 )))))))))))))))))))))))))))))))
.

2009-10-07 06:15 . 2009-10-07 06:15 -------- d-----w- C:\Combo-Fix
2009-10-03 19:51 . 2009-10-03 19:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\JGsoft
2009-10-02 05:17 . 2009-10-02 05:17 -------- d-----w- c:\windows\LastGood
2009-09-28 07:47 . 2009-09-28 07:47 -------- d-----w- C:\FOUND.003
2009-09-22 19:47 . 2009-09-22 19:47 -------- d-----w- C:\FOUND.002
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-17 04:36 . 2009-09-17 04:36 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\program files\NOS
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-09 16:07 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 23:01 . 2009-03-17 04:02 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-31 23:01 . 2009-03-17 04:02 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-31 23:01 . 2009-03-17 04:02 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-31 23:01 . 2009-03-17 04:02 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-22 07:21 . 2009-03-17 04:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-18 04:19 . 2004-03-17 04:19 36328 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 00:24 . 2005-01-04 03:40 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2005-01-04 03:40 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2003-03-26 02:49 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2003-03-26 02:46 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2005-01-04 03:59 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2006-11-17 02:45 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 00:23 . 2005-05-26 09:19 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 00:23 . 2003-03-26 02:49 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2003-05-07 03:44 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 20:07 . 2009-08-03 20:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 20:07 . 2009-08-03 20:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 20:07 . 2009-08-03 20:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-07-17 19:01 . 2003-03-26 02:46 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2003-03-26 03:52 286208 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StickyPassword"="d:\giveaway\Sticky Password\stpass.exe" [2007-05-19 1303040]
"DirectPlayerCore"="g:\nbc direct\DirectPlayerCore.exe" [2009-03-25 1150016]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2009-07-18 257440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPQEASYACC"="c:\program files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 32768]
"Acronis True Image Monitor"="c:\program files\Acronis\TrueImage\TrueImageMonitor.exe" [2005-07-06 419408]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2005-07-06 69632]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Ad-Watch"="g:\lavasoft\Ad-Aware\AAWTray.exe" [2009-09-22 520024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="g:\program files\Reader 8\Reader\Reader_sl.exe" [2008-10-15 39792]
"Run StartupMonitor"="StartupMonitor.exe" - c:\windows\StartupMonitor.exe [2000-05-20 86016]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-3-6 38912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2004-07-14 03:14 24673 ----a-w- c:\windows\system32\ckpNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"PROMon.exe"=PROMon.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Smapp"=c:\program files\Analog Devices\SoundMAX\Smtray.exe
"Symantec NetDriver Monitor"=c:\progra~1\SYMNET~1\SNDMon.exe /Consumer
"WinFaxAppPortStarter"=wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\BIN\\SR_GUI.EXE"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"g:\\NBC Direct\\DirectPlayerCore.exe"=
"g:\\program files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"56436:TCP"= 56436:TCP:Pando Media Booster
"56436:UDP"= 56436:UDP:Pando Media Booster

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [4/3/2003 11:23 PM 9344]
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [4/8/2009 10:31 PM 40496]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/11/2009 10:22 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [9/1/2008 11:36 PM 28544]
R0 RVSDISK;RVSDISK;c:\windows\system32\drivers\RVSDISK.sys [4/26/2008 12:16 AM 11904]
R0 RVSYSTEM;RVSYSTEM;c:\windows\system32\drivers\RVSYSTEM.sys [4/26/2008 12:15 AM 38272]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [8/31/2009 6:01 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [8/31/2009 6:01 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [8/31/2009 6:00 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090916.003\IDSXpx86.sys [9/16/2009 5:25 PM 329080]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [3/28/2008 10:04 PM 95592]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;d:\giveaway\ASTRA32\astra32.sys [2/22/2007 11:28 AM 30864]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [4/3/2003 11:23 PM 454144]
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;c:\windows\Cpqdiag\CPQDFWAG.EXE [3/22/2003 3:41 AM 212992]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 6:00 PM 117640]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [8/23/2006 10:19 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [8/23/2006 10:19 PM 670128]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 9:38 PM 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [8/23/2006 10:20 PM 2041904]
S0 PQV2i;PQV2i; [x]
S1 PQIMount;PQIMount; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1028432]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/18/2001 12:36 AM 14336]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/17/2009 5:21 PM 38224]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [8/23/2006 10:20 PM 14924]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2009-10-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 12:03]

2009-10-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2009-09-28 c:\windows\Tasks\GlaryInitialize.job
- g:\giveawayoftheday\Glary Utilities\initialize.exe [2009-01-13 22:02]

2009-10-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- g:\lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 03:21]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]{searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = sas.r5.attbi.com:8000
uInternet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]\windows\Java\classes\xmldso.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: d:\giveaway\Sticky Password\spautofill\components\SPAutofill.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\IDM\bin\flash\platform\WINNT\plugins\npidmdcp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npDocX.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npnul32.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nprpjplug.dll
FF - plugin: g:\nbc direct\npDirectPlayerMozilla.dll
FF - plugin: g:\program files\Reader 8\Reader\browser\nppdf32.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
.
------- File Associations -------
.
txtfile="g:\program files\EditPad Lite\EditPadLite.exe" "%1"
.
- - - - ORPHANS REMOVED - - - -

BHO-{3B1191EE-EF43-4ADB-BF52-12D0A83F7727} - (no file)
AddRemove-HijackThis - c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Z9224N0M\HijackThis.exe
AddRemove-Move Networks Player_is1 - c:\documents and settings\Administrator\Application Data\Move Networks\ie_bin\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-10-07 01:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-919082819-2040581095-3719885985-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{32E01C85-8E43-78C7-6D84-C9E20DD24F75}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"haelhmpglifhljbc"=hex:61,62,70,69,63,6a,62,67,6f,6d,68,6b,66,66,6e,66,6c,63,
6f,6c,6a,67,6d,6b,61,67,6e,6a,61,67,69,6f,6d,6d,00,00
"haelhmpgaikndngk"=hex:70,62,70,69,62,66,68,62,63,6b,68,68,65,6a,6b,6e,6f,66,
6d,6d,69,66,64,6b,64,67,6d,67,6f,64,68,69,6d,6c,6f,70,6d,6f,6c,61,69,62,64,\

[HKEY_USERS\S-1-5-21-919082819-2040581095-3719885985-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{51D1A0C0-CAB4-6BCE-EA97-774334BA7832}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"halfcdbnbeneppcc"=hex:61,62,69,61,6a,62,6b,6e,64,63,6f,69,62,6d,70,67,67,70,
68,66,63,70,6f,62,6b,66,6b,68,6b,61,66,67,69,6a,00,00
"galfcdbnkfcgbh"=hex:64,62,67,61,68,68,66,67,61,68,67,70,62,64,67,6e,62,6a,63,
62,66,6f,61,64,63,68,6d,67,6c,62,68,68,63,6e,67,68,61,6c,64,6d,00,00
.
Completion time: 2009-10-07 1:37
ComboFix-quarantined-files.txt 2009-10-07 06:36

Pre-Run: 2,336,526,336 bytes free
Post-Run: 2,489,225,216 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\Windows
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\Windows="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

244 --- E O F --- 2009-10-05 03:34

Does ComboFix scan a registry that is not on the primary, active hard drive? I am asking because the problem drive is the USB piggybacked drive. Here are the results from the above procedure:

ComboFix 09-10-06.03 - Administrator 10/07/2009 19:26.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.942 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFscript.txt
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\FOUND.001
c:\found.001\FILE0000.CHK
C:\FOUND.002
c:\found.002\FILE0000.CHK
c:\found.002\FILE0001.CHK
c:\found.002\FILE0002.CHK
c:\found.002\FILE0003.CHK
C:\FOUND.003
c:\found.003\FILE0000.CHK
c:\found.003\FILE0001.CHK
c:\found.003\FILE0002.CHK
c:\found.003\FILE0003.CHK
c:\found.003\FILE0004.CHK
c:\found.003\FILE0005.CHK
c:\found.003\FILE0006.CHK
c:\found.003\FILE0007.CHK
c:\found.003\FILE0008.CHK
c:\found.003\FILE0009.CHK
c:\found.003\FILE0010.CHK
c:\found.003\FILE0011.CHK
c:\found.003\FILE0012.CHK
c:\found.003\FILE0013.CHK
c:\found.003\FILE0014.CHK
c:\found.003\FILE0015.CHK
c:\found.003\FILE0016.CHK
c:\found.003\FILE0017.CHK
c:\found.003\FILE0018.CHK
c:\found.003\FILE0019.CHK
c:\found.003\FILE0020.CHK
c:\found.003\FILE0021.CHK
c:\found.003\FILE0022.CHK
c:\found.003\FILE0023.CHK
c:\found.003\FILE0024.CHK
c:\found.003\FILE0025.CHK
c:\found.003\FILE0026.CHK
c:\found.003\FILE0027.CHK
c:\found.003\FILE0028.CHK
c:\found.003\FILE0029.CHK
c:\found.003\FILE0030.CHK
c:\found.003\FILE0031.CHK
c:\found.003\FILE0032.CHK
c:\found.003\FILE0033.CHK
c:\found.003\FILE0034.CHK
c:\found.003\FILE0035.CHK
c:\found.003\FILE0036.CHK
c:\found.003\FILE0037.CHK
c:\found.003\FILE0038.CHK
c:\found.003\FILE0039.CHK
c:\found.003\FILE0040.CHK
c:\found.003\FILE0041.CHK
c:\found.003\FILE0042.CHK
c:\found.003\FILE0043.CHK
c:\found.003\FILE0044.CHK
c:\found.003\FILE0045.CHK
c:\found.003\FILE0046.CHK
c:\found.003\FILE0047.CHK
c:\found.003\FILE0048.CHK
c:\found.003\FILE0049.CHK
c:\found.003\FILE0050.CHK
c:\found.003\FILE0051.CHK
c:\found.003\FILE0052.CHK
c:\found.003\FILE0053.CHK
c:\found.003\FILE0054.CHK
c:\found.003\FILE0055.CHK
c:\found.003\FILE0056.CHK
c:\found.003\FILE0057.CHK
c:\found.003\FILE0058.CHK
c:\found.003\FILE0059.CHK
c:\found.003\FILE0060.CHK
c:\found.003\FILE0061.CHK
c:\found.003\FILE0062.CHK
c:\found.003\FILE0063.CHK
c:\found.003\FILE0064.CHK
c:\found.003\FILE0065.CHK
c:\found.003\FILE0066.CHK
c:\found.003\FILE0067.CHK
c:\found.003\FILE0068.CHK
c:\found.003\FILE0069.CHK
c:\found.003\FILE0070.CHK
c:\found.003\FILE0071.CHK
c:\found.003\FILE0072.CHK
c:\found.003\FILE0073.CHK
c:\found.003\FILE0074.CHK
c:\found.003\FILE0075.CHK
c:\found.003\FILE0076.CHK
c:\found.003\FILE0077.CHK
c:\found.003\FILE0078.CHK
c:\found.003\FILE0079.CHK
c:\found.003\FILE0080.CHK
c:\found.003\FILE0081.CHK
c:\found.003\FILE0082.CHK
c:\found.003\FILE0083.CHK
c:\found.003\FILE0084.CHK
c:\found.003\FILE0085.CHK
c:\found.003\FILE0086.CHK
c:\found.003\FILE0087.CHK
c:\found.003\FILE0088.CHK
c:\found.003\FILE0089.CHK
c:\found.003\FILE0090.CHK
c:\found.003\FILE0091.CHK
c:\found.003\FILE0092.CHK
c:\found.003\FILE0093.CHK
c:\found.003\FILE0094.CHK
c:\found.003\FILE0095.CHK
c:\found.003\FILE0096.CHK
c:\found.003\FILE0097.CHK
c:\found.003\FILE0098.CHK
c:\found.003\FILE0099.CHK
c:\found.003\FILE0100.CHK
c:\found.003\FILE0101.CHK
c:\found.003\FILE0102.CHK
c:\found.003\FILE0103.CHK
c:\found.003\FILE0104.CHK
c:\found.003\FILE0105.CHK
c:\found.003\FILE0106.CHK
c:\found.003\FILE0107.CHK
c:\found.003\FILE0108.CHK
c:\found.003\FILE0109.CHK
c:\found.003\FILE0110.CHK
c:\found.003\FILE0111.CHK
c:\found.003\FILE0112.CHK
c:\found.003\FILE0113.CHK
c:\found.003\FILE0114.CHK
c:\found.003\FILE0115.CHK
c:\found.003\FILE0116.CHK
c:\found.003\FILE0117.CHK
c:\found.003\FILE0118.CHK
c:\found.003\FILE0119.CHK
c:\found.003\FILE0120.CHK
c:\found.003\FILE0121.CHK
c:\found.003\FILE0122.CHK
c:\found.003\FILE0123.CHK
c:\found.003\FILE0124.CHK
c:\found.003\FILE0125.CHK
c:\found.003\FILE0126.CHK
c:\found.003\FILE0127.CHK
c:\found.003\FILE0128.CHK
c:\found.003\FILE0129.CHK
c:\found.003\FILE0130.CHK
c:\found.003\FILE0131.CHK
c:\found.003\FILE0132.CHK
c:\found.003\FILE0133.CHK
c:\found.003\FILE0134.CHK
c:\found.003\FILE0135.CHK
c:\found.003\FILE0136.CHK
c:\found.003\FILE0137.CHK
c:\found.003\FILE0138.CHK
c:\found.003\FILE0139.CHK
c:\found.003\FILE0140.CHK
c:\found.003\FILE0141.CHK
c:\found.003\FILE0142.CHK
c:\found.003\FILE0143.CHK
c:\found.003\FILE0144.CHK
c:\found.003\FILE0145.CHK
c:\found.003\FILE0146.CHK
c:\found.003\FILE0147.CHK
c:\found.003\FILE0148.CHK
c:\found.003\FILE0149.CHK
c:\found.003\FILE0150.CHK
c:\found.003\FILE0151.CHK
c:\found.003\FILE0152.CHK
c:\found.003\FILE0153.CHK
c:\found.003\FILE0154.CHK
c:\found.003\FILE0155.CHK
c:\found.003\FILE0156.CHK
c:\found.003\FILE0157.CHK
c:\found.003\FILE0158.CHK
c:\found.003\FILE0159.CHK
c:\found.003\FILE0160.CHK
c:\found.003\FILE0161.CHK
c:\found.003\FILE0162.CHK
c:\found.003\FILE0163.CHK
c:\found.003\FILE0164.CHK
c:\found.003\FILE0165.CHK
c:\found.003\FILE0166.CHK
c:\found.003\FILE0167.CHK

.
((((((((((((((((((((((((( Files Created from 2009-09-08 to 2009-10-08 )))))))))))))))))))))))))))))))
.

2009-10-07 06:15 . 2009-10-07 06:15 -------- d-----w- C:\Combo-Fix
2009-10-03 19:51 . 2009-10-03 19:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\JGsoft
2009-10-02 05:17 . 2009-10-02 05:17 -------- d-----w- c:\windows\LastGood
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-17 04:36 . 2009-09-17 04:36 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\program files\NOS
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-09 16:07 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 23:01 . 2009-03-17 04:02 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-31 23:01 . 2009-03-17 04:02 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-31 23:01 . 2009-03-17 04:02 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-31 23:01 . 2009-03-17 04:02 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-22 07:21 . 2009-03-17 04:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-18 04:19 . 2004-03-17 04:19 36328 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 00:24 . 2005-01-04 03:40 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2005-01-04 03:40 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2003-03-26 02:49 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2003-03-26 02:46 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2005-01-04 03:59 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2006-11-17 02:45 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 00:23 . 2005-05-26 09:19 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 00:23 . 2003-03-26 02:49 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2003-05-07 03:44 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 20:07 . 2009-08-03 20:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 20:07 . 2009-08-03 20:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 20:07 . 2009-08-03 20:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-07-17 19:01 . 2003-03-26 02:46 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2003-03-26 03:52 286208 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StickyPassword"="d:\giveaway\Sticky Password\stpass.exe" [2007-05-19 1303040]
"DirectPlayerCore"="g:\nbc direct\DirectPlayerCore.exe" [2009-03-25 1150016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPQEASYACC"="c:\program files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 32768]
"Acronis True Image Monitor"="c:\program files\Acronis\TrueImage\TrueImageMonitor.exe" [2005-07-06 419408]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2005-07-06 69632]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Ad-Watch"="g:\lavasoft\Ad-Aware\AAWTray.exe" [2009-09-22 520024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="g:\program files\Reader 8\Reader\Reader_sl.exe" [2008-10-15 39792]
"Run StartupMonitor"="StartupMonitor.exe" - c:\windows\StartupMonitor.exe [2000-05-20 86016]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-3-6 38912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2004-07-14 03:14 24673 ----a-w- c:\windows\system32\ckpNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"PROMon.exe"=PROMon.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Smapp"=c:\program files\Analog Devices\SoundMAX\Smtray.exe
"Symantec NetDriver Monitor"=c:\progra~1\SYMNET~1\SNDMon.exe /Consumer
"WinFaxAppPortStarter"=wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\BIN\\SR_GUI.EXE"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"g:\\NBC Direct\\DirectPlayerCore.exe"=
"g:\\program files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"56436:TCP"= 56436:TCP:Pando Media Booster
"56436:UDP"= 56436:UDP:Pando Media Booster

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [4/3/2003 11:23 PM 9344]
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [4/8/2009 10:31 PM 40496]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/11/2009 10:22 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [9/1/2008 11:36 PM 28544]
R0 RVSDISK;RVSDISK;c:\windows\system32\drivers\RVSDISK.sys [4/26/2008 12:16 AM 11904]
R0 RVSYSTEM;RVSYSTEM;c:\windows\system32\drivers\RVSYSTEM.sys [4/26/2008 12:15 AM 38272]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [8/31/2009 6:01 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [8/31/2009 6:01 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [8/31/2009 6:00 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090916.003\IDSXpx86.sys [9/16/2009 5:25 PM 329080]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [3/28/2008 10:04 PM 95592]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;d:\giveaway\ASTRA32\astra32.sys [2/22/2007 11:28 AM 30864]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [4/3/2003 11:23 PM 454144]
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;c:\windows\Cpqdiag\CPQDFWAG.EXE [3/22/2003 3:41 AM 212992]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 6:00 PM 117640]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [8/23/2006 10:19 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [8/23/2006 10:19 PM 670128]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 9:38 PM 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [8/23/2006 10:20 PM 2041904]
S0 PQV2i;PQV2i; [x]
S1 PQIMount;PQIMount; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1028432]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/18/2001 12:36 AM 14336]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/17/2009 5:21 PM 38224]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [8/23/2006 10:20 PM 14924]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2009-10-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 12:03]

2009-10-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2009-09-28 c:\windows\Tasks\GlaryInitialize.job
- g:\giveawayoftheday\Glary Utilities\initialize.exe [2009-01-13 22:02]

2009-10-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- g:\lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 03:21]
.
.
------- Supplementary Scan -------
.
uStart Page = [You must be registered and logged in to see this link.]
uSearchMigratedDefaultURL = [You must be registered and logged in to see this link.]{searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = [You must be registered and logged in to see this link.]
mSearch Bar = [You must be registered and logged in to see this link.]*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyServer = sas.r5.attbi.com:8000
uInternet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
uSearchURL,(Default) = [You must be registered and logged in to see this link.]
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - [You must be registered and logged in to see this link.]\windows\Java\classes\xmldso.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - [You must be registered and logged in to see this link.]
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\
FF - prefs.js: browser.search.defaulturl - [You must be registered and logged in to see this link.]
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: d:\giveaway\Sticky Password\spautofill\components\SPAutofill.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\IDM\bin\flash\platform\WINNT\plugins\npidmdcp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npDocX.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npnul32.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nprpjplug.dll
FF - plugin: g:\nbc direct\npDirectPlayerMozilla.dll
FF - plugin: g:\program files\Reader 8\Reader\browser\nppdf32.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, [You must be registered and logged in to see this link.]
Rootkit scan 2009-10-07 19:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
Completion time: 2009-10-08 19:36
ComboFix-quarantined-files.txt 2009-10-08 00:36
ComboFix2.txt 2009-10-07 06:37

Pre-Run: 2,682,359,808 bytes free
Post-Run: 2,657,169,408 bytes free

375 --- E O F --- 2009-10-05 03:34