Another WinBlueSoft victim!

Grr, don't ask how but Winbluesoft was downloaded and now is running rampant on my computer. Here's my Hijackthis log:
ETA: Unistalled and deleted limewire and utorrent and rescanned with hijackthis:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:22:04 AM, on 6/12/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe
C:\Program Files\Java\jre1.5.0_03\bin\jucheck.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\setup2.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Documents and Settings\Lauren\Desktop\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: {f91bd35d-12b2-c58a-59f4-cdd81b4d0f84} - {48f0d4b1-8ddc-4f95-a85c-2b21d53db19f} - (no file)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {926C75F1-6ABD-4188-9BF9-DA1C1C936FF4} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Apoint] "C:\Program Files\Apoint\Apoint.exe"
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [Dell Wireless Manager UI] C:\WINDOWS\system32\WLTRAY
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [WinBlueSoft] C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
O4 - Startup: Shortcut to stuff.lnk = C:\stuff.bat
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: dlbcserv.lnk = C:\Program Files\Dell Photo Printer 720\dlbcserv.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O20 - AppInit_DLLs: hcizsp.dll
O20 - Winlogon Notify: iifcbba - iifcbba.dll (file missing)
O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe
O24 - Desktop Component 0: (no name) - about:home
O24 - Desktop Component 1: (no name) - about:home
O24 - Desktop Component 2: (no name) - about:home

--
End of file - 9119 bytes






I really appreciate anything you guys can do. I can't say enough about your services. I already have Malwarebytes downloaded if that will be needed.

Thanks again.

Yep, I want to try MBAM first.
Let me know if it will run, I suspect it probably wont, but worth a try.

That's the odd thing. I'm not experiencing the problems like others did where it won't let me run programs. I ran the MBAM full scan as well as my Symantec full scan. While they did clean up other things, neither of them made a difference on the WinBlueSoft.

Hello.

• Open HijackThis.
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: {f91bd35d-12b2-c58a-59f4-cdd81b4d0f84} - {48f0d4b1-8ddc-4f95-a85c-2b21d53db19f} - (no file)
  O2 - BHO: {f91bd35d-12b2-c58a-59f4-cdd81b4d0f84} - {48f0d4b1-8ddc-4f95-a85c-2b21d53db19f} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O4 - HKLM\..\Run: [WinBlueSoft] C:\Program Files\WinBlueSoft Software\WinBlueSoft\WinBlueSoft.exe -min
  O4 - HKCU\..\Run: [setup2.exe] C:\WINDOWS\system32\setup2.exe
  O4 - Startup: Shortcut to stuff.lnk = C:\stuff.bat
  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
  O20 - AppInit_DLLs: hcizsp.dll
  O20 - Winlogon Notify: iifcbba - iifcbba.dll (file missing)
  O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll (file missing)
  O20 - AppInit_DLLs: hcizsp.dll
  O20 - Winlogon Notify: iifcbba - iifcbba.dll (file missing)
  O20 - Winlogon Notify: jkhfd - C:\WINDOWS\system32\jkhfd.dll (file missing)
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Next,

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  
• Double click DDS.scr to run.
  
• When complete, two logs will open. Save both of the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt just yet.
  

DDS (Ver_09-05-14.01) - NTFSx86
Run by Lauren at 10:36:33.29 on Fri 06/12/2009
Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.134 [GMT -4:00]

AV: Symantec AntiVirus Corporate Edition *On-access scanning enabled* (Updated) {FB06448E-52B8-493A-90F3-E43226D3305C}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\PROGRA~1\SYMANT~1\VPTray.exe
C:\WINDOWS\system32\NWTRAY.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Documents and Settings\Lauren\Desktop\hijackgpthis.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Lauren\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.dell4me.com/myway
uSearch Bar = hxxp://www.google.com/ie
mDefault_Page_URL = hxxp://www.dell4me.com/myway
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\tfswshx.dll
BHO: {926C75F1-6ABD-4188-9BF9-DA1C1C936FF4} - No File
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\3.1.807.1746\swg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: &Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [DellSupport] "c:\program files\dellsupport\DSAgnt.exe" /startup
uRun: [Aim6]
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [Apoint] "c:\program files\apoint\Apoint.exe"
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [HotKeysCmds] c:\windows\system32\hkcmd.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Dell QuickSet] c:\program files\dell\quickset\quickset.exe
mRun: [Dell Wireless Manager UI] c:\windows\system32\WLTRAY
mRun: [DVDLauncher] "c:\program files\cyberlink\powerdvd\DVDLauncher.exe"
mRun: [dla] c:\windows\system32\dla\tfswctrl.exe
mRun: [ISUSPM Startup] "c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [dscactivate] "c:\program files\dell support center\gs_agent\custom\dsca.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [vptray] c:\progra~1\symant~1\VPTray.exe
mRun: [NWTRAY] NWTRAY.EXE
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\dlbcserv.lnk - c:\program files\dell photo printer 720\dlbcserv.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
mPolicies-system: CompatibleRUPSecurity = 1 (0x1)
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office10\EXCEL.EXE/3000
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: microsoft.com \*.windowsupdate
Trusted Zone: windowsupdate.com
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Notify: igfxcui - igfxsrvc.dll
Notify: NavLogon - c:\windows\system32\NavLogon.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\lauren\applic~1\mozilla\firefox\profiles\t9zmcpmn.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R1 SAVRT;SAVRT;c:\program files\symantec antivirus\savrt.sys [2006-9-6 337592]
R1 SAVRTPEL;SAVRTPEL;c:\program files\symantec antivirus\Savrtpel.sys [2006-9-6 54968]
R2 aawservice;Ad-Aware 2007 Service;c:\program files\lavasoft\ad-aware 2007\aawservice.exe [2007-7-20 557056]
R2 ccEvtMgr;Symantec Event Manager;c:\program files\common files\symantec shared\ccEvtMgr.exe [2006-7-19 192160]
R2 ccSetMgr;Symantec Settings Manager;c:\program files\common files\symantec shared\ccSetMgr.exe [2006-7-19 169632]
R2 SavRoam;SAVRoam;c:\program files\symantec antivirus\SavRoam.exe [2006-9-27 116464]
R2 Symantec AntiVirus;Symantec AntiVirus;c:\program files\symantec antivirus\Rtvscan.exe [2006-9-27 1813232]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-3-1 24652]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-3-16 101936]
R3 NAVENG;NAVENG;c:\progra~1\common~1\symant~1\virusd~1\20090610.002\naveng.sys [2009-6-11 89104]
R3 NAVEX15;NAVEX15;c:\progra~1\common~1\symant~1\virusd~1\20090610.002\navex15.sys [2009-6-11 876144]

=============== Created Last 30 ================

2009-06-12 10:02 73,728 a------- c:\windows\system32\javacpl.cpl
2009-06-12 10:02 410,984 a------- c:\windows\system32\deploytk.dll
2009-06-12 01:25 --d----- c:\docume~1\lauren\applic~1\Malwarebytes
2009-06-12 01:25 40,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-12 01:25 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-06-12 01:25 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-06-12 01:25 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-06-12 00:48 69,120 a------- c:\windows\system32\drivers\imqipmtivfviobvo.sys
2009-06-10 12:47 12,109 a------- c:\windows\system32\2219downloz5er1682.exe
2009-06-10 02:12 13,859 a------- c:\windows\29c5thiefz880.dll
2009-06-09 14:39 --d----- c:\program files\common files\Hewlett-Packard
2009-06-09 14:38 15,104 a------- c:\windows\system32\drivers\usbscan.sys
2009-06-09 14:38 15,104 a------- c:\windows\system32\dllcache\usbscan.sys
2009-06-09 14:31 --d----- c:\program files\HP
2009-06-09 14:28 103,509 a------- c:\windows\hpoins04.dat
2009-06-09 14:28 17,176 -------- c:\windows\hpomdl04.dat
2009-06-09 14:28 --d----- c:\temp\HP_WebRelease
2009-06-09 10:01 2,606 a------- c:\windows\system32\245659pz2c5.dll
2009-06-09 00:12 819,200 a------- c:\windows\system32\xvidcore.dll
2009-06-09 00:12 180,224 a------- c:\windows\system32\xvidvfw.dll
2009-06-09 00:12 77,824 a------- c:\windows\system32\xvid.ax
2009-06-09 00:12 --d----- c:\program files\Xvid
2009-06-08 00:55 15,823 a------- c:\windows\102935roz274.cpl
2009-06-05 22:10 5,092 a------- c:\windows\system32\27923trzj54e5.bin
2009-06-04 22:11 6,915 a------- c:\windows\system32\93cadownloa5er4z5.dll
2009-06-01 15:12 5,376 a------- c:\windows\system32\13705s9yzbf.ocx
2009-05-28 19:33 3,349 a------- c:\windows\system32\25960t9zj525.bin
2009-05-28 15:19 10,308 a------- c:\windows\39bev5r90z7.exe
2009-05-28 03:09 2,993 a------- c:\windows\294755orz3c89.ocx
2009-05-27 18:04 4,422 a------- c:\windows\system32\705d9wnloazer906.bin
2009-05-25 13:05 18,346 a------- c:\windows\system32\185z9troj795.cpl
2009-05-23 16:11 16,720 a------- c:\windows\z095s5eal40.cpl
2009-05-21 10:06 17,575 a------- c:\windows\z9868n59-a-virus20e.cpl
2009-05-19 07:10 11,085 a------- c:\windows\994z5pyware3233.ocx
2009-05-19 01:04 12,693 a------- c:\windows\system32\91z5ad5ware1586.cpl
2009-05-18 21:58 11,922 a------- c:\windows\system32\6eze9ir520.dll
2009-05-17 20:53 12,045 a------- c:\windows\9824haz9t5ol1f5.exe

==================== Find3M ====================

2009-05-10 22:45 16,590 a------- c:\windows\2759spamboz500.dll
2009-05-10 12:36 6,288 a------- c:\windows\system32\308695roj3z9.bin
2009-05-08 14:44 6,710 a------- c:\windows\28088hazkt5ol79b.dll
2009-05-06 12:07 9,756 a------- c:\windows\system32\196395azse2377.bin
2009-05-05 00:47 8,581 a------- c:\windows\5d48s9ez51040.dll
2009-05-02 18:55 3,203 a------- c:\windows\system32\57237wzr9514.exe
2009-05-01 10:41 6,495 a------- c:\windows\system32\95290worm5b8z.exe
2009-04-26 16:26 14,151 a------- c:\windows\96797tr5j765z.dll
2009-04-23 07:19 3,907 a------- c:\windows\system32\1ee0zpy95re899.bin
2009-04-21 15:53 7,909 a------- c:\windows\297aspywzre1415.exe
2009-04-20 02:37 16,635 a------- c:\windows\58e5thrzat19689.dll
2009-04-18 04:12 14,176 a------- c:\windows\4z45spamb9t536.exe
2009-04-18 02:49 7,352 a------- c:\windows\system32\10919w5rmzd9.exe
2009-04-15 01:07 16,696 a------- c:\windows\system32\933cs5zal451.exe
2009-04-13 16:09 9,686 a------- c:\windows\acd5ddwar91200z.exe
2009-04-12 14:05 6,986 a------- c:\windows\system32\z6310troj659.dll
2009-04-12 02:22 5,528 a------- c:\windows\system32\ea7t5i9f62z.dll
2009-04-11 13:26 10,303 a------- c:\windows\3fz1th95at20598.exe
2009-04-09 17:35 17,704 a------- c:\windows\system32\18550worm9z2.bin
2009-04-09 10:10 18,203 a------- c:\windows\system32\415zsteal1079.bin
2009-04-07 04:10 15,966 a------- c:\windows\system32\45zbbackdo5r27569.bin
2009-04-07 04:05 6,916 a------- c:\windows\system32\15abzhreat20929.exe
2009-04-04 03:35 3,377 a------- c:\windows\system32\5f52threat59z96.dll
2009-04-03 08:52 11,398 a------- c:\windows\5561sp9ware184z.exe
2009-04-03 06:22 3,293 a------- c:\windows\system32\57z8s5y595.exe
2009-04-02 00:13 7,459 a------- c:\windows\system32\53920virzs51f.bin
2009-03-28 10:28 11,889 a------- c:\windows\3039stealz531.dll
2009-03-26 20:19 17,954 a------- c:\windows\system32\77d0th9e51044z.dll
2009-03-26 11:11 5,293 a------- c:\windows\5900w9rm4z5.exe
2009-03-25 00:20 16,150 a------- c:\windows\system32\3048zspambo5639.bin
2009-03-24 11:52 14,253 a------- c:\windows\5abc5zie9379.exe
2009-03-16 07:38 16,246 a------- c:\windows\system32\6ea35tezl90.bin
2009-03-14 12:29 9,781 a------- c:\windows\system32\559aspywaze2306.dll
2007-08-29 21:05 246 a------- c:\program files\common files\lavu
2007-08-21 00:25 246 a------- c:\program files\common files\lavu779
2007-07-28 05:06 135 a------- c:\program files\common files\profsy.html
2005-12-26 10:35 45,016 a------- c:\docume~1\lauren\applic~1\GDIPFONTCACHEV1.DAT
2007-08-13 20:55 1,686,656 ---sh--- c:\windows\system32\dfhkj.bak1
2007-05-31 14:51 6,369 ---sh--- c:\windows\system32\kjjlm.bak1
2007-06-01 02:48 1,843,636 ---sh--- c:\windows\system32\kjjlm.bak2
2009-01-27 21:28 933 a--sh--- c:\windows\system32\OpqAaccf.ini2
2007-08-15 14:37 1,685,605 ---sh--- c:\windows\system32\ycbeg.bak1

============= FINISH: 10:37:07.81 ===============



Thank you so much thus far. The annoying pop up banners have stopped already with the first step.

Hello.

• Download combofix from here
  Link 1
  Link 2
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV. (Symantec)
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

ComboFix 09-06-11.06 - Lauren 06/12/2009 11:09.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.216 [GMT -4:00]
Running from: c:\documents and settings\Lauren\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\temp\0b9
c:\temp\1cb
c:\temp\fse
c:\temp\iee
c:\windows\system32\o02PrEz
c:\windows\system32\X1
C:\-1931993994
c:\documents and settings\Lauren\err.log
c:\documents and settings\Lauren\ResErrors.log
c:\temp\0b9\tmpTF.log
c:\temp\1cb\syscheck.log
c:\temp\fse\tmpZTF.log
c:\temp\iee\tmpZTF.log
c:\windows\100zpyware9354.exe
c:\windows\102935roz274.cpl
c:\windows\105dd9wzloader2861.cpl
c:\windows\10659ddwarz650.dll
c:\windows\10z7a9dware5822.cpl
c:\windows\112c9oznl5ader815.ocx
c:\windows\11626notza5v9rus7d8.exe
c:\windows\11819not9a-v5rus254z.cpl
c:\windows\11z21not-9-vir5s4f5.cpl
c:\windows\1205sp5999z.dll
c:\windows\12939pa5se16z0.dll
c:\windows\13215t9oz504.dll
c:\windows\1331895rm310z.cpl
c:\windows\13509otza-virus195.ocx
c:\windows\13653spyza9.cpl
c:\windows\1517do5nzoader1109.cpl
c:\windows\1519a9dwarez518.ocx
c:\windows\1525zspa9bo5c4.dll
c:\windows\15509spambot92az.ocx
c:\windows\15z8st9al14895.exe
c:\windows\16273szamb5t19f.ocx
c:\windows\16z29not-a-9irus15d.dll
c:\windows\1700b5c9door2274z.ocx
c:\windows\17z56t9oj85.exe
c:\windows\18046zot-a-5irus9eb.dll
c:\windows\1815s9ywaze549.dll
c:\windows\1821trz5309.ocx
c:\windows\18270s9ambo51z3.cpl
c:\windows\1854t9oz475.exe
c:\windows\18903zr9j7e5.cpl
c:\windows\18960s9z3c5.ocx
c:\windows\18e5ddwar91z95.ocx
c:\windows\18z99hack5ool943.cpl
c:\windows\19507troj5z5.cpl
c:\windows\19508virus70z.exe
c:\windows\19545troj65z9.dll
c:\windows\195aspywa5z1968.exe
c:\windows\195szeal597.cpl
c:\windows\19695zr690.ocx
c:\windows\1975vzrus7b9.dll
c:\windows\19895viruz2dc.dll
c:\windows\19aathzeat12507.dll
c:\windows\19easp5wa9e1z51.cpl
c:\windows\1a6dste9lz453.dll
c:\windows\1c175parze1259.dll
c:\windows\1d1zthre9t281025.cpl
c:\windows\1z563s9y385.dll
c:\windows\1z62t5oj9a2.ocx
c:\windows\20509irz610.ocx
c:\windows\2084v5z945.exe
c:\windows\20946zo9-5-virus32e.cpl
c:\windows\2196spaz5o9e6.exe
c:\windows\225529pamb5t57z.ocx
c:\windows\22895zro5654.dll
c:\windows\23081no9-a-viru56z9.dll
c:\windows\23665spamzot799.ocx
c:\windows\23983vi9us56z.ocx
c:\windows\241zvir9s5065.ocx
c:\windows\24531hacktool9ez.ocx
c:\windows\24980nz5-a-virus79f.dll
c:\windows\2551baczd9or2560.exe
c:\windows\256z4spamb9t578.ocx
c:\windows\2596thie92999z.dll
c:\windows\264z8hackt5ol199.ocx
c:\windows\26619o5nloazer2595.dll
c:\windows\26777h9c5tozl6cb.exe
c:\windows\26784s9yzd55.ocx
c:\windows\26825w9rz679.cpl
c:\windows\26939spam5ot62az.ocx
c:\windows\26a6downzoade92525.ocx
c:\windows\2759spamboz500.dll
c:\windows\276z5w9rm355.ocx
c:\windows\27916t9oj2za5.dll
c:\windows\27997viruz53a.dll
c:\windows\27z469orm55a.exe
c:\windows\28088hazkt5ol79b.dll
c:\windows\28245z9rse2620.ocx
c:\windows\28355z5cktool91f.exe
c:\windows\29055wor5cz.exe
c:\windows\2942szy45c.dll
c:\windows\294755orz3c89.ocx
c:\windows\296zspambot165.cpl
c:\windows\297659rzj15e.cpl
c:\windows\297aspywzre1415.exe
c:\windows\29848troz2e45.ocx
c:\windows\2989addwaze1542.dll
c:\windows\29935szy75a.ocx
c:\windows\29c5thiefz880.dll
c:\windows\2aa1spy9arez385.dll
c:\windows\2b2ftzi592411.dll
c:\windows\2cf9steaz5989.exe
c:\windows\2z158spy329.exe
c:\windows\2z439v9ru5190.ocx
c:\windows\2zf1add5are2909.ocx
c:\windows\3039stealz531.dll
c:\windows\307569zy250.dll
c:\windows\31395s5zmbot2a9.exe
c:\windows\31523viru958z.exe
c:\windows\3154not-a-vzr9s99.cpl
c:\windows\31713t9oz55.ocx
c:\windows\317z9troj665.cpl
c:\windows\3192not-a5zirus434.exe
c:\windows\31zd59ief352.dll
c:\windows\322abzckdoor1195.dll
c:\windows\32505ha9ktozl286.cpl
c:\windows\3312zddw9re26635.cpl
c:\windows\34319ownloadzr3025.exe
c:\windows\34a2thr5atz1992.ocx
c:\windows\34d39hr5at26232z.ocx
c:\windows\35151spambot2dz9.exe
c:\windows\35859hacktool2z.dll
c:\windows\35910not-a9viruz787.ocx
c:\windows\359ethief3z18.ocx
c:\windows\35fath9eat1z690.cpl
c:\windows\35z5spa9bot51d.exe
c:\windows\37e9bazkdo5r973.ocx
c:\windows\3914zsp570b.cpl
c:\windows\391725roj6z1.dll
c:\windows\3954spambzt3b5.exe
c:\windows\39bev5r90z7.exe
c:\windows\3ab5th9eaz29825.exe
c:\windows\3d08ad5waze2097.exe
c:\windows\3e5espyware944z.cpl
c:\windows\3fz1th95at20598.exe
c:\windows\4026z5ywar93142.exe
c:\windows\409etzreat6456.ocx
c:\windows\40bb5ckdo9rz046.cpl
c:\windows\4159threaz14133.ocx
c:\windows\4192backdoorz375.exe
c:\windows\43dc9parsz6705.dll
c:\windows\43eb9pa5sez217.exe
c:\windows\45d6zi93053.cpl
c:\windows\470spywar9259z.cpl
c:\windows\472athi9f52z.exe
c:\windows\4756worm1cz9.dll
c:\windows\4949spambz519c.exe
c:\windows\4955spamboz2d0.cpl
c:\windows\4d79downloa5er191z.ocx
c:\windows\4e61spz9se3235.cpl
c:\windows\4fa2ad5ware98z7.cpl
c:\windows\4z25spambo9594.dll
c:\windows\4z35steal2980.ocx
c:\windows\4z45spamb9t536.exe
c:\windows\4z6c9hreat50420.exe
c:\windows\50579spy152z.exe
c:\windows\5265spyw9re253z.exe
c:\windows\529639py34z.ocx
c:\windows\52c5thie918z.cpl
c:\windows\535bdowzloader2379.dll
c:\windows\5378s9y489z.cpl
c:\windows\5386tz9ef1270.ocx
c:\windows\5393zddware5283.cpl
c:\windows\54469zy735.cpl
c:\windows\5538tz9eat9751.cpl
c:\windows\555not-z-v95us511.exe
c:\windows\5561sp9ware184z.exe
c:\windows\5599vir214z.ocx
c:\windows\559z7tr9j562.exe
c:\windows\55z8spar9e3222.ocx
c:\windows\568zdown9oa5er997.dll
c:\windows\570zbackdoor594.ocx
c:\windows\577ast95l9z3.ocx
c:\windows\57bcspa9ze3181.ocx
c:\windows\57czs9eal1551.dll
c:\windows\587zthre5t911.ocx
c:\windows\58e5thrzat19689.dll
c:\windows\5900w9rm4z5.exe
c:\windows\59a2zir31515.cpl
c:\windows\5abc5zie9379.exe
c:\windows\5ad2addw9re210z.dll
c:\windows\5b1asparse291z.exe
c:\windows\5b97backdozr2463.dll
c:\windows\5d48s9ez51040.dll
c:\windows\5d6zste9l2775.exe
c:\windows\5d785z9nloader2558.ocx
c:\windows\5f9zsparse1385.cpl
c:\windows\5fa0th9eatz19555.cpl
c:\windows\5fd99ir22z95.dll
c:\windows\5zb5addwar92569.cpl
c:\windows\5zfcthief3905.dll
c:\windows\6185zor93.exe
c:\windows\629cb5zkdoor2114.dll
c:\windows\62z0threat156899.ocx
c:\windows\6351spzrse951.exe
c:\windows\635zthre9t2658.cpl
c:\windows\63acaddzare2593.ocx
c:\windows\63zorm7b59.cpl
c:\windows\64fzvir9785.cpl
c:\windows\65e8add5arez7049.ocx
c:\windows\6629spambot5dz9.ocx
c:\windows\6669do5zload9r3245.dll
c:\windows\6739s5913z.cpl
c:\windows\6bz15hreat21579.cpl
c:\windows\6c29tzr5at4372.cpl
c:\windows\6d01t9i5f1z36.exe
c:\windows\6ez4spy9are5297.ocx
c:\windows\6z52worm9e5.exe
c:\windows\72e1thze517239.dll
c:\windows\745downloa9ez895.dll
c:\windows\747fsp59are2579z.cpl
c:\windows\74a5backzoor15409.dll
c:\windows\752esp5wa9e268z.exe
c:\windows\7539szam5ot79e.dll
c:\windows\7571spaz9ot507.ocx
c:\windows\7578addwz9e336.dll
c:\windows\764ft5rezt29939.ocx
c:\windows\7650not-a5viz9s478.exe
c:\windows\77a9threat10959z.exe
c:\windows\7950downloadzr801.ocx
c:\windows\7956sze5l2687.exe
c:\windows\7958spar5e665z.ocx
c:\windows\79zf59r3080.exe
c:\windows\7a25downloa9er15z9.cpl
c:\windows\7aa4spar9ez55.cpl
c:\windows\7bz9threa57354.ocx
c:\windows\7c94bac5dozr1732.cpl
c:\windows\7ce4baz95oor1572.ocx
c:\windows\7dd0do5nlozder2495.ocx
c:\windows\7e88s9ywzre1285.exe
c:\windows\7f735ackdozr11939.exe
c:\windows\7fzasparse1895.ocx
c:\windows\7z29bac5door417.exe
c:\windows\8060noz9a-virus35b.exe
c:\windows\81995yware2195z.dll
c:\windows\8925worm590z.cpl
c:\windows\90905roj4z6.ocx
c:\windows\91768t5oj5az.exe
c:\windows\91d5hiez1976.ocx
c:\windows\9212b5czdoor2305.exe
c:\windows\930ba9kdoor14z25.ocx
c:\windows\94805trojz04.cpl
c:\windows\9526hacktooz29a.cpl
c:\windows\9537s9y3c5z.dll
c:\windows\9549wzrm459.dll
c:\windows\95627troj1adz.cpl
c:\windows\9598trzj6cf.exe
c:\windows\95dthizf8999.dll
c:\windows\96797tr5j765z.dll
c:\windows\971659z523.ocx
c:\windows\98160vir5s407z.ocx
c:\windows\9824haz9t5ol1f5.exe
c:\windows\9853spywar513z2.cpl
c:\windows\99065pyz8.exe
c:\windows\994z5pyware3233.ocx
c:\windows\99z0virus357.ocx
c:\windows\99z1troj512.exe
c:\windows\9bfaddwaz51534.dll
c:\windows\9cz6spywa5e994.dll
c:\windows\9e0thief9353z.ocx
c:\windows\9f3athrzat35871.ocx
c:\windows\9f45th5eaz19198.ocx
c:\windows\9f5v5r226z.ocx
c:\windows\9z275py1f1.exe
c:\windows\9z76hacktool1e95.exe
c:\windows\acd5ddwar91200z.exe
c:\windows\czea9dware1259.dll
c:\windows\e1695r1557z.ocx
c:\windows\e23sparsz2695.dll
c:\windows\e3as5za9836.cpl
c:\windows\e93steal5z5.dll
c:\windows\fb5stezl57599.dll
c:\windows\system32\105515azktool9c.ocx
c:\windows\system32\10597trojzf5.ocx
c:\windows\system32\10919w5rmzd9.exe
c:\windows\system32\11449hacktoold5z.ocx
c:\windows\system32\11z5v9rus528.exe
c:\windows\system32\12223z59ktool716.cpl
c:\windows\system32\1293noz-a95irus77d.cpl
c:\windows\system32\12991s9ambo54fz.dll
c:\windows\system32\129cthr5at8913z.dll
c:\windows\system32\12z9steal20115.exe
c:\windows\system32\135299pambotz95.exe
c:\windows\system32\13705s9yzbf.ocx
c:\windows\system32\13805wzrm39a.cpl
c:\windows\system32\13z259orm515.exe
c:\windows\system32\14159virus75z.ocx
c:\windows\system32\14455tro9ze7.cpl
c:\windows\system32\14960hacktozl965.ocx
c:\windows\system32\1515795oj20fz.exe
c:\windows\system32\15293virus2z5.bin
c:\windows\system32\15329spz5db.bin
c:\windows\system32\154z2troj4ea9.cpl
c:\windows\system32\15538notza-viru9211.ocx
c:\windows\system32\15555troj4z29.dll
c:\windows\system32\155eth9eat589z4.dll
c:\windows\system32\1564backd9zr825.cpl
c:\windows\system32\15793vzru5695.dll
c:\windows\system32\1580spyzar916425.bin
c:\windows\system32\15910troj548z.cpl
c:\windows\system32\15960hac9toolz4f.cpl
c:\windows\system32\15abzhreat20929.exe
c:\windows\system32\15b8thizf1539.ocx
c:\windows\system32\15eb5zy9are1713.cpl
c:\windows\system32\15z38hackt59l585.dll
c:\windows\system32\165zvi91257.dll
c:\windows\system32\1678azdwa5e194.dll
c:\windows\system32\16904hacktoo9z56.exe
c:\windows\system32\16999noz-a-virus581.exe
c:\windows\system32\169dz5nloader355.ocx
c:\windows\system32\17202zackt5ol469.bin
c:\windows\system32\1723not-a95iruz25e.cpl
c:\windows\system32\1729zddware675.exe
c:\windows\system32\17c9z5r504.ocx
c:\windows\system32\184529pyz8e.exe
c:\windows\system32\18550worm9z2.bin
c:\windows\system32\185z9troj795.cpl
c:\windows\system32\1877v953175z.exe
c:\windows\system32\1896h9ckto5l3cz.bin
c:\windows\system32\190999o5mz8.cpl
c:\windows\system32\190z4spambot5ff5.bin
c:\windows\system32\19595spyz7d.bin
c:\windows\system32\196395azse2377.bin
c:\windows\system32\1a6czhi9f527.ocx
c:\windows\system32\1b32a5dwzr975.ocx
c:\windows\system32\1c59zddware2319.exe
c:\windows\system32\1c85thrz9t19599.exe
c:\windows\system32\1d84addz9re16045.cpl
c:\windows\system32\1e85thre9t25896z.bin
c:\windows\system32\1ed6adz9are2575.exe
c:\windows\system32\1ee0zpy95re899.bin
c:\windows\system32\1z079hack5ool112.dll
c:\windows\system32\1z125v5rus3c09.bin
c:\windows\system32\1z520v9rus49c.bin
c:\windows\system32\1z537viru55f9.dll
c:\windows\system32\1z67595rm66b.ocx
c:\windows\system32\1z7929r5j1a4.ocx
c:\windows\system32\1z866hack5o9l1d9.exe
c:\windows\system32\1z879troj6785.dll
c:\windows\system32\1z990h5cktool212.bin
c:\windows\system32\20035worm29ez.exe
c:\windows\system32\20dathrza916951.exe
c:\windows\system32\212cz5ief11529.dll
c:\windows\system32\21810z5oj598.ocx
c:\windows\system32\21bfspy9a5e167z.dll
c:\windows\system32\21fbthief99z5.bin
c:\windows\system32\21z4add95re2631.bin
c:\windows\system32\21z90s9am5ot7a4.exe
c:\windows\system32\2219downloz5er1682.exe
c:\windows\system32\22783not-a-9irusz5c.cpl
c:\windows\system32\22890zr9j795.ocx
c:\windows\system32\2298viruz5d7.ocx
c:\windows\system32\2385z59oj4d3.exe
c:\windows\system32\241z3s59b.dll
c:\windows\system32\245659pz2c5.dll
c:\windows\system32\246419i5uz514.ocx
c:\windows\system32\2469ddware3550z.exe
c:\windows\system32\24z9s5arse2689.bin
c:\windows\system32\25139spambzt55.exe
c:\windows\system32\2517zn5t-a-9irus26.dll
c:\windows\system32\252esp9rze2626.cpl
c:\windows\system32\2538spz259.bin
c:\windows\system32\25559ha5kzool4bb.exe
c:\windows\system32\2557notza-vir9s55c.ocx
c:\windows\system32\2559pamboz569.ocx
c:\windows\system32\2559stza52935.cpl
c:\windows\system32\257789pz71a.exe
c:\windows\system32\258859py6zd.exe
c:\windows\system32\25960t9zj525.bin
c:\windows\system32\25992t5zj1ac.exe
c:\windows\system32\259cspyware9z35.ocx
c:\windows\system32\25z74not9a-virus7cd.exe
c:\windows\system32\25z99troj5309.cpl
c:\windows\system32\26763no9za-virus725.exe
c:\windows\system32\26996troj2z5.exe
c:\windows\system32\27244s5ambo9791z.exe
c:\windows\system32\2790zn5t-a-virus29a.ocx
c:\windows\system32\27923trzj54e5.bin
c:\windows\system32\279259ir5sz3a.dll
c:\windows\system32\279zthief5994.cpl
c:\windows\system32\27cfspar5ez6739.ocx
c:\windows\system32\27z43t5oj6799.ocx
c:\windows\system32\28005not-azvi9us597.cpl
c:\windows\system32\28165aczto9l359.cpl
c:\windows\system32\282045oz-a-virus25e9.dll
c:\windows\system32\283edzwn9oad5r2208.ocx
c:\windows\system32\284z9vi5u9407.dll
c:\windows\system32\28595sp9mbot5z9.bin
c:\windows\system32\28916not-a-virzs52b.ocx
c:\windows\system32\28931h5cztool7ef.cpl
c:\windows\system32\28bdv59z924.cpl
c:\windows\system32\28z19s9a5bot243.exe
c:\windows\system32\2906dowz5oader208.cpl
c:\windows\system32\2908s5arsz567.exe
c:\windows\system32\29189nzt5a-virus35c.bin
c:\windows\system32\29325hack9oz53.ocx
c:\windows\system32\29423w5rm2z.cpl
c:\windows\system32\2945back5zor1965.ocx
c:\windows\system32\29603hackt9oz54.dll
c:\windows\system32\296859orm6c5z.cpl
c:\windows\system32\29788n5t-a-virusz99.cpl
c:\windows\system32\29825zp9mbot84.exe
c:\windows\system32\2989ownlozde51682.dll
c:\windows\system32\29966z5oj499.exe
c:\windows\system32\299z2wo5m13f9.cpl
c:\windows\system32\2a5cspywa9e1248z.ocx
c:\windows\system32\2a97vir225z.ocx
c:\windows\system32\2ae39parse55z9.cpl
c:\windows\system32\2az95hief1859.exe

c:\windows\system32\2bzfbackdoo59359.ocx
c:\windows\system32\2e75thiez2990.dll
c:\windows\system32\2ezdv95575.cpl
c:\windows\system32\2f13d9znloader3235.exe
c:\windows\system32\2z505hackt9ol2b5.cpl
c:\windows\system32\2z745tr9j59d.bin
c:\windows\system32\2z839worm51c.exe
c:\windows\system32\2zebbackdo592794.ocx
c:\windows\system32\2zf59hief2281.ocx
c:\windows\system32\3005backdzo92315.dll
c:\windows\system32\30345spamb9t4bz.bin
c:\windows\system32\303599iru543z.bin
c:\windows\system32\3048zspambo5639.bin
c:\windows\system32\30554spam9zt337.ocx
c:\windows\system32\30566s9yz1c.exe
c:\windows\system32\30859izu57aa.exe
c:\windows\system32\308695roj3z9.bin
c:\windows\system32\30921vir5s69z.cpl
c:\windows\system32\309329ot-a-zirus4a5.exe
c:\windows\system32\31706hack5oolz96.dll
c:\windows\system32\31904not-a-vi9uszb65.cpl
c:\windows\system32\323z69ot-a5virus1a5.dll
c:\windows\system32\32511szamb5t799.bin
c:\windows\system32\3435b5czdo9r3148.exe
c:\windows\system32\34379ackzoo53140.dll
c:\windows\system32\344athrea929578z.cpl
c:\windows\system32\3538stezl1589.ocx
c:\windows\system32\35569not-a-vzr9s27b.cpl
c:\windows\system32\3559zorm9b75.bin
c:\windows\system32\35726viru963z.cpl
c:\windows\system32\35891vizus7d0.ocx
c:\windows\system32\35z5virus6e9.dll
c:\windows\system32\3637t5zj74d9.cpl
c:\windows\system32\3676spz59re150.dll
c:\windows\system32\37d9sparsz1451.dll
c:\windows\system32\3842d5wn9zader2807.bin
c:\windows\system32\3919stezl2563.ocx
c:\windows\system32\39dza5dw9re1897.exe
c:\windows\system32\39z5backdoor3221.cpl
c:\windows\system32\3a4csp9zare19795.dll
c:\windows\system32\3aa6z9yware5533.cpl
c:\windows\system32\3b33tzie519569.exe
c:\windows\system32\3b5esteal49z9.ocx
c:\windows\system32\3d0csteal5z9.bin
c:\windows\system32\3dz45t9al1284.dll
c:\windows\system32\3e37tzief5995.cpl
c:\windows\system32\3e73backdo9rz05.bin
c:\windows\system32\3efbdownlo5dez293.dll
c:\windows\system32\3f55viz31689.dll
c:\windows\system32\3f95dzwnloade91867.exe
c:\windows\system32\3ffspz9are1285.exe
c:\windows\system32\3z0spywa5e9598.exe
c:\windows\system32\3z957spa9bot259.exe
c:\windows\system32\415zsteal1079.bin
c:\windows\system32\421zdownloade5319.ocx
c:\windows\system32\4255thzef3229.exe
c:\windows\system32\432zt5i9f919.cpl
c:\windows\system32\44695pywaze1737.exe
c:\windows\system32\45169ir1552z.cpl
c:\windows\system32\4545zdd5ar934.ocx
c:\windows\system32\459fstea910z6.ocx
c:\windows\system32\45zbbackdo5r27569.bin
c:\windows\system32\4739d9wzloade5455.cpl
c:\windows\system32\4859zp597.exe
c:\windows\system32\49e5threaz11494.dll
c:\windows\system32\49f1t5izf3128.ocx
c:\windows\system32\49zp97be5.dll
c:\windows\system32\4eb8thiez29495.bin
c:\windows\system32\4f8cz5arse1194.ocx
c:\windows\system32\4za8d9wnlo5der734.exe
c:\windows\system32\503259roj7fz.cpl
c:\windows\system32\504dowzloa5er9270.bin
c:\windows\system32\50zcvir3589.bin
c:\windows\system32\5105s5am9ot3z6.cpl
c:\windows\system32\5119spar5e1z32.exe
c:\windows\system32\5158bac5doorz9.bin
c:\windows\system32\5195z9eal1871.exe
c:\windows\system32\52795szy5db.dll
c:\windows\system32\5308steal3191z.dll
c:\windows\system32\5352ste9lz95.cpl
c:\windows\system32\53920virzs51f.bin
c:\windows\system32\5420h9cktoolfz5.dll
c:\windows\system32\5457backz9or2097.exe
c:\windows\system32\5458virz9365.cpl
c:\windows\system32\5497bazkd5or1845.dll
c:\windows\system32\5497steal2z09.bin
c:\windows\system32\54c9threatz2225.cpl
c:\windows\system32\55390wozm30e.dll
c:\windows\system32\558vir99z9.ocx
c:\windows\system32\559aspywaze2306.dll
c:\windows\system32\55c9backzoor9026.bin
c:\windows\system32\55csze5l1069.bin
c:\windows\system32\55z10troj6a9.dll
c:\windows\system32\565czhie57369.bin
c:\windows\system32\566z4spy9aa.dll
c:\windows\system32\56f4zir1597.ocx
c:\windows\system32\571z6virus469.bin
c:\windows\system32\57237wzr9514.exe
c:\windows\system32\5738thr5at2984z.bin
c:\windows\system32\57549zr2514.ocx
c:\windows\system32\57z8s5y595.exe
c:\windows\system32\58efspyz5re299.ocx
c:\windows\system32\59053not-azvirus359.dll
c:\windows\system32\592ztroj247.dll
c:\windows\system32\597dzir459.cpl
c:\windows\system32\5989back5oor192z.cpl
c:\windows\system32\5a8dspywa5e95z1.dll
c:\windows\system32\5b5s5azse193.cpl
c:\windows\system32\5bd8zpyware699.dll
c:\windows\system32\5bdezpa59e432.cpl
c:\windows\system32\5bdzspywar918535.ocx
c:\windows\system32\5bzcadd95re3192.dll
c:\windows\system32\5cb8downlzader20799.dll
c:\windows\system32\5dd15h9eatz8962.cpl
c:\windows\system32\5e1fsp9rsz2052.cpl
c:\windows\system32\5ez5ste5l3119.ocx
c:\windows\system32\5f52threat59z96.dll
c:\windows\system32\5f9zs9arse506.ocx
c:\windows\system32\5z93spyware832.bin
c:\windows\system32\609bthi5f597z.exe
c:\windows\system32\6218a9dw5re96z.bin
c:\windows\system32\646fdow5loa9ez2625.cpl
c:\windows\system32\652caddware99z.bin
c:\windows\system32\6590wo9mzde5.bin
c:\windows\system32\65z49roj3c9.cpl
c:\windows\system32\663d5h9zf3112.bin
c:\windows\system32\66z75ot-a-virus9a4.cpl
c:\windows\system32\66zfthr9at5544.ocx
c:\windows\system32\6875spzware4199.exe
c:\windows\system32\696zdownlo9der3565.ocx
c:\windows\system32\6bz595r3151.ocx
c:\windows\system32\6c24baczd9or5218.cpl
c:\windows\system32\6c99th5ef15z3.cpl
c:\windows\system32\6d4zthre5t19873.dll
c:\windows\system32\6ea35tezl90.bin
c:\windows\system32\6eze9ir520.dll
c:\windows\system32\6ffczp95are99.cpl
c:\windows\system32\6z35troj795.dll
c:\windows\system32\705addwarez289.exe
c:\windows\system32\705d9wnloazer906.bin
c:\windows\system32\7281zot-a-5iru964f.bin
c:\windows\system32\72e1sparse5299z.bin
c:\windows\system32\7399v5z590.bin
c:\windows\system32\74019py5z3.dll
c:\windows\system32\74ca9za5se900.exe
c:\windows\system32\751zvir9569.ocx
c:\windows\system32\7555n9t-a-viruz17b.cpl
c:\windows\system32\7578addwa5e2z94.bin
c:\windows\system32\757eaddwar9z17.exe
c:\windows\system32\7593backd9or379z.bin
c:\windows\system32\7599ad9warez20.exe
c:\windows\system32\75ffbac5dzo91933.bin
c:\windows\system32\7645threatz09719.cpl
c:\windows\system32\76czdown5oad9r429.bin
c:\windows\system32\77d0th9e51044z.dll
c:\windows\system32\77d39hrea52z49.bin
c:\windows\system32\7895addware559z.exe
c:\windows\system32\7908sp5mzot7c8.cpl
c:\windows\system32\7971th5zf574.ocx
c:\windows\system32\7972downloadez2562.cpl
c:\windows\system32\797ezteal258.exe
c:\windows\system32\79b3add5arz1705.exe
c:\windows\system32\7bdezt5a92499.bin
c:\windows\system32\7fz5addwa9e1599.dll
c:\windows\system32\7z73h5cktoolf09.dll
c:\windows\system32\7z9avi932625.exe
c:\windows\system32\8281s95mboz29d.dll
c:\windows\system32\83749roj10z5.bin
c:\windows\system32\8555wz9m736.ocx
c:\windows\system32\8825trz595.ocx
c:\windows\system32\886ha9ktool1z85.dll
c:\windows\system32\8986viruszc5.exe
c:\windows\system32\91z5ad5ware1586.cpl
c:\windows\system32\93245virzs15b.exe
c:\windows\system32\932z3hackt5ol1e9.dll
c:\windows\system32\933cs5zal451.exe
c:\windows\system32\93445ownloader662z.dll
c:\windows\system32\9348spyza5e1693.cpl
c:\windows\system32\93915worm3z8.ocx
c:\windows\system32\93cadownloa5er4z5.dll
c:\windows\system32\94758hzcktool135.ocx
c:\windows\system32\9491hackto5z447.bin
c:\windows\system32\95048vzrus1fd5.bin
c:\windows\system32\951eaddzare229.ocx
c:\windows\system32\95290worm5b8z.exe
c:\windows\system32\9544n5z-a-virus5649.ocx
c:\windows\system32\954ztroj67d.exe
c:\windows\system32\9653spambot7az.ocx
c:\windows\system32\96726h5cktoolz7f.exe
c:\windows\system32\9709s9ambot75z.ocx
c:\windows\system32\97z5sparse983.exe
c:\windows\system32\982vzru9518.ocx
c:\windows\system32\9908ha5ktozl7c9.ocx
c:\windows\system32\9945ir951z.bin
c:\windows\system32\9a4cspywarez8575.ocx
c:\windows\system32\9a73spy5zre972.dll
c:\windows\system32\9f25zhief1595.bin
c:\windows\system32\ad6addwarez9815.cpl
c:\windows\system32\ae2spy5are39z9.bin
c:\windows\system32\bce5zwnload9r2869.bin
c:\windows\system32\bszip.dll
c:\windows\system32\cfz9teal13915.exe
c:\windows\system32\dc3spywa5z9751.dll
c:\windows\system32\dfhkj.bak1
c:\windows\system32\dfhkj.ini
c:\windows\system32\e4bdo5nloa9er80z.dll
c:\windows\system32\e55ste9lz19.dll
c:\windows\system32\e5zaddware2259.ocx
c:\windows\system32\ea7t5i9f62z.dll
c:\windows\system32\f0add5are95z.exe
c:\windows\system32\f5dviz16239.cpl
c:\windows\system32\f77z5ie9153.cpl
c:\windows\system32\fb25z93019.ocx
c:\windows\system32\fmojsjsn.ini
c:\windows\system32\gpknbsdn.ini
c:\windows\system32\hdfxptpg.ini
c:\windows\system32\jeglyxcf.ini
c:\windows\system32\kjjlm.bak1
c:\windows\system32\kjjlm.bak2
c:\windows\system32\kjjlm.tmp
c:\windows\system32\kvnsipki.ini
c:\windows\system32\OpqAaccf.ini
c:\windows\system32\OpqAaccf.ini2
c:\windows\system32\ptyafjpg.ini
c:\windows\system32\setup2.exe
c:\windows\system32\sfjjbyhd.ini
c:\windows\system32\smhvmlbn.ini
c:\windows\system32\stera.log
c:\windows\system32\wfimlngb.ini
c:\windows\system32\winpfz32.sys
c:\windows\system32\ycbeg.bak1
c:\windows\system32\ycbeg.ini
c:\windows\system32\z0055wor94a8.ocx
c:\windows\system32\z0556worm69e9.cpl
c:\windows\system32\z1398sp9315.ocx
c:\windows\system32\z25st5a9215.cpl
c:\windows\system32\z2905not-a-virus4af9.ocx
c:\windows\system32\z305spyware9375.cpl
c:\windows\system32\z4921tro52289.ocx
c:\windows\system32\z4953spy5c9.cpl
c:\windows\system32\z50bs5ea92816.exe
c:\windows\system32\z5208tro55da9.bin
c:\windows\system32\z5637not5a-vir9s434.exe
c:\windows\system32\z6310troj659.dll
c:\windows\system32\z6544hackt5o979b.exe
c:\windows\system32\z6754spa9b5t194.exe
c:\windows\system32\z83back5oor9765.cpl
c:\windows\system32\z8562s5y42f9.ocx
c:\windows\system32\z8979parse31255.cpl
c:\windows\system32\z8992spambot395.cpl
c:\windows\system32\z9101v95us142.dll
c:\windows\system32\z951thief5987.dll
c:\windows\system32\z991tr5j109.exe
c:\windows\system32\ze6e9ownloade5833.cpl
c:\windows\system32\zf2threat55929.bin
c:\windows\system32\zfe9downloader2653.ocx
c:\windows\z0599w5rm2d4.dll
c:\windows\z0940s9ambot885.dll
c:\windows\z095s5eal40.cpl
c:\windows\z165s5am9ot342.ocx
c:\windows\z209wo9m2895.exe
c:\windows\z251395rm5e9.ocx
c:\windows\z2f5thie911415.cpl
c:\windows\z4205not5a-virus59d.ocx
c:\windows\z51825pamb9t404.exe
c:\windows\z55429orm567.cpl
c:\windows\z729no5-9-virus372.exe
c:\windows\z864virus7695.cpl
c:\windows\z9062spambot955.cpl
c:\windows\z9868n59-a-virus20e.cpl
c:\windows\zadthr9at18475.cpl

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSQPDXSERV.SYS
-------\Service_msqpdxserv.sys


((((((((((((((((((((((((( Files Created from 2009-05-12 to 2009-06-12 )))))))))))))))))))))))))))))))
.

2009-06-12 14:02 . 2009-06-12 14:01 410984 ----a-w- c:\windows\system32\deploytk.dll
2009-06-12 14:00 . 2009-06-12 14:00 152576 ----a-w- c:\documents and settings\Lauren\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-06-12 05:25 . 2009-06-12 05:25 -------- d-----w- c:\documents and settings\Lauren\Application Data\Malwarebytes
2009-06-12 05:25 . 2009-05-26 17:20 40160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-12 05:25 . 2009-06-12 05:25 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-06-12 05:25 . 2009-05-26 17:19 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-12 05:25 . 2009-06-12 05:25 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-12 04:48 . 2009-06-12 04:48 69120 ----a-w- c:\windows\system32\drivers\imqipmtivfviobvo.sys
2009-06-09 18:39 . 2009-06-09 18:39 -------- d-----w- c:\program files\Common Files\Hewlett-Packard
2009-06-09 18:38 . 2004-08-04 02:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
2009-06-09 18:38 . 2004-08-04 02:58 15104 ----a-w- c:\windows\system32\dllcache\usbscan.sys
2009-06-09 18:31 . 2009-06-09 18:31 -------- d-----w- c:\program files\HP
2009-06-09 18:28 . 2009-06-09 18:40 103509 ----a-w- c:\windows\hpoins04.dat
2009-06-09 18:28 . 2004-06-22 12:04 17176 ------w- c:\windows\hpomdl04.dat
2009-06-09 18:28 . 2009-06-09 18:28 -------- d-----w- c:\temp\HP_WebRelease
2009-06-09 04:12 . 2009-06-07 20:24 180224 ----a-w- c:\windows\system32\xvidvfw.dll
2009-06-09 04:12 . 2009-06-07 20:16 819200 ----a-w- c:\windows\system32\xvidcore.dll
2009-06-09 04:12 . 2009-06-09 04:12 -------- d-----w- c:\program files\Xvid

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-12 15:05 . 2008-05-23 00:36 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-06-12 15:05 . 2008-05-23 00:36 -------- d-----w- c:\program files\Symantec
2009-06-12 15:05 . 2008-05-23 00:36 -------- d-----w- c:\program files\Symantec AntiVirus
2009-06-12 15:05 . 2008-05-23 00:36 -------- d-----w- c:\documents and settings\All Users\Application Data\Symantec
2009-06-12 14:01 . 2005-08-27 16:11 -------- d-----w- c:\program files\Java
2009-06-10 13:55 . 2005-10-29 17:35 -------- d-----w- c:\documents and settings\Lauren\Application Data\AdobeUM
2009-06-09 18:16 . 2008-10-09 17:28 -------- d-----w- c:\program files\Last.fm
2007-08-30 01:05 . 2007-08-29 01:59 246 ----a-w- c:\program files\Common Files\lavu
2007-08-21 04:25 . 2007-08-19 23:31 246 ----a-w- c:\program files\Common Files\lavu779
2007-07-28 09:06 . 2007-06-14 19:55 135 ----a-w- c:\program files\Common Files\profsy.html
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"DellSupport"="c:\program files\DellSupport\DSAgnt.exe" [2007-03-15 460784]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-05 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Dell Wireless Manager UI"="c:\windows\system32\WLTRAY" [X]
"Apoint"="c:\program files\Apoint\Apoint.exe" [2004-09-13 155648]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2005-02-15 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2005-02-15 126976]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-12 148888]
"Dell QuickSet"="c:\program files\Dell\QuickSet\quickset.exe" [2005-03-04 606208]
"DVDLauncher"="c:\program files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 53248]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-12-06 127035]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"dscactivate"="c:\program files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 16384]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-10-06 185872]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-09-06 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-10-01 289576]
"NWTRAY"="NWTRAY.EXE" - c:\windows\system32\nwtray.exe [2002-03-12 28672]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - c:\program files\Digital Line Detect\DLG.exe [2005-8-27 24576]
dlbcserv.lnk - c:\program files\Dell Photo Printer 720\dlbcserv.exe [2005-9-6 315392]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-11-11 806912]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"CompatibleRUPSecurity"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\WINDOWS\\system32\\LEXPPS.EXE"=
"c:\\StubInstaller.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Java\\jre1.5.0_03\\bin\\javaw.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [3/1/2007 11:56 PM 24652]

--- Other Services/Drivers In Memory ---

*Deregistered* - Ndisprot.sys
.
Contents of the 'Scheduled Tasks' folder

2009-06-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 16:34]
.
- - - - ORPHANS REMOVED - - - -

BHO-{926C75F1-6ABD-4188-9BF9-DA1C1C936FF4} - (no file)
HKCU-Run-Aim6 - (no file)
Notify-NavLogon - (no file)


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = hxxp://www.dell4me.com/myway
uInternet Settings,ProxyOverride = *.local
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: &Search
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\Office10\EXCEL.EXE/3000
Trusted Zone: microsoft.com \*.windowsupdate
Trusted Zone: windowsupdate.com
FF - ProfilePath -
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-12 11:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(824)
c:\windows\system32\NETWIN32.DLL

- - - - - - - > 'explorer.exe'(656)
c:\progra~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
c:\windows\system32\shdoclc.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\WLTRYSVC.EXE
c:\windows\system32\BCMWLTRY.EXE
c:\windows\system32\LEXBCES.EXE
c:\program files\Lavasoft\Ad-Aware 2007\aawservice.exe
c:\windows\system32\LEXPPS.EXE
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Dell\NicConfigSvc\NicConfigSvc.exe
c:\windows\system32\CF19173.exe
c:\windows\system32\WLTRAY.EXE
c:\program files\Apoint\ApntEx.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Viewpoint\Viewpoint Manager\ViewMgr.exe
c:\windows\SoftwareDistribution\Download\a37ea2d49e8a7659886ac76c226cad7d\update\update.exe
.
**************************************************************************
.
Completion time: 2009-06-12 11:22 - machine was rebooted
ComboFix-quarantined-files.txt 2009-06-12 15:22

Pre-Run: 5,444,366,336 bytes free
Post-Run: 5,296,271,360 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

Current=2 Default=2 Failed=3 LastKnownGood=4 Sets=1,2,3,4
854 --- E O F --- 2008-11-16 02:11

Hello.
Before removing the leftovers, I want to get an uninstall list.

• Open HijackThis.
  
• When Hijack This opens, click "Open the Misc Tools section"
  
• Then select "Open Uninstall Manager"
  
• Click on "Save List..." (generates uninstall_list.txt)
  
• Click Save, copy and paste the results in your next post.
  

Adobe Acrobat - Reader 6.0.2 Update
Adobe Flash Player 10 Plugin
Adobe Flash Player ActiveX
Adobe Reader 6.0.1
AIM 6
ALPS Touch Pad Driver
AOLIcon
Apple Mobile Device Support
Apple Software Update
Bonjour
Broadcom Management Programs 2
CCleaner (remove only)
Conexant D110 MDC V.9x Modem
Dell Driver Reset Tool
Dell Photo Printer 720
Dell Photo Printer 720 Logger
Dell Picture Studio v3.0
Dell Support Center
Dell Wireless WLAN Card
DellSupport
Digital Line Detect
Google Toolbar for Internet Explorer
Google Toolbar for Internet Explorer
HijackThis 2.0.2
HP Image Zone 4.2
HP PSC & OfficeJet 4.2
Intel(R) Graphics Media Accelerator Driver for Mobile
Internal Network Card Power Management
Internet Explorer Default Page
iTunes
J2SE Runtime Environment 5.0 Update 3
Jasc Paint Shop Photo Album 5
Jasc Paint Shop Pro 8 Dell Edition
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 13
Last.fm 1.5.4.24567
LiveUpdate 3.1 (Symantec Corporation)
Macromedia Flash Player
Macromedia Shockwave Player
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Office XP Professional with FrontPage
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Modem Helper
Mozilla Firefox (3.0.11)
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Musicmatch for Windows Media Player
NetWaiting
NICI (Shared) U.S./Worldwide (128 bit) (2.7.3-1)
Novell Client for Windows
PowerDVD 5.5
QuickBooks Simple Start Special Edition
QuickSet
QuickTime
RealPlayer
Sonic DLA
Sonic RecordNow Audio
Sonic RecordNow Copy
Sonic RecordNow Data
Sonic Update Manager
Viewpoint Manager (Remove Only)
Viewpoint Media Player
WebCyberCoach 3.2 Dell
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Media Player 11
WinRAR archiver
WordPerfect Office 12



Thank you for everything. I will make a donation for sure when I can.

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

Adobe Reader 6.0.1
J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 13
Viewpoint Manager (Remove Only)
Viewpoint Media Player

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\program files\Common Files\lavu
  c:\program files\Common Files\lavu779
  c:\program files\Common Files\profsy.html
  
  :reg
  [HKEY_LOCAL_MACHINE\software\microsoft\security center]
  "AntiVirusOverride"=-
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.