Started with many virii, worms, adware that were hard to ID

The computer system starts up, gets to logins, allows selection of login, and logs off login. Safe Boot has no effect. Cannot run Task Manager. After running various tools from a boot CD, I bought an external enclosure so that I would be able to hook the drive up to a USB port on my main computer. That is where it is now as the H: and I: drives. I ran NIS 2009 and came up with the following three virii/worms: Backdoor.Rustock.B, Backdoor.Tidserv, and HackTool.Rootkit. These were incurable. Ran Multi Virus Cleaner 2009, Dr Web, and MBAM which seemed to clean up more problems. Ran NIS 2009 again and it showed no infections found. Tried reinstalling and rebooting problem computer, but results in same behavior as mentioned above. Again, attached to main computer and reran NIS 2009. Nothing found. Reran Dr Web and found SymXPep2Interface.vbs -- Probably script.virus. Then found you. Here is my HJT log, but I fear it only shows my main computer. I would like to try to keep my problem computer's stuff intact if at all possible. Thanks for any assistance you can provide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:43:34 AM, on 9/21/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16876)
Boot mode: Normal

Running processes:
C:\Windows\System32\smss.exe
C:\Windows\system32\winlogon.exe
C:\Windows\system32\services.exe
C:\Windows\system32\lsass.exe
C:\Windows\system32\svchost.exe
C:\Windows\System32\svchost.exe
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Windows\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\System32\drivers\CDAC11BA.EXE
C:\Windows\Cpqdiag\Cpqdfwag.exe
C:\Program Files\MATCO\DirmsService\DirmsService.exe
C:\Windows\System32\GEARSec.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Windows\system32\drivers\KodakCCS.exe
C:\Windows\System32\NMSSvc.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\nvsvc32.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Windows\StartupMonitor.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Windows\system32\taskswitch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\System32\svchost.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
D:\giveaway\Sticky Password\stpass.exe
G:\Spybot - Search & Destroy\TeaTimer.exe
G:\NBC Direct\DirectPlayerCore.exe
C:\Program Files\Pando Networks\Media Booster\pmb.exe
G:\program files\Reader 8\Reader\AcroRd32.exe
C:\Windows\System32\mmc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\Lavasoft\Ad-Aware\AAWService.exe
G:\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\L3MCTB42\launch[1].exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\z6m27r.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\ns39rXP.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
C:\Documents and Settings\Administrator\Desktop\winlogon.scr

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.compaq.com/1Q00CDT/0409/bl7.asp
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.r5.attbi.com:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {3B1191EE-EF43-4ADB-BF52-12D0A83F7727} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - G:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\common\yiesrvc.dll
O2 - BHO: Symantec NCO BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\IPSBHO.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [CoolSwitch] C:\Windows\system32\taskswitch.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Ad-Watch] G:\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "G:\program files\Reader 8\Reader\Reader_sl.exe"
O4 - HKLM\..\RunServices: [CPQDFWAG] C:\Windows\Cpqdiag\CpqDfwAg.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\Windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [StickyPassword] D:\giveaway\Sticky Password\stpass.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] G:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DirectPlayerCore] "G:\NBC Direct\DirectPlayerCore.exe"
O4 - HKLM\..\Policies\Explorer\Run: []

O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'ASPNET')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1006\..\RunOnce: [] (User 'ASPNET')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1007\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'admin')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1007\..\RunOnce: [] (User 'admin')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1008\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'kids')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1008\..\RunOnce: [] (User 'kids')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1009\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Eileen')
O4 - HKUS\S-1-5-21-919082819-2040581095-3719885985-1009\..\RunOnce: [] (User 'Eileen')
O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://G:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - G:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\YAHOO!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - G:\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\Windows\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: ComcastHSI - {0F11C315-352D-47EB-A383-2225BCA40D97} - http://www.comcast.net (file missing) (HKCU)
O9 - Extra button: Help - {45712049-617C-4945-8CB9-7A57CA190440} - http://www.comcast.net/memberservices/ (file missing) (HKCU)
O9 - Extra button: Support - {7D99D985-4E94-4116-A93B-E058C9024522} - http://www.comcastsupport.com (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.comcast.net
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2359626E-7524-4F87-B04E-22CD38A0C88C} (ICSScannerLight Class) - http://download.zonelabs.com/bin/free/cm/ICSCM.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper20073151.dll
O16 - DPF: {34F12AFD-E9B5-492A-85D2-40FA4535BE83} (AxProdInfoCtl Class) - http://www.symantec.com/techsupp/activedata/nprdtinf.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/20021205/qtinstall.info.apple.com/drakken/us/win/QuickTimeInstaller.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by104fd.bay104.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} - http://a1540.g.akamai.net/7/1540/52/20031216/qtinstall.info.apple.com/mickey/us/win/QuickTimeInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1163641890350
O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.ofoto.com/downloads/BUM/BUM_WIN_IE_1/axofupld.cab
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go.com/global/download/otoy/OTOYAX29b.cab
O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/promotions/spywaredetector/WebAAS.cab
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/FujifilmUploadClient.cab
O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/SSC/SharedContent/common/bin/cabsa.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install3.5/installer.exe
O16 - DPF: {F137B9BA-89EA-4B04-9C67-2074A9DF61FD} (Photo Upload Plugin Class) - http://cvs.pnimedia.com/upload/activex/v2_0_0_10/PCAXSetupv2.0.0.10.cab?
O16 - DPF: {FA91DF8D-53AB-455D-AB20-F2F023E498D3} (RSClientPrint Class) - http://216.82.118.77/ReportServer/Reserved.ReportViewerWebControl.axd?ExecutionID=5kolf5uwtgp5jmzm0yqmqzqb&ControlID=6a6e75a9-1957-4032-840e-c1141b6dfb15&Culture=1033&UICulture=9&ReportStack=1&OpType=PrintCab
O18 - Protocol: symres - {AA1061FE-6C41-421F-9344-69640C9732AB} - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\coIEPlg.dll
O18 - Filter: application/hta - {D962EF38-5FB0-4761-8638-C86F085E25E6} - (no file)
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O19 - User stylesheet: (file missing)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - C:\Windows\System32\drivers\CDAC11BA.EXE
O23 - Service: Compaq Remote Diagnostics Enabling Agent (CpqDfwWebAgent) - Compaq Computer Corporation - C:\Windows\Cpqdiag\Cpqdfwag.exe
O23 - Service: DirMS_Defragmentation - Unknown owner - C:\Program Files\MATCO\DirmsService\DirmsService.exe
O23 - Service: GEARSecurity - GEAR Software - C:\Windows\System32\GEARSec.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\Windows\system32\drivers\KodakCCS.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - G:\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: Pure Networks Net2Go Service (nmraapache) - Pure Networks, Inc. - C:\Program Files\Pure Networks\Network Magic\WebServer\bin\nmraapache.exe
O23 - Service: Pure Networks Platform Service (nmservice) - Pure Networks, Inc. - C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
O23 - Service: Intel(R) NMS (NMSSvc) - Intel Corporation - C:\Windows\System32\NMSSvc.exe
O23 - Service: Norton Internet Security - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\Windows\system32\nvsvc32.exe
O23 - Service: Check Point SecuRemote Service (SR_Service) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
O23 - Service: Check Point SecuRemote WatchDog (SR_WatchDog) - Check Point Software Technologies - C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
O23 - Service: V2i Protector - PowerQuest Corporation - C:\Program Files\PowerQuest\Drive Image 7.0\Agent\PQV2iSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\SYSTEM32\YPCSER~1.EXE
O24 - Desktop Component 0: (no name) - http://www.nickjr.com/kids_common/assets/pt_background.gif

--
End of file - 17821 bytes

Hello.

I notice that you have Spybot's TeaTimer running. While this is normally a wonderful tool to protect against hijackers, it can also interfere with HijackThis fixes. So please disable TeaTimer by doing the following:
1) Run Spybot-S&D
2) Go to the Mode menu, and make sure "Advanced Mode" is selected
3) On the left hand side, choose Tools -> Resident
4) Uncheck "Resident TeaTimer" and OK any prompts
You can reenable TeaTimer once your system is clean.

Please make sure Teatimer is disable before we do this, otherwise this fix will fail.

• Open HijackThis.
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O4 - HKLM\..\Policies\Explorer\Run: []
  
  O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'LOCAL SERVICE')
  O4 - HKUS\S-1-5-20\..\RunOnce: [] (User 'NETWORK SERVICE')
  O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM')
  O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user')
  O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Thank you, Belahzur, for your quick reply. I am running the scan now and will post the results when I get them.

Scan just completed. I did not take any action yet, because it appears to have found HJT:
Malwarebytes' Anti-Malware 1.41
Database version: 2837
Windows 5.1.2600 Service Pack 3

9/21/2009 10:03:36 AM
mbam-log-2009-09-21 (10-03-30).txt

Scan type: Quick Scan
Objects scanned: 128347
Time elapsed: 11 minute(s), 8 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Documents and Settings\Administrator\Desktop\winlogon.scr (Heuristics.Reserved.Word.Exploit) -> No action taken.

DDS (Ver_09-07-30.01) - FAT32x86
Run by Administrator at 13:43:44.33 on Mon 09/21/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.271 [GMT -5:00]

FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}

============== Running Processes ===============

C:\Windows\system32\svchost -k DcomLaunch
C:\Windows\system32\svchost -k rpcss
C:\Windows\System32\svchost.exe -k netsvcs
C:\Windows\System32\svchost.exe -k LocalService
C:\WINDOWS\SYSTEM32\ZONELABS\vsmon.exe
C:\Windows\system32\spoolsv.exe
C:\Windows\System32\svchost.exe -k LocalService
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Windows\System32\drivers\CDAC11BA.EXE
C:\Windows\Cpqdiag\Cpqdfwag.exe
C:\Program Files\MATCO\DirmsService\DirmsService.exe
C:\Windows\System32\GEARSec.exe
C:\Windows\system32\inetsrv\inetinfo.exe
C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Windows\system32\drivers\KodakCCS.exe
C:\Windows\System32\NMSSvc.exe
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Windows\system32\nvsvc32.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_WatchDog.exe
C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
C:\Windows\Explorer.EXE
C:\Program Files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEAKSYSTEMTRAY.EXE
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\Windows\StartupMonitor.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\alg.exe
C:\Program Files\CheckPoint\SecuRemote\bin\SR_GUI.Exe
C:\Windows\system32\taskswitch.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Windows\system32\ctfmon.exe
C:\Windows\System32\svchost.exe -k HTTPFilter
C:\Program Files\CheckPoint\SecuRemote\bin\SR_Service.exe
D:\giveaway\Sticky Password\stpass.exe
G:\NBC Direct\DirectPlayerCore.exe
C:\Program Files\Pando Networks\Media Booster\pmb.exe
G:\program files\Reader 8\Reader\AcroRd32.exe
C:\Windows\System32\mmc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
G:\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\System32\wbem\unsecapp.exe
G:\Lavasoft\Ad-Aware\AAWTray.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\L3MCTB42\launch[1].exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\z6m27r.exe
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\RarSFX0\ns39rXP.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\YAHOO!\browser\ycommon.exe
C:\WINDOWS\system32\mstsc.exe
C:\Program Files\JGsoft\EditPadLite\EditPad.exe
C:\Program Files\Mozilla Firefox3\firefox.exe
G:\program files\mbam\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\CyberAC Software\NotePadXP\NotePadXP.exe
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\3NZGD26B\dds[1].scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://google.com/
uSearch Page = hxxp://www.google.com
uWindow Title = Microsoft Internet Explorer provided by Comcast
uSearch Bar = hxxp://www.google.com/ie
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = hxxp://go.compaq.com/1Q00CDT/0409/bl7.asp
uInternet Settings,ProxyServer = sas.r5.attbi.com:8000
uInternet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
mSearchAssistant = hxxp://www.google.com/ie
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {3B1191EE-EF43-4ADB-BF52-12D0A83F7727} - No File
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - g:\spybot~1\SDHelper.dll
BHO: Yahoo! IE Services Button: {5bab4b5b-68bc-4b02-94d6-2fc0de4a7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
BHO: Symantec NCO BHO: {602adb0e-4aff-4217-8aa1-95dac4dfa408} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
BHO: Symantec Intrusion Prevention: {6d53ec84-6aae-4787-aeee-f4628f01010c} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\IPSBHO.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.3.4501.1418\swg.dll
BHO: Google Dictionary Compression sdch: {c84d72fe-e17d-4195-bb24-76c02e2e7c4e} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: ZoneAlarm Spy Blocker BHO: {f0d4b231-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\1.bin\SPYBLOCK.DLL
BHO: SidebarAutoLaunch Class: {f2aa9440-6328-4933-b7c9-a6ccdf9cbf6d} - c:\program files\yahoo!\browser\YSidebarIEBHO.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn1\yt.dll
TB: ZoneAlarm Spy Blocker: {f0d4b239-da4b-4daf-81e4-dfee4931a4aa} - c:\program files\zonealarmsb\bar\1.bin\SPYBLOCK.DLL
TB: Norton Toolbar: {7febefe3-6b19-4349-98d2-ffb09d4b49ca} - c:\program files\norton internet security\norton internet security\engine\16.7.2.11\coIEPlg.dll
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [StickyPassword] d:\giveaway\sticky password\stpass.exe
uRun: [DirectPlayerCore] "g:\nbc direct\DirectPlayerCore.exe"
mRun: [CPQEASYACC] c:\program files\compaq\easy access button support\StartEAK.exe
mRun: [Run StartupMonitor] StartupMonitor.exe
mRun: [Acronis True Image Monitor] "c:\program files\acronis\trueimage\TrueImageMonitor.exe"
mRun: [Acronis Scheduler2 Service] "c:\program files\common files\acronis\schedule2\schedhlp.exe"
mRun: [CoolSwitch] c:\windows\system32\taskswitch.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe"
mRun: [Ad-Watch] g:\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "g:\program files\reader 8\reader\Reader_sl.exe"
mRunOnce: [Malwarebytes' Anti-Malware] g:\program files\mbam\malwarebytes' anti-malware\mbamgui.exe /install /silent
mRunServices: [CPQDFWAG] c:\windows\cpqdiag\CpqDfwAg.exe
StartupFolder: c:\docume~1\admini~1\startm~1\programs\startup\erunta~1.lnk - c:\program files\erunt\AUTOBACK.EXE
uPolicies-explorer: SpecifyDefaultButtons = 0 (0x0)
uPolicies-explorer: NoViewOnDrive = 0 (0x0)
uPolicies-system: HideFastUserSwitching = 0 (0x0)
IE: E&xport to Microsoft Excel - g:\progra~1\micros~1\office12\EXCEL.EXE/3000
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\jp2iexp.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - g:\progra~1\micros~1\office12\ONBttnIE.dll
IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\progra~1\yahoo!\common\yiesrvc.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - g:\progra~1\micros~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - g:\spybot~1\SDHelper.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\admini~1\applic~1\mozilla\firefox\profiles\cg4ym9cr.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Ask.com (Virtus Designs)
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\coffplgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\ipsffplgn\components\IPSFFPl.dll
FF - component: d:\giveaway\sticky password\spautofill\components\SPAutofill.dll
FF - plugin: c:\documents and settings\administrator\application data\idm\bin\flash\platform\winnt\plugins\npidmdcp.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\cg4ym9cr.default\extensions\{e2883e8f-472f-4fb0-9522-ac9bf37916a7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\administrator\application data\mozilla\firefox\profiles\cg4ym9cr.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp07074039.dll
FF - plugin: c:\program files\google\google updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\k-lite codec pack\real\browser\plugins\nprpjplug.dll
FF - plugin: g:\nbc direct\npDirectPlayerMozilla.dll
FF - plugin: g:\program files\reader 8\reader\browser\nppdf32.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox3\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\mozilla firefox3\greprefs\all.js - pref("dom.storage.default_quota", 5120);
c:\program files\mozilla firefox3\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\mozilla firefox3\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\mozilla firefox3\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\mozilla firefox3\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\mozilla firefox3\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\mozilla firefox3\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\mozilla firefox3\greprefs\all.js - pref("geo.enabled", true);
c:\program files\mozilla firefox3\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\mozilla firefox3\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\mozilla firefox3\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.history", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.cache", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\mozilla firefox3\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");

============= SERVICES / DRIVERS ===============

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [2003-4-3 9344]
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [2009-4-8 40496]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-4-11 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2008-9-1 28544]
R0 RVSDISK;RVSDISK;c:\windows\system32\drivers\RVSDISK.sys [2008-4-26 11904]
R0 RVSYSTEM;RVSYSTEM;c:\windows\system32\drivers\RVSYSTEM.sys [2008-4-26 38272]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\nis\1007020.00b\SymEFA.sys [2009-8-31 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\nis\1007020.00b\BHDrvx86.sys [2009-8-31 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\nis\1007020.00b\cchpx86.sys [2009-8-31 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\ipsdefs\20090916.003\IDSXpx86.sys [2009-9-16 329080]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [2008-3-28 95592]
R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2007-6-23 353672]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;d:\giveaway\astra32\astra32.sys [2007-2-22 30864]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [2003-4-3 454144]
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;c:\windows\cpqdiag\CPQDFWAG.EXE [2003-3-22 212992]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\common files\intuit\update service\IntuitUpdateService.exe [2008-10-10 13088]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\lavasoft\ad-aware\AAWService.exe [2009-3-9 1029456]
R2 Norton Internet Security;Norton Internet Security;c:\program files\norton internet security\norton internet security\engine\16.7.2.11\ccSvcHst.exe [2009-8-31 117640]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [2006-8-23 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [2006-8-23 670128]
R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-8-27 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [2006-8-23 2041904]
R3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2009-9-17 38224]
R3 NAVENG;NAVENG;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090921.002\NAVENG.SYS [2009-9-21 84912]
R3 NAVEX15;NAVEX15;c:\documents and settings\all users\application data\norton\{0c55c096-0f1d-4f28-aaa2-85ef591126e7}\norton\definitions\virusdefs\20090921.002\NAVEX15.SYS [2009-9-21 1323568]
S0 PQV2i;PQV2i; [x]
S1 PQIMount;PQIMount; [x]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\system32\svchost.exe -k getPlusHelper [2001-8-18 14336]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [2006-8-23 14924]

============== File Associations ===============

inffile=c:\windows\$ntservicepackuninstall$\notepad.exe %1

=============== Created Last 30 ================

2009-09-17 17:21 38,224 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 17:21 19,160 a------- c:\windows\system32\drivers\mbam.sys
2009-09-09 11:07 153,088 -------- c:\windows\system32\dllcache\triedit.dll

==================== Find3M ====================

2009-08-31 18:01 124,976 a------- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-31 18:01 60,808 a------- c:\windows\system32\S32EVNT1.DLL
2009-08-31 18:01 7,456 a------- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-31 18:01 806 a------- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-22 02:21 36,400 a----r-- c:\windows\system32\drivers\SymIM.sys
2009-08-13 10:16 512,000 -------- c:\windows\system32\dllcache\jscript.dll
2009-08-05 04:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-08-05 04:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll
2009-07-19 08:33 3,597,824 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-19 08:33 6,067,200 -------- c:\windows\system32\dllcache\ieframe.dll
2009-07-17 14:01 58,880 a------- c:\windows\system32\atl.dll
2009-07-17 14:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 10,841,088 -------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 -------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-10 08:27 1,315,328 -------- c:\windows\system32\dllcache\msoe.dll
2009-06-29 06:07 70,656 -------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-29 06:07 13,824 -------- c:\windows\system32\dllcache\ieudinit.exe
2009-06-29 03:35 634,632 -------- c:\windows\system32\dllcache\iexplore.exe
2009-06-29 03:33 2,452,872 -------- c:\windows\system32\dllcache\ieapfltr.dat
2009-06-29 03:33 161,792 -------- c:\windows\system32\dllcache\ieakui.dll
2009-06-25 03:25 730,112 a------- c:\windows\system32\lsasrv.dll
2009-06-25 03:25 301,568 a------- c:\windows\system32\kerberos.dll
2009-06-25 03:25 147,456 a------- c:\windows\system32\schannel.dll
2009-06-25 03:25 136,192 a------- c:\windows\system32\msv1_0.dll
2009-06-25 03:25 56,832 a------- c:\windows\system32\secur32.dll
2009-06-25 03:25 54,272 a------- c:\windows\system32\wdigest.dll
2009-06-25 03:25 730,112 -------- c:\windows\system32\dllcache\lsasrv.dll
2009-06-25 03:25 301,568 -------- c:\windows\system32\dllcache\kerberos.dll
2009-06-25 03:25 147,456 -------- c:\windows\system32\dllcache\schannel.dll
2009-06-25 03:25 136,192 -------- c:\windows\system32\dllcache\msv1_0.dll
2009-06-25 03:25 56,832 -------- c:\windows\system32\dllcache\secur32.dll
2009-06-25 03:25 54,272 -------- c:\windows\system32\dllcache\wdigest.dll
2009-06-24 06:18 92,928 -------- c:\windows\system32\dllcache\ksecdd.sys
2009-03-09 01:15 81,920 a------- c:\docume~1\admini~1\applic~1\ezpinst.exe
2009-03-09 01:15 47,360 a------- c:\docume~1\admini~1\applic~1\pcouffin.sys
2003-04-12 15:49 723 a------- c:\program files\INSTALL.LOG
2008-09-13 09:38 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008091320080914\index.dat
2007-05-03 09:59 16,384 a--sh--- c:\windows\temp\cookies\index.dat
2007-05-03 09:59 16,384 a--sh--- c:\windows\temp\history\history.ie5\index.dat
2007-05-03 09:59 32,768 a--sh--- c:\windows\temp\temporary internet files\content.ie5\index.dat

============= FINISH: 13:45:38.19 ===============

Hello.
That log looks fine.

Can you post attach.txt? there is one thing I need to see from that log.

Two questions. One, should it be zipped and attached as it says? Two, it looks like all this has been diagnosing my main computer and not the bootable drive that I have piggybacked and that I mentioned at the beginning of my post (which was a separate computer's hard drive that had the issues). Am I wrong? I just would hate to see you going through all this work and not getting what you really need to diagnose it. Thanks!

No, your not wrong.
Just I had to make sure the machine was okay first, I can't know what's on the bootable external drive, if it's bad, it may screw the machine up even worse.

Is the bootable drive a USB drive?

Yes. It is a SATA hard drive that I have put into an external enclosure that has a USB 2.0 interface. By the way, I did experience a system panic yesterday on my main computer that resulted in an immediate shutdown (i.e. crash). I removed the external hard drive and rebooted the main machine and let it go through the chkdsk procedure. It found a few files that were either cross-linked or had allocation issues, which it resolved. Normal boot-up continued and I seem to be OK (I am using it now). I have not attached the USB external yet. At this point, I will wait until I hear back from you. And, as always, thanks for your help. Do you still need the attach.txt file? If so, should I zip and attach it or just post it?

Last edited by robs27 on 24th September 2009, 3:05 am; edited 1 time in total (Reason for editing : Appending info to it)

Hi Belahzur,

I know you are very busy and have a lot going but I would like to know if there is anything I can do (when I get the time to work on it, too!) that will help move this issue along? My main computer's system panic was apparently caused by me denying Firefox to act as a server. I still have not reattached the other machine's hard drive. Any direction you can provide would be great. Please see my previous post's last few sentences for questions that I was hoping to get answers for. Thank you!

Hello.
Sorry for the delay; your post got overlooked. Please attach the external USB device.

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Sorry, Belahzur, for taking so long. Here are the results of combofix.

ComboFix 09-10-06.03 - Administrator 10/07/2009 1:26.1.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.934 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\recycled\NPROTECT
c:\windows\Installer\12aecf.msi
c:\windows\Installer\14b38b.msi
c:\windows\Installer\3447c.msp
c:\windows\Installer\38b385.msp
c:\windows\Installer\eb54b.msp
c:\windows\system32\Cache
c:\windows\system32\com.dll
c:\windows\winini.exe
G:\autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-09-07 to 2009-10-07 )))))))))))))))))))))))))))))))
.

2009-10-07 06:15 . 2009-10-07 06:15 -------- d-----w- C:\Combo-Fix
2009-10-03 19:51 . 2009-10-03 19:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\JGsoft
2009-10-02 05:17 . 2009-10-02 05:17 -------- d-----w- c:\windows\LastGood
2009-09-28 07:47 . 2009-09-28 07:47 -------- d-----w- C:\FOUND.003
2009-09-22 19:47 . 2009-09-22 19:47 -------- d-----w- C:\FOUND.002
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-17 04:36 . 2009-09-17 04:36 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\program files\NOS
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-09 16:07 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 23:01 . 2009-03-17 04:02 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-31 23:01 . 2009-03-17 04:02 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-31 23:01 . 2009-03-17 04:02 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-31 23:01 . 2009-03-17 04:02 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-22 07:21 . 2009-03-17 04:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-18 04:19 . 2004-03-17 04:19 36328 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 00:24 . 2005-01-04 03:40 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2005-01-04 03:40 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2003-03-26 02:49 53472 ----a-w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2003-03-26 02:46 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2005-01-04 03:59 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2006-11-17 02:45 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 00:23 . 2005-05-26 09:19 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 00:23 . 2003-03-26 02:49 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2003-05-07 03:44 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 20:07 . 2009-08-03 20:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 20:07 . 2009-08-03 20:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 20:07 . 2009-08-03 20:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-07-17 19:01 . 2003-03-26 02:46 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2003-03-26 03:52 286208 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StickyPassword"="d:\giveaway\Sticky Password\stpass.exe" [2007-05-19 1303040]
"DirectPlayerCore"="g:\nbc direct\DirectPlayerCore.exe" [2009-03-25 1150016]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"FlashPlayerUpdate"="c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2009-07-18 257440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPQEASYACC"="c:\program files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 32768]
"Acronis True Image Monitor"="c:\program files\Acronis\TrueImage\TrueImageMonitor.exe" [2005-07-06 419408]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2005-07-06 69632]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Ad-Watch"="g:\lavasoft\Ad-Aware\AAWTray.exe" [2009-09-22 520024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="g:\program files\Reader 8\Reader\Reader_sl.exe" [2008-10-15 39792]
"Run StartupMonitor"="StartupMonitor.exe" - c:\windows\StartupMonitor.exe [2000-05-20 86016]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-3-6 38912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2004-07-14 03:14 24673 ----a-w- c:\windows\system32\ckpNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"PROMon.exe"=PROMon.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Smapp"=c:\program files\Analog Devices\SoundMAX\Smtray.exe
"Symantec NetDriver Monitor"=c:\progra~1\SYMNET~1\SNDMon.exe /Consumer
"WinFaxAppPortStarter"=wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\BIN\\SR_GUI.EXE"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"g:\\NBC Direct\\DirectPlayerCore.exe"=
"g:\\program files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"56436:TCP"= 56436:TCP:Pando Media Booster
"56436:UDP"= 56436:UDP:Pando Media Booster

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [4/3/2003 11:23 PM 9344]
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [4/8/2009 10:31 PM 40496]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/11/2009 10:22 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [9/1/2008 11:36 PM 28544]
R0 RVSDISK;RVSDISK;c:\windows\system32\drivers\RVSDISK.sys [4/26/2008 12:16 AM 11904]
R0 RVSYSTEM;RVSYSTEM;c:\windows\system32\drivers\RVSYSTEM.sys [4/26/2008 12:15 AM 38272]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [8/31/2009 6:01 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [8/31/2009 6:01 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [8/31/2009 6:00 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090916.003\IDSXpx86.sys [9/16/2009 5:25 PM 329080]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [3/28/2008 10:04 PM 95592]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;d:\giveaway\ASTRA32\astra32.sys [2/22/2007 11:28 AM 30864]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [4/3/2003 11:23 PM 454144]
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;c:\windows\Cpqdiag\CPQDFWAG.EXE [3/22/2003 3:41 AM 212992]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 6:00 PM 117640]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [8/23/2006 10:19 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [8/23/2006 10:19 PM 670128]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 9:38 PM 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [8/23/2006 10:20 PM 2041904]
S0 PQV2i;PQV2i; [x]
S1 PQIMount;PQIMount; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1028432]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/18/2001 12:36 AM 14336]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/17/2009 5:21 PM 38224]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [8/23/2006 10:20 PM 14924]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2009-10-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 12:03]

2009-10-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2009-09-28 c:\windows\Tasks\GlaryInitialize.job
- g:\giveawayoftheday\Glary Utilities\initialize.exe [2009-01-13 22:02]

2009-10-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- g:\lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 03:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = hxxp://go.compaq.com/1Q00CDT/0409/bl7.asp
uInternet Settings,ProxyServer = sas.r5.attbi.com:8000
uInternet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: d:\giveaway\Sticky Password\spautofill\components\SPAutofill.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\IDM\bin\flash\platform\WINNT\plugins\npidmdcp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npDocX.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npnul32.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nprpjplug.dll
FF - plugin: g:\nbc direct\npDirectPlayerMozilla.dll
FF - plugin: g:\program files\Reader 8\Reader\browser\nppdf32.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
.
------- File Associations -------
.
txtfile="g:\program files\EditPad Lite\EditPadLite.exe" "%1"
.
- - - - ORPHANS REMOVED - - - -

BHO-{3B1191EE-EF43-4ADB-BF52-12D0A83F7727} - (no file)
AddRemove-HijackThis - c:\documents and settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\Z9224N0M\HijackThis.exe
AddRemove-Move Networks Player_is1 - c:\documents and settings\Administrator\Application Data\Move Networks\ie_bin\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-07 01:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-919082819-2040581095-3719885985-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{32E01C85-8E43-78C7-6D84-C9E20DD24F75}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"haelhmpglifhljbc"=hex:61,62,70,69,63,6a,62,67,6f,6d,68,6b,66,66,6e,66,6c,63,
6f,6c,6a,67,6d,6b,61,67,6e,6a,61,67,69,6f,6d,6d,00,00
"haelhmpgaikndngk"=hex:70,62,70,69,62,66,68,62,63,6b,68,68,65,6a,6b,6e,6f,66,
6d,6d,69,66,64,6b,64,67,6d,67,6f,64,68,69,6d,6c,6f,70,6d,6f,6c,61,69,62,64,\

[HKEY_USERS\S-1-5-21-919082819-2040581095-3719885985-500\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{51D1A0C0-CAB4-6BCE-EA97-774334BA7832}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"halfcdbnbeneppcc"=hex:61,62,69,61,6a,62,6b,6e,64,63,6f,69,62,6d,70,67,67,70,
68,66,63,70,6f,62,6b,66,6b,68,6b,61,66,67,69,6a,00,00
"galfcdbnkfcgbh"=hex:64,62,67,61,68,68,66,67,61,68,67,70,62,64,67,6e,62,6a,63,
62,66,6f,61,64,63,68,6d,67,6c,62,68,68,63,6e,67,68,61,6c,64,6d,00,00
.
Completion time: 2009-10-07 1:37
ComboFix-quarantined-files.txt 2009-10-07 06:36

Pre-Run: 2,336,526,336 bytes free
Post-Run: 2,489,225,216 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\Windows
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\Windows="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

244 --- E O F --- 2009-10-05 03:34

Does ComboFix scan a registry that is not on the primary, active hard drive? I am asking because the problem drive is the USB piggybacked drive. Here are the results from the above procedure:

ComboFix 09-10-06.03 - Administrator 10/07/2009 19:26.2.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1535.942 [GMT -5:00]
Running from: c:\documents and settings\Administrator\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Administrator\Desktop\CFscript.txt
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\FOUND.001
c:\found.001\FILE0000.CHK
C:\FOUND.002
c:\found.002\FILE0000.CHK
c:\found.002\FILE0001.CHK
c:\found.002\FILE0002.CHK
c:\found.002\FILE0003.CHK
C:\FOUND.003
c:\found.003\FILE0000.CHK
c:\found.003\FILE0001.CHK
c:\found.003\FILE0002.CHK
c:\found.003\FILE0003.CHK
c:\found.003\FILE0004.CHK
c:\found.003\FILE0005.CHK
c:\found.003\FILE0006.CHK
c:\found.003\FILE0007.CHK
c:\found.003\FILE0008.CHK
c:\found.003\FILE0009.CHK
c:\found.003\FILE0010.CHK
c:\found.003\FILE0011.CHK
c:\found.003\FILE0012.CHK
c:\found.003\FILE0013.CHK
c:\found.003\FILE0014.CHK
c:\found.003\FILE0015.CHK
c:\found.003\FILE0016.CHK
c:\found.003\FILE0017.CHK
c:\found.003\FILE0018.CHK
c:\found.003\FILE0019.CHK
c:\found.003\FILE0020.CHK
c:\found.003\FILE0021.CHK
c:\found.003\FILE0022.CHK
c:\found.003\FILE0023.CHK
c:\found.003\FILE0024.CHK
c:\found.003\FILE0025.CHK
c:\found.003\FILE0026.CHK
c:\found.003\FILE0027.CHK
c:\found.003\FILE0028.CHK
c:\found.003\FILE0029.CHK
c:\found.003\FILE0030.CHK
c:\found.003\FILE0031.CHK
c:\found.003\FILE0032.CHK
c:\found.003\FILE0033.CHK
c:\found.003\FILE0034.CHK
c:\found.003\FILE0035.CHK
c:\found.003\FILE0036.CHK
c:\found.003\FILE0037.CHK
c:\found.003\FILE0038.CHK
c:\found.003\FILE0039.CHK
c:\found.003\FILE0040.CHK
c:\found.003\FILE0041.CHK
c:\found.003\FILE0042.CHK
c:\found.003\FILE0043.CHK
c:\found.003\FILE0044.CHK
c:\found.003\FILE0045.CHK
c:\found.003\FILE0046.CHK
c:\found.003\FILE0047.CHK
c:\found.003\FILE0048.CHK
c:\found.003\FILE0049.CHK
c:\found.003\FILE0050.CHK
c:\found.003\FILE0051.CHK
c:\found.003\FILE0052.CHK
c:\found.003\FILE0053.CHK
c:\found.003\FILE0054.CHK
c:\found.003\FILE0055.CHK
c:\found.003\FILE0056.CHK
c:\found.003\FILE0057.CHK
c:\found.003\FILE0058.CHK
c:\found.003\FILE0059.CHK
c:\found.003\FILE0060.CHK
c:\found.003\FILE0061.CHK
c:\found.003\FILE0062.CHK
c:\found.003\FILE0063.CHK
c:\found.003\FILE0064.CHK
c:\found.003\FILE0065.CHK
c:\found.003\FILE0066.CHK
c:\found.003\FILE0067.CHK
c:\found.003\FILE0068.CHK
c:\found.003\FILE0069.CHK
c:\found.003\FILE0070.CHK
c:\found.003\FILE0071.CHK
c:\found.003\FILE0072.CHK
c:\found.003\FILE0073.CHK
c:\found.003\FILE0074.CHK
c:\found.003\FILE0075.CHK
c:\found.003\FILE0076.CHK
c:\found.003\FILE0077.CHK
c:\found.003\FILE0078.CHK
c:\found.003\FILE0079.CHK
c:\found.003\FILE0080.CHK
c:\found.003\FILE0081.CHK
c:\found.003\FILE0082.CHK
c:\found.003\FILE0083.CHK
c:\found.003\FILE0084.CHK
c:\found.003\FILE0085.CHK
c:\found.003\FILE0086.CHK
c:\found.003\FILE0087.CHK
c:\found.003\FILE0088.CHK
c:\found.003\FILE0089.CHK
c:\found.003\FILE0090.CHK
c:\found.003\FILE0091.CHK
c:\found.003\FILE0092.CHK
c:\found.003\FILE0093.CHK
c:\found.003\FILE0094.CHK
c:\found.003\FILE0095.CHK
c:\found.003\FILE0096.CHK
c:\found.003\FILE0097.CHK
c:\found.003\FILE0098.CHK
c:\found.003\FILE0099.CHK
c:\found.003\FILE0100.CHK
c:\found.003\FILE0101.CHK
c:\found.003\FILE0102.CHK
c:\found.003\FILE0103.CHK
c:\found.003\FILE0104.CHK
c:\found.003\FILE0105.CHK
c:\found.003\FILE0106.CHK
c:\found.003\FILE0107.CHK
c:\found.003\FILE0108.CHK
c:\found.003\FILE0109.CHK
c:\found.003\FILE0110.CHK
c:\found.003\FILE0111.CHK
c:\found.003\FILE0112.CHK
c:\found.003\FILE0113.CHK
c:\found.003\FILE0114.CHK
c:\found.003\FILE0115.CHK
c:\found.003\FILE0116.CHK
c:\found.003\FILE0117.CHK
c:\found.003\FILE0118.CHK
c:\found.003\FILE0119.CHK
c:\found.003\FILE0120.CHK
c:\found.003\FILE0121.CHK
c:\found.003\FILE0122.CHK
c:\found.003\FILE0123.CHK
c:\found.003\FILE0124.CHK
c:\found.003\FILE0125.CHK
c:\found.003\FILE0126.CHK
c:\found.003\FILE0127.CHK
c:\found.003\FILE0128.CHK
c:\found.003\FILE0129.CHK
c:\found.003\FILE0130.CHK
c:\found.003\FILE0131.CHK
c:\found.003\FILE0132.CHK
c:\found.003\FILE0133.CHK
c:\found.003\FILE0134.CHK
c:\found.003\FILE0135.CHK
c:\found.003\FILE0136.CHK
c:\found.003\FILE0137.CHK
c:\found.003\FILE0138.CHK
c:\found.003\FILE0139.CHK
c:\found.003\FILE0140.CHK
c:\found.003\FILE0141.CHK
c:\found.003\FILE0142.CHK
c:\found.003\FILE0143.CHK
c:\found.003\FILE0144.CHK
c:\found.003\FILE0145.CHK
c:\found.003\FILE0146.CHK
c:\found.003\FILE0147.CHK
c:\found.003\FILE0148.CHK
c:\found.003\FILE0149.CHK
c:\found.003\FILE0150.CHK
c:\found.003\FILE0151.CHK
c:\found.003\FILE0152.CHK
c:\found.003\FILE0153.CHK
c:\found.003\FILE0154.CHK
c:\found.003\FILE0155.CHK
c:\found.003\FILE0156.CHK
c:\found.003\FILE0157.CHK
c:\found.003\FILE0158.CHK
c:\found.003\FILE0159.CHK
c:\found.003\FILE0160.CHK
c:\found.003\FILE0161.CHK
c:\found.003\FILE0162.CHK
c:\found.003\FILE0163.CHK
c:\found.003\FILE0164.CHK
c:\found.003\FILE0165.CHK
c:\found.003\FILE0166.CHK
c:\found.003\FILE0167.CHK

.
((((((((((((((((((((((((( Files Created from 2009-09-08 to 2009-10-08 )))))))))))))))))))))))))))))))
.

2009-10-07 06:15 . 2009-10-07 06:15 -------- d-----w- C:\Combo-Fix
2009-10-03 19:51 . 2009-10-03 19:51 -------- d-----w- c:\documents and settings\Administrator\Application Data\JGsoft
2009-10-02 05:17 . 2009-10-02 05:17 -------- d-----w- c:\windows\LastGood
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-09-17 22:21 . 2009-09-17 22:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-09-17 22:21 . 2009-09-10 19:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-09-17 04:36 . 2009-09-17 04:36 -------- d-----w- c:\documents and settings\Administrator\DoctorWeb
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\program files\NOS
2009-09-12 20:14 . 2009-09-12 20:14 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2009-09-09 16:07 . 2009-06-21 21:44 153088 ------w- c:\windows\system32\dllcache\triedit.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-31 23:01 . 2009-03-17 04:02 806 ----a-w- c:\windows\system32\drivers\SYMEVENT.INF
2009-08-31 23:01 . 2009-03-17 04:02 7456 ----a-w- c:\windows\system32\drivers\SYMEVENT.CAT
2009-08-31 23:01 . 2009-03-17 04:02 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-08-31 23:01 . 2009-03-17 04:02 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-08-22 07:21 . 2009-03-17 04:06 36400 ----a-r- c:\windows\system32\drivers\SymIM.sys
2009-08-18 04:19 . 2004-03-17 04:19 36328 ----a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-07 00:24 . 2005-01-04 03:40 327896 ----a-w- c:\windows\system32\wucltui.dll
2009-08-07 00:24 . 2005-01-04 03:40 209632 ----a-w- c:\windows\system32\wuweb.dll
2009-08-07 00:24 . 2003-03-26 02:49 53472 ------w- c:\windows\system32\wuauclt.exe
2009-08-07 00:24 . 2003-03-26 02:46 96480 ----a-w- c:\windows\system32\cdm.dll
2009-08-07 00:23 . 2005-01-04 03:59 575704 ----a-w- c:\windows\system32\wuapi.dll
2009-08-07 00:23 . 2006-11-17 02:45 274288 ----a-w- c:\windows\system32\mucltui.dll
2009-08-07 00:23 . 2005-05-26 09:19 215920 ----a-w- c:\windows\system32\muweb.dll
2009-08-07 00:23 . 2003-03-26 02:49 1929952 ----a-w- c:\windows\system32\wuaueng.dll
2009-08-05 09:01 . 2003-05-07 03:44 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 20:07 . 2009-08-03 20:07 403816 ----a-w- c:\windows\system32\OGACheckControl.dll
2009-08-03 20:07 . 2009-08-03 20:07 322928 ----a-w- c:\windows\system32\OGAAddin.dll
2009-08-03 20:07 . 2009-08-03 20:07 230768 ----a-w- c:\windows\system32\OGAEXEC.exe
2009-07-17 19:01 . 2003-03-26 02:46 58880 ----a-w- c:\windows\system32\atl.dll
2009-07-14 04:43 . 2003-03-26 03:52 286208 ----a-w- c:\windows\system32\wmpdxm.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"StickyPassword"="d:\giveaway\Sticky Password\stpass.exe" [2007-05-19 1303040]
"DirectPlayerCore"="g:\nbc direct\DirectPlayerCore.exe" [2009-03-25 1150016]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPQEASYACC"="c:\program files\COMPAQ\Easy Access Button Support\StartEAK.exe" [2001-12-14 32768]
"Acronis True Image Monitor"="c:\program files\Acronis\TrueImage\TrueImageMonitor.exe" [2005-07-06 419408]
"Acronis Scheduler2 Service"="c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe" [2005-07-06 69632]
"CoolSwitch"="c:\windows\system32\taskswitch.exe" [2002-03-19 45632]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2003-07-28 4841472]
"ZoneAlarm Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2009-02-16 981384]
"Ad-Watch"="g:\lavasoft\Ad-Aware\AAWTray.exe" [2009-09-22 520024]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-09 148888]
"Adobe Reader Speed Launcher"="g:\program files\Reader 8\Reader\Reader_sl.exe" [2008-10-15 39792]
"Run StartupMonitor"="StartupMonitor.exe" - c:\windows\StartupMonitor.exe [2000-05-20 86016]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-3-6 38912]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"SpecifyDefaultButtons"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ckpNotify]
2004-07-14 03:14 24673 ----a-w- c:\windows\system32\ckpNotify.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SymEFA.sys]
@="FSFilter Activity Monitor"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvCplDaemon"=RUNDLL32.EXE c:\windows\System32\NvCpl.dll,NvStartup
"nwiz"=nwiz.exe /install
"PROMon.exe"=PROMon.exe
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" -atboottime
"Smapp"=c:\program files\Analog Devices\SoundMAX\Smtray.exe
"Symantec NetDriver Monitor"=c:\progra~1\SYMNET~1\SNDMon.exe /Consumer
"WinFaxAppPortStarter"=wfxsnt40.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Kodak\\KODAK Software Updater\\7288971\\Program\\Kodak Software Updater.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\CheckPoint\\SecuRemote\\BIN\\SR_GUI.EXE"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"g:\\NBC Direct\\DirectPlayerCore.exe"=
"g:\\program files\\Microsoft Office\\Office12\\ONENOTE.EXE"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"56436:TCP"= 56436:TCP:Pando Media Booster
"56436:UDP"= 56436:UDP:Pando Media Booster

R0 BsStor;InCD Storage Helper Driver;c:\windows\system32\drivers\bsstor.sys [4/3/2003 11:23 PM 9344]
R0 hotcore3;Hotcore helper;c:\windows\system32\drivers\hotcore3.sys [4/8/2009 10:31 PM 40496]
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [4/11/2009 10:22 PM 64160]
R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [9/1/2008 11:36 PM 28544]
R0 RVSDISK;RVSDISK;c:\windows\system32\drivers\RVSDISK.sys [4/26/2008 12:16 AM 11904]
R0 RVSYSTEM;RVSYSTEM;c:\windows\system32\drivers\RVSYSTEM.sys [4/26/2008 12:15 AM 38272]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1007020.00B\SymEFA.sys [8/31/2009 6:01 PM 310320]
R1 BHDrvx86;Symantec Heuristics Driver;c:\windows\system32\drivers\NIS\1007020.00B\BHDrvx86.sys [8/31/2009 6:01 PM 259632]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1007020.00B\cchpx86.sys [8/31/2009 6:00 PM 482432]
R1 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\Definitions\IPSDefs\20090916.003\IDSXpx86.sys [9/16/2009 5:25 PM 329080]
R1 StarPortLite;StarPort Storage Controller (Lite);c:\windows\system32\drivers\StarPortLite.sys [3/28/2008 10:04 PM 95592]
R2 ASTRA32;ASTRA32 Kernel Driver 5.2.1.0;d:\giveaway\ASTRA32\astra32.sys [2/22/2007 11:28 AM 30864]
R2 BsUDF;InCD UDF Driver;c:\windows\system32\drivers\bsudf.sys [4/3/2003 11:23 PM 454144]
R2 CpqDfwWebAgent;Compaq Remote Diagnostics Enabling Agent;c:\windows\Cpqdiag\CPQDFWAG.EXE [3/22/2003 3:41 AM 212992]
R2 IntuitUpdateService;Intuit Update Service;c:\program files\Common Files\Intuit\Update Service\IntuitUpdateService.exe [10/10/2008 5:45 AM 13088]
R2 Norton Internet Security;Norton Internet Security;c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe [8/31/2009 6:00 PM 117640]
R2 Scap;SecureClient Application Policy Module;c:\windows\system32\drivers\scap.sys [8/23/2006 10:19 PM 17456]
R2 VPN-1;VPN-1 Module;c:\windows\system32\drivers\vpn.sys [8/23/2006 10:19 PM 670128]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [8/27/2009 9:38 PM 102448]
R3 FW1;SecuRemote Miniport;c:\windows\system32\drivers\fw.sys [8/23/2006 10:20 PM 2041904]
S0 PQV2i;PQV2i; [x]
S1 PQIMount;PQIMount; [x]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;g:\lavasoft\Ad-Aware\AAWService.exe [3/9/2009 2:06 PM 1028432]
S3 getPlusHelper;getPlus(R) Helper;c:\windows\System32\svchost.exe -k getPlusHelper [8/18/2001 12:36 AM 14336]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [9/17/2009 5:21 PM 38224]
S3 OMVA;VPN-1 SecureClient Adapter;c:\windows\system32\drivers\OMVA.sys [8/23/2006 10:20 PM 14924]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
getPlusHelper REG_MULTI_SZ getPlusHelper
.
Contents of the 'Scheduled Tasks' folder

2009-10-07 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-02-01 12:03]

2009-10-05 c:\windows\Tasks\OGALogon.job
- c:\windows\system32\OGAEXEC.exe [2009-08-03 20:07]

2009-09-28 c:\windows\Tasks\GlaryInitialize.job
- g:\giveawayoftheday\Glary Utilities\initialize.exe [2009-01-13 22:02]

2009-10-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- g:\lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 03:21]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7
mStart Page = hxxp://www.google.com/
mSearch Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
uInternet Connection Wizard,ShellNext = hxxp://go.compaq.com/1Q00CDT/0409/bl7.asp
uInternet Settings,ProxyServer = sas.r5.attbi.com:8000
uInternet Settings,ProxyOverride = 127.0.0.1;*.r5.attbi.com;localhost;
uSearchURL,(Default) = hxxp://www.google.com/keyword/%s
IE: E&xport to Microsoft Excel - g:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
Trusted Zone: turbotax.com
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} - hxxp://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab
FF - ProfilePath - c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/ig?hl=en&source=iglk
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\coFFPlgn\components\coFFPlgn.dll
FF - component: c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Norton\IPSFFPlgn\components\IPSFFPl.dll
FF - component: d:\giveaway\Sticky Password\spautofill\components\SPAutofill.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\IDM\bin\flash\platform\WINNT\plugins\npidmdcp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\{E2883E8F-472F-4fb0-9522-AC9BF37916A7}\plugins\np_gp.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npDocX.dll
FF - plugin: c:\documents and settings\Administrator\Application Data\Mozilla\Firefox\Profiles\dmr5kssx.work\extensions\OpenXMLViewer@Codeplex.com\plugins\npnul32.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\real\browser\plugins\nprpjplug.dll
FF - plugin: g:\nbc direct\npDirectPlayerMozilla.dll
FF - plugin: g:\program files\Reader 8\Reader\browser\nppdf32.dll
FF - hȋdden: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-07 19:34
Windows 5.1.2600 Service Pack 3 FAT NTAPI

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\Norton Internet Security]
"ImagePath"="\"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\ccSvcHst.exe\" /s \"Norton Internet Security\" /m \"c:\program files\Norton Internet Security\Norton Internet Security\Engine\16.7.2.11\diMaster.dll\" /prefetch:1"
.
Completion time: 2009-10-08 19:36
ComboFix-quarantined-files.txt 2009-10-08 00:36
ComboFix2.txt 2009-10-07 06:37

Pre-Run: 2,682,359,808 bytes free
Post-Run: 2,657,169,408 bytes free

375 --- E O F --- 2009-10-05 03:34

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

I will try this when I get home in a few hours and see how things are. In the meantime, I have two questions: 1) Because ComboFix was renamed, you do mean Combo-Fix /u, right? Also, is ComboFix "smart enough" to realize that the piggybacked USB drive is also a standalone bootable hard drive (i.e. did it also scour its registry entries and restore points)? I have it piggybacked because it doesn't let me into Windows otherwise. This will be easy enough to check when I get home. Thanks!

Hello.
Combofix is smart enough to realize the change, just because of how it does this in it's code.

Combofix will have checked the external drive too, it checks for autorun infection, which includes every drive it finds connected.

Thanks for your reply to my questions. I ran ComboFix and it uninstalled. I removed the drive and remounted it in its case with the same results. It boots normally to the Welcome Screen and allows me to click the user I want to login with. It then displays a blank desktop, runs for maybe 15 seconds and then says logging off. It then backs out to the Welcome Screen again. Any additional thoughts? I will keep the drive in the other system unless you tell me to do otherwise. If you can, please continue to help. I appreciate it!

bump

Sorry for the delay.

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /u



This will also reset your restore points.

How is the machine running now?

Already did that. Please see my reply previous to "bump".

Hello.
Do you have your XP disc?

No. XP Media Center was factory installed. All I have are the recovery discs (which I believe will reset everything to the way it was when I first received it). If I am right about that, I could just as easily restore from an image I took with Acronis, but I was trying to avoid that. I also believe I set an administrator password, but I can't find or recall what that was.

Hello.
Is there anything you don't want to lose on this machine? can you back up anything you want? we can try an image restore if you want to try that.

Unfortunately, I was trying to keep a bunch of programs that I had gotten on Giveaway of the Day. That was why I was trying to just get rid of my infection without restoring from an image that does not have all of these programs. Are we saying that it looks like my Windows installation is damaged and that is what is causing my computer's behavior now? If so, I looked into doing a Windows Repair, but I don't have the disc nor remember my Administrator password. If I could, I suppose I would really like to try to repair my Windows without data loss if possible. My image restore would be my last resort.

Go ahead with repair and let us know how that goes for you.

Any suggestions on how to go about that without an administrator password or a Windows disc for that machine? As I mentioned earlier, it came preinstalled with an OEM copy of Windows XP Media Center and I cannot recall my administrator password.

If you are not willing to do the image restore, then what would be your approach.

I would like to try to do a Windows Repair that would not wipe out all my data first. But I already mentioned my issues with that. I know there may be some free or low cost utilities out there that will recover or reset your administrator password and possibly also something to enable a Windows Repair, but I could use some help in identifying those. Any ideas? Do you know of anything?

This might help: http://www.petri.co.il/forgot_administrator_password.htm

Many thanks. A bit to read here and possibly a lot more to do. I will post again after trying a few things.

Belahzur and DragonMaster Jay,

OK. I have finally gotten past my immediate issue (which was the login loop). I thought that I would have to do a repair install, thus the need for remembering my password. The link you gave me above about the password got me started and I finally found this cracking utility which worked very well and automatically after burning the iso image to CD: http://ophcrack.sourceforge.net/. It cracked my password in a little over 5 minutes! Popped my WinXP Home Ed CD into the drive, but no option to repair became available (I am guessing this is because I installed SP2 and this is the SP1 CD--I don't know). Anyway, I finally found the right search to determine that my login loop was caused because because of a userinit.exe and wsaupdater.exe problem. fȋxed that and login worked with all of my info/programs intact.

That being said, I now have problems with some unknown dlls not being found, an internet connection that I can't seem to get to work anymore, and an occasional Windows error that crops up mentioning a missing or corrupt \minint\SYSTEM32\Config\System.

*** Any further ideas or should I now turn to another forum as it appears this is no longer due to an active virus?

Thank you for all your help.

*** Any further ideas or should I post to another forum? Please see below and previous post for more info if necessary. Thanks, again!

Update of my prior post... Got rid of the dll problem using CCLEANER. Also, hopefully got rid of the crash (using XP_fix.exe) that was occurring with the missing or corrupt \minint\SYSTEM32\Config\System while logged into Windows (waiting to see if this repeats).

Only remaining problem (that is obvious to me anyway):
- wireless network adapter card has a great signal and says connected
- I can ping IP address and DNS address (i.e. Google) without issue
- IE won't connect to any website
- IE won't connect to router at 192.168.0.1
- I tried turning off the firewall on the wireless desktop
- Other wireless computer can browse the internet through the same router.
- IPCONFIG /all looks similar to other wireless computer

Note:
I have not tried another browser. Before my infection, it was working (which is how I got the infection in the first place!).

Hello.
Sounds like a proxy maybe, did you check that too? Did you try another browser? Does Firefox work?

Firefox starts up and yields a blank page and it doesn't look like I have anything set for proxy.

What is the latest report? What are any problems you are having?

The latest is I am still dead with my wireless internet connection. IE and Firefox do not connect, yet I am able to ping www.google.com and its IP address successfully. I think my next step is to try a hardwired ethernet connection to find out if that will connect. If so, I believe that will tell me whether it is a wireless or a wireless/firewall or just a firewall problem.

Does that sound right?

Do you have any further ideas?

Thanks!

Go ahead and try hardwired and let me know the results please.

I tried hardwired and no go.

Firefox and IE both come up with blank pages. No proxies, no firewalls. Ping still works either hardwired or wireless. When I disable them, ping does not work (as expected). All that shows in Firefox is done at the bottom and the white, blank page. There are no other messages.

Because this machine is now operating standalone, would it be worth running another HJT?

Sure, we can start off with another HijackThis log.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:36:02 PM, on 11/6/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Customer\Wireless PCI_CardBus utility V1.01\Wireless PCI_CardBus utility V1.01.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\WINDOWS\system32\rundll32.exe
C:\Documents and Settings\Mom~Dad\Application Data\U3\00001673A671642D\LaunchPad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: (no name) - {a96bcc63-40fd-402c-9b9f-4909a30d1c38} - (no file)
O2 - BHO: (no name) - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)
O2 - BHO: (no name) - {eeea7df5-983d-4519-a80e-f576b6d6b221} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [skinclock] C:\Program Files\Real Ball\realball.exe.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\winlognn.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [z2m0z66rj1jcdf9luoh] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\itnm86silg.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [nt2h43rqwj1rpm9hw0tebbjor7pebssyb7siaud6nr] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\i4pxqur.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [b19mn21g0unygi8ctkk9w4oh9af84ek1cx7t] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\rhpkutjmjw.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [e9f3p78dpznr3ftgicgqg7z6g9cm876v] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\q0fotu35.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [o6xv0aplwwdu7ek22gnf] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\asa98nl2.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [ylpqnc0e1gzq3dls7t2jgz7b9eg60rgmajj21y8t3zhapn0m1] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\b2f7z45dm.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [system tool] C:\WINDOWS\sysguard.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [c7px2kk2nl1q4mpm7wf3fo7hwavmhu] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\vqwpshtkrz.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [phk3m5jddtntqi2] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\qb1x3g8m.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB5; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)" -"http://www.drivearcade.com/playgames/1320/moto-urban-fever.html" (User 'Alex~Lucas~Zachary')
O4 - S-1-5-21-3405786225-280757992-2748749879-1006 Startup: PowerReg Scheduler V3.exe (User 'Alex~Lucas~Zachary')
O4 - S-1-5-21-3405786225-280757992-2748749879-1006 User Startup: PowerReg Scheduler V3.exe (User 'Alex~Lucas~Zachary')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Launch Wireless PCI_CardBus utility V1.01.exe.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Broken Internet access because of LSP provider 'c:\docume~1\alex~l~1\locals~1\temp\ntdll64.dll' missing
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1196029020687
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.94,85.255.112.147
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.94,85.255.112.147
O20 - AppInit_DLLs: C:\WINDOWS\system32\davuhano.dll yyzlmx.dll c:\windows\system32\hagatogo.dll
O20 - Winlogon Notify: crypt - crypts.dll (file missing)
O20 - Winlogon Notify: nwdmoihl - skutwek.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

--
End of file - 10665 bytes

I ran HJT last night and posted the log (see previous post). I left the system with HJT open and the machine running. This morning I see the following error on screen (even though Windows seems to be running fine):

Windows could not start because the following file is missing or corrupt:
\Minint\SYSTEM32\CONFIG\SYSTEM
You can attempt to repair this file by starting Windows Setup using the original Setup CD-ROM. Select 'r' at the first screen to start repair.

Is your computer able to run at all?

If so, please do the following:

Please re-open HijackThis and scan. Check the boxes next to all the entries listed below.

O1 - Hosts: 195.245.119.131 browser-security.microsoft.com
O2 - BHO: (no name) - {a96bcc63-40fd-402c-9b9f-4909a30d1c38} - (no file)
O2 - BHO: (no name) - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)
O2 - BHO: (no name) - {eeea7df5-983d-4519-a80e-f576b6d6b221} - (no file)
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [jsf8uiw3jnjgffght] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\winlognn.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [z2m0z66rj1jcdf9luoh] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\itnm86silg.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [nt2h43rqwj1rpm9hw0tebbjor7pebssyb7siaud6nr] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\i4pxqur.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [b19mn21g0unygi8ctkk9w4oh9af84ek1cx7t] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\rhpkutjmjw.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [e9f3p78dpznr3ftgicgqg7z6g9cm876v] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\q0fotu35.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [o6xv0aplwwdu7ek22gnf] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\asa98nl2.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [ylpqnc0e1gzq3dls7t2jgz7b9eg60rgmajj21y8t3zhapn0m1] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\b2f7z45dm.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [system tool] C:\WINDOWS\sysguard.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [c7px2kk2nl1q4mpm7wf3fo7hwavmhu] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\vqwpshtkrz.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [phk3m5jddtntqi2] C:\DOCUME~1\ALEX~L~1\LOCALS~1\Temp\qb1x3g8m.exe (User 'Alex~Lucas~Zachary')
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.112.94,85.255.112.147
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.112.94,85.255.112.147
O20 - AppInit_DLLs: C:\WINDOWS\system32\davuhano.dll yyzlmx.dll c:\windows\system32\hagatogo.dll
O20 - Winlogon Notify: crypt - crypts.dll (file missing)
O20 - Winlogon Notify: nwdmoihl - skutwek.dll (file missing)
O21 - SSODL: SSODL - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)
O22 - SharedTaskScheduler: jgzfkj9w38rksndfi7r4 - {C5BF49A2-94F3-42BD-F434-3604812C8955} - (no file)
O22 - SharedTaskScheduler: STS - {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - (no file)

Now close all windows other than HijackThis, then click Fix Checked. Close HijackThis.

Please reboot your computer.

Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these files (if present):

C:\WINDOWS\system32\davuhano.dll
c:\windows\system32\hagatogo.dll
c:\windows\system32\yyzlmx.dll
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\winlognn.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\itnm86silg.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\i4pxqur.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\rhpkutjmjw.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\q0fotu35.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\asa98nl2.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\b2f7z45dm.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\sysguard.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\vqwpshtkrz.exe
C:\documents and settings\Alex~Lucas~Zachary\local settings\temp\qb1x3g8m.exe


Please reboot your computer, and post a new HijackThis log here in your next reply.

==

There is some evidence of what may be a very nasty infection.
If the Computer has been used for any important data, you are strongly advised to do the following, immediately:

• Back up all important data on the machine.
  
• If you have ever used this computer for shopping, banking, or any transactions relating to your financial well being:
  
  Call all of your banks, credit card companies, and financial institutions, informing them that you may be a victim of identity theft, and to put a watch on your accounts or change all your account umbers.
  
• From a clean computer, change ALL your online passwords -- for ISP login, email, banks, financial accounts, PayPal, eBay, online companies, and any online forums or groups you belong to.
  
• DO NOT change passwords or do any transactions while using the infected computer because the attacker will get the new password and transaction information.
  
• Take any other steps you think appropriate for an attempted identity theft.

==

If you are able to post the HJT log, go ahead. If not, please let me know.

Followed all of your instructions without incident. Here is the new HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:06:48 PM, on 11/7/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\UAService7.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Acer\Empowering Technology\eRecovery\Monitor.exe
C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [ntiMUI] c:\Program Files\NewTech Infosystems\NTI CD & DVD-Maker 7\ntiMUI.exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [eRecoveryService] C:\Acer\Empowering Technology\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Acronis True Image Monitor] "C:\Program Files\Acronis\TrueImage\TrueImageMonitor.exe"
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKLM\..\Run: [Framework Windows] frmwrk32.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [skinclock] C:\Program Files\Real Ball\realball.exe.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'Alex~Lucas~Zachary')
O4 - HKUS\S-1-5-21-3405786225-280757992-2748749879-1006\..\RunOnce: [Shockwave Updater] C:\WINDOWS\system32\Adobe\SHOCKW~1\SWHELP~2.EXE -Update -1100465 -"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; GTB5; .NET CLR 1.0.3705; .NET CLR 1.1.4322; Media Center PC 4.0; .NET CLR 2.0.50727)" -"http://www.drivearcade.com/playgames/1320/moto-urban-fever.html" (User 'Alex~Lucas~Zachary')
O4 - S-1-5-21-3405786225-280757992-2748749879-1006 Startup: PowerReg Scheduler V3.exe (User 'Alex~Lucas~Zachary')
O4 - S-1-5-21-3405786225-280757992-2748749879-1006 User Startup: PowerReg Scheduler V3.exe (User 'Alex~Lucas~Zachary')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Launch Wireless PCI_CardBus utility V1.01.exe.lnk = ?
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O10 - Broken Internet access because of LSP provider 'c:\docume~1\alex~l~1\locals~1\temp\ntdll64.dll' missing
O16 - DPF: {44990301-3C9D-426D-81DF-AAB636FA4345} (Symantec Script Runner Class) - https://www-secure.symantec.com/techsupp/asa/ss/sa/sa_cabs/tgctlsr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1196029020687
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} (Virtools WebPlayer Class) - http://3dlifeplayer.dl.3dvia.com/player/install/installer.exe
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINDOWS\system32\UAService7.exe

--
End of file - 7832 bytes

Good. Can you connect to the internet on that machine?

No, I still can't and still get the same thing. I am posting screenshots to show the behavior. Although I used my router url in the screenshots, I get the same thing for sites such as Google--whether I use its IP address or DNS name.




Any other ideas? Thanks.

See last post, please. Here are the screenshots I referred to.

Seems to be either a router or modem issue.

Please open Internet Explorer and place the following address in your address bar: http://192.168.1.1
This will ask for a password, then may redirect to the setup screen. If this does, then the router is working fine, probably.

Now, check the outside of your modem for an address such as:

192.168.x.xxx

("x"=some number)

Place that in your address bar, and hit Enter. Can you access the settings of the modem?

Please tell me either of the results, so I know how to instruct you next.

My router is a D-Link DI-524 with an IP address of 192.168.0.1 (not 192.168.1.1). If I put 192.168.1.1 in the problem machine's IE, nothing changes in the browser. If I put it in two other good machines, it can't find the URL. If however I put in 192.168.0.1 on the good machines (one ethernet and one wireless), they connect just fine. The problem machine still won't display anything in the browser, but can still ping the IP address.