Windows Security System Virus

Please HELP ME!!!! I have tried EVERYTHING. Anti malware does not work. Ive tried renaming the files, running in safe mode, reinstalling, etc. it does not work. I ve used every scanner, software I could find including registryfix, superscan, malwarepro, etc. NOTHING works. Im running windows xp sp2. My computer locks up evey 2 minutes. Warnings come up constantly along with an offer for a free scanner (As if). Please help me kill this peice of shit. I promise to make a Christmas donation if you help!!!

Thanks,
Jenn

Here is my hijack log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:53:17 AM, on 12/18/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\AOL\1188534385\ee\AOLSoftware.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\DOCUME~1\BABETR~1\LOCALS~1\Temp\clspackxq.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\Program Files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
C:\DOCUME~1\BABETR~1\LOCALS~1\Temp\wscsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Babetribute\Local Settings\Temporary Internet Files\Content.IE5\KRN9A3YJ\winlogon[1].scr
C:\Program Files\Internet Explorer\Iexplore.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 209.44.111.57 security.microsoft.com
O1 - Hosts: 209.44.111.57 inetavirus.com
O1 - Hosts: 209.44.111.57 www.inetavirus.com
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O2 - BHO: SnapToolbarHelper Class - {8600AC1E-BE58-4FFC-BD5D-F2A8EC38C838} - C:\Program Files\Snap Visual Search\snapbar.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Browser Helper Object - {AFD4AD01-58C1-47DB-A404-FBE00A6C5486} - C:\Program Files\Shared\lib.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Snap Visual Search - {EF56413F-9398-4DF5-BC88-6FC3B227D5C5} - C:\Program Files\Snap Visual Search\snapbar.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1188534385\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe /tray
O4 - HKLM\..\Run: [RoxioDragToDisc] "C:\Program Files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [UVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [clspackxq.exe] C:\DOCUME~1\BABETR~1\LOCALS~1\Temp\clspackxq.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 5.0\aoltb.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6F750202-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/flashplayer/current/swflash.cab
O18 - Filter hijack: text/html - {02d23e7c-f3df-4938-b5a7-45bd48898556} - C:\WINDOWS\default32.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: FlipShare Service - Unknown owner - C:\Program Files\Flip Video\FlipShare\FlipShareService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LiveShare P2P Server (RoxLiveShare) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxLiveShare.exe
O23 - Service: RoxMediaDB - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxMediaDB.exe
O23 - Service: RoxUpnpRenderer (RoxUPnPRenderer) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCom\RoxUpnpRenderer.exe
O23 - Service: RoxUpnpServer - Sonic Solutions - C:\Program Files\Roxio\Easy Media Creator 8\Digital Home\RoxUpnpServer.exe
O23 - Service: Roxio Hard Drive Watcher (RoxWatch) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

--
End of file - 10798 bytes

Hello.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O1 - Hosts: ::1 localhost
  O1 - Hosts: 209.44.111.57 security.microsoft.com
  O1 - Hosts: 209.44.111.57 inetavirus.com
  O1 - Hosts: 209.44.111.57 www.inetavirus.com
  O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
  O4 - HKCU\..\Run: [clspackxq.exe] C:\DOCUME~1\BABETR~1\LOCALS~1\Temp\clspackxq.exe
  O18 - Filter hijack: text/html - {02d23e7c-f3df-4938-b5a7-45bd48898556} - C:\WINDOWS\default32.dll
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Did the Hijack part of this, but as always when I try to install antimalware, the computer locks up and wont let me.

Any other ideas?? Ive tried it 3 times.

I also noticed that the 018 line you wanted me to check and fix, keeps showing up everytime I scan. The other all stayed fixed.

Download the GMER rootkit scan from here: GMER

1. Unzip it and start GMER.
   
2. Click the >>> tab and then click the Scan button.
   
3. Once done, click the Copy button.
   
4. This will copy the results to your clipboard.
   
5. Paste the results in your next reply.
   

Note:
If you're having problems with running GMER.exe, try it in safe mode. This tools works in safe mode.
You can also try renaming it since some malware blocks GMER.

Okay, so my computer locks up about every 2 minutes and I have to reboot. The only way I could get the GMER to scan was in safe mode. Took me forever to be able to post the results to you because it keeps locking up. Im having to send you these results through another computer.

Here are the GMER results:
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2009-12-20 10:50:15
Windows 5.1.2600 Service Pack 2
Running: 9ld8oxno.exe; Driver: C:\DOCUME~1\BABETR~1\LOCALS~1\Temp\pgadipod.sys


---- System - GMER 1.0.15 ----

Code 84A1C980 ZwEnumerateKey
Code 84A316A8 ZwFlushInstructionCache
Code 84AC238E IofCallDriver
Code 84A97E56 IofCompleteRequest

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!IofCallDriver 804E13A7 5 Bytes JMP 84AC2393
.text ntoskrnl.exe!IofCompleteRequest 804E17BD 5 Bytes JMP 84A97E5B
PAGE ntoskrnl.exe!ZwEnumerateKey 80578EE4 5 Bytes JMP 84A1C984
PAGE ntoskrnl.exe!ZwFlushInstructionCache 805873DB 5 Bytes JMP 84A316AC

---- Modules - GMER 1.0.15 ----

Module \systemroot\system32\drivers\H8SRTndopwxduwi.sys (*** hȋdden *** ) F725B000-F7278000 (118784 bytes)
---- Processes - GMER 1.0.15 ----

Library \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll (*** hȋdden *** ) @ C:\WINDOWS\system32\svchost.exe [548] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll (*** hȋdden *** ) @ C:\WINDOWS\system32\svchost.exe [596] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll (*** hȋdden *** ) @ C:\WINDOWS\Explorer.EXE [852] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll (*** hȋdden *** ) @ C:\WINDOWS\system32\svchost.exe [1012] 0x10000000
Library \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll (*** hȋdden *** ) @ C:\Program Files\Internet Explorer\Iexplore.exe [1376] 0x10000000

---- Services - GMER 1.0.15 ----

Service C:\WINDOWS\system32\drivers\H8SRTndopwxduwi.sys (*** hȋdden *** ) [SYSTEM] H8SRTd.sys <-- ROOTKIT !!!

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTndopwxduwi.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTndopwxduwi.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTylkxejyour.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTbcvlaiyttf.dat
Reg HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@start 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@type 1
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@imagepath \systemroot\system32\drivers\H8SRTndopwxduwi.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys@group file system
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTd \\?\globalroot\systemroot\system32\drivers\H8SRTndopwxduwi.sys
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTc \\?\globalroot\systemroot\system32\H8SRTylkxejyour.dll
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@H8SRTsrcr \\?\globalroot\systemroot\system32\H8SRTbcvlaiyttf.dat
Reg HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys\modules@h8srtserf \\?\globalroot\systemroot\system32\H8SRTveaypejklx.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}@ SSubTimer6.ISubclass
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\ProgID@ SSubTimer6.ISubclass
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\Programmable
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{71A2702F-C7D8-11D2-BEF8-525400DFB47A}\VERSION@ 1.0
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}@ SSubTimer6.GSubclass
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\InprocServer32@ C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\ProgID@ SSubTimer6.GSubclass
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\Programmable
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27032-C7D8-11D2-BEF8-525400DFB47A}\VERSION@ 1.0
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}@ SSubTimer6.CTimer
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\InprocServer32@ C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\ProgID@ SSubTimer6.CTimer
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\Programmable
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{71A27034-C7D8-11D2-BEF8-525400DFB47A}\VERSION@ 1.0
Reg HKLM\SOFTWARE\Classes\CLSID\{74D248F8-1D57-CF68-67DB-5683E516AAD1}\InProcServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{74D248F8-1D57-CF68-67DB-5683E516AAD1}\InProcServer32@jaoiegfbhleojjnjgjce 0x69 0x61 0x6E 0x6B ...
Reg HKLM\SOFTWARE\Classes\CLSID\{74D248F8-1D57-CF68-67DB-5683E516AAD1}\InProcServer32@iaoikhhhcehbiajdfb 0x69 0x61 0x63 0x6B ...
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}@ vbAcceleratorSGrid6.cGridCell
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\ProgID@ vbAcceleratorSGrid6.cGridCell
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\Programmable
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{9BD3A001-42A2-491E-AACA-9512F6CF4CDB}\VERSION@ 1.1
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}@ vbAccelerator Grid Control
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Control
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Control@
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\InprocServer32
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\InprocServer32@ C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\InprocServer32@ThreadingModel Apartment
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\MiscStatus
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\MiscStatus@ 0
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\MiscStatus\1
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\MiscStatus\1@ 131473
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\ProgID@ vbAcceleratorSGrid6.vbalGrid
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\ToolboxBitmap32
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\ToolboxBitmap32@ C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx, 30000
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}\VERSION@ 1.1
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}@ vbAcceleratorSGrid6.cGridSortObject
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\ProgID@ vbAcceleratorSGrid6.cGridSortObject
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\Programmable
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{D2129738-6A78-4BCB-915A-412982CAA23D}\VERSION@ 1.1
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}@ vbAcceleratorSGrid6.IGridCellOwnerDraw
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\Implemented Categories
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\ProgID
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\ProgID@ vbAcceleratorSGrid6.IGridCellOwnerDraw
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\Programmable
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\TypeLib
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\VERSION
Reg HKLM\SOFTWARE\Classes\CLSID\{DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}\VERSION@ 1.1
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}@ vbalGrid
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\ProxyStubClsid@ {00020420-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\ProxyStubClsid32@ {00020420-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\Interface\{1EDFD7DF-030D-4144-952E-9D7D86691CDB}\TypeLib@Version 1.1
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}@ cGridCell
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}\Forward
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}\Forward@ {464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{3E9FB490-7EE2-46E9-B52A-9DE91DD218F4}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}@ IGridCellOwnerDraw
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\Interface\{459A91BC-193F-4A70-959C-BFF69D781142}\TypeLib@Version 1.1
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}@ cGridCell
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\Interface\{464D3E06-7D5B-416F-A6EE-0FFB1A5E931B}\TypeLib@Version 1.1
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}@ cGridSortObject
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\Interface\{497B84D4-FB2F-4AB0-A280-8AACFB4B355F}\TypeLib@Version 1.1
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}@ IGridCellOwnerDraw
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}\Forward
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}\Forward@ {459A91BC-193F-4A70-959C-BFF69D781142}
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{66718B8E-A382-4FE2-AA7A-926F9D8C4621}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}@ ISubclass
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A2702E-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@Version 1.0
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}@ GSubclass
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27031-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@Version 1.0
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}@ CTimer
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27033-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@Version 1.0
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}@ CTimer
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid@ {00020420-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\ProxyStubClsid32@ {00020420-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@ {71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\Interface\{71A27036-C7D8-11D2-BEF8-525400DFB47A}\TypeLib@Version 1.0
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}@ cGridSortObject
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}\Forward
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}\Forward@ {497B84D4-FB2F-4AB0-A280-8AACFB4B355F}
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{BC39A57D-DF2C-45B4-BFFD-7D55E911C1B2}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}@ vbalGrid
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\ProxyStubClsid
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\ProxyStubClsid@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\ProxyStubClsid32
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\ProxyStubClsid32@ {00020424-0000-0000-C000-000000000046}
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\TypeLib
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\TypeLib@ {DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\Interface\{CCA2E620-B807-451F-BAFD-2057AF9025FE}\TypeLib@Version 1.1
Reg HKLM\SOFTWARE\Classes\mbam.script@ Malwarebytes' Anti-Malware script
Reg HKLM\SOFTWARE\Classes\mbam.script\shell
Reg HKLM\SOFTWARE\Classes\mbam.script\shell\open
Reg HKLM\SOFTWARE\Classes\mbam.script\shell\open\command
Reg HKLM\SOFTWARE\Classes\mbam.script\shell\open\command@ "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" %1
Reg HKLM\SOFTWARE\Classes\SSubTimer6.CTimer@ SSubTimer6.CTimer
Reg HKLM\SOFTWARE\Classes\SSubTimer6.CTimer\Clsid
Reg HKLM\SOFTWARE\Classes\SSubTimer6.CTimer\Clsid@ {71A27034-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\SSubTimer6.GSubclass@ SSubTimer6.GSubclass
Reg HKLM\SOFTWARE\Classes\SSubTimer6.GSubclass\Clsid
Reg HKLM\SOFTWARE\Classes\SSubTimer6.GSubclass\Clsid@ {71A27032-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\SSubTimer6.ISubclass@ SSubTimer6.ISubclass
Reg HKLM\SOFTWARE\Classes\SSubTimer6.ISubclass\Clsid
Reg HKLM\SOFTWARE\Classes\SSubTimer6.ISubclass\Clsid@ {71A2702F-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0@ vbAccelerator VB6 Subclassing and Timer Assistant (with configurable message response, multi-control support + timer bug fix)
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\0
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\0\win32
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\0\win32@ C:\Program Files\Malwarebytes' Anti-Malware\ssubtmr6.dll
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\FLAGS
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\FLAGS@ 0
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\HELPDIR
Reg HKLM\SOFTWARE\Classes\TypeLib\{71A2702D-C7D8-11D2-BEF8-525400DFB47A}\1.0\HELPDIR@ C:\Program Files\Malwarebytes' Anti-Malware
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1@ vbAccelerator VB6 SGrid Control 2.0
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\0
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\0\win32
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\0\win32@ C:\Program Files\Malwarebytes' Anti-Malware\vbalsgrid6.ocx
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\FLAGS
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\FLAGS@ 2
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\HELPDIR
Reg HKLM\SOFTWARE\Classes\TypeLib\{DE8CE233-DD83-481D-844C-C07B96589D3A}\1.1\HELPDIR@ C:\Program Files\Malwarebytes' Anti-Malware
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridCell@ vbAcceleratorSGrid6.cGridCell
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridCell\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridCell\Clsid@ {9BD3A001-42A2-491E-AACA-9512F6CF4CDB}
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridSortObject@ vbAcceleratorSGrid6.cGridSortObject
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridSortObject\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.cGridSortObject\Clsid@ {D2129738-6A78-4BCB-915A-412982CAA23D}
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.IGridCellOwnerDraw@ vbAcceleratorSGrid6.IGridCellOwnerDraw
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.IGridCellOwnerDraw\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.IGridCellOwnerDraw\Clsid@ {DC90EAA6-69B8-4DE4-9A7B-5B2C5B3FEACD}
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.vbalGrid@ vbAccelerator Grid Control
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.vbalGrid\Clsid
Reg HKLM\SOFTWARE\Classes\vbAcceleratorSGrid6.vbalGrid\Clsid@ {C5DA1F2B-B2BF-4DFC-BC9A-439133543A67}

---- Files - GMER 1.0.15 ----

File C:\Documents and Settings\Babetribute\Local Settings\Temp\H8SRT8191.tmp 343040 bytes executable
File C:\Documents and Settings\Babetribute\Local Settings\Temporary Internet Files\Content.IE5\2BWICJLD\dnserror[3] 6537 bytes
File C:\Documents and Settings\Babetribute\Local Settings\Temporary Internet Files\Content.IE5\UF2N1CDK\favcenter[2] 3366 bytes
File C:\WINDOWS\system32\drivers\H8SRTndopwxduwi.sys 40448 bytes executable <-- ROOTKIT !!!
File C:\WINDOWS\system32\H8SRTbcvlaiyttf.dat 201 bytes
File C:\WINDOWS\system32\H8SRTveaypejklx.dll 23040 bytes executable
File C:\WINDOWS\system32\H8SRTylkxejyour.dll 23040 bytes executable
File C:\WINDOWS\Temp\H8SRTdcc3.tmp 201 bytes
File C:\WINDOWS\Temp\H8SRTde3a.tmp 201 bytes

---- EOF - GMER 1.0.15 ----

Hello.

1. Please download The Avenger by Swandog46 to your Desktop
Link: HERE

• Click on Avenger.zip to open the file
  
• Extract avenger.exe to your desktop
  

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Drivers to disable:
H8SRTd.sys

Drivers to delete:
H8SRTd.sys

Files to delete:
C:\WINDOWS\system32\drivers\H8SRTndopwxduwi.sys
C:\WINDOWS\system32\H8SRTveaypejklx.dll
C:\WINDOWS\system32\H8SRTbcvlaiyttf.dat
C:\WINDOWS\system32\H8SRTylkxejyour.dll

Registry keys to delete:
HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys
HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.

• Under "Input script here:", paste in the script from the quote box above.
  
• Leave the ticked box "Scan for rootkit" ticked.
  
• Then tick "Disable any rootkits found"
  
• Now click on the Execute to begin execution of the script.
  
• Answer "Yes" twice when prompted.
  
  The Avenger will automatically do the following:
  
  
• It will Restart your computer.
  
• On reboot, it will briefly open a black command window on your desktop, this is normal.
  
• After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  
• The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
  

4. Please copy/paste the content of c:\avenger.txt into your reply.

Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com

Platform: Windows XP

*******************

Script file opened successfully.
Script file read successfully.

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Rootkit scan active.

hȋdden driver "H8SRTd.sys" found!
ImagePath: \systemroot\system32\drivers\H8SRTndopwxduwi.sys
Driver disabled successfully.

Rootkit scan completed.

Driver "H8SRTd.sys" disabled successfully.
Driver "H8SRTd.sys" deleted successfully.
File "C:\WINDOWS\system32\drivers\H8SRTndopwxduwi.sys" deleted successfully.
File "C:\WINDOWS\system32\H8SRTveaypejklx.dll" deleted successfully.
File "C:\WINDOWS\system32\H8SRTbcvlaiyttf.dat" deleted successfully.
File "C:\WINDOWS\system32\H8SRTylkxejyour.dll" deleted successfully.

Error: registry key "HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys" not found!
Deletion of registry key "HKLM\SYSTEM\CurrentControlSet\Services\H8SRTd.sys" failed!
Status: 0xc0000034 (STATUS_OBJECT_NAME_NOT_FOUND)
--> the object does not exist

Registry key "HKLM\SYSTEM\ControlSet002\Services\H8SRTd.sys" deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

Is that it??? Because it seems to be all fixed! I just downloaded some updates and everything seems pretty good. What is your professional opinion??

Malwarebytes Anti-malware software is now working!!! Running a scan just in case!! YAY!!

Anti Malware Scan results:

Malwarebytes' Anti-Malware 1.42
Database version: 3398
Windows 5.1.2600 Service Pack 2
Internet Explorer 8.0.6001.18702

12/20/2009 12:08:28 PM
mbam-log-2009-12-20 (12-08-28).txt

Scan type: Quick Scan
Objects scanned: 120621
Time elapsed: 10 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 20

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Program Files\Shared\lib.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\default32.dll (Trojan.Downloader) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{afd4ad01-58c1-47db-a404-fbe00a6c5486} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\H8SRT (Rootkit.TDSS) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{02d23e7c-f3df-4938-b5a7-45bd48898556} (Trojan.Downloader) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\All Users\AVP 2009 (Malware.Trace) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Shared\lib.dll (Trojan.BHO) -> Delete on reboot.
C:\Documents and Settings\Babetribute\Local Settings\Temp\Installer.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\~TM6A.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\~TMA.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\wscsvc32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\clspackxq.exe (Rogue.Installer) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\uac9b3c.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\uac9c46.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\uac9d01.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\uaca0b1.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\uaca1bb.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\uaca2b5.tmp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temporary Internet Files\Content.IE5\TYS3C5RU\eHffc3f65eV0100f070006R34dea906102Tb4ea8444201l0409317P000800070[1] (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\All Users\AVP 2009\1.dat (Malware.Trace) -> Quarantined and deleted successfully.
C:\Program Files\Shared\lib.sig (Adware.Deepdive) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\H8SRT50ab.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\H8SRTdcc3.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\Temp\H8SRTde3a.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\Documents and Settings\Babetribute\Local Settings\Temp\H8SRT8191.tmp (Rootkit.TDSS) -> Quarantined and deleted successfully.
C:\WINDOWS\default32.dll (Trojan.Downloader) -> Delete on reboot.

Hello.

• Download combofix from here
  Link 1
  Link 2
  
  1. If you are using Firefox, make sure that your download settings are as follows:
  
  * Tools->Options->Main tab
  * Set to "Always ask me where to Save the files".
  
  2. During the download, rename Combofix to Combo-Fix as follows:
  
  
  
  
  
  3. It is important you rename Combofix during the download, but not after.
  4. Please do not rename Combofix to other names, but only to the one indicated.
  5. Close any open browsers.
  6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
  
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

It never offers me the opportunity to rename combo fix. It goes right to the run menu. Its not working. Maybe because I use a bitcomet program for downloading files???

ComboFix 09-12-20.08 - Babetribute 12/21/2009 10:31:48.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.895.485 [GMT -7:00]
Running from: c:\documents and settings\Babetribute\My Documents\Btcomet downloads\music\Combo-Fix.exe
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\AntiMalware
c:\program files\Shared
c:\windows\kb913800.exe
c:\windows\system32\krl32mainweq.dll
c:\windows\system32\srcr.dat

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_BHDRVX86
-------\Legacy_MYWEBSEARCHSERVICE
-------\Service_BHDrvx86


((((((((((((((((((((((((( Files Created from 2009-11-21 to 2009-12-21 )))))))))))))))))))))))))))))))
.

2009-12-21 14:52 . 2009-12-21 14:54 -------- d-----w- C:\Combo-Fix
2009-12-20 19:20 . 2009-12-20 19:23 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-20 19:20 . 2009-12-20 19:20 60808 ----a-w- c:\windows\system32\S32EVNT1.DLL
2009-12-20 19:20 . 2009-12-20 19:20 124976 ----a-w- c:\windows\system32\drivers\SYMEVENT.SYS
2009-12-20 19:20 . 2009-12-20 19:20 -------- d-----w- c:\program files\Symantec
2009-12-20 19:19 . 2009-12-20 19:19 -------- d-----w- c:\windows\system32\drivers\NIS
2009-12-20 19:19 . 2009-12-20 19:19 -------- d-----w- c:\program files\Windows Sidebar
2009-12-20 19:19 . 2009-12-20 19:19 -------- d-----w- c:\program files\Norton Internet Security
2009-12-20 19:19 . 2009-12-20 19:19 -------- d-----w- c:\program files\NortonInstaller
2009-12-20 19:19 . 2009-12-20 19:19 -------- d-----w- c:\documents and settings\All Users\Application Data\NortonInstaller
2009-12-20 19:13 . 2009-12-20 19:21 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-12-20 18:56 . 2009-12-03 23:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-20 18:56 . 2009-12-03 23:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-20 18:51 . 2009-12-20 18:51 -------- d-sh--w- c:\documents and settings\Babetribute\IECompatCache
2009-12-20 18:50 . 2009-12-20 18:50 -------- d-sh--w- c:\documents and settings\Babetribute\PrivacIE
2009-12-20 18:49 . 2009-12-20 18:49 -------- d-sh--w- c:\documents and settings\Babetribute\IETldCache
2009-12-20 18:42 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-20 18:42 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-20 18:42 . 2009-12-20 18:42 -------- d-----w- c:\windows\ie8updates
2009-12-20 18:41 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-12-20 18:38 . 2009-12-20 18:40 -------- dc-h--w- c:\windows\ie8
2009-12-20 18:15 . 2009-12-20 18:15 -------- d-----w- C:\ebf1e9b4da87530663b254f9
2009-12-20 18:15 . 2009-12-20 18:15 -------- d-----w- c:\windows\ServicePackFiles
2009-12-20 18:14 . 2004-08-03 23:56 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-12-20 11:35 . 2009-10-20 14:41 265728 -c----w- c:\windows\system32\dllcache\http.sys
2009-12-19 15:38 . 2009-12-19 15:38 -------- d-----w- C:\641f693cddf95a8ef2b1415225
2009-12-18 14:19 . 2009-12-20 18:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-18 13:32 . 2009-12-18 13:32 -------- d-----w- c:\program files\RegistryFix7
2009-12-18 13:13 . 2009-06-09 14:53 53248 -c----w- c:\windows\system32\dllcache\tsgqec.dll
2009-12-18 13:13 . 2009-06-09 14:53 290816 -c----w- c:\windows\system32\dllcache\rhttpaa.dll
2009-12-18 13:13 . 2009-06-09 14:53 136192 -c----w- c:\windows\system32\dllcache\aaclient.dll
2009-12-17 02:28 . 2009-12-18 12:41 -------- d-----w- C:\Desktop

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-21 14:46 . 2009-12-21 14:46 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\naveng.sys
2009-12-21 14:46 . 2009-12-21 14:46 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\eeCtrl.sys
2009-12-21 14:46 . 2009-12-21 14:46 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\ecmsvr32.dll
2009-12-21 14:46 . 2009-12-21 14:46 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\naveng32.dll
2009-12-21 14:46 . 2009-12-21 14:46 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\navex32a.dll
2009-12-21 14:46 . 2009-12-21 14:46 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\navex15.sys
2009-12-21 14:46 . 2009-12-21 14:46 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\eraser.sys
2009-12-21 14:46 . 2009-12-21 14:46 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\cceraser.dll
2009-10-29 07:45 . 2007-01-16 20:07 916480 ----a-w- c:\windows\system32\wininet.dll
2009-10-29 02:31 . 2009-12-20 19:21 784752 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\coFFPlgn\components\coFFPlgn.dll
2009-10-28 22:37 . 2009-12-21 14:47 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSXpx86.sys
2009-10-28 22:37 . 2009-12-21 14:47 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-12-21 14:47 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\Scxpx86.dll
2009-10-28 22:37 . 2009-12-21 14:47 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSxpx86.dll
2009-10-28 22:37 . 2009-12-21 14:47 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSviA64.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-27 03:15 . 2009-10-27 03:15 127872 ----a-w- c:\documents and settings\Babetribute\Application Data\Move Networks\uninstall.exe
2009-10-27 03:15 . 2008-09-21 20:02 -------- d-----w- c:\documents and settings\Babetribute\Application Data\Move Networks
2009-10-27 03:15 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\Babetribute\Application Data\Move Networks\plugins\npqmp071503000010.dll
2009-10-27 03:15 . 2009-10-27 03:14 1686272 ----a-w- c:\documents and settings\Babetribute\Application Data\Move Networks\MoveMediaPlayerWin_071503000010.exe
2009-10-21 05:50 . 2004-08-03 23:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:50 . 2004-08-03 23:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:41 . 2007-01-16 20:05 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:45 . 2007-01-16 20:06 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:54 . 2004-08-03 23:56 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:54 . 2004-08-03 23:56 112128 ----a-w- c:\windows\system32\rastls.dll
2009-10-11 11:17 . 2008-11-29 15:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-05 17:34 . 2009-12-20 19:20 929648 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\OCS\hsplayer.dll
2009-10-01 09:19 . 2009-12-20 19:21 164216 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\IPSFFPlgn\components\IPSFFPl.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8600AC1E-BE58-4FFC-BD5D-F2A8EC38C838}]
2007-09-15 15:38 311296 ----a-w- c:\program files\Snap Visual Search\snapbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-02 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="c:\program files\Common Files\AOL\1188534385\ee\AOLSoftware.exe" [2008-06-24 41824]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe" [2005-09-19 1687552]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe" [2005-09-19 163840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-8-30 113664]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2007-8-30 389120]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\aol\\1188534385\\ee\\aolsoftware.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8603:TCP"= 8603:TCP:BitComet 8603 TCP
"8603:UDP"= 8603:UDP:BitComet 8603 UDP

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1101000.013\SymDS.sys [12/20/2009 12:20 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1101000.013\SymEFA.sys [12/20/2009 12:20 PM 171056]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1101000.013\cchpx86.sys [12/20/2009 12:20 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1101000.013\Ironx86.sys [12/20/2009 12:20 PM 114736]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [12/20/2009 12:20 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/20/2009 12:20 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSXpx86.sys [12/21/2009 7:47 AM 329592]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: &Search
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
AddRemove-HijackThis - c:\documents and settings\Babetribute\Local Settings\Temporary Internet Files\Content.IE5\KRN9A3YJ\HijackThis.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-21 10:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.1.0.19\diMaster.dll\" /prefetch:1"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74D248F8-1D57-CF68-67DB-5683E516AAD1}\InProcServer32*]
"jaoiegfbhleojjnjgjce"=hex:69,61,6e,6b,6a,6f,70,67,6e,6d,6d,6d,70,6d,65,61,6a,
6f,00,80
"iaoikhhhcehbiajdfb"=hex:69,61,63,6b,67,6d,69,66,6c,6c,6b,6b,61,62,6a,69,66,69,
00,80
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(928)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2848)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\browselc.dll
c:\program files\Snap Visual Search\snapbar.dll
c:\program files\Microsoft Office\OFFICE11\msohev.dll
c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\MSVCR80.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\AOL\ACS\AOLAcsd.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Flip Video\FlipShare\FlipShareService.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxWatch.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\program files\Common Files\Roxio Shared\SharedCOM8\CPSHelpRunner.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wbem\wmiapsrv.exe
c:\program files\iPod\bin\iPodService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-12-21 10:45:31 - machine was rebooted
ComboFix-quarantined-files.txt 2009-12-21 17:45

Pre-Run: 41,183,133,696 bytes free
Post-Run: 41,445,113,856 bytes free

- - End Of File - - DB5E8D7070B134C9C8D09C415FB0280A

Please download SystemLook from one of the links below and save it to your Desktop.
Download Mirror #1
Download Mirror #2

• Double-click SystemLook.exe to run it.
  
• Copy the content of the following codebox into the main textfield:
  

  Code:

  
:filefind
proquota.exe

  
  
  
• Click the Look button to start the scan.
  
• When finished, a notepad window will open with the results of the scan. Please post this log in your next reply.
  

Note: The log can also be found on your Desktop entitled SystemLook.txt

SystemLook v1.0 by jpshortstuff (29.08.09)
Log created at 12:51 on 21/12/2009 by Babetribute (Administrator - Elevation successful)

========== filefind ==========

Searching for "proquota.exe"
C:\WINDOWS\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\proquota.exe --a--- 50176 bytes [06:37 01/09/2008] [00:12 14/04/2008] F6465A2EEF75468988A4FCF124148FA8

-=End Of File=-

ComboFix 09-12-20.08 - Babetribute 12/21/2009 13:05:18.2.2 - x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.895.483 [GMT -7:00]
Running from: c:\documents and settings\Babetribute\My Documents\Btcomet downloads\music\Combo-Fix.exe
Command switches used :: c:\documents and settings\Babetribute\My Documents\Btcomet downloads\music\CFScript.txt
AV: Norton Internet Security *On-access scanning disabled* (Updated) {E10A9785-9598-4754-B552-92431C1C35F8}
FW: Norton Internet Security *disabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
--------------- FCopy ---------------

c:\windows\SoftwareDistribution\Download\cf8ec753e88561d2ddb53e183dc05c3e\proquota.exe --> c:\windows\system32\proquota.exe
.
((((((((((((((((((((((((( Files Created from 2009-11-21 to 2009-12-21 )))))))))))))))))))))))))))))))
.

2009-12-21 20:05 . 2008-04-14 00:12 50176 ----a-w- c:\windows\system32\proquota.exe
2009-12-21 17:51 . 2009-12-21 19:56 -------- d-----w- c:\documents and settings\Babetribute\Local Settings\Application Data\Tific
2009-12-21 17:51 . 2009-12-21 17:51 -------- d-----w- c:\documents and settings\Babetribute\Application Data\Tific
2009-12-21 17:51 . 2009-12-21 17:51 -------- d-----w- c:\documents and settings\Babetribute\Local Settings\Application Data\Symantec
2009-12-21 14:52 . 2009-12-21 14:54 -------- d-----w- C:\Combo-Fix
2009-12-21 14:47 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSXpx86.sys
2009-12-21 14:47 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\Scxpx86.dll
2009-12-21 14:47 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSxpx86.dll
2009-12-21 14:47 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSvix86.sys
2009-12-21 14:47 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSviA64.sys
2009-12-21 14:46 . 2009-12-21 14:46 84912 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\naveng.sys
2009-12-21 14:46 . 2009-12-21 14:46 371248 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\eeCtrl.sys
2009-12-21 14:46 . 2009-12-21 14:46 259440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\ecmsvr32.dll
2009-12-21 14:46 . 2009-12-21 14:46 177520 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\naveng32.dll
2009-12-21 14:46 . 2009-12-21 14:46 1647984 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\navex32a.dll
2009-12-21 14:46 . 2009-12-21 14:46 1323568 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\navex15.sys
2009-12-21 14:46 . 2009-12-21 14:46 102448 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\eraser.sys
2009-12-21 14:46 . 2009-12-21 14:46 2747440 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\VirusDefs\20091220.020\cceraser.dll
2009-12-20 19:21 . 2009-10-29 02:31 784752 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\coFFPlgn\components\coFFPlgn.dll
2009-12-20 18:56 . 2009-12-03 23:14 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-12-20 18:56 . 2009-12-03 23:13 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-12-20 18:51 . 2009-12-20 18:51 -------- d-sh--w- c:\documents and settings\Babetribute\IECompatCache
2009-12-20 18:50 . 2009-12-20 18:50 -------- d-sh--w- c:\documents and settings\Babetribute\PrivacIE
2009-12-20 18:49 . 2009-12-20 18:49 -------- d-sh--w- c:\documents and settings\Babetribute\IETldCache
2009-12-20 18:42 . 2009-10-29 07:45 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-12-20 18:42 . 2009-10-29 07:45 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-12-20 18:42 . 2009-12-20 18:42 -------- d-----w- c:\windows\ie8updates
2009-12-20 18:41 . 2009-10-02 04:44 92160 -c----w- c:\windows\system32\dllcache\iecompat.dll
2009-12-20 18:38 . 2009-12-20 18:40 -------- dc-h--w- c:\windows\ie8
2009-12-20 18:15 . 2009-12-20 18:15 -------- d-----w- C:\ebf1e9b4da87530663b254f9
2009-12-20 18:15 . 2009-12-20 18:15 -------- d-----w- c:\windows\ServicePackFiles
2009-12-20 18:14 . 2004-08-03 23:56 221184 ----a-w- c:\windows\system32\wmpns.dll
2009-12-20 11:35 . 2009-10-20 14:41 265728 -c----w- c:\windows\system32\dllcache\http.sys
2009-12-19 15:38 . 2009-12-19 15:38 -------- d-----w- C:\641f693cddf95a8ef2b1415225
2009-12-18 14:19 . 2009-12-20 18:56 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-12-18 13:32 . 2009-12-18 13:32 -------- d-----w- c:\program files\RegistryFix7
2009-12-18 13:13 . 2009-06-09 14:53 53248 -c----w- c:\windows\system32\dllcache\tsgqec.dll
2009-12-18 13:13 . 2009-06-09 14:53 290816 -c----w- c:\windows\system32\dllcache\rhttpaa.dll
2009-12-18 13:13 . 2009-06-09 14:53 136192 -c----w- c:\windows\system32\dllcache\aaclient.dll
2009-12-17 02:28 . 2009-12-18 12:41 -------- d-----w- C:\Desktop
2009-12-16 23:21 . 2009-12-16 23:21 152576 ----a-w- c:\documents and settings\Babetribute\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2009-12-16 15:17 . 2009-12-16 15:17 79488 ----a-w- c:\documents and settings\Babetribute\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-05 04:54 . 2009-12-05 04:54 529456 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHDrvx86.sys
2009-12-05 04:54 . 2009-12-05 04:54 201616 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHRules.dll
2009-12-05 04:54 . 2009-12-05 04:54 1405840 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHEngine.dll
2009-12-05 04:54 . 2009-12-05 04:54 668720 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\BHDrvx64.sys
2009-12-05 04:54 . 2009-12-05 04:54 610704 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\BASHDefs\20091205.001\bbRGen.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-12-21 19:56 . 2009-12-20 19:20 965488 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\OCS\hsplayer.dll
2009-12-21 18:24 . 2007-08-31 21:47 -------- d-----w- c:\program files\QuickTime
2009-12-20 19:23 . 2009-12-20 19:20 -------- d-----w- c:\program files\Common Files\Symantec Shared
2009-12-20 19:21 . 2009-12-20 19:13 -------- d-----w- c:\documents and settings\All Users\Application Data\Norton
2009-10-29 07:45 . 2007-01-16 20:07 916480 ------w- c:\windows\system32\wininet.dll
2009-10-28 22:37 . 2009-10-28 22:37 343088 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSvix86.sys
2009-10-28 22:37 . 2009-10-28 22:37 329592 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSXpx86.sys
2009-10-28 22:37 . 2009-10-28 22:37 811896 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\Scxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 488312 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSxpx86.dll
2009-10-28 22:37 . 2009-10-28 22:37 466992 ----a-w- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\BinHub\IDSviA64.sys
2009-10-27 03:15 . 2009-10-27 03:15 127872 ----a-w- c:\documents and settings\Babetribute\Application Data\Move Networks\uninstall.exe
2009-10-27 03:15 . 2008-09-21 20:02 -------- d-----w- c:\documents and settings\Babetribute\Application Data\Move Networks
2009-10-27 03:15 . 2009-06-16 06:35 4183416 ----a-w- c:\documents and settings\Babetribute\Application Data\Move Networks\plugins\npqmp071503000010.dll
2009-10-27 03:15 . 2009-10-27 03:14 1686272 ----a-w- c:\documents and settings\Babetribute\Application Data\Move Networks\MoveMediaPlayerWin_071503000010.exe
2009-10-21 05:50 . 2004-08-03 23:56 75776 ----a-w- c:\windows\system32\strmfilt.dll
2009-10-21 05:50 . 2004-08-03 23:56 25088 ----a-w- c:\windows\system32\httpapi.dll
2009-10-20 14:41 . 2007-01-16 20:05 265728 ----a-w- c:\windows\system32\drivers\http.sys
2009-10-13 10:45 . 2007-01-16 20:06 270336 ----a-w- c:\windows\system32\oakley.dll
2009-10-12 13:54 . 2004-08-03 23:56 69632 ----a-w- c:\windows\system32\raschap.dll
2009-10-12 13:54 . 2004-08-03 23:56 112128 ----a-w- c:\windows\system32\rastls.dll
2009-10-11 11:17 . 2008-11-29 15:51 411368 ----a-w- c:\windows\system32\deploytk.dll
2009-10-01 09:19 . 2009-12-20 19:21 164216 ----a-r- c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\IPSFFPlgn\components\IPSFFPl.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "c:\program files\Winamp Toolbar\winamptb.dll" [2008-03-19 1267040]

[HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8600AC1E-BE58-4FFC-BD5D-F2A8EC38C838}]
2007-09-15 15:38 311296 ----a-w- c:\program files\Snap Visual Search\snapbar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-02 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HostManager"="c:\program files\Common Files\AOL\1188534385\ee\AOLSoftware.exe" [2008-06-24 41824]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"RoxioDragToDisc"="c:\program files\Roxio\Easy Media Creator 8\Drag to Disc\DrgToDsc.exe" [2005-09-19 1687552]
"RoxWatchTray"="c:\program files\Common Files\Roxio Shared\SharedCOM8\RoxWatchTray.exe" [2005-09-19 163840]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-09-04 111936]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"UVS12 Preload"="c:\program files\Corel\Corel VideoStudio 12\uvPL.exe" [2008-06-09 397456]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-11 149280]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-10-03 35696]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2009-09-04 935288]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-8-30 113664]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2007-8-30 389120]

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\aol\\acs\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\aol\\acs\\AOLacsd.exe"=
"c:\\Program Files\\Common Files\\aol\\1188534385\\ee\\aolsoftware.exe"=
"c:\\Program Files\\AOL 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\aol\\TopSpeed\\3.0\\aoltpsd3.exe"=
"c:\\Program Files\\Common Files\\aol\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\aol\\System Information\\sinf.exe"=
"c:\\Program Files\\AOL 9.1\\waol.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Macromedia\\Dreamweaver 8\\Dreamweaver.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Roxio\\Easy Media Creator 8\\Digital Home\\RoxUpnpServer.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"8603:TCP"= 8603:TCP:BitComet 8603 TCP
"8603:UDP"= 8603:UDP:BitComet 8603 UDP

R0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NIS\1101000.013\SymDS.sys [12/20/2009 12:20 PM 328752]
R0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NIS\1101000.013\SymEFA.sys [12/20/2009 12:20 PM 171056]
R1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NIS\1101000.013\cchpx86.sys [12/20/2009 12:20 PM 501888]
R1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NIS\1101000.013\Ironx86.sys [12/20/2009 12:20 PM 114736]
R2 NIS;Norton Internet Security;c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe [12/20/2009 12:20 PM 126392]
R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [12/20/2009 12:20 PM 102448]
R3 IDSxpx86;IDSxpx86;c:\documents and settings\All Users\Application Data\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.1.0.19\Definitions\IPSDefs\20091217.002\IDSXpx86.sys [12/21/2009 7:47 AM 329592]
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: &AOL Toolbar Search - c:\program files\aol\aol toolbar 5.0\resources\en-US\local\search.html
IE: &D&ownload &with BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm
IE: &D&ownload all video with BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm
IE: &D&ownload all with BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm
IE: &Search
IE: &Winamp Search - c:\documents and settings\All Users\Application Data\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_60D6097707281E79.dll/cmsidewiki.html
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-12-21 13:09
Windows 5.1.2600 Service Pack 2 NTFS

scanning hȋdden processes ...

scanning hȋdden autostart entries ...

scanning hȋdden files ...

scan completed successfully
hȋdden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\NIS]
"ImagePath"="\"c:\program files\Norton Internet Security\Engine\17.1.0.19\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files\Norton Internet Security\Engine\17.1.0.19\diMaster.dll\" /prefetch:1"
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(796)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(280)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-12-21 13:11:01
ComboFix-quarantined-files.txt 2009-12-21 20:10
ComboFix2.txt 2009-12-21 17:45

Pre-Run: 41,236,336,640 bytes free
Post-Run: 41,205,211,136 bytes free

- - End Of File - - FBAAD95E78DB6DCC958D97B4C2C0DEF9

Click Start > Run and copy/paste the following bolded text into the Run box and click OK:

ComboFix /uninstall

This will also reset your restore points.

How is the machine running now?

Much faster and cleaner! Thanks!