pc wont connect after 18 infections removed by malewarebytes

my home computer wont connect to internet please help. ive included combofix and malewarbytes log files. Thanks.
combofix: ComboFix 10-10-01.06 - chris 10/02/2010 10:53:40.1.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3191.2244 [GMT -4:00]
Running from: c:\documents and settings\chris\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Movavi
c:\documents and settings\All Users\Application Data\Movavi\iCopy.ini
c:\documents and settings\chris\Application Data\Etofo\riax.exe
c:\windows\system32\11478.exe
c:\windows\system32\11538.exe
c:\windows\system32\11942.exe
c:\windows\system32\12382.exe
c:\windows\system32\14604.exe
c:\windows\system32\14771.exe
c:\windows\system32\153.exe
c:\windows\system32\15724.exe
c:\windows\system32\16827.exe
c:\windows\system32\17035.exe
c:\windows\system32\17421.exe
c:\windows\system32\18467.exe
c:\windows\system32\1869.exe
c:\windows\system32\18716.exe
c:\windows\system32\19169.exe
c:\windows\system32\19718.exe
c:\windows\system32\19895.exe
c:\windows\system32\19912.exe
c:\windows\system32\21726.exe
c:\windows\system32\23281.exe
c:\windows\system32\24464.exe
c:\windows\system32\25667.exe
c:\windows\system32\26299.exe
c:\windows\system32\26500.exe
c:\windows\system32\26962.exe
c:\windows\system32\28145.exe
c:\windows\system32\292.exe
c:\windows\system32\29358.exe
c:\windows\system32\2995.exe
c:\windows\system32\32391.exe
c:\windows\system32\3902.exe
c:\windows\system32\41.exe
c:\windows\system32\4827.exe
c:\windows\system32\491.exe
c:\windows\system32\5436.exe
c:\windows\system32\5447.exe
c:\windows\system32\5705.exe
c:\windows\system32\6334.exe
c:\windows\system32\9894.exe
c:\windows\system32\9961.exe
c:\windows\Tasks\rzajtvfd.job

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IAS
-------\Legacy_WINSTS


((((((((((((((((((((((((( Files Created from 2010-09-02 to 2010-10-02 )))))))))))))))))))))))))))))))
.

2010-10-02 14:18 . 2010-04-29 19:39 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-10-02 14:18 . 2010-04-29 19:39 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-10-02 14:10 . 2010-10-02 14:10 -------- d-----w- c:\windows\system32\wbem\Repository
2010-10-02 13:19 . 2010-10-02 13:47 -------- d-----w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-10-02 13:19 . 2009-10-23 07:00 -------- d-----w- c:\documents and settings\Administrator\IETldCache
2010-10-02 13:19 . 2010-10-02 13:47 -------- d-s---w- c:\documents and settings\Administrator
2010-10-01 00:46 . 2010-10-01 00:46 -------- d-----w- c:\program files\iPod
2010-10-01 00:42 . 2010-10-01 00:42 -------- d-----w- c:\program files\QuickTime
2010-10-01 00:40 . 2010-10-01 00:40 -------- d-----w- c:\program files\Bonjour
2010-10-01 00:38 . 2010-10-01 00:38 73000 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 10.0.1.22\SetupAdmin.exe
2010-10-01 00:33 . 2010-10-01 00:33 72488 ----a-w- c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\Safari 5.33.18.5\SetupAdmin.exe
2010-09-04 19:42 . 2010-09-04 19:42 -------- d-----w- c:\program files\Trihedral

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-10-02 17:39 . 2009-12-15 00:04 -------- d-----w- c:\documents and settings\chris\Application Data\Skype
2010-10-02 15:00 . 2009-09-24 01:11 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-10-02 14:46 . 2010-01-09 20:41 -------- d-----w- c:\program files\Spyware Doctor
2010-10-02 14:36 . 2009-10-21 23:46 -------- d-----w- c:\program files\NCH Software
2010-10-02 14:32 . 2009-10-29 22:23 -------- d-----w- c:\program files\Common Files\Factoid
2010-10-02 14:21 . 2009-09-23 01:37 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2010-10-02 14:18 . 2010-01-09 20:07 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-10-02 13:47 . 2009-09-24 01:06 -------- d-----w- c:\documents and settings\chris\Application Data\uTorrent
2010-10-02 13:36 . 2009-09-24 01:01 -------- d-----w- c:\documents and settings\chris\Application Data\skypePM
2010-10-01 00:47 . 2010-06-22 00:58 -------- d-----w- c:\program files\iTunes
2010-10-01 00:46 . 2009-09-23 01:38 -------- d-----w- c:\program files\Common Files\Apple
2010-10-01 00:36 . 2009-09-23 01:37 -------- d-----w- c:\program files\Safari
2010-10-01 00:14 . 2009-12-05 14:43 -------- d-----w- c:\program files\Paint Shop Pro 5
2010-09-25 17:40 . 2009-09-24 01:07 -------- d-----w- c:\program files\uTorrent
2010-09-11 19:41 . 2010-04-09 20:59 -------- d-----w- c:\documents and settings\chris\Application Data\GRLevel3
2010-08-31 16:11 . 2010-08-31 16:11 3401880 ----a-w- c:\documents and settings\chris\Application Data\Mozilla\plugins\npgtpo3dautoplugin.dll
2010-08-31 15:55 . 2010-08-31 15:55 275096 ----a-w- c:\documents and settings\chris\Application Data\Mozilla\plugins\npgoogletalk.dll
2010-08-31 15:39 . 2010-08-31 15:39 3734536 ----a-w- c:\documents and settings\chris\Application Data\Mozilla\plugins\Google Talk Plugin Extras\d3dx9_36.dll
2010-08-31 00:02 . 2010-06-02 17:30 -------- d-----w- c:\documents and settings\chris\Application Data\Ohekg
2010-08-23 04:00 . 2010-03-23 10:23 -------- d-----w- c:\documents and settings\chris\Application Data\Etofo
2010-08-21 20:21 . 2010-08-21 20:21 -------- d-----w- c:\program files\Common Files\Java
2010-08-21 20:21 . 2010-04-06 22:50 -------- d-----w- c:\program files\Java
2010-08-09 01:26 . 2010-08-09 01:26 503808 ----a-w- c:\documents and settings\chris\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3e0c89ce-n\msvcp71.dll
2010-08-09 01:26 . 2010-08-09 01:26 499712 ----a-w- c:\documents and settings\chris\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3e0c89ce-n\jmc.dll
2010-08-09 01:26 . 2010-08-09 01:26 61440 ----a-w- c:\documents and settings\chris\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5257f033-n\decora-sse.dll
2010-08-09 01:26 . 2010-08-09 01:26 12800 ----a-w- c:\documents and settings\chris\Application Data\Sun\Java\Deployment\SystemCache\6.0\42\4488892a-5257f033-n\decora-d3d.dll
2010-08-09 01:26 . 2010-08-09 01:26 348160 ----a-w- c:\documents and settings\chris\Application Data\Sun\Java\Deployment\SystemCache\6.0\4\7ec4bf04-3e0c89ce-n\msvcr71.dll
2010-07-27 22:44 . 2010-07-27 22:44 91424 ----a-w- c:\windows\system32\dnssd.dll
2010-07-27 22:44 . 2010-07-27 22:44 107808 ----a-w- c:\windows\system32\dns-sd.exe
2010-07-17 09:00 . 2010-08-21 20:21 423656 ----a-w- c:\windows\system32\deployJava1.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 18:01 1230080 ----a-w- c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "c:\program files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-08-20 2363392]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-16 24264488]
"Google Update"="c:\documents and settings\chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-06-14 136176]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2010-07-10 2048352]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 31072]
"LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912]
"VX3000"="c:\windows\vVX3000.exe" [2007-04-10 709992]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 2807808]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-11-02 155648]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2004-11-02 126976]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 110592]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 221184]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 81920]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"FinePrint Dispatcher v5"="c:\windows\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2008-04-18 520192]
"pdfFactory Pro Dispatcher v2"="c:\windows\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" [2007-01-29 507904]
"AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 47392]
"IntelliPoint"="c:\program files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 1468296]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 1135912]
"googletalk"="c:\program files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2010-09-08 421888]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-09-24 421160]

c:\documents and settings\chris\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - c:\program files\Microsoft Office\Office12\GROOVE.EXE [2009-2-14 337264]
OneNote 2007 Screen Clipper and Launcher.lnk - c:\program files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - c:\program files\InterVideo\Common\Bin\WinCinemaMgr.exe [2009-11-14 98304]
Windows Search.lnk - c:\program files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
WinZip Quick Pick.lnk - c:\program files\WinZip\WZQKPICK.EXE [2009-1-14 525664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-23 01:18 11952 ----a-w- c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\N:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"c:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgtray.exe"=
"c:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"c:\\Documents and Settings\\chris\\Desktop\\f0recast-1.0.2.exe"=
"c:\\Program Files\\Safari\\Safari.exe"=
"c:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"c:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19164:TCP"= 19164:TCP:utorrent
"62293:TCP"= 62293:TCP:u torrent

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [1/9/2010 4:41 PM 207792]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/22/2009 9:18 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/22/2009 9:18 PM 108552]
R2 ArcGIS License Manager;ArcGIS License Manager;c:\progra~1\ESRI\License\arcgis9x\lmgrd.exe [1/8/2010 5:51 PM 467968]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [9/22/2009 9:18 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/22/2009 9:18 PM 297752]
R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\Spyware Doctor\BDT\BDTUpdateService.exe [1/9/2010 4:47 PM 112592]
S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [1/9/2010 6:20 PM 135664]
S2 Iprip;Network Security;c:\windows\System32\svchost.exe -k netsvcs [8/29/2002 8:00 AM 14336]
S3 ndisdrv;ndisdrv;\??\c:\windows\system32\ndisdrv.sys --> c:\windows\system32\ndisdrv.sys [?]
S3 Netaapl;Apple Mobile Device Ethernet Service;c:\windows\system32\drivers\netaapl.sys [9/22/2009 9:38 PM 17408]
S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\Spyware Doctor\pctsAuxs.exe [1/9/2010 4:41 PM 359624]
S3 USA19W;USA19W;c:\windows\system32\drivers\usa19w2k.sys [11/26/2009 8:31 PM 292920]
S3 USA19w2KP;Keyspan High Speed USB Serial Adapter Port Driver;c:\windows\system32\drivers\usa19w2kp.sys [11/26/2009 8:31 PM 40848]
S3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [5/14/2010 5:47 PM 11520]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 17:24 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-09-29 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-09 22:20]

2010-10-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-01-09 22:20]

2010-10-01 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-220523388-725345543-1003Core.job
- c:\documents and settings\chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-18 23:44]

2010-10-02 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-220523388-725345543-1003UA.job
- c:\documents and settings\chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-18 23:44]

2010-10-02 c:\windows\Tasks\zuluSevenDays.job
- c:\program files\NCH Software\Zulu\zulu.exe [2010-10-02 14:36]

2010-10-02 c:\windows\Tasks\zuluShakeIcon.job
- c:\program files\NCH Software\Zulu\zulu.exe [2010-10-02 14:36]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A753E183-622F-42B1-A57F-F351B88E97D9} = 192.168.0.1,192.168.1.1
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {6CA42F3D-70D6-11D3-A44D-00104B9D101F} - hxxp://207.98.148.167/vtsx/distribution/vtsx.cab
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
HKCU-Run-Weather - c:\program files\AWS\WeatherBug\Weather.exe
HKCU-Run-{0A3E2721-9C26-C637-EAF1-F82B7628B51B} - c:\documents and settings\chris\Application Data\Etofo\riax.exe
SharedTaskScheduler-{54807c78-3204-45dc-805d-93c0e6c25db0} - c:\windows\system32\kotefupu.dll
SSODL-jahuzajuv-{54807c78-3204-45dc-805d-93c0e6c25db0} - c:\windows\system32\kotefupu.dll
AddRemove-LSI Soft Modem - c:\windows\agrsmdel
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files\DivX\DivXCodecUninstall.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-10-02 13:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2052)
c:\windows\system32\WININET.dll
c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
c:\windows\system32\ieframe.dll
c:\program files\Common Files\Microsoft Shared\OFFICE12\MSOXEV.DLL
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\LSI SoftModem\agrsmsvc.exe
c:\program files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\progra~1\ESRI\License\arcgis9x\ARCGIS.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\program files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
c:\progra~1\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\SearchIndexer.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\SOUNDMAN.EXE
c:\windows\ALCWZRD.EXE
c:\windows\system32\rundll32.exe
c:\program files\Microsoft IntelliPoint\dpupdchk.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-10-02 13:43:54 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-02 17:43

Pre-Run: 863,846,195,200 bytes free
Post-Run: 866,032,623,616 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn

- - End Of File - - E42E337CB5F1A5B3838536093185FF21
malewarebytes log :Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4052

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10/10/2010 11:24:19 AM
mbam-log-2010-10-10 (11-24-19).txt

Scan type: Quick scan
Objects scanned: 143979
Time elapsed: 9 minute(s), 18 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 7
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\CLSID\{14c2cf97-6896-40d0-bc64-e3dceb8e8ebb} (Trojan.FakeAlert.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\F5JMWNZTHI (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\winsts (Backdoor.Bot) -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ndisdrv (Trojan.Agent) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\ROUA3O12PW (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\ididp (Trojan.Sasfis) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\tikobuvev (Trojan.Vundo.H) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\factoidclass (Trojan.FakeAlert.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\f5jmwnzthi (Trojan.FakeAlert) -> No action taken.
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\AppCertDlls\appsecdll (Spyware.Passwords) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\uid (Malware.Trace) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WBEM\updatenew (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\roua3o12pw (Trojan.FakeAlert) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.11,93.188.161.63 -> No action taken.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{bc4f9e2f-f48d-404e-81a8-29be7d7343d7}\NameServer (Trojan.DNSChanger) -> Data: 93.188.162.11,93.188.161.63 -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Common Files\Factoid\FactoidClass.dll (Trojan.FakeAlert.H) -> No action taken.
C:\fwihed.exe (Trojan.Dropper) -> No action taken.
C:\WINDOWS\system32\41.exe (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\flags.ini (Malware.Trace) -> No action taken.

Hello.

1. Close any open browsers.
   
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
   
3. Open notepad and copy/paste the text in the quotebox below into it:
   

   Code:

   
KILLALL::

Folder::
c:\documents and settings\chris\Application Data\Ohekg
c:\documents and settings\chris\Application Data\Etofo

Driver::
Iprip
ndisdrv

   
   
4. Save this as CFScript.txt, in the same location as ComboFix.exe
   
   
   
   
5. Referring to the picture above, drag CFScript into ComboFix.exe
   
6. When finished, it shall produce a log for you at C:\ComboFix.txt
   
7. Please post the contents of the log in your next reply.
   

ok thanks, i wil try this tomorrow after work and post my results. Thanks for your help!!

Okay, standing by.

here are the results

ComboFix 10-10-11.01 - chris 10/11/2010 18:35:08.2.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3191.2157 [GMT -4:00]
Running from: C:\Documents and Settings\chris\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\chris\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Movavi
C:\Documents and Settings\All Users\Application Data\Movavi\iCopy.ini
c:\documents and settings\chris\Application Data\Etofo
C:\Documents and Settings\chris\Application Data\Etofo\riax.exe
c:\documents and settings\chris\Application Data\Ohekg
c:\documents and settings\chris\Application Data\Ohekg\obitl.tmp
C:\WINDOWS\system32\11478.exe
C:\WINDOWS\system32\11538.exe
C:\WINDOWS\system32\11942.exe
C:\WINDOWS\system32\12382.exe
C:\WINDOWS\system32\14604.exe
C:\WINDOWS\system32\14771.exe
C:\WINDOWS\system32\153.exe
C:\WINDOWS\system32\15724.exe
C:\WINDOWS\system32\16827.exe
C:\WINDOWS\system32\17035.exe
C:\WINDOWS\system32\17421.exe
C:\WINDOWS\system32\18467.exe
C:\WINDOWS\system32\1869.exe
C:\WINDOWS\system32\18716.exe
C:\WINDOWS\system32\19169.exe
C:\WINDOWS\system32\19718.exe
C:\WINDOWS\system32\19895.exe
C:\WINDOWS\system32\19912.exe
C:\WINDOWS\system32\21726.exe
C:\WINDOWS\system32\23281.exe
C:\WINDOWS\system32\24464.exe
C:\WINDOWS\system32\25667.exe
C:\WINDOWS\system32\26299.exe
C:\WINDOWS\system32\26500.exe
C:\WINDOWS\system32\26962.exe
C:\WINDOWS\system32\28145.exe
C:\WINDOWS\system32\292.exe
C:\WINDOWS\system32\29358.exe
C:\WINDOWS\system32\2995.exe
C:\WINDOWS\system32\32391.exe
C:\WINDOWS\system32\3902.exe
C:\WINDOWS\system32\4827.exe
C:\WINDOWS\system32\491.exe
C:\WINDOWS\system32\5436.exe
C:\WINDOWS\system32\5447.exe
C:\WINDOWS\system32\5705.exe
C:\WINDOWS\system32\6334.exe
C:\WINDOWS\system32\9894.exe
C:\WINDOWS\system32\9961.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_IAS
-------\Legacy_IPRIP
-------\Legacy_NDISDRV
-------\Legacy_WINSTS
-------\Service_Iprip


((((((((((((((((((((((((( Files Created from 2010-09-11 to 2010-10-11 )))))))))))))))))))))))))))))))
.

2010-10-10 15:13:09 . 2010-04-29 19:39:38 38224 ----a-w- C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2010-10-10 15:13:07 . 2010-04-29 19:39:26 20952 ----a-w- C:\WINDOWS\system32\drivers\mbam.sys
2010-10-04 01:01:49 . 2010-10-04 01:01:49 -------- d-----w- C:\WINDOWS\system32\wbem\Repository
2010-10-04 01:00:25 . 2010-10-04 01:00:26 -------- d-----w- C:\Program Files\Bonjour
2010-10-04 01:00:03 . 2010-10-04 01:00:14 -------- d-----w- C:\Program Files\QuickTime
2010-10-04 00:59:08 . 2010-10-04 00:59:08 -------- d-----w- C:\Program Files\iPod
2010-10-02 13:19:24 . 2010-10-04 00:42:01 -------- d-s---w- C:\Documents and Settings\Administrator

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.

((((((((((((((((((((((((((((( SnapShot@2010-10-10_16.39.38 )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-10-11 22:42:17 . 2010-10-11 22:42:17 16384 C:\WINDOWS\temp\Perflib_Perfdata_720.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{A3BC75A2-1F87-4686-AA43-5347D756017C}"= "C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 18:01:54 1230080]

[HKEY_CLASSES_ROOT\clsid\{a3bc75a2-1f87-4686-aa43-5347d756017c}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A3BC75A2-1F87-4686-AA43-5347D756017C}]
2009-11-25 18:01:54 1230080 ----a-w- C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 18:01:54 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{CCC7A320-B3CA-4199-B1A6-9F516DD69829}"= "C:\Program Files\AVG\AVG8\Toolbar\IEToolbar.dll" [2009-11-25 18:01:54 1230080]

[HKEY_CLASSES_ROOT\clsid\{ccc7a320-b3ca-4199-b1a6-9f516dd69829}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2009-08-20 17:25:58 2363392]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2009-04-16 18:36:36 24264488]
"Weather"="C:\Program Files\AWS\WeatherBug\Weather.exe" [BU]
"Google Update"="C:\Documents and Settings\chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2010-06-14 23:44:44 136176]
"{0A3E2721-9C26-C637-EAF1-F82B7628B51B}"="C:\Documents and Settings\chris\Application Data\Etofo\riax.exe" [BU]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 00:12:16 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2010-07-10 13:33:32 2048352]
"GrooveMonitor"="C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [2008-10-25 16:44:34 31072]
"LifeCam"="C:\Program Files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 21:45:32 279912]
"VX3000"="C:\WINDOWS\vVX3000.exe" [2007-04-10 21:46:48 709992]
"SoundMan"="SOUNDMAN.EXE" [2005-09-21 14:24:02 86016]
"AlcWzrd"="ALCWZRD.EXE" [2005-09-21 19:32:56 2807808]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-11-02 13:03:44 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-11-02 12:59:42 126976]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2008-04-14 00:12:42 110592]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 20:50:42 221184]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 20:50:18 81920]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 15:50:42 155648]
"FinePrint Dispatcher v5"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fpdisp5a.exe" [2008-04-18 17:15:36 520192]
"pdfFactory Pro Dispatcher v2"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\fppdis2a.exe" [2007-01-29 23:03:31 507904]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2010-04-13 06:29:02 47392]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2009-05-26 19:16:31 1468296]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 05:42:51 36272]
"Adobe ARM"="C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-09-21 18:37:40 932288]
"DivXUpdate"="C:\Program Files\DivX\DivX Update\DivXUpdate.exe" [2010-04-12 22:46:36 1135912]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2010-03-18 01:53:36 421888]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2010-06-15 20:33:44 141624]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 21:22:02 3739648]
"SunJavaUpdateSched"="C:\Program Files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 15:44:46 248552]

C:\Documents and Settings\chris\Start Menu\Programs\Startup\
Microsoft Office Groove.lnk - C:\Program Files\Microsoft Office\Office12\GROOVE.EXE [2009-2-14 337264]
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2008-10-25 98696]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2009-11-14 98304]
Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe [2008-5-26 123904]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2009-1-14 525664]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{54807c78-3204-45dc-805d-93c0e6c25db0}"= "c:\windows\system32\kotefupu.dll" [BU]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 02:41:34 304128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"jahuzajuv"= {54807c78-3204-45dc-805d-93c0e6c25db0} - c:\windows\system32\kotefupu.dll [BU]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-09-23 01:18:30 11952 ----a-w- C:\WINDOWS\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk /r \??\N:\0autocheck autochk *

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"C:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"C:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=
"C:\\Program Files\\PFPortChecker\\PFPortChecker.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgtray.exe"=
"C:\\Program Files\\Common Files\\SafeNet Sentinel\\Sentinel Protection Server\\WinNT\\spnsrvnt.exe"=
"C:\\Documents and Settings\\chris\\Desktop\\f0recast-1.0.2.exe"=
"C:\\Program Files\\Safari\\Safari.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"19164:TCP"= 19164:TCP:utorrent
"62293:TCP"= 62293:TCP:u torrent

R0 PCTCore;PCTools KDS;C:\WINDOWS\system32\drivers\PCTCore.sys [1/9/2010 4:41:58 PM 207792]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\drivers\avgldx86.sys [9/22/2009 9:18:25 PM 335240]
R1 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\drivers\avgtdix.sys [9/22/2009 9:18:30 PM 108552]
R2 ArcGIS License Manager;ArcGIS License Manager;C:\PROGRA~1\ESRI\License\arcgis9x\lmgrd.exe [1/8/2010 5:51:46 PM 467968]
R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [9/22/2009 9:18:06 PM 908056]
R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [9/22/2009 9:18:05 PM 297752]
R2 Browser Defender Update Service;Browser Defender Update Service;C:\Program Files\Spyware Doctor\BDT\BDTUpdateService.exe [1/9/2010 4:47:29 PM 112592]
S2 gupdate;Google Update Service (gupdate);C:\Program Files\Google\Update\GoogleUpdate.exe [1/9/2010 6:20:49 PM 135664]
S3 Netaapl;Apple Mobile Device Ethernet Service;C:\WINDOWS\system32\drivers\netaapl.sys [9/22/2009 9:38:45 PM 17408]
S3 sdAuxService;PC Tools Auxiliary Service;C:\Program Files\Spyware Doctor\pctsAuxs.exe [1/9/2010 4:41:46 PM 359624]
S3 USA19W;USA19W;C:\WINDOWS\system32\drivers\usa19w2k.sys [11/26/2009 8:31:04 PM 292920]
S3 USA19w2KP;Keyspan High Speed USB Serial Adapter Port Driver;C:\WINDOWS\system32\drivers\usa19w2kp.sys [11/26/2009 8:31:04 PM 40848]
S3 WDC_SAM;WD SCSI Pass Thru driver;C:\WINDOWS\system32\drivers\wdcsam.sys [5/14/2010 5:47:23 PM 11520]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2009-08-20 17:24:06 451872 ----a-w- C:\Program Files\Common Files\LightScribe\LSRunOnce.exe
.
Contents of the 'Scheduled Tasks' folder

2010-10-06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34:12 . 2008-07-30 16:34:12]

2010-10-11 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineCore.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-09 22:20:49 . 2010-01-09 22:20:35]

2010-10-10 C:\WINDOWS\Tasks\GoogleUpdateTaskMachineUA.job
- C:\Program Files\Google\Update\GoogleUpdate.exe [2010-01-09 22:20:49 . 2010-01-09 22:20:35]

2010-10-09 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-220523388-725345543-1003Core.job
- C:\Documents and Settings\chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-18 19:04:56 . 2010-06-14 23:44:44]

2010-10-10 C:\WINDOWS\Tasks\GoogleUpdateTaskUserS-1-5-21-1844237615-220523388-725345543-1003UA.job
- C:\Documents and Settings\chris\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2010-07-18 19:04:56 . 2010-06-14 23:44:44]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uInternet Settings,ProxyOverride = *.local
IE: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {A753E183-622F-42B1-A57F-F351B88E97D9} = 192.168.0.1,192.168.1.1
DPF: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
DPF: {6CA42F3D-70D6-11D3-A44D-00104B9D101F} - hxxp://207.98.148.167/vtsx/distribution/vtsx.cab
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)


.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3680)
C:\WINDOWS\system32\WININET.dll
C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.4053_x-ww_e6967989\MSVCR80.dll
C:\WINDOWS\system32\ieframe.dll
C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXEV.DLL
C:\WINDOWS\system32\webcheck.dll
C:\WINDOWS\system32\WPDShServiceObj.dll
C:\WINDOWS\system32\PortableDeviceTypes.dll
C:\WINDOWS\system32\PortableDeviceApi.dll
C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll
C:\Program Files\Epson Software\Easy Photo Print\EPTBL.dll
C:\Program Files\Microsoft Office\Office12\1033\GrooveIntlResource.dll
C:\WINDOWS\system32\wpdshext.dll
C:\WINDOWS\system32\Audiodev.dll
C:\WINDOWS\system32\WMVCore.DLL
C:\WINDOWS\system32\WMASF.DLL
C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
C:\Program Files\WinZip\wzshlstb.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\LSI SoftModem\agrsmsvc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\ESRI\License\arcgis9x\ARCGIS.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\Program Files\Common Files\SafeNet Sentinel\Sentinel Protection Server\WinNT\spnsrvnt.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\ALCWZRD.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Microsoft IntelliPoint\dpupdchk.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
.
**************************************************************************
.
Completion time: 2010-10-11 18:47:23 - machine was rebooted
ComboFix-quarantined-files.txt 2010-10-11 22:47:21
ComboFix2.txt 2010-10-02 17:43:55

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

try to update and came up with this message: MBAM_ERROR_UPDATING(12007,0,WINHTTPSENDREQUEST)

mbam wont allow me to update :< :sad:

Hello.
Are you on a router? I'm thinking your router has been hijacked by the malware and will require a manual restart back to factory default.

ok, is that possible as im on my laptop now using same router? im deffinately not a tech guy so any and all help is appreciated
when you say that it needs a reset to factory, will that kill my current password to connect wirelessly? how would i do a factory reset/ restore? thanking you in advance for your time

Hello.
I'll try break this down for you.

The router works by connecting to your ISP's DNS servers, well the malware has changed that to work on the bad guys DNS servers and the only way of fixing that is doing a manual factory restore which will stop the hijack, but also will probably kill your working internet connection.

ok, do i just hit the reset button on the back of my router? its a wrt160 n linksys

No, that will just reboot the router, you have to actually restart it back to factory default via going into the router via your web browser.

ok, thanks will try in a few mins

How did it go?

Thanks for staying with me through this dilemma. reset to factory defaults and still no luck, took a few hours to remember my password to even be able to reset it. rebooted after reset and i can get on with my laptop but not with pc using same router. Any additional help u can offer would be greatly appreciated!! Thanks, Chris

Hello.
Does the router have the setting for enabled DHCP?

I am not sure, I am out of town till Sunday night, will check that when I get home. Is that setting also in router?? Thanks for your patience

Yes it is.

I wont get too technical, but it's a setting so even if your on the network, the router wont assign the machine an IP adress.

i checked tonight, dhcp is enabled automatic, i have performed a windows internet connection troubleshooter, here are the results





DNS - Not a home user scenario


info Using Web Proxy: no
info Resolving name ok for (www.microsoft.com): no
warn Unrecognized WinSock NSP: mdnsNSP
No DNS servers


action Automated repair: Renew IP address
action Releasing the current IP address...
error Error releasing the current IP address: The system cannot find the file specified.
info Redirecting user to support call

Network Adapter Diagnostic

Network location detection


info Using home Internet connection
Network adapter identification


info Network connection: Name=Local Area Connection, Device=Realtek RTL8139 Family PCI Fast Ethernet NIC, MediaType=LAN, SubMediaType=LAN
info Network connection: Name=1394 Connection, Device=1394 Net Adapter, MediaType=LAN, SubMediaType=1394
info Ethernet connection selected
Network adapter status


info Network connection status: Connected

WinSock Diagnostic

WinSock status


info All base service provider entries are present in the Winsock catalog.
info The Winsock Service provider chains are valid.
info Provider entry MSAFD Tcpip [TCP/IP] passed the loopback communication test.
info Provider entry MSAFD Tcpip [UDP/IP] passed the loopback communication test.
info Provider entry RSVP UDP Service Provider passed the loopback communication test.
info Provider entry RSVP TCP Service Provider passed the loopback communication test.
info Connectivity is valid for all Winsock service providers.

Wireless Diagnostic

Wireless - Service disabled


Wireless - User SSID


Wireless - First time setup


Wireless - Radio off


Wireless - Out of range


Wireless - Hardware issue


Wireless - Novice user


Wireless - Ad-hoc network


Wireless - Less preferred


Wireless - 802.1x enabled


Wireless - Configuration mismatch


Wireless - Low SNR



IP Configuration Diagnostic

Invalid IP address


info Valid IP address detected: 192.168.1.110

IP Layer Diagnostic

Corrupted IP routing table


info The default route is valid
info The loopback route is valid
info The local host route is valid
info The local subnet route is valid
Invalid ARP cache entries


action The ARP cache has been flushed

Gateway Diagnostic

Gateway


info The following proxy configuration is being used by IE: Automatically Detect Settings:Disabled Automatic Configuration Script: Proxy Server: Proxy Bypass list:
info This computer has the following default gateway entry(ies): 192.168.1.1
info This computer has the following IP address(es): 192.168.1.110
info The default gateway is in the same subnet as this computer
info The default gateway entry is a valid unicast address
info The default gateway address was resolved via ARP in 1 try(ies)
info The default gateway was reached via ICMP Ping in 1 try(ies)
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
action Automated repair: Reset network connection
action Disabling the network adapter
action Enabling the network adapter
info Network adapter successfully enabled
info This computer has the following default gateway entry(ies): 192.168.1.1
info This computer has the following IP address(es): 192.168.1.110
info The default gateway is in the same subnet as this computer
info The default gateway entry is a valid unicast address
info The default gateway address was resolved via ARP in 1 try(ies)
info The default gateway was reached via ICMP Ping in 1 try(ies)
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
action Manual repair: Reboot modem
info This computer has the following default gateway entry(ies): 192.168.1.1
info This computer has the following IP address(es): 192.168.1.110
info The default gateway is in the same subnet as this computer
info The default gateway entry is a valid unicast address
info The default gateway address was resolved via ARP in 1 try(ies)
info The default gateway was reached via ICMP Ping in 1 try(ies)
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue
info Waiting some time for the modem/router to stabilize
warn Hostname www.microsoft.com could not be resolved (Error code 0x2afc). Could be either gateway or DNS issue

HTTP, HTTPS, FTP Diagnostic

HTTP, HTTPS, FTP connectivity


warn HTTP: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved
warn HTTPS: Error 12007 connecting to www.microsoft.com: The server name or address could not be resolved
warn FTP (Passive): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved
warn HTTP: Error 12007 connecting to www.hotmail.com: The server name or address could not be resolved
warn HTTPS: Error 12007 connecting to www.passport.net: The server name or address could not be resolved
warn FTP (Active): Error 12007 connecting to ftp.microsoft.com: The server name or address could not be resolved
error Could not make an HTTP connection.
error Could not make an HTTPS connection.
error Could not make an FTP connection.

any Ideas?

Yes.

Please download Winsock XP Fix from here:
http://www.snapfiles.com/get/winsockxpfix.html

Download and press the Fix button. You may need to reboot after. Do you have a working connection now?

THANKS A MILLION !!!!!!!!!!!!!!!!!!!!!! That did the trick. Once again thanks for all your help and patience. :smile2:

Not a problem.