Backdoor.Tidserv!inf - Cannot remove manually as Norton sugg

On Friday, November 21, Norton AntiVirus 2005 warned that a virus had been detected on my computer. I tried running a system scan, but the scan 'froze' before making it half way through. On the second attempt, the scan progressed much further, but again froze before completion. The third scan also froze, but the last two scans seemed to indicate that the virus was confined to the Temp folder on the main drive. Although Norton previously identified and located the files below, all quarantine, repair and delete attempts failed. After scanning the Temp folder again today (after which the infected computer immediately froze up), Norton showed these descriptions in the logs:

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp2.tmp is infected with the Backdoor.Tidserv!inf virus.

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp4.tmp is infected with the Backdoor.Tidserv!inf virus.

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp549.tmp is infected with the Backdoor.Tidserv!inf virus.

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp6.tmp is infected with the Backdoor.Tidserv!inf virus

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp1.tmp is infected with the W32.SillyDC virus.

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp3.tmp is infected with the W32.SillyDC virus.

Description: The file C:\Documents and settings\Owner.YOUR-588B4A13EA\Local Settings\Temp\tmp5.tmp is infected with the W32.SillyDC virus.

Also, I can only boot infected computer into safe mode; from there it can be 'restarted' into regular mode. Upon doing so, this message immediately comes up:

Windows cannot find 'C:\Program'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button,and then click search.

Internet connection has also been completely disrupted. Malwarebytes' Anti-Malware was downloaded onto uninfected computer, burned to disc then copied onto desktop of infected computer. After installation, when attempting to launch, it failed (several times).

After downloading HijackThis onto uninfected computer, burning to disc and copying to desktop of infected computer, I was able to open and create a HijackThis.log before the entire system froze up. Fortunately, HijackThis had already automatically saved the log to the desktop. After retarting in safe mode, HijackThis allowed me to create the uninstall list before restarting again back into Normal mode. Though the virus wouldn't allow any cd burning software to open, I managed to write the two files to cd using basic CD Writing Wizard.

After 12 plus years of 'surfing the web' with extreme caution, looks like I'm in a real quagmire now. Any help would be greatly appreciated.

Thanks in advance.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:22:34 PM, on 11/25/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\Program Files\Digital Media Reader\readericon45G.exe
C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Canon\MyPrinter\BJMyPrt.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Search Settings\SearchSettings.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\BigFix\bigfix.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Documents and Settings\Owner.YOUR-588B4A13EA\Desktop\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5048
R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: Browser Address Error Redirector - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\windows\system32\BAE.dll
O2 - BHO: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
O2 - BHO: OToolbarHelper Class - {EAD3A971-6A23-4246-8691-C9244E858967} - C:\Program Files\PayPal\PayPal Plug-In\PayPalHelper.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: PayPal Plug-In - {DC0F2F93-27FA-4f84-ACAA-9416F90B9511} - C:\Program Files\PayPal\PayPal Plug-In\OToolbar.dll
O4 - HKLM\..\Run: [readericon] C:\Program Files\Digital Media Reader\readericon45G.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Recguard] %WINDIR%\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [Reminder] %WINDIR%\Creator\Remind_XP.exe
O4 - HKLM\..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe /Consumer
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe
O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKCU\..\Run: [Power2GoExpress] NA
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D80A6D1-B500-47DA-82B8-EB9875F85B4D} (Google Gadget Control) - http://dl.google.com/dl/desktop/nv/GoogleGadgetPluginIEWin.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E01F2433-5690-49A5-9D70-2EEE3B61E1A4}: NameServer = 85.255.112.137;85.255.112.235
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

--
End of file - 9615 bytes

UNINSTALL LIST
___________________________________

Adobe Photoshop 7.0
Adobe Reader 7.1.0
Apricorn EZ Gig II
ATI Display Driver
AV DVD Player Morpher
BigFix
Browser Address Error Redirector
Canon iP1700
Canon iP1700 User Registration
Canon My Printer
Canon Utilities Easy-PhotoPrint
ccCommon
CDBurnerXP
Clipstream Audio 3 Pro
Debut Video Recorder
Digital Media Reader
DVD Solution
Easy-WebPrint
Eusing Free Registry Cleaner
FLVPlayer4Free Free FLV Player 2.7.0.0
Free FLV Converter V 5.1
Google Toolbar for Internet Explorer
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Internet Worm Protection
J2SE Runtime Environment 5.0 Update 2
Java(TM) 6 Update 6
Java(TM) 6 Update 7
LiveReg (Symantec Corporation)
LiveUpdate 3.0 (Symantec Corporation)
Macromedia Dreamweaver 4
Macromedia Extension Manager
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Digital Image Starter Edition 2006
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Works
MSXML 4.0 SP2 (KB925672)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Napster Burn Engine
Norton AntiVirus 2005
Norton AntiVirus 2005 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton WMI Update
OpenOffice.org Installer 1.0
PayPal Plug-In
Power2Go 4.0
PowerDVD
QuickTime
RealPlayer
REALTEK GbE & FE Ethernet PCI NIC Driver
Realtek High Definition Audio Driver
Search Settings 1.2
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953838)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956390)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Soft Data Fax Modem with SmartCP
Sonic Encoders
SPBBC
Symantec
Symantec Script Blocking Installer
SymNet
Tradewinds
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update Rollup 2 for Windows XP Media Center Edition 2005
Verizon Online Help and Support
Viewpoint Media Player
WavePad Uninstall
WildTangent Web Driver
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Media Center Edition 2005 KB925766
Windows XP Service Pack 3

Hello.
I see you use Paypal. If you are logged into your account, please logout NOW

First, press Start > Control Panel > Add/remove programs.
Allow the list to load and uninstall this stuff below in bold.

J2SE Runtime Environment 5.0 Update 2
Java(TM) 6 Update 6
Search Settings 1.2
Viewpoint Media Player
WildTangent Web Driver

Select each one and press the Remove button on the right.

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.gateway.com/g/startpage.html?Ch=Retail&Br=EM&Loc=ENG_US&Sys=DTP&M=T5048
  R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll
  O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)
  O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe
  O17 - HKLM\System\CCS\Services\Tcpip\..\{E01F2433-5690-49A5-9D70-2EEE3B61E1A4}: NameServer = 85.255.112.137;85.255.112.235
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

Delete this folder in red:
C:\Program Files\Search Settings
====
Next,

• Download combofix from here, use the top links - combofix.exe
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Thank you for the quick reply. Before proceeding, there is something I want to bring to your attention.

First of all, the five programs you asked me to remove were removed. However, after opening HijackThis and choosing 'do a system scan only', two of the lines you asked me to check were not there:

O4 - HKLM\..\Run: [SearchSettings] C:\Program Files\Search Settings\SearchSettings.exe

R3 - URLSearchHook: SearchSettings Class - {E312764E-7706-43F1-8DAB-FCDD2B1E416D} - C:\Program Files\Search Settings\kb127\SearchSettings.dll

After pressing 'fix checked', I went to C:\Program Files\Search Settings and there was no Search Settings folder anywhere to be found.

Is there a problem, or should I go ahead and run ComboFix?

No problem, probably deleted when you uninstalled it.
Go onto combofix.

Had to download ComboFix to uninfected computer, burn to disk, started infected computer, copied to desktop, double-clicked ComboFix icon and it would not launch. Tried several times, including right-clicking on icon and selecting 'Open' and 'Run As..' I then tried 'Run As...' with the 'Protect my computer and data from unauthorized program activity' line unchecked. Nothing. Even tried restarting back into safe mode, but again, with no luck. It will not open.

Darm.
Here's a link to a mirror.
It's also renamed, so it should get around this malware.

http://www.sendspace.com/file/wguo75

Wow. Not sure what just happened. I downloaded ComboFix from the mirror link you sent, and it did open on the infected computer. While going through the prompts, ComboFix asked if I wanted to download Recovery Console. When I clicked yes, it ran a few seconds and I got a 'download error...abort' message. But instead of having the option to cancel the scan, it simply announced that it was going ahead with scan anyway. It was then off and running like a wild horse. Since you warned me about clicking on any windows and causing a freeze-up, I let it go out of fear I would screw things up even worse. Anyway, here is the log ComboFix produced:

ComboFix 08-11-26.01 - Owner 2008-11-26 12:51:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.117 [GMT -5:00]

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\autorun.inf
c:\docume~1\OWNER~1.YOU\LOCALS~1\Temp\tmp1.tmp
c:\docume~1\OWNER~1.YOU\LOCALS~1\Temp\tmp2.tmp
C:\resycled
c:\resycled\boot.com
c:\windows\IE4 Error Log.txt
c:\windows\system32\drivers\TDSSmqlt.sys
c:\windows\system32\kdoqq.exe
c:\windows\system32\TDSSbrsr.dll
c:\windows\system32\TDSSlxwp.dll
c:\windows\system32\TDSSnmxh.log
c:\windows\system32\TDSSoiqh.dll
c:\windows\system32\TDSSosvd.dat
c:\windows\system32\TDSSrhym.log
c:\windows\system32\TDSSriqp.dll
c:\windows\system32\TDSSsihc.dll
c:\windows\system32\TDSStkdv.log
c:\windows\system32\TDSSxfum.dll
c:\windows\Temp\tmp3.tmp
D:\Autorun.inf
D:\resycled
d:\resycled\boot.com
J:\Autorun.inf
J:\resycled
j:\resycled\boot.com

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_TDSSSERV.SYS
-------\Legacy_TDSSSERV.SYS


((((((((((((((((((((((((( Files Created from 2008-10-26 to 2008-11-26 )))))))))))))))))))))))))))))))
.

2008-11-21 12:57 . 2008-11-21 12:57 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys
2008-11-12 12:43 . 2008-09-04 12:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 12:43 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-10 13:44 . 2008-11-10 13:44 d-------- c:\program files\Clipstream
2008-11-10 13:34 . 2008-11-10 13:34 2,194,129 --a------ c:\program files\ClipstreamAudioPro.exe
2008-11-03 19:29 . 2008-11-11 12:14 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-03 19:29 . 2008-11-03 19:29 1,409 --a------ c:\windows\QTFont.for
2008-10-28 12:01 . 2008-10-28 12:01 d--h----- c:\windows\system32\GroupPolicy
2008-10-27 14:47 . 2008-10-27 14:51 d-------- c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\W Photo Studio Viewer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 08:51 --------- d-----w c:\program files\WildTangent
2008-11-26 08:51 --------- d-----w c:\program files\Gateway Games
2008-11-26 08:51 --------- d-----w c:\documents and settings\All Users\Application Data\WildTangent
2008-11-26 08:50 --------- d-----w c:\program files\Java
2008-11-26 08:50 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-20 23:34 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-19 16:30 --------- d-----w c:\program files\Common Files\Adobe
2008-11-12 06:21 4,144 ----a-w c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\wklnhst.dat
2008-11-10 18:05 --------- d-----w c:\documents and settings\All Users\Application Data\WholeSecurity
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-11 09:16 --------- d-----w c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\uTorrent
2008-10-11 04:22 --------- d-----w c:\program files\uTorrent
2008-10-11 04:18 270,128 ----a-w c:\program files\utorrent.exe
2008-08-05 19:07 5,375,452 ----a-w c:\program files\Setup_FreeFlvConverter2.exe
2008-08-05 15:02 125,336 ----a-w c:\program files\hideoe_v1.1b6.exe
2008-08-05 14:53 809,462 ----a-w c:\program files\4t-min tray.zip
2008-07-30 17:09 2,631,824 ----a-w c:\program files\Reg Reg Man.exe
2008-07-29 18:45 2,790,202 ----a-w c:\program files\sound record update.wav
2008-07-22 19:08 61,224 ----a-w c:\documents and settings\Owner.YOUR-588B4A13EA\GoToAssistDownloadHelper.exe
2008-07-11 17:07 5,625,382 ----a-w c:\program files\Setup_FreeFlvConverter.exe
2008-06-07 19:41 6,634,099 ----a-w c:\program files\mp3morpher_cnt.exe
2008-06-07 18:59 10,537,992 ----a-w c:\program files\dvd_player_morpher_cnt.exe
2008-05-28 21:48 1,822,737 ----a-w c:\program files\flvplayer4free_setup.exe
2008-05-25 20:12 5,842,845 ----a-w c:\program files\gusetupnew.exe
2008-05-25 20:08 2,897,456 ----a-w c:\program files\ccsetup207.exe
2008-05-25 20:06 929,820 ----a-w c:\program files\EFRCSetup.exe
2008-05-23 21:49 10,153,224 ----a-w c:\program files\PortalInstaller.exe
2008-05-23 21:27 427,160 ----a-w c:\program files\debutsetup.exe
2008-05-23 19:56 432,552 ----a-w c:\program files\wpsetup.exe
2008-05-10 19:02 2,078,689 ----a-w c:\program files\WebAudioPlus.zip
2008-02-07 23:47 5,386,264 ----a-w c:\program files\Plug-In.exe
2008-02-03 19:54 2,356,231 ----a-w c:\program files\cdbxp_setup_4.0.022.370.exe
2007-10-24 19:13 389,784 ----a-w c:\program files\switchsetup.exe
2007-09-22 08:24 4,581,672 ----a-w c:\program files\SFTPMSI.exe
2007-09-21 19:41 20,256,064 ----a-w c:\program files\QuickTimeInstaller.exe
2007-09-12 19:45 168,360 ----a-w c:\program files\cftpsetup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-21 1191936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-31 98304]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 58984]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2007-11-27 100056]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-17 185896]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com c:
\Shell\Open\command - c:\resycled\boot.com c:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com d:
\Shell\Open\command - d:\resycled\boot.com d:

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d30f5173-20bb-11db-870b-806d6172696f}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480
.
Contents of the 'Scheduled Tasks' folder

2007-08-29 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 19:12]

2007-09-03 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 19:12]

2008-11-15 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\Navw32.exe [2005-01-10 12:20]
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-c:\windows\system32\kdoqq.exe - c:\windows\system32\kdoqq.exe


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
mSearchAssistant = hxxp://www.google.com/ie
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Easy-WebPrint Add To Print List - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html

c:\windows\Downloaded Program Files\GoogleGadgetPluginIEWin.dll - O16 -: {5D80A6D1-B500-47DA-82B8-EB9875F85B4D}
hxxp://dl.google.com/dl/desktop/nv/GoogleGadgetPluginIEWin.cab
c:\windows\Downloaded Program Files\install.inf
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 12:55:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCEVTMGR.EXE
c:\windows\system32\ati2evxx.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Norton AntiVirus\NAVAPSVC.EXE
c:\progra~1\BigFix\bigfix.exe
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Norton AntiVirus\IWP\NPFMNTOR.EXE
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Messenger\msmsgs.exe
c:\program files\Norton AntiVirus\NAVW32.EXE
.
**************************************************************************
.
Completion time: 2008-11-26 13:06:54 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-26 18:06:42

Pre-Run: 131,956,420,608 bytes free
Post-Run: 132,460,535,808 bytes free

200 --- E O F --- 2008-11-13 03:05:39

Probably the malware blocking the connection.
The rootkit is gone now, so this time through, it will download it and install it.

Now open a new notepad file.
Input this into the notepad file:

File::
c:\windows\system32\drivers\ndisprot.sys

Folder::
c:\program files\WildTangent
c:\documents and settings\All Users\Application Data\WildTangent
c:\documents and settings\All Users\Application Data\Viewpoint

Registry::
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\C]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d30f5173-20bb-11db-870b-806d6172696f}]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"=dword:00000001

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

I noticed in the log that a new restore point was created in Windows XP Professional, when I failed to download Recovery Console for my Windows Media Center Version. Is that significant?

ComboFix 08-11-26.01 - Owner 2008-11-26 14:11:47.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.85 [GMT -5:00]
Running from: c:\documents and settings\Owner.YOUR-588B4A13EA\Desktop\c0mb0-fx.exe
Command switches used :: c:\documents and settings\Owner.YOUR-588B4A13EA\Desktop\CFscript.txt.txt
* Created a new restore point

FILE ::
c:\windows\system32\drivers\ndisprot.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Viewpoint
c:\documents and settings\All Users\Application Data\WildTangent
c:\documents and settings\All Users\Application Data\WildTangent\moregames.ico
c:\documents and settings\All Users\Application Data\WildTangent\oem-eula.exe
c:\program files\WildTangent
c:\program files\WildTangent\LicenseStores\WT\WT.sto
c:\windows\system32\drivers\ndisprot.sys

.
((((((((((((((((((((((((( Files Created from 2008-10-26 to 2008-11-26 )))))))))))))))))))))))))))))))
.

2008-11-12 12:43 . 2008-09-04 12:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 12:43 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-10 13:44 . 2008-11-10 13:44 d-------- c:\program files\Clipstream
2008-11-10 13:34 . 2008-11-10 13:34 2,194,129 --a------ c:\program files\ClipstreamAudioPro.exe
2008-11-03 19:29 . 2008-11-11 12:14 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-03 19:29 . 2008-11-03 19:29 1,409 --a------ c:\windows\QTFont.for
2008-10-28 12:01 . 2008-10-28 12:01 d--h----- c:\windows\system32\GroupPolicy
2008-10-27 14:47 . 2008-10-27 14:51 d-------- c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\W Photo Studio Viewer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 18:03 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-26 08:51 --------- d-----w c:\program files\Gateway Games
2008-11-26 08:50 --------- d-----w c:\program files\Java
2008-11-19 16:30 --------- d-----w c:\program files\Common Files\Adobe
2008-11-12 06:21 4,144 ----a-w c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\wklnhst.dat
2008-11-10 18:05 --------- d-----w c:\documents and settings\All Users\Application Data\WholeSecurity
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-16 19:13 202,776 ----a-w c:\windows\system32\wuweb.dll
2008-10-16 19:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
2008-10-16 19:12 561,688 ----a-w c:\windows\system32\wuapi.dll
2008-10-16 19:12 323,608 ----a-w c:\windows\system32\wucltui.dll
2008-10-16 19:09 92,696 ----a-w c:\windows\system32\cdm.dll
2008-10-16 19:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
2008-10-16 19:09 43,544 ----a-w c:\windows\system32\wups2.dll
2008-10-16 19:08 34,328 ----a-w c:\windows\system32\wups.dll
2008-10-11 09:16 --------- d-----w c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\uTorrent
2008-10-11 04:22 --------- d-----w c:\program files\uTorrent
2008-10-11 04:18 270,128 ----a-w c:\program files\utorrent.exe
2008-09-30 21:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 12:12 1,846,400 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:14 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-04 17:15 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-05 19:07 5,375,452 ----a-w c:\program files\Setup_FreeFlvConverter2.exe
2008-08-05 15:02 125,336 ----a-w c:\program files\hideoe_v1.1b6.exe
2008-08-05 14:53 809,462 ----a-w c:\program files\4t-min tray.zip
2008-07-30 17:09 2,631,824 ----a-w c:\program files\Reg Reg Man.exe
2008-07-29 18:45 2,790,202 ----a-w c:\program files\sound record update.wav
2008-07-22 19:08 61,224 ----a-w c:\documents and settings\Owner.YOUR-588B4A13EA\GoToAssistDownloadHelper.exe
2008-07-11 17:07 5,625,382 ----a-w c:\program files\Setup_FreeFlvConverter.exe
2008-06-07 19:41 6,634,099 ----a-w c:\program files\mp3morpher_cnt.exe
2008-06-07 18:59 10,537,992 ----a-w c:\program files\dvd_player_morpher_cnt.exe
2008-05-28 21:48 1,822,737 ----a-w c:\program files\flvplayer4free_setup.exe
2008-05-25 20:12 5,842,845 ----a-w c:\program files\gusetupnew.exe
2008-05-25 20:08 2,897,456 ----a-w c:\program files\ccsetup207.exe
2008-05-25 20:06 929,820 ----a-w c:\program files\EFRCSetup.exe
2008-05-23 21:49 10,153,224 ----a-w c:\program files\PortalInstaller.exe
2008-05-23 21:27 427,160 ----a-w c:\program files\debutsetup.exe
2008-05-23 19:56 432,552 ----a-w c:\program files\wpsetup.exe
2008-05-10 19:02 2,078,689 ----a-w c:\program files\WebAudioPlus.zip
2008-02-07 23:47 5,386,264 ----a-w c:\program files\Plug-In.exe
2008-02-03 19:54 2,356,231 ----a-w c:\program files\cdbxp_setup_4.0.022.370.exe
2007-10-24 19:13 389,784 ----a-w c:\program files\switchsetup.exe
2007-09-22 08:24 4,581,672 ----a-w c:\program files\SFTPMSI.exe
2007-09-21 19:41 20,256,064 ----a-w c:\program files\QuickTimeInstaller.exe
2007-09-12 19:45 168,360 ----a-w c:\program files\cftpsetup.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-21 1191936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-31 98304]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 58984]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2007-11-27 100056]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-17 185896]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - c:\program files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2008-11-19 113664]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
BigFix.lnk - c:\program files\BigFix\bigfix.exe [2006-07-31 2168360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 ezgmntr;EZ GIG II Backup Archive Explorer;c:\windows\system32\DRIVERS\ezgmntr.sys [2007-08-19 213760]
R2 dvdmmg;dvdmmg;\??\c:\windows\system32\drivers\dvdmmg.sys [2007-09-06 5504]
R2 ezgfsfilt;EZ GIG II FS Filter;c:\windows\system32\DRIVERS\ezgfsfilt.sys [2007-08-19 28800]
S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys []
.
Contents of the 'Scheduled Tasks' folder

2007-08-29 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 19:12]

2007-09-03 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 19:12]

2008-11-15 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\Navw32.exe [2005-01-10 12:20]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 14:13:55
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(652)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2008-11-26 14:15:40
ComboFix-quarantined-files.txt 2008-11-26 19:15:18
ComboFix2.txt 2008-11-26 18:31:44
ComboFix3.txt 2008-11-26 18:06:57

Pre-Run: 132,443,291,648 bytes free
Post-Run: 132,423,237,632 bytes free

148 --- E O F --- 2008-11-13 03:05:39

Okay, this should do it.

Now open a new notepad file.
Input this into the notepad file:

Driver::
Ndisprot

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix.exe again, agree to it's terms and allow it to run, it may want to reboot after it's done. Post the resulting log back here.

Let me know how the machine is doing now?

The computer seems to be running just fine now. It boots into normal mode, runs as fast as it ever did, opens all apps without freezing-up and once again has proper internet access! Thank you so much for getting me to this point. I thought I was a real goner this time...

Here's the latest ComboFix log:

ComboFix 08-11-26.01 - Owner 2008-11-26 15:23:34.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.92 [GMT -5:00]
Running from: c:\documents and settings\Owner.YOUR-588B4A13EA\Desktop\c0mb0-fx.exe
Command switches used :: c:\documents and settings\Owner.YOUR-588B4A13EA\Desktop\CFscript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NDISPROT
-------\Service_Ndisprot


((((((((((((((((((((((((( Files Created from 2008-10-26 to 2008-11-26 )))))))))))))))))))))))))))))))
.

2008-11-12 12:43 . 2008-09-04 12:15 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll
2008-11-12 12:43 . 2008-10-24 06:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys
2008-11-10 13:44 . 2008-11-10 13:44 d-------- c:\program files\Clipstream
2008-11-10 13:34 . 2008-11-10 13:34 2,194,129 --a------ c:\program files\ClipstreamAudioPro.exe
2008-11-03 19:29 . 2008-11-11 12:14 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-03 19:29 . 2008-11-03 19:29 1,409 --a------ c:\windows\QTFont.for
2008-10-28 12:01 . 2008-10-28 12:01 d--h----- c:\windows\system32\GroupPolicy
2008-10-27 14:47 . 2008-10-27 14:51 d-------- c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\W Photo Studio Viewer

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-26 18:03 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-26 08:51 --------- d-----w c:\program files\Gateway Games
2008-11-26 08:50 --------- d-----w c:\program files\Java
2008-11-19 16:30 --------- d-----w c:\program files\Common Files\Adobe
2008-11-12 06:21 4,144 ----a-w c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\wklnhst.dat
2008-11-10 18:05 --------- d-----w c:\documents and settings\All Users\Application Data\WholeSecurity
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-11 09:16 --------- d-----w c:\documents and settings\Owner.YOUR-588B4A13EA\Application Data\uTorrent
2008-10-11 04:22 --------- d-----w c:\program files\uTorrent
2008-10-11 04:18 270,128 ----a-w c:\program files\utorrent.exe
2008-08-05 19:07 5,375,452 ----a-w c:\program files\Setup_FreeFlvConverter2.exe
2008-08-05 15:02 125,336 ----a-w c:\program files\hideoe_v1.1b6.exe
2008-08-05 14:53 809,462 ----a-w c:\program files\4t-min tray.zip
2008-07-30 17:09 2,631,824 ----a-w c:\program files\Reg Reg Man.exe
2008-07-29 18:45 2,790,202 ----a-w c:\program files\sound record update.wav
2008-07-22 19:08 61,224 ----a-w c:\documents and settings\Owner.YOUR-588B4A13EA\GoToAssistDownloadHelper.exe
2008-07-11 17:07 5,625,382 ----a-w c:\program files\Setup_FreeFlvConverter.exe
2008-06-07 19:41 6,634,099 ----a-w c:\program files\mp3morpher_cnt.exe
2008-06-07 18:59 10,537,992 ----a-w c:\program files\dvd_player_morpher_cnt.exe
2008-05-28 21:48 1,822,737 ----a-w c:\program files\flvplayer4free_setup.exe
2008-05-25 20:12 5,842,845 ----a-w c:\program files\gusetupnew.exe
2008-05-25 20:08 2,897,456 ----a-w c:\program files\ccsetup207.exe
2008-05-25 20:06 929,820 ----a-w c:\program files\EFRCSetup.exe
2008-05-23 21:49 10,153,224 ----a-w c:\program files\PortalInstaller.exe
2008-05-23 21:27 427,160 ----a-w c:\program files\debutsetup.exe
2008-05-23 19:56 432,552 ----a-w c:\program files\wpsetup.exe
2008-05-10 19:02 2,078,689 ----a-w c:\program files\WebAudioPlus.zip
2008-02-07 23:47 5,386,264 ----a-w c:\program files\Plug-In.exe
2008-02-03 19:54 2,356,231 ----a-w c:\program files\cdbxp_setup_4.0.022.370.exe
2007-10-24 19:13 389,784 ----a-w c:\program files\switchsetup.exe
2007-09-22 08:24 4,581,672 ----a-w c:\program files\SFTPMSI.exe
2007-09-21 19:41 20,256,064 ----a-w c:\program files\QuickTimeInstaller.exe
2007-09-12 19:45 168,360 ----a-w c:\program files\cftpsetup.exe
.

((((((((((((((((((((((((((((( snapshot@2008-11-26_13.03.23.35 )))))))))))))))))))))))))))))))))))))))))
.
+ 2005-10-21 01:02:28 163,328 ----a-w c:\windows\ERDNT\subs\ERDNT.EXE
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Power2GoExpress"="NA" [X]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-08-20 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"readericon"="c:\program files\Digital Media Reader\readericon45G.exe" [2005-12-09 139264]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2002-09-14 212992]
"Reminder"="c:\windows\Creator\Remind_XP.exe" [2005-02-25 966656]
"CanonMyPrinter"="c:\program files\Canon\MyPrinter\BJMyPrt.exe" [2006-03-21 1191936]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-31 98304]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2007-01-09 58984]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2007-11-27 100056]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2007-09-28 936960]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-06-17 185896]
"ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"RTHDCPL"="RTHDCPL.EXE" [2006-04-04 c:\windows\RTHDCPL.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

R0 ezgmntr;EZ GIG II Backup Archive Explorer;c:\windows\system32\DRIVERS\ezgmntr.sys [2007-08-19 213760]
R2 dvdmmg;dvdmmg;\??\c:\windows\system32\drivers\dvdmmg.sys [2007-09-06 5504]
R2 ezgfsfilt;EZ GIG II FS Filter;c:\windows\system32\DRIVERS\ezgfsfilt.sys [2007-08-19 28800]
.
Contents of the 'Scheduled Tasks' folder

2007-08-29 c:\windows\Tasks\ISP signup reminder 2.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 19:12]

2007-09-03 c:\windows\Tasks\ISP signup reminder 3.job
- c:\windows\system32\OOBE\oobebaln.exe [2008-04-13 19:12]

2008-11-15 c:\windows\Tasks\Norton AntiVirus - Scan my computer - Owner.job
- c:\progra~1\NORTON~1\Navw32.exe [2005-01-10 12:20]
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-26 15:28:14
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(640)
c:\windows\system32\Ati2evxx.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Symantec Shared\CCSETMGR.EXE
c:\program files\Common Files\Symantec Shared\SNDSrvc.exe
c:\program files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
c:\program files\Common Files\Symantec Shared\CCEVTMGR.EXE
c:\windows\system32\ati2evxx.exe
c:\program files\Symantec\LiveUpdate\AluSchedulerSvc.exe
c:\program files\Norton AntiVirus\NAVAPSVC.EXE
c:\program files\CDBurnerXP\NMSAccessU.exe
c:\program files\Norton AntiVirus\IWP\NPFMNTOR.EXE
c:\program files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
c:\program files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\BigFix\bigfix.exe
c:\program files\Messenger\msmsgs.exe
.
**************************************************************************
.
Completion time: 2008-11-26 15:34:53 - machine was rebooted
ComboFix-quarantined-files.txt 2008-11-26 20:34:46
ComboFix2.txt 2008-11-26 19:15:41
ComboFix3.txt 2008-11-26 18:31:44
ComboFix4.txt 2008-11-26 18:06:57

Pre-Run: 132,421,259,264 bytes free
Post-Run: 132,332,736,512 bytes free

151 --- E O F --- 2008-11-13 03:05:39

Log looks good.
There is a bunch of .exe files in program files and documents and settings.
Do you know where they came from? Did you put them there?

The vast majority of files in Program Files I put there. As far as Documents and Settings, I recognize most but not all. Perhaps they came preloaded with Windows? There's no way for me to know where all the .exe files came from. Whenever I ran a full scan with Norton in the past, no threats were ever detected.

Perhaps, the names look legit.
What problems remain?

As far as I can see, the real problem has been solved. You don't think I deleted any wrong files by letting ComboFix complete the first scan without Recovery Console in place do you? Everything seems to be running smoothly. Also, I have 3 computers running through the same DSL router. Is there any danger the other computers could become targets, or that the previously 'infected' computer might be especially vunerable now? Do you suggest I upgrade from Norton 2005?

Hello.
The infection isn't network targeted.
Please run this to prevent the autorun infection returning.

Please download Flash_Disinfector from HERE

• First, download it to your desktop.
  
• Now double click it to run it and will tell it you what to do when you open it.
  
• It will temporarily kill explorer.exe and your desktop will go blank.
  
• Let Flash_Disinfector do it's job and it will restart explorer.exe for you.
  
• It will make a dummy autorun.inf in the root of every drive.
  
• You can now delete Flash_Disinfector.exe.
  

No, CF didn't delete anything legit.
And yes, I suggest you upgrade Norton.

Downloaded and ran Flash Disinfector, then deleted. Only took a few seconds.

Good.
Delete this folder:
C:\Qoobox

Your version of Java is outdated and needs to be updated to take advantage of fixes that have eliminated security vulnerabilities.
Updating Java:

• Download the latest version of Java SE Runtime Environment (JRE) 6 Update 10.
  
• Select the first option where it says "Java SE Runtime Environment (JRE) 6 Update 10".
  
• Click the "Download" button to the right.
  
• In the Window that opens, select your platform and language, check the "agree" box, and click Continue.
  
• Click on the link to download Windows Offline Installation and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add or Remove Programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  - Examples of older versions in Add or Remove Programs:
  - Java 2 Runtime Environment, SE v1.4.2
  - J2SE Runtime Environment 5.0
  - J2SE Runtime Environment 5.0 Update 2
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u10-windows-i586-p.exe that you downloaded to install the newest version.
  

Please make sure the new version of Java is installed before you run JavaRa.

Please download JavaRa from here

• First, unzip it.
  
• Then run JavaRa.
  
• Select English from the drop down menu and press Select.
  
• This will open JavaRa.
  
• Press Remove older versions
  
• Press yes to the prompt.
  
• It will make a log file of what it's removed.
  
• Copy and paste the log back here.
  

Done and done. Here's the log you wanted:


JavaRa 1.11 Removal Log.

Report follows after line.

------------------------------------

The JavaRa removal process was started on Wed Nov 26 17:55:32 2008

Found and removed: C:\Program Files\Java\jre1.5.0_02

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0015-0000-0002-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\JavaPlugin.150_02

Found and removed: SOFTWARE\Classes\JavaWebStart.isInstalled.1.5.0.0

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBB}

Found and removed: SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0006-ABCDEFFEDCBC}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA}

Found and removed: SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders\\C:\Program Files\Java\jre1.5.0_02\

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_02

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_03

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.0.1_04

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2

Found and removed: SOFTWARE\JavaSoft\Java Web Start\1.2.0_01

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0000-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0001-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0003-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0004-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0005-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0006-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0007-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0008-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0009-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0010-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0011-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0012-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0013-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0015-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0016-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0017-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0018-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0019-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0021-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0022-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0023-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0024-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0025-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0026-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0027-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0028-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0029-ABCDEFFEDCBB}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBA}

Found and removed: Software\Classes\CLSID\{CAFEEFAC-0013-0001-0030-ABCDEFFEDCBB}

------------------------------------

Finished reporting.

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.
===

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Ad-Aware SE
A tutorial on using Ad-Aware to remove spyware from your computer may be found here.

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

Hopefully this should take care of your problems! Good luck.

I can't tell you how overjoyed and relieved I am that you pulled me from the jaws of disaster. I will seriously consider all the suggestions you made about keeping my computer safe in the future. To you, and all the folks at GeekPolice, thank you for your time and patience, and most of all, for sharing your incredible savvy and knowledge with the rest of us. The world now seems like a much better place.

Since this issue is resolved, this topic is closed.

If you need this topic reopened, please contact a staff member. This applies only to the original topic starter.