Found a Nasty and need help

I was copying some music from a friends memory stick and got a virus warning.... I run Spybot S & D and sure enough it popped up with Win32.rungbu.a.... I removed it... rebooted and low and behold, it was back again... How go I get rid of it?

Here's a copy of my HJT....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:54:02 AM, on 3/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtect.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.live.com/sphome.aspx
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [BOC-427] C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\Comodo\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Startup Manager] "C:\Program Files\Advanced System Optimizer\startUp manager.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Translate with &Babylon - res://C:\Program Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/betapit/PCPitStop.CAB
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab_srl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230772705531
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: FolderProtectService - Unknown owner - d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c985d829e7373e) (gupdate1c985d829e7373e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 10317 bytes

I also noticed when running Spybot along with Win32.rungbu.a there was another one..... virtumonde.sdn

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.34
Database version: 1824
Windows 5.1.2600 Service Pack 3

3/6/2009 10:31:45 AM
mbam-log-2009-03-06 (10-31-45).txt

Scan type: Quick Scan
Objects scanned: 64455
Time elapsed: 1 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\videosoft (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup Manager (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Common Files\chd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\Advanced System Optimizer\startUp manager.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\service.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRLbyxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

• Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  
• Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  
• Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  
• From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
  

Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.

• Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
  Link 1
  Link 2
  Link 3
  
• Double click DDS.scr to run
  
• When complete, DDS.txt will open.
  
• Save the report to your Desktop.
  
• Copy and paste DDS.txt back here, I don't need to see attach.txt.
  

RP307: 3/6/2009 10:51:33 AM - Installed Windows Media Format Runtime
RP308: 3/6/2009 10:52:27 AM - Installed Windows Media Format Runtime
RP309: 3/6/2009 10:53:07 AM - Installed Windows Media Format Runtime

==== Installed Programs ======================


µTorrent
2Wire Gateway
Abrosoft FantaMorph 3.0
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Advanced System Optimizer
Auslogics BoostSpeed
Babylon
BayGenie eBay Auction Sniper Pro Edition 3.3.1.0
Bejeweled Twist 1.0.3
BOClean
Bonjour
Bricks '2000
Canon iP1700
Canon My Printer
Canon Utilities Easy-PhotoPrint
CCleaner (remove only)
Chicken Invaders v1.30
Choice Guard
COMODO Internet Security
ComputerExpert 2009 V3.6
DeepBurner Pro v1.8.0.225
DIGOpt
DIGReqEx
Disk Investigator 1.4
Doremi FLV to MP3 Converter 1.0
Dramatica Pro 4.0
Driver Genius Professional Edition
DSL Speed V4.5
EASEUS Partition Manager 3.0 Home Edition
Easy-WebPrint
Eusing Free Registry Cleaner
FinePixViewer Ver.4.2
Free YouTube to Mp3 Converter version 3.1
FreeAgent Pro Tools
FUJIFILM USB Driver
Full Tilt Poker
getPlus(R) for Adobe
GIMP 2.6.4
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB954708)
Identity Finder Professional Edition
ImageMixer VCD2 for FinePix
ImgBurn
Inkscape 0.46
Intel(R) Graphics Media Accelerator Driver
IZArc 3.81
Jardinains!
Java(TM) 6 Update 12
Java(TM) 6 Update 7
Junk Mail filter update
Malwarebytes' Anti-Malware
Mario Forever 4.0
Mathcad 14
Mathcad 14 Help
Mathcad 14 Resource Center
MathPlayer
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Picture It! Express 9
Microsoft Picture It! Library 9
Microsoft Search Enhancement Pack
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
MicroStaff WINASPI
Miro
Modem Booster
Mozilla Firefox (3.1b2)
MSN
MSN Encarta Plus Support Files
MSVCRT
myBabylon_English Toolbar
OpenOffice.org 3.0
PC Pitstop Optimize 1.5
PerfectDisk 2008 Professional
Performance Center
PokerStars
PokerStars.net
PowerISO
QuickTime
QuuxPlayer
RAW FILE CONVERTER LE
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
RegCure 1.5.2.7
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Segoe UI
Skype 3.8
Spotmau Wincare 2008
Spybot - Search & Destroy
Spyware Terminator
Student and Home Edition
System Requirements Lab
The Rosetta Stone
The Ultimate Troubleshooter
ToSearch
Uninstall 1.0.0.1
USB Storage Adapter V3 (TPP)
VDownloader 0.77
Virtual Engine Calculator Advanced
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
VMC The KEY, Release Candidate
WebFldrs XP
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
Womens Murder Club a Darker Shade of Grey 1.00
Word Magic Professional Suite Premier 5.0
Xara Xtreme Pro 4 e-version
Yahoo! Toolbar
ZipItFree 1.90
Zuma Deluxe RA

==== Event Viewer Messages From Past Week ========

3/2/2009 10:48:03 PM, error: Service Control Manager [7000] - The BOClean Kernel Monitor. service failed to start due to the following error: Access is denied.
3/2/2009 10:48:00 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: FolderProtectDriver
3/2/2009 10:47:59 PM, error: Service Control Manager [7023] - The TuneUp Theme Extension service terminated with the following error: The system cannot find the file specified.
3/5/2009 5:53:18 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer NEPHITEWARRIOR that believes that it is the master browser for the domain on transport NetBT_Tcpip_{42F6FC79-0748. The master browser is stopping or an election is being forced.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD cmdGuard cmdHlp Fips FolderProtectDriver intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SCDEmu sp_rsdrv2 Tcpip
3/5/2009 7:17:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/5/2009 7:17:31 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
3/6/2009 3:18:44 AM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for ImagePath with the following error: Access is denied.

==== End Of File ===========================

Wrong log file.
I need to see DDS.txt

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

µTorrent
Java(TM) 6 Update 7

DDS (Ver_09-02-01.01) - NTFSx86
Run by K. Albert at 11:40:28.10 on Fri 03/06/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1159 [GMT -8:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtect.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Documents and Settings\K. Albert\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB1.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB1.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB1.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [FreeRAM XP] "c:\program files\yourware solutions\freeram xp pro\FreeRAM XP Pro.exe" -win
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [BOC-427] c:\progra~1\comodo\cboclean\BOC427.exe
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [TPP Auto Loader] c:\windows\tppaldr.exe
mRun: []
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html
IE: Translate with &Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Translate.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab_srl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230772705531
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kc8a4~1.alb\applic~1\mozilla\firefox\profiles\hcpgmaki.default\
FF - prefs.js: browser.search.selectedEngine - Ixquick
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - plugin: c:\program files\google\google updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin2.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin3.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin4.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin5.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin6.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-3-1 64160]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-30 110992]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-30 24336]
R1 FolderProtectDriver;FolderProtectDriver;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectDriver.sys [2009-2-3 15616]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-30 142592]
R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-12-30 73464]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2008-12-30 700152]
R2 FolderProtectService;FolderProtectService;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectService.exe [2009-2-3 10240]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 951120]
R2 PD91Agent;PD91Agent;c:\program files\raxco\perfectdisk2008\PD91Agent.exe [2008-1-16 664840]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-1-2 603904]
R2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2008-12-31 598856]
S2 gupdate1c985d829e7373e;Google Update Service (gupdate1c985d829e7373e);c:\program files\google\update\GoogleUpdate.exe [2009-2-3 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-1-4 1684736]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-1-25 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-1-25 3072]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-1-1 33752]
S3 PD91Engine;PD91Engine;c:\program files\raxco\perfectdisk2008\PD91Engine.exe [2008-1-16 894216]
S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\drivers\TPP300.SYS [2002-6-23 35584]

============== File Associations ===============

txtfile=c:\windows\NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-03-06 10:24 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Malwarebytes
2009-03-06 10:24 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-06 10:24 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 10:24 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 10:24 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-03-06 03:22 --d----- C:\MGtools
2009-03-06 03:16 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-05 19:12 --d----- c:\program files\Yahoo!
2009-03-05 18:17 --d----- c:\docume~1\kc8a4~1.alb\applic~1\GetRightToGo
2009-03-05 17:53 0 a------- C:\broadcast.tmp
2009-03-04 18:56 --d----- c:\documents and settings\k. albert\Saved Games
2009-03-04 18:56 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Flood Light Games
2009-03-04 18:56 --d----- c:\docume~1\alluse~1\applic~1\Flood Light Games
2009-03-04 15:53 --d----- c:\program files\Identity Finder
2009-03-04 15:31 --d----- c:\windows\ZipItFree
2009-03-04 05:58 72 ---shr-- C:\autorun.inf
2009-03-02 10:20 --d----- c:\docume~1\kc8a4~1.alb\applic~1\WebcamZoneTrigger
2009-03-01 14:35 15,688 a------- c:\windows\system32\lsdelete.exe
2009-03-01 00:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-03-01 00:47 -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-01 00:47 --d----- c:\program files\Lavasoft
2009-02-26 19:18 24,468 a---h--- c:\windows\system32\mlfcache.dat
2009-02-26 19:17 --d----- c:\program files\Bonjour
2009-02-26 00:14 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Systweak
2009-02-26 00:12 --d----- c:\program files\Advanced System Optimizer
2009-02-25 23:57 406 a------- c:\windows\system32\ioloBootDefrag.cfg
2009-02-25 23:40 74,703 a------- c:\windows\system32\mfc45.dll
2009-02-25 23:33 --d----- c:\docume~1\kc8a4~1.alb\applic~1\iolo
2009-02-25 23:33 --d----- c:\docume~1\alluse~1\applic~1\iolo
2009-02-25 21:10 --d----- C:\JUNK
2009-02-25 20:21 68,624 a----r-- c:\windows\system32\drivers\DefragFS.sys
2009-02-25 20:19 --d----- c:\program files\Raxco
2009-02-24 21:30 20 a------- c:\windows\mafosav.INI
2009-02-23 02:54 43 a------- C:\mo.mid
2009-02-21 22:51 344,064 a------- c:\windows\system32\msvcr70.dll
2009-02-21 22:51 --d----- c:\program files\common files\DVDVideoSoft
2009-02-18 17:46 95 a------- c:\windows\wininit.ini
2009-02-18 08:30 71 a------- c:\windows\RmFile.ini
2009-02-18 08:30 53,728 a------- c:\windows\rmfile.exe
2009-02-18 08:30 43,664 a------- c:\windows\addrun.exe
2009-02-18 08:30 890 a------- c:\windows\Win.Fa
2009-02-18 08:30 231 a------- c:\windows\System.Fa
2009-02-18 08:26 27,632 a------- c:\windows\system\Ctl3DV2.Dll
2009-02-18 08:19 --d----- c:\program files\Microsoft SQL Server Compact Edition
2009-02-17 22:39 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-02-17 22:39 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-02-17 16:53 30,208 -------- c:\windows\system32\WNASPI32.DLL
2009-02-17 16:53 4,030 -------- c:\windows\system\WINASPI.DLL
2009-02-17 16:53 291 a------- c:\windows\msfsetup.ini
2009-02-17 16:53 8,096 -------- c:\windows\system32\drivers\MASPINT.SYS
2009-02-17 16:53 2,486 -------- c:\windows\system\AS16POST.BIN
2009-02-17 16:48 155,648 a------- c:\windows\system32\FFRAFLIB.DLL
2009-02-17 16:48 274,432 a------- c:\windows\system32\FFTIFF16.dll
2009-02-17 16:47 81,924 -------- c:\windows\system32\drivers\VC4CB104.SYS
2009-02-17 16:47 --d----- c:\program files\REGSHAVE
2009-02-17 16:47 65,536 -------- c:\windows\system32\FINFCHECK.dll
2009-02-17 16:47 45,056 -------- c:\windows\system32\FINFCOPY.dll
2009-02-17 16:47 69,632 -------- c:\windows\system32\FREGSHEX.DLL
2009-02-17 16:47 45,056 -------- c:\windows\system32\FCLKBTN.DLL
2009-02-15 09:39 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Geometric
2009-02-15 09:37 3,426,072 a------- c:\windows\system32\d3dx9_32.dll
2009-02-14 17:35 53,248 a------- c:\windows\system32\CSVer.dll
2009-02-14 17:35 290,816 a------- c:\windows\vncutil.exe
2009-02-14 17:35 104,992 a------- c:\windows\RtkAudioService.exe
2009-02-14 17:02 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
2009-02-14 17:02 662,288 a------- c:\windows\system32\MSCOMCT2.OCX
2009-02-14 17:02 427,864 a------- c:\windows\system32\XceedZip.dll
2009-02-12 23:15 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Auslogics
2009-02-12 20:23 --d----- c:\program files\Ascentive
2009-02-11 15:20 459,264 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-02-11 15:20 267,776 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-02-11 15:20 52,224 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-11 15:20 383,488 -c------ c:\windows\system32\dllcache\ieapfltr.dll
2009-02-11 15:20 63,488 -c------ c:\windows\system32\dllcache\icardie.dll
2009-02-11 15:20 13,824 -c------ c:\windows\system32\dllcache\ieudinit.exe
2009-02-11 15:20 2,455,488 -c------ c:\windows\system32\dllcache\ieapfltr.dat
2009-02-11 15:20 991,232 -c------ c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-11 15:20 6,066,688 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-02-10 19:38 --d----- c:\docume~1\kc8a4~1.alb\applic~1\PCF-VLC
2009-02-10 12:24 --d-h--- c:\program files\Zero G Registry
2009-02-10 12:21 --d-h--- c:\documents and settings\k. albert\InstallAnywhere
2009-02-10 00:03 --d----- c:\windows\vbSkinner
2009-02-09 05:35 --d----- c:\windows\SHELLNEW
2009-02-09 05:05 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Mathsoft
2009-02-09 02:12 334,792 a------- c:\windows\system32\_AxShlEx.dll
2009-02-09 02:10 --d----- c:\program files\Alcohol Soft
2009-02-06 19:03 307,576 a------- c:\windows\WLXPGSS.SCR
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2009-02-05 13:58 212,240 a------- c:\windows\system32\RichTx32.ocx
2009-02-05 13:58 124,688 a------- c:\windows\system32\MSWinSck.ocx
2009-02-05 13:58 1,753,088 a------- c:\windows\system32\ExGrid.dll
2009-02-05 13:58 614,400 a------- c:\windows\system32\ExButton.dll
2009-02-05 13:58 602,112 a------- c:\windows\system32\ExMenu.dll
2009-02-05 13:58 307,200 a------- c:\windows\system32\ExPMenu.dll
2009-02-05 13:58 516,096 a------- c:\windows\system32\ExTab.dll
2009-02-05 13:58 356,352 a------- c:\windows\system32\eSellerateEngine.dll
2009-02-05 13:58 118,784 a------- c:\windows\system32\eWebControl.dll
2009-02-05 13:58 --d----- c:\program files\common files\eSellerate
2009-02-05 13:58 368,912 a------- c:\windows\system32\vbar332.dll
2009-02-05 13:58 --d----- c:\program files\AnswersThatWork
2009-02-05 08:32 --d----- c:\program files\Spybot - Search & Destroy
2009-02-05 07:51 --d----- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-02-05 07:47 --d----- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-02-05 07:46 --d----- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-02-05 07:46 --d----- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-02-05 07:39 --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-02-04 21:25 159,744 a------- c:\windows\system32\lfpng13n.dll
2009-02-04 21:25 206,336 a------- c:\windows\system32\ltefx13n.dll
2009-02-04 21:25 69,632 a------- c:\windows\system32\lfgif13n.dll
2009-02-04 21:25 462,848 a------- c:\windows\system32\ltkrn13n.dll
2009-02-04 21:25 450,560 a------- c:\windows\system32\ltimg13n.dll
2009-02-04 21:25 401,408 a------- c:\windows\system32\lfcmp13n.dll
2009-02-04 21:25 299,008 a------- c:\windows\system32\ltdis13n.dll
2009-02-04 21:25 163,840 a------- c:\windows\system32\ltfil13n.dll
2009-02-04 21:25 57,344 a------- c:\windows\system32\lfbmp13n.dll
2009-02-04 16:33 506 a------- c:\windows\PowerReg.dat
2009-02-04 16:32 --d----- c:\program files\Screenplay Systems
2009-02-04 14:42 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Downloaded Installations

==================== Find3M ====================

2009-03-06 03:17 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-26 22:11 155,384 a------- c:\windows\system32\guard32.dll
2009-02-26 22:11 110,992 a------- c:\windows\system32\drivers\cmdguard.sys
2009-02-20 10:01 24,336 a------- c:\windows\system32\drivers\cmdhlp.sys
2009-02-05 01:25 700,928 ----h--- c:\windows\system32\wodfamoh.dll
2009-02-03 17:32 18,085,888 a------- c:\windows\RTHDCPL.EXE
2009-02-03 17:22 5,030,912 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-02-03 16:35 35,840 a------- c:\windows\system32\RtkCoInstXP.dll
2009-01-30 18:27 717,296 a------- c:\windows\system32\drivers\sptd.sys
2009-01-26 16:06 98,304 a------- c:\windows\system32\CmdLineExt.dll
2009-01-21 15:54 1,206,816 a------- c:\windows\RtlUpd.exe
2009-01-06 03:33 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-02 22:53 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-01-01 15:09 12,325 a------- c:\windows\system32\SpoonUninstall-Jardinains!.dat
2009-01-01 15:09 164,352 a------- c:\windows\system32\SpoonUninstall.exe
2008-12-30 18:29 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll

============= FINISH: 11:40:58.00 ===============

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\autorun.inf
  C:\Documents and Settings\K. Albert\Desktop\dds.scr
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
File/Folder C:\autorun.inf not found.
File/Folder C:\Documents and Settings\K. Albert\Desktop\dds.scr not found.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03062009_150100

Hello.
How is the machine now?

It seems to be working great.......

Great.

Lets remove the tools we have used, they can't be trusted if you don't know how to handle them.

• Please double-click OTMoveIt3.exe to run it again.
  
• Press the green CleanUp! button.
  
• Press Yes cleanup process prompt.
  
• It will start cleaning now, and will want to reboot after, please allow it to do so.
  
• It will make a log of what it has removed, but I don't need to see the log.
  

====

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers.

1) Please navigate to http://windowsupdate.microsoft.com and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

Spybot-Search & Destroy
A tutorial on using Spybot to remove spyware from your computer may be found here. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

SpywareBlaster
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found here.

SpywareGuard
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found here.

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
http://www.mozilla.org/products/firefox/
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
https://addons.mozilla.org/en-US/firefox/addon/722
https://addons.mozilla.org/en-US/firefox/addon/1865
https://addons.mozilla.org/en-US/firefox/addon/433

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
Update Checker

5) Finally, consider maintaining a firewall. Some good free firewalls are Kerio, or
Outpost
A tutorial on understanding and using firewalls may be found here.

Please also read Tony Klein's excellent article: How I got Infected in the First Place

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found here.

Hopefully this should take care of your problems! Good luck.

I know exactly how I got infected, We were at the races and a friend loaned me a memory stick with some cool music and kaa=boom..

Protect yourself from autorun worms.
Turn off autoplay, this will do it all for you.

Please download Flash_Disinfector from HERE

• First, download it to your desktop.
  
• Now double click it to run it and will tell it you what to do when you open it.
  
• It will temporarily kill explorer.exe and your desktop will go blank.
  
• Let Flash_Disinfector do it's job and it will restart explorer.exe for you.
  
• It will make a dummy autorun.inf in the root of every drive.
  
• You can now delete Flash_Disinfector.exe.
  

Belahzur, I tried to download Flash_Disinfector and the link is/was broken. Then I Googled Flash_Disinfector and found the same problem. Some other forums also are talking about the link being broken...
Anyways I'll be racing this weekend and will get back to you Monday AM...

Thanks Much,

Mel Adjusted

I got up this morning and run the computer before installing it in the car and Malwarebytes found the following again...

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden)
-> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\olhrwef.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Please go back here and download DDS again and run it.
http://www.geekpolice.net/virus-spyware-malware-removal-f11/found-a-nasty-and-need-help-t7337.htm#44994

Post the new DDS log.

DDS (Ver_09-02-01.01) - NTFSx86
Run by K. Albert at 19:16:28.34 on Sat 03/07/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1279 [GMT -8:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\FrostWire\FrostWire.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Documents and Settings\K. Albert\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = hxxp://search.live.com/sphome.aspx
uURLSearchHooks: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB0.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB0.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB0.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [FreeRAM XP] "c:\program files\yourware solutions\freeram xp pro\FreeRAM XP Pro.exe" -win
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [BOC-427] c:\progra~1\comodo\cboclean\BOC427.exe
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [TPP Auto Loader] c:\windows\tppaldr.exe
mRun: []
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html
IE: Translate with &Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Translate.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://www.pcpitstop.com/betapit/PCPitStop.CAB
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - hxxp://www.srtest.com/srl_bin/sysreqlab_srl.cab
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - hxxp://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230772705531
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - hxxp://wwwimages.adobe.com/www.adobe.com/products/acrobat/nos/gp.cab
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kc8a4~1.alb\applic~1\mozilla\firefox\profiles\hcpgmaki.default\
FF - prefs.js: browser.search.selectedEngine - Ixquick
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/webhp
FF - plugin: c:\program files\google\google updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin2.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin3.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin4.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin5.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin6.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-3-1 64160]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-30 110992]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-30 24336]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-30 142592]
R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-12-30 73464]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2008-12-30 700152]
R2 FolderProtectService;FolderProtectService;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectService.exe [2009-2-3 10240]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 951120]
R2 PD91Agent;PD91Agent;c:\program files\raxco\perfectdisk2008\PD91Agent.exe [2008-1-16 664840]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-1-2 603904]
R2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2008-12-31 598856]
S1 FolderProtectDriver;FolderProtectDriver;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectDriver.sys [2009-2-3 15616]
S2 gupdate1c985d829e7373e;Google Update Service (gupdate1c985d829e7373e);c:\program files\google\update\GoogleUpdate.exe [2009-2-3 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-1-4 1684736]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-1-25 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-1-25 3072]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-1-1 33752]
S3 PD91Engine;PD91Engine;c:\program files\raxco\perfectdisk2008\PD91Engine.exe [2008-1-16 894216]
S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\drivers\TPP300.SYS [2002-6-23 35584]

============== File Associations ===============

txtfile=c:\windows\NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-03-07 18:33 --d----- c:\program files\common files\PC Tools
2009-03-07 18:33 --d----- c:\program files\Spyware Doctor
2009-03-07 17:39 --d----- c:\docume~1\kc8a4~1.alb\applic~1\FrostWire
2009-03-07 16:12 72 ---shr-- C:\autorun.inf
2009-03-07 15:14 --d----- c:\docume~1\kc8a4~1.alb\applic~1\LimeWire
2009-03-07 15:14 --d----- c:\program files\LimeWire
2009-03-07 10:17 --d----- c:\program files\SupervisionCam
2009-03-07 02:38 94,720 ---shr-- c:\windows\system32\nmdfgds1.dll
2009-03-07 02:38 94,720 ---shr-- c:\windows\system32\nmdfgds0.dll
2009-03-06 10:24 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Malwarebytes
2009-03-06 10:24 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-06 10:24 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 10:24 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 10:24 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-03-06 03:16 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-05 19:12 --d----- c:\program files\Yahoo!
2009-03-05 18:17 --d----- c:\docume~1\kc8a4~1.alb\applic~1\GetRightToGo
2009-03-05 17:53 0 a------- C:\broadcast.tmp
2009-03-04 18:56 --d----- c:\documents and settings\k. albert\Saved Games
2009-03-04 18:56 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Flood Light Games
2009-03-04 18:56 --d----- c:\docume~1\alluse~1\applic~1\Flood Light Games
2009-03-04 15:53 --d----- c:\program files\Identity Finder
2009-03-04 15:31 --d----- c:\windows\ZipItFree
2009-03-02 10:20 --d----- c:\docume~1\kc8a4~1.alb\applic~1\WebcamZoneTrigger
2009-03-01 14:35 15,688 a------- c:\windows\system32\lsdelete.exe
2009-03-01 00:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-03-01 00:47 -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-01 00:47 --d----- c:\program files\Lavasoft
2009-02-26 19:18 24,468 a---h--- c:\windows\system32\mlfcache.dat
2009-02-26 19:17 --d----- c:\program files\Bonjour
2009-02-26 00:14 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Systweak
2009-02-26 00:12 --d----- c:\program files\Advanced System Optimizer
2009-02-25 23:57 406 a------- c:\windows\system32\ioloBootDefrag.cfg
2009-02-25 23:40 74,703 a------- c:\windows\system32\mfc45.dll
2009-02-25 23:33 --d----- c:\docume~1\kc8a4~1.alb\applic~1\iolo
2009-02-25 23:33 --d----- c:\docume~1\alluse~1\applic~1\iolo
2009-02-25 21:10 --d----- C:\JUNK
2009-02-25 20:21 68,624 a----r-- c:\windows\system32\drivers\DefragFS.sys
2009-02-25 20:19 --d----- c:\program files\Raxco
2009-02-24 21:30 20 a------- c:\windows\mafosav.INI
2009-02-21 22:51 344,064 a------- c:\windows\system32\msvcr70.dll
2009-02-21 22:51 --d----- c:\program files\common files\DVDVideoSoft
2009-02-18 17:46 95 a------- c:\windows\wininit.ini
2009-02-18 08:30 71 a------- c:\windows\RmFile.ini
2009-02-18 08:30 53,728 a------- c:\windows\rmfile.exe
2009-02-18 08:30 43,664 a------- c:\windows\addrun.exe
2009-02-18 08:30 890 a------- c:\windows\Win.Fa
2009-02-18 08:30 231 a------- c:\windows\System.Fa
2009-02-18 08:26 27,632 a------- c:\windows\system\Ctl3DV2.Dll
2009-02-18 08:19 --d----- c:\program files\Microsoft SQL Server Compact Edition
2009-02-17 22:39 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-02-17 22:39 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-02-17 16:53 30,208 -------- c:\windows\system32\WNASPI32.DLL
2009-02-17 16:53 4,030 -------- c:\windows\system\WINASPI.DLL
2009-02-17 16:53 291 a------- c:\windows\msfsetup.ini
2009-02-17 16:53 8,096 -------- c:\windows\system32\drivers\MASPINT.SYS
2009-02-17 16:53 2,486 -------- c:\windows\system\AS16POST.BIN
2009-02-17 16:48 155,648 a------- c:\windows\system32\FFRAFLIB.DLL
2009-02-17 16:48 274,432 a------- c:\windows\system32\FFTIFF16.dll
2009-02-17 16:47 81,924 -------- c:\windows\system32\drivers\VC4CB104.SYS
2009-02-17 16:47 --d----- c:\program files\REGSHAVE
2009-02-17 16:47 65,536 -------- c:\windows\system32\FINFCHECK.dll
2009-02-17 16:47 45,056 -------- c:\windows\system32\FINFCOPY.dll
2009-02-17 16:47 69,632 -------- c:\windows\system32\FREGSHEX.DLL
2009-02-17 16:47 45,056 -------- c:\windows\system32\FCLKBTN.DLL
2009-02-15 09:39 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Geometric
2009-02-15 09:37 3,426,072 a------- c:\windows\system32\d3dx9_32.dll
2009-02-14 17:35 53,248 a------- c:\windows\system32\CSVer.dll
2009-02-14 17:35 290,816 a------- c:\windows\vncutil.exe
2009-02-14 17:35 104,992 a------- c:\windows\RtkAudioService.exe
2009-02-14 17:02 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
2009-02-14 17:02 662,288 a------- c:\windows\system32\MSCOMCT2.OCX
2009-02-14 17:02 427,864 a------- c:\windows\system32\XceedZip.dll
2009-02-12 23:15 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Auslogics
2009-02-12 20:23 --d----- c:\program files\Ascentive
2009-02-11 15:20 459,264 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-02-11 15:20 267,776 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-02-11 15:20 52,224 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-11 15:20 383,488 -c------ c:\windows\system32\dllcache\ieapfltr.dll
2009-02-11 15:20 63,488 -c------ c:\windows\system32\dllcache\icardie.dll
2009-02-11 15:20 13,824 -c------ c:\windows\system32\dllcache\ieudinit.exe
2009-02-11 15:20 2,455,488 -c------ c:\windows\system32\dllcache\ieapfltr.dat
2009-02-11 15:20 991,232 -c------ c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-11 15:20 6,066,688 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-02-10 19:38 --d----- c:\docume~1\kc8a4~1.alb\applic~1\PCF-VLC
2009-02-10 12:24 --d-h--- c:\program files\Zero G Registry
2009-02-10 12:21 --d-h--- c:\documents and settings\k. albert\InstallAnywhere
2009-02-10 00:03 --d----- c:\windows\vbSkinner
2009-02-09 05:35 --d----- c:\windows\SHELLNEW
2009-02-09 05:05 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Mathsoft
2009-02-09 02:12 334,792 a------- c:\windows\system32\_AxShlEx.dll
2009-02-09 02:10 --d----- c:\program files\Alcohol Soft
2009-02-06 19:03 307,576 a------- c:\windows\WLXPGSS.SCR
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll

==================== Find3M ====================

2009-03-06 03:17 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-26 22:11 155,384 a------- c:\windows\system32\guard32.dll
2009-02-26 22:11 110,992 a------- c:\windows\system32\drivers\cmdguard.sys
2009-02-20 10:01 24,336 a------- c:\windows\system32\drivers\cmdhlp.sys
2009-02-05 01:25 700,928 ----h--- c:\windows\system32\wodfamoh.dll
2009-02-03 17:32 18,085,888 a------- c:\windows\RTHDCPL.EXE
2009-02-03 17:22 5,030,912 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-02-03 16:35 35,840 a------- c:\windows\system32\RtkCoInstXP.dll
2009-01-30 18:27 717,296 a------- c:\windows\system32\drivers\sptd.sys
2009-01-26 16:06 98,304 a------- c:\windows\system32\CmdLineExt.dll
2009-01-21 15:54 1,206,816 a------- c:\windows\RtlUpd.exe
2009-01-06 03:33 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-02 22:53 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-01-01 15:09 12,325 a------- c:\windows\system32\SpoonUninstall-Jardinains!.dat
2009-01-01 15:09 164,352 a------- c:\windows\system32\SpoonUninstall.exe
2008-12-30 18:29 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll

============= FINISH: 19:17:39.87 ===============

I'm not suprised it came back, Limewire and frostwire are installed. You will ALWAYS get infected using P2P. Stay away from P2P.


Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  C:\autorun.inf
  c:\windows\system32\nmdfgds1.dll
  c:\windows\system32\nmdfgds0.dll
  c:\docume~1\kc8a4~1.alb\applic~1\FrostWire
  c:\docume~1\kc8a4~1.alb\applic~1\LimeWire
  c:\program files\LimeWire
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
C:\autorun.inf moved successfully.
File/Folder c:\windows\system32\nmdfgds1.dll not found.
File/Folder c:\windows\system32\nmdfgds0.dll not found.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\xml\data moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\xml moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\themes\frostwirePro_theme moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\themes moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\.NetworkShare\Incomplete moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\.NetworkShare moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\.AppSpecialShare moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\xml\data moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\xml moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\promotion moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\updates\0 moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\updates moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\extensions moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\Cache moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\html moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\fonts moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\entityTables moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\dtd moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\plugins moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\modules moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\greprefs moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\dictionaries moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile\US\chrome moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile\US moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile\chrome moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\pref moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\autoconfig moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\components moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\chrome moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\.AppSpecialShare moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire moved successfully.
c:\program files\LimeWire\lib moved successfully.
c:\program files\LimeWire moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03082009_095952

It should be okay now.

I hope so were at the races right now and I need this computer to hatch whats going on in the car.... I'll keep a eye on it...

We just got a break and I run Spybot S & D and got the following:

ABetterInternet
Bestsearch.Scvlost
XPPreload
TNS-Search
Smitfraud.C
Sgrunt
MediaMotor
CoolWWWSearch
CoolWWWSearch.Goolems
CoolWWWSearch.BadZoneMap

Does Spybot say where it found them? They could be OTMoveIt backups.

Delete this folder in bold.
C:\_OTMoveIt

I removed C:\_OTMoveIt...Yesterday and this morning I checked my system and everything is clean...
You did a execrably job...Thank you very much

From the Mel Adjusted Racing Team and K. Albert, Thank you very much