Win32 /Cryptor Virus Found need a fix

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:20:23 PM, on 5/20/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Internet Explorer\Iexplore.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All Users\Desktop\Downloads\hijackgpthis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Dan Patel
O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WinInet Class - {39fc2065-c9c7-49cd-8942-44cc2dedc844} - C:\WINDOWS\ieocx.dll (file missing)
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Uninstall getPlus(R) for Adobe] "C:\Program Files\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1noarp
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe
O4 - HKUS\S-1-5-21-2646134407-1993050365-1204694373-1010\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup (User 'QBDataServiceUser18')
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Personal Coach.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Bela\Start Menu\Programs\>Accessories\IMVU\Run IMVU.lnk (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
O16 - DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} (DHSurveillanceCtrl Control) - http://dvr.icrealtimewest.com/dvrweb.cab
O16 - DPF: {145F2C4A-A607-11D5-A439-000021033F40} (Silicor WebRemote View) - http://www.silicor.com/SilicorWebRemote.cab
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - http://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
O16 - DPF: {562F7004-BE6D-42D0-AFE3-D149F7F3DD6C} (SSRNetViewer Control) - http://www.goddns.org/vtvt/DIVIS_NET.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
O16 - DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} (ActiveView Control) - http://208.57.207.76/ActiveView.cab
O16 - DPF: {69F62FC3-3FEC-4073-BF33-5C64401C0E5D} (ImageCalc Control) - http://divis.serveftp.com/ImageCalc.cab
O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
O16 - DPF: {886F18E5-DF38-4AFD-8C9C-38A6DC1D6265} (SkyWeb) - http://69.230.80.178:60002/Skyweb.cab
O16 - DPF: {8F393A31-0BB8-4F15-88AA-7FC258781B7D} - http://netpromax.net/Files/FXWEBSVC.CAB
O16 - DPF: {949987D2-EAA6-4092-9563-7C221FC718FB} (RemoteClient Control) - http://2008dvr.dvrip.com.tw/RemoteClient.cab
O16 - DPF: {B37D8AB5-3A6C-4219-BC46-93B26EF0E53D} (ActiveFormX Control) - http://211.174.251.155/XViewer.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
O16 - DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} (WebDvr3 Class) - http://69.234.184.251/WebDvr3.cab
O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
O16 - DPF: {F92211F4-3913-4DC2-A275-756374D848B0} (ERViewerOCX Control) - http://208.50.31.230/MP4DVR.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O16 - DPF: {FE681FA4-1F59-4B05-B186-F948F5965DC4} (AxWebSetup Control) - http://vs1312.dyndns.org/ICLAXPlayer16.cab
O16 - DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} (CheckersZPA Object) - http://zone.msn.com/bingame/zpagames/CheckersZPA.cab55579.cab
O18 - Protocol: intu-help-qb1 - {9B0F96C7-2E4B-433E-ABF3-043BA1B54AE3} - C:\Program Files\Intuit\QuickBooks 2006\HelpAsyncPluggableProtocol.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - mscoree.dll (file missing)
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: QBCFMonitorService - Intuit - C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
O23 - Service: QuickBooksDB18 - iAnywhere Solutions, Inc. - C:\PROGRA~1\Intuit\QUICKB~1\QBDBMgrN.exe
O24 - Desktop Component 0: (no name) - http://teldancommunication.com/images/logo1-copy-62.gif

--
End of file - 11846 bytes

I did the hijack and pasted the info in note pad. Will wait for you prompt reply

dan wrote:

I did the hijack and pasted the info in note pad. Will wait for you prompt reply

Please advise what I need to next.

Hello dan,

Please try not to reply to your own thread as I assume someone is already helping you

• Open HijackThis
  
• Choose "Do a system scan only"
  
• Check the boxes in front of these lines:
  
  
  O2 - BHO: (no name) - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
  O2 - BHO: WinInet Class - {39fc2065-c9c7-49cd-8942-44cc2dedc844} - C:\WINDOWS\ieocx.dll (file missing)
  O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
  O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)'
  
  
  
  
• Press "Fix Checked"
  
• Close Hijack This.
  

• Download combofix from here
  Link 1
  Link 2
  
• We need to disable your local AV (Anti-virus) before running Combofix.
  
• See HERE for how to disable your AV.
  
• Double click on ComboFix.exe.
  
• Follow the prompts. NOTE:
  
• ComboFix will check to see if the Microsoft Windows Recovery Console is installed.
  ***It's strongly recommended to have the Recovery Console installed before doing any malware removal.***
  
  **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will automatically proceed with its scan.
  
  
  
• The Recovery Console provides a recovery/repair mode should a problem occur during a Combofix run.
  
  
  
  
• Allow ComboFix to download the Recovery Console.
  
• Accept the End-User License Agreement.
  
• The Recovery Console will be installed.
  
• You will then get this next prompt that asks if you want to continue the malware scan, select yes
  
  
  
  
• Allow combofix to run
  
• Post C:\combofix.txt back here.
  
  Note:
  Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
  

Still get the error ' You cannot rename Combofix 2 please use another name preferably alphanumeric. Thanks

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-05-14.01)

Microsoft Windows XP Professional
Boot Device: \Device\HarddiskVolume2
Install Date: 5/14/2006 6:31:49 PM
System Uptime: 5/28/2009 12:04:53 PM (0 hours ago)

Motherboard: Dell Inc. | | 0JC474
Processor: Intel(R) Pentium(R) 4 CPU 2.80GHz | Microprocessor | 2793/800mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 144 GiB total, 108.216 GiB free.
E: is CDROM ()
F: is FIXED (FAT32) - 149 GiB total, 135.429 GiB free.
G: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1049: 5/20/2009 8:19:32 PM - System Checkpoint
RP1050: 5/25/2009 3:22:15 AM - System Checkpoint

==== Installed Programs ======================

Acrobat.com
Adobe Acrobat 4.0
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 9.1
Adobe Shockwave Player
Adobe Photoshop Album Starter Edition 3.0
AOLIcon
Apple Mobile Device Support
Apple Software Update
AVG 8.5
BDoC Manager
BDoC Manager (C:\Program Files\BDoC Manager\)
Canon Camera Access Library
Canon Camera Support Core Library
Canon Camera Window DC_DV 5 for ZoomBrowser EX
Canon Camera Window DC_DV 6 for ZoomBrowser EX
Canon Camera Window MC 6 for ZoomBrowser EX
Canon G.726 WMP-Decoder
Canon MovieEdit Task for ZoomBrowser EX
Canon RAW Image Task for ZoomBrowser EX
Canon RemoteCapture Task for ZoomBrowser EX
Canon Utilities EOS Utility
Canon Utilities PhotoStitch
Canon Utilities ZoomBrowser EX
CoffeeCup Free FTP 4.0.1
Conexant D850 56K V.9x DFVc Modem
ConfigIO Utility
Corel Paint Shop Pro X
Corel Photo Album 6
Dell CinePlayer
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Game Console
Dell System Restore
DellSupport
Digital Content Portal
Digital Line Detect
Documentation & Support Launcher
Driver Detective
DVR Utility
DVR Web Viewer for IE (remove only)
EducateU
ELIcon
ESPNMotion
Expedia Fare Alert
FXClient
FXClient32
Games, Music, & Photos Launcher
GoToMeeting/GoToWebinar 3.0.0.198
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Player 10 (KB903157)
Hotfix for Windows XP (KB952287)
HP Photo and Imaging 2.0 - All-in-One
HP Photo and Imaging 2.0 - All-in-One Drivers
hp psc 2200 series
Intel(R) Graphics Media Accelerator Driver
Intel(R) PRO Network Connections Drivers
Intel(R) PROSet for Wired Connections
Inter-Tel 3000 MPS Maintenance Version 1.0
iPod Copy Expert 3.1.2
iPod for Windows 2006-06-28
iTunes
Java(TM) 6 Update 13
Learn2 Player (Uninstall Only)
LiveUpdate 2.6 (Symantec Corporation)
Math Trek 7, 8
Mavis Beacon Teaches Typing 15
MCU
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 1
Microsoft Component Installer 2.0 SDK
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Standard Edition 2003
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Middle School Vocabulary
Modem Helper
Mozilla Firefox (3.0.10)
Mpg4Decode
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 Parser and SDK
NetWaiting
Otto
PDA-Net
QuickBooks Pro 2008
QuickTime
ReaJPEG 2.0
Roxio DLA
Roxio MyDVD LE
Roxio RecordNow Audio
Roxio RecordNow Copy
Roxio RecordNow Data
SCRABBLE
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Serial Simulator
Sonic Activation Module
Sonic Encoders
Sonic Update Manager
Spybot - Search & Destroy 1.4
SupportSoft Assisted Service
Uninstall EyeMax DVR Client
Uninstall MDVR
Universe 3D
Update for Windows Media Player 10 (KB910393)
Update for Windows Media Player 10 (KB913800)
Update for Windows Media Player 10 (KB926251)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update Rollup 2 for Windows XP Media Center Edition 2005
Viewpoint Media Player
WebCyberCoach 3.2 Dell
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows Imaging Component
Windows Installer 3.1 (KB893803)
Windows Installer Clean Up
Windows Internet Explorer 7
Windows Live Mail
Windows Live Messenger
Windows Live Writer
Windows Media Format Runtime
Windows Media Player 10
Windows Media Player 10 Hotfix [See EmeraldQFE2 for more information]
Windows Media Player Firefox Plugin
Windows XP Media Center Edition 2005 KB908246
Windows XP Media Center Edition 2005 KB912067
Windows XP Service Pack 3
WordPerfect Office 12
World of Satellites II

==== Event Viewer Messages From Past Week ========

5/24/2009 10:46:51 AM, error: sr [1] - The System Restore filter encountered the unexpected error '0xC0000001' while processing the file '' on the volume 'HarddiskVolume4'. It has stopped monitoring the volume.
5/23/2009 11:14:11 AM, error: Service Control Manager [7034] - The iPod Service service terminated unexpectedly. It has done this 1 time(s).
5/23/2009 11:13:36 AM, error: Service Control Manager [7034] - The HTTP SSL service terminated unexpectedly. It has done this 1 time(s).
5/21/2009 2:11:09 PM, error: Print [19] - Sharing printer failed + 1722, Printer hp psc 2200 series share name hppsc220.

==== End Of File ===========================

DDS (Ver_09-05-14.01) - NTFSx86
Run by Dan at 12:17:10.47 on Thu 05/28/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_13
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.411 [GMT -7:00]

AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
svchost.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Canon\CAL\CALMAIN.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb07.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Broderbund\Mavis Beacon Teaches Typing 15\minimavis.exe
C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Internet Explorer\Iexplore.exe
C:\Documents and Settings\Dan\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.yahoo.com/
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.yahoo.com/search/ie.html
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
uWindow Title = Microsoft Internet Explorer provided by Dan Patel
mDefault_Page_URL = hxxp://www.yahoo.com/
mDefault_Search_URL = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
mSearch Page = hxxp://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
uSearchAssistant = hxxp://www.google.com/ie
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
BHO: : {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: DriveLetterAccess: {5ca3d70e-1895-11cf-8e15-001234567890} - c:\windows\system32\dla\DLASHX_W.DLL
BHO: {7E853D72-626A-48EC-A868-BA8D5E23E045} - No File
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [MSMSGS] "c:\program files\messenger\msmsgs.exe" /background
uRun: [AdobeUpdater] c:\program files\common files\adobe\updater5\AdobeUpdater.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hppsc2~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpobnz08.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpoddt~1.lnk - c:\program files\hewlett-packard\digital imaging\bin\hpotdd01.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\person~1.lnk - c:\program files\broderbund\mavis beacon teaches typing 15\minimavis.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\quickb~1.lnk - c:\program files\common files\intuit\quickbooks\qbupdate\qbupdate.exe
IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\bela\start menu\programs\>accessories\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
Trusted Zone: vitekcctv.com\www
DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} - hxxp://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
DPF: {0DB074F0-617E-4EE9-912C-2965CF2AA5A4} - hxxp://download.microsoft.com/download/f/0/2/f02b515c-7076-4cee-bc08-fd6fea594578/VirtualEarth3D.cab
DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://dvr.icrealtimewest.com/dvrweb.cab
DPF: {145F2C4A-A607-11D5-A439-000021033F40} - hxxp://www.silicor.com/SilicorWebRemote.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/9/b/d/9bdc68ef-6a9f-4505-8fb8-d0d2d160e512/LegitCheckControl.cab
DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} - hxxp://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
DPF: {49232000-16E4-426C-A231-62846947304B} - hxxp://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
DPF: {4CCA4E80-9259-11D9-AC6E-444553544200} - hxxp://h30155.www3.hp.com/ediags/dd/install/HPInstallMgr_v01_5.cab
DPF: {562F7004-BE6D-42D0-AFE3-D149F7F3DD6C} - hxxp://www.goddns.org/vtvt/DIVIS_NET.cab
DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} - hxxp://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} - hxxp://208.57.207.76/ActiveView.cab
DPF: {69F62FC3-3FEC-4073-BF33-5C64401C0E5D} - hxxp://divis.serveftp.com/ImageCalc.cab
DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} - hxxp://h20270.www2.hp.com/ediags/gmn2/install/HPProductDetection.cab
DPF: {886F18E5-DF38-4AFD-8C9C-38A6DC1D6265} - hxxp://69.230.80.178:60002/Skyweb.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {8F393A31-0BB8-4F15-88AA-7FC258781B7D} - hxxp://netpromax.net/Files/FXWEBSVC.CAB
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {949987D2-EAA6-4092-9563-7C221FC718FB} - hxxp://2008dvr.dvrip.com.tw/RemoteClient.cab
DPF: {B37D8AB5-3A6C-4219-BC46-93B26EF0E53D} - hxxp://211.174.251.155/XViewer.cab
DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} - hxxp://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab56649.cab
DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} - hxxp://69.234.184.251/WebDvr3.cab
DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553560000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - hxxp://a532.g.akamai.net/f/532/6712/5m/virtools.download.akamai.com/6712/player/install/installer.exe
DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} - hxxp://zone.msn.com/binframework/v10/StProxy.cab55579.cab
DPF: {F92211F4-3913-4DC2-A275-756374D848B0} - hxxp://208.50.31.230/MP4DVR.cab
DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} - hxxps://secure.logmein.com/activex/ractrl.cab?lmi=100
DPF: {FE681FA4-1F59-4B05-B186-F948F5965DC4} - hxxp://vs1312.dyndns.org/ICLAXPlayer16.cab
DPF: {FF3C5A9F-5A91-4930-80E8-4709194C2AD3} - hxxp://zone.msn.com/bingame/zpagames/CheckersZPA.cab55579.cab
Handler: intu-help-qb1 - {9B0F96C7-2E4B-433e-ABF3-043BA1B54AE3} - c:\program files\intuit\quickbooks 2006\HelpAsyncPluggableProtocol.dll
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Handler: qbwc - {FC598A64-626C-4447-85B8-53150405FD57} - c:\windows\system32\mscoree.dll
Notify: avgrsstarter - avgrsstx.dll
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\dan\applic~1\mozilla\firefox\profiles\2rcdjld2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npracplug.dll
FF - plugin: c:\program files\real\realarcade\plugins\mozilla\npracplug.dll
FF - plugin: c:\program files\viewpoint\viewpoint experience technology\npViewpoint.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true
============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-5-7 325896]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-5-7 27784]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-5-7 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-5-7 298776]
R2 iomgmt;TMT IO Managment Protocol Driver;c:\windows\system32\drivers\iomgmt.sys [2006-5-14 33664]
R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
R2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\intuit\quickb~1\qbdbmgrn.exe -hvquickbooksdb18 --> c:\progra~1\intuit\quickb~1\QBDBMgrN.exe -hvQuickBooksDB18 [?]

=============== Created Last 30 ================

2009-05-25 15:50 --d----- C:\$WIN_NT$.~LS
2009-05-25 15:50 --d----- C:\$WIN_NT$.~BT
2009-05-25 15:50 --d----- c:\windows\setupupd
2009-05-25 15:30 477,897 a----r-- C:\txtsetup.sif
2009-05-25 15:30 260,272 a----r-- C:\$LDR$
2009-05-25 15:30 --d----- c:\windows\setup.pss
2009-05-24 12:02 389,120 a------- c:\windows\system32\CF15357.exe
2009-05-24 12:02 389,120 a------- c:\windows\system32\CF15253.exe
2009-05-24 11:55 389,120 a------- c:\windows\system32\CF13924.exe
2009-05-24 11:54 389,120 a------- c:\windows\system32\CF13290.exe
2009-05-24 11:24 389,120 a------- c:\windows\system32\CF7530.exe
2009-05-24 10:54 389,120 a------- c:\windows\system32\CF2034.exe
2009-05-24 10:51 389,120 a------- c:\windows\system32\CF1505.exe
2009-05-24 10:49 389,120 a------- c:\windows\system32\CF1077.exe
2009-05-24 10:30 --d----- c:\windows\system32\en
2009-05-24 10:30 --d----- c:\windows\system32\bits
2009-05-24 10:19 0 a------t c:\windows\006507_.tmp
2009-05-24 10:05 388,608 a------- c:\windows\system32\CF25139.exe
2009-05-23 11:19 388,608 a------- c:\windows\system32\CF19630.exe
2009-05-23 11:05 388,608 a------- c:\windows\system32\CF16919.exe
2009-05-23 11:04 388,608 a------- c:\windows\system32\CF16671.exe
2009-05-23 11:03 388,608 a------- c:\windows\system32\CF16491.exe
2009-05-23 11:02 388,608 a------- c:\windows\system32\CF16273.exe
2009-05-22 00:39 388,608 a------- c:\windows\system32\CF5256.exe
2009-05-22 00:38 388,608 a------- c:\windows\system32\CF5099.exe
2009-05-22 00:37 388,608 a------- c:\windows\system32\CF4929.exe
2009-05-22 00:36 388,608 a------- c:\windows\system32\CF4756.exe
2009-05-22 00:34 388,608 a------- c:\windows\system32\CF4442.exe
2009-05-22 00:33 388,608 a------- c:\windows\system32\CF4184.exe
2009-05-22 00:32 388,608 a------- c:\windows\system32\CF3907.exe
2009-05-22 00:31 388,608 a------- c:\windows\system32\CF3789.exe
2009-05-22 00:30 388,608 a------- c:\windows\system32\CF3590.exe
2009-05-22 00:23 388,608 a------- c:\windows\system32\CF1696.exe
2009-05-20 22:55 410,984 a------- c:\windows\system32\deploytk.dll
2009-05-20 22:55 73,728 a------- c:\windows\system32\javacpl.cpl
2009-05-13 03:03 118 a------- c:\windows\system32\MRT.INI
2009-05-11 14:59 --d----- c:\docume~1\dan\applic~1\aAvgApi
2009-05-07 21:31 --d----- c:\docume~1\dan\applic~1\AVG8
2009-05-07 18:27 --d-h--- C:\$AVG8.VAULT$
2009-05-07 18:22 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
2009-05-07 18:22 11,952 a------- c:\windows\system32\avgrsstx.dll
2009-05-07 18:22 325,896 a------- c:\windows\system32\drivers\avgldx86.sys
2009-05-07 18:22 --d----- c:\windows\system32\drivers\Avg
2009-05-07 18:22 --d----- c:\docume~1\dan\applic~1\AVGTOOLBAR
2009-05-07 18:21 --d----- c:\program files\AVG
2009-05-07 18:21 --d----- c:\docume~1\alluse~1\applic~1\avg8

==================== Find3M ====================

2009-05-05 10:14 6,686 a--sh--- c:\windows\system32\KGyGaAvL.sys
2009-04-16 11:14 249,856 -------- c:\windows\Setup1.exe
2009-04-16 11:14 73,216 a------- c:\windows\ST6UNST.EXE
2009-03-21 07:06 989,696 -------- c:\windows\system32\dllcache\kernel32.dll
2009-03-06 07:22 284,160 a------- c:\windows\system32\pdh.dll
2009-03-06 07:22 284,160 -------- c:\windows\system32\dllcache\pdh.dll
2009-03-02 17:18 826,368 a------- c:\windows\system32\wininet.dll
2009-03-02 17:18 826,368 a------- c:\windows\system32\dllcache\wininet.dll
2009-02-27 21:54 636,072 -------- c:\windows\system32\dllcache\iexplore.exe
2009-02-05 10:20 60,744 a------- c:\documents and settings\dan\g2mdlhlpx.exe
2008-03-01 10:48 0 a------- c:\program files\temp01
2008-02-17 21:30 164 a---h--- c:\documents and settings\all users\hpothb07.dat
2007-10-21 22:46 739 a---h--- c:\documents and settings\dan\hpothb07.dat
2007-09-27 21:18 774,144 a------- c:\program files\RngInterstitial.dll
2007-09-18 08:35 659,380 a------- c:\program files\BDoC Manager.zip
2006-06-20 13:55 6,177,452 a------- c:\documents and settings\dan\200409092069212004100516525220041105154230_20060214_3.50(HO.4)C0-ZyAIR_G-3000_V3.50(HO.4)C0_Standard.zip
2006-06-16 11:36 1,205,372 a------- c:\documents and settings\dan\dyndns-setup.zip
2008-12-15 20:44 32,768 a--sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008121520081216\index.dat

============= FINISH: 12:18:42.50 ===============

Hello.

Go to Start > Control Panel > Add/Remove Programs and remove the following programs.

• Spybot - Search & Destroy 1.4
  
• Viewpoint Media Player
  

Delete your copy of Combofix you have right now.

1. If you are using Firefox, make sure that your download settings are as follows:

* Tools->Options->Main tab
* Set to "Always ask me where to Save the files".

2. During the download, rename Combofix to Combo-Fix as follows:





3. It is important you rename Combofix during the download, but not after.
4. Please do not rename Combofix to other names, but only to the one indicated.
5. Close any open browsers.
6. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Now try running Combofix.

ComboFix 09-05-29.01 - Dan 05/29/2009 23:30.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.627 [GMT -7:00]
Running from: c:\documents and settings\Dan\Desktop\avgvirusremoval05\Combo-Fix.exe
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bela\Application Data\SpamBlocker
c:\documents and settings\Bela\Desktop\WinPC Defender.LNK
c:\documents and settings\Bela\Start Menu\WinPC Defender.LNK
c:\documents and settings\Dan\Application Data\SpamBlocker
c:\program files\FunWebProducts
c:\program files\MyWebSearch
c:\program files\MyWebSearch\bar\History\search3
c:\program files\MyWebSearch\bar\Settings\s_pid.dat
c:\program files\MyWebSearch\bar\Settings\setting2.htm
c:\program files\MyWebSearch\bar\Settings\settings.dat
c:\temp\bkR11
c:\windows\jestertb.dll
c:\windows\system32\bszip.dll
c:\windows\system32\drivers\UACswcxssud.sys
c:\windows\system32\UACagedwfei.dll
c:\windows\system32\UACcbyohngo.log
c:\windows\system32\UACchtwstws.dat
c:\windows\system32\UACdfxxbiwq.log
c:\windows\system32\UAChublmxuu.dll
c:\windows\system32\uacinit.dll
c:\windows\system32\UAClnoaciyd.log
c:\windows\system32\UACqvoqavdv.dll
c:\windows\system32\UACvxyqhxab.dll
c:\windows\system32\UACxvoafmtm.dll
c:\windows\system32\xpysys.dll
F:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_UACd.sys


((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 )))))))))))))))))))))))))))))))
.

2009-05-24 17:30 . 2009-05-24 17:30 -------- d-----w c:\windows\system32\en
2009-05-24 17:30 . 2009-05-24 17:30 -------- d-----w c:\windows\system32\bits
2009-05-21 06:09 . 2009-05-21 06:09 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-05-21 05:55 . 2009-05-21 05:55 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-21 05:55 . 2009-05-21 05:55 152576 ----a-w c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 03:24 . 2009-05-21 03:24 -------- d-----w c:\documents and settings\Dan\Local Settings\Application Data\PC_Drivers_Headquarters
2009-05-18 23:45 . 2009-05-08 01:21 312088 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-18 23:44 . 2009-05-08 01:21 1437464 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-16 17:36 . 2009-05-16 17:35 2051864 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-16 17:36 . 2009-05-08 01:21 3288344 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-16 17:36 . 2009-05-08 01:21 2302232 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-16 17:36 . 2009-05-08 01:21 3399960 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-16 17:36 . 2009-05-08 04:39 1262880 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll
2009-05-16 17:36 . 2009-05-08 01:21 424472 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-16 17:36 . 2009-05-08 01:21 354584 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll
2009-05-16 17:36 . 2009-05-08 01:21 177432 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-16 17:36 . 2009-05-08 01:21 486168 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-16 17:35 . 2009-05-08 04:39 1083672 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe
2009-05-16 17:35 . 2009-05-08 01:21 755992 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-11 21:59 . 2009-05-11 21:59 -------- d-----w c:\documents and settings\Dan\Application Data\aAvgApi
2009-05-09 19:37 . 2009-05-09 19:37 -------- d-----w c:\documents and settings\Bela\Application Data\AVGTOOLBAR
2009-05-08 04:31 . 2009-05-08 04:31 -------- d-----w c:\documents and settings\Dan\Application Data\AVG8
2009-05-08 01:27 . 2009-05-30 05:51 -------- d--h--w C:\$AVG8.VAULT$
2009-05-08 01:22 . 2009-05-08 01:22 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-08 01:22 . 2009-05-08 01:22 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-08 01:22 . 2009-05-08 01:22 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-08 01:22 . 2009-05-08 01:22 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-08 01:22 . 2009-05-30 01:48 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-08 01:22 . 2009-05-09 20:19 -------- d-----w c:\documents and settings\Dan\Application Data\AVGTOOLBAR
2009-05-08 01:21 . 2009-05-08 13:33 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-08 01:21 . 2009-05-08 01:21 -------- d-----w c:\program files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 06:05 . 2006-05-15 03:48 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-30 05:59 . 2006-05-09 19:25 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-05-30 05:59 . 2006-05-15 03:48 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-30 05:56 . 2006-05-09 19:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-26 05:57 . 2009-03-05 06:30 -------- d-----w c:\documents and settings\Dan\Application Data\U3
2009-05-24 21:39 . 2007-10-06 23:03 -------- d-----w c:\documents and settings\Bela\Application Data\IMVU
2009-05-24 17:19 . 2009-05-24 17:19 0 ----atw c:\windows\006507_.tmp
2009-05-21 21:11 . 2008-07-01 17:35 -------- d-----w c:\program files\NOS
2009-05-21 21:11 . 2008-07-01 17:35 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-21 06:08 . 2006-05-16 15:58 -------- d-----w c:\program files\Common Files\Adobe
2009-05-21 06:00 . 2006-05-09 19:14 -------- d-----w c:\program files\Java
2009-05-21 03:23 . 2007-02-16 02:31 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-08 11:24 . 2008-09-29 21:13 849184 ----a-w c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\qbpatch.exe
2009-05-08 02:51 . 2005-08-17 01:54 -------- d-----w c:\program files\DIGStream
2009-05-05 21:30 . 2009-05-05 21:30 43 ----a-w c:\documents and settings\Bela\Application Data\~ygw.tmp
2009-05-05 17:14 . 2006-05-18 06:04 6686 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-05-05 17:14 . 2006-05-18 06:04 88 --sh--r c:\windows\system32\F80C9CA4FB.sys
2009-04-24 14:17 . 2009-04-16 18:14 -------- d-----w c:\program files\Serial Simulator
2009-04-23 17:45 . 2006-06-08 03:55 56 --sh--r c:\windows\system32\FBA49C0CF8.sys
2009-04-16 18:14 . 2006-05-15 03:59 249856 ------w c:\windows\Setup1.exe
2009-04-16 18:14 . 2006-05-15 03:59 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-16 17:59 . 2009-04-16 17:59 -------- d-----w c:\program files\PC Drivers HeadQuarters
2009-04-16 17:59 . 2009-04-16 17:59 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-04-13 16:17 . 2009-04-13 16:17 -------- d-----w c:\program files\webrec
2009-04-06 01:03 . 2008-09-20 06:00 5368 ----a-w c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\qbbackup.sys
2009-03-06 14:22 . 2005-08-16 09:18 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2005-08-16 09:18 826368 ----a-w c:\windows\system32\wininet.dll
2008-03-01 17:48 . 2008-03-01 17:48 0 ----a-w c:\program files\temp01
2007-09-28 04:18 . 2007-09-28 04:20 774144 ----a-w c:\program files\RngInterstitial.dll
2007-09-18 15:35 . 2007-09-18 15:35 659380 ----a-w c:\program files\BDoC Manager.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 06:05 . 2006-05-15 03:48 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-30 05:59 . 2006-05-09 19:25 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-05-30 05:59 . 2006-05-15 03:48 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-30 05:56 . 2006-05-09 19:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-26 05:57 . 2009-03-05 06:30 -------- d-----w c:\documents and settings\Dan\Application Data\U3
2009-05-24 21:39 . 2007-10-06 23:03 -------- d-----w c:\documents and settings\Bela\Application Data\IMVU
2009-05-24 17:19 . 2009-05-24 17:19 0 ----atw c:\windows\006507_.tmp
2009-05-21 21:11 . 2008-07-01 17:35 -------- d-----w c:\program files\NOS
2009-05-21 21:11 . 2008-07-01 17:35 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-21 06:08 . 2006-05-16 15:58 -------- d-----w c:\program files\Common Files\Adobe
2009-05-21 06:00 . 2006-05-09 19:14 -------- d-----w c:\program files\Java
2009-05-21 03:23 . 2007-02-16 02:31 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-08 11:24 . 2008-09-29 21:13 849184 ----a-w c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\qbpatch.exe
2009-05-08 02:51 . 2005-08-17 01:54 -------- d-----w c:\program files\DIGStream
2009-05-05 21:30 . 2009-05-05 21:30 43 ----a-w c:\documents and settings\Bela\Application Data\~ygw.tmp
2009-05-05 17:14 . 2006-05-18 06:04 6686 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-05-05 17:14 . 2006-05-18 06:04 88 --sh--r c:\windows\system32\F80C9CA4FB.sys
2009-04-24 14:17 . 2009-04-16 18:14 -------- d-----w c:\program files\Serial Simulator
2009-04-23 17:45 . 2006-06-08 03:55 56 --sh--r c:\windows\system32\FBA49C0CF8.sys
2009-04-16 18:14 . 2006-05-15 03:59 249856 ------w c:\windows\Setup1.exe
2009-04-16 18:14 . 2006-05-15 03:59 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-16 17:59 . 2009-04-16 17:59 -------- d-----w c:\program files\PC Drivers HeadQuarters
2009-04-16 17:59 . 2009-04-16 17:59 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-04-13 16:17 . 2009-04-13 16:17 -------- d-----w c:\program files\webrec
2009-04-06 01:03 . 2008-09-20 06:00 5368 ----a-w c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\qbbackup.sys
2009-03-06 14:22 . 2005-08-16 09:18 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2005-08-16 09:18 826368 ----a-w c:\windows\system32\wininet.dll
2008-03-01 17:48 . 2008-03-01 17:48 0 ----a-w c:\program files\temp01
2007-09-28 04:18 . 2007-09-28 04:20 774144 ----a-w c:\program files\RngInterstitial.dll
2007-09-18 15:35 . 2007-09-18 15:35 659380 ----a-w c:\program files\BDoC Manager.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-09-26 267064]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-03-10 188416]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

c:\documents and settings\Bela\Start Menu\Programs\Startup\
IMVU.lnk - c:\my games\IMVU\IMVUClient.exe [2007-9-17 40192]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-08 01:22 11952 ----a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=c:\windows\pss\hp psc 2000 Series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Bela^Start Menu^Programs^Startup^Expedia Fare Alert.lnk]
path=c:\documents and settings\Bela\Start Menu\Programs\Startup\Expedia Fare Alert.lnk
backup=c:\windows\pss\Expedia Fare Alert.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"="1"
"UpdatesDisableNotify"="1"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\BDoC Manager\\D-Link2.exe"=
"c:\\dvr.plugins\\MDVR\\mdvr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\networkdvr\\remote.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Inter-Tel 3000\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Dan\\Desktop\\FAXconsol.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/7/2009 6:22 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/7/2009 6:22 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/7/2009 6:21 PM 298776]
R2 iomgmt;TMT IO Managment Protocol Driver;c:\windows\system32\drivers\iomgmt.sys [5/14/2006 9:04 PM 33664]
R2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB18 --> c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB18 [?]
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 21:57]

2009-05-29 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4200284678.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 00:56]

2009-05-30 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4217033178.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 00:56]
.
- - - - ORPHANS REMOVED - - - -

HKCU-Run-AdobeUpdater - c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe
SafeBoot-procexp90.Sys


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Bela\Start Menu\Programs\>Accessories\IMVU\Run IMVU.lnk
Trusted Zone: vitekcctv.com\www
DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://dvr.icrealtimewest.com/dvrweb.cab
DPF: {145F2C4A-A607-11D5-A439-000021033F40} - hxxp://www.silicor.com/SilicorWebRemote.cab
DPF: {562F7004-BE6D-42D0-AFE3-D149F7F3DD6C} - hxxp://www.goddns.org/vtvt/DIVIS_NET.cab
DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} - hxxp://208.57.207.76/ActiveView.cab
DPF: {69F62FC3-3FEC-4073-BF33-5C64401C0E5D} - hxxp://divis.serveftp.com/ImageCalc.cab
DPF: {886F18E5-DF38-4AFD-8C9C-38A6DC1D6265} - hxxp://69.230.80.178:60002/Skyweb.cab
DPF: {8F393A31-0BB8-4F15-88AA-7FC258781B7D} - hxxp://netpromax.net/Files/FXWEBSVC.CAB
DPF: {949987D2-EAA6-4092-9563-7C221FC718FB} - hxxp://2008dvr.dvrip.com.tw/RemoteClient.cab
DPF: {B37D8AB5-3A6C-4219-BC46-93B26EF0E53D} - hxxp://211.174.251.155/XViewer.cab
DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} - hxxp://69.234.184.251/WebDvr3.cab
DPF: {F92211F4-3913-4DC2-A275-756374D848B0} - hxxp://208.50.31.230/MP4DVR.cab
DPF: {FE681FA4-1F59-4B05-B186-F948F5965DC4} - hxxp://vs1312.dyndns.org/ICLAXPlayer16.cab
FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\2rcdjld2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-29 23:37
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-2646134407-1993050365-1204694373-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8704C2EA-42AE-D91B-95DE-6B414E8BFD67}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iacnfgibcccobhiphg"=hex:6a,61,70,62,6e,6e,6b,6d,6d,6e,69,61,61,63,6b,62,6d,68,
6b,6e,00,00
"haemihjfjnclgpfd"=hex:6a,61,70,62,6e,6e,6b,6d,6d,6e,69,61,61,63,6b,62,6d,68,
6b,6e,00,af
.
Completion time: 2009-05-30 23:41
ComboFix-quarantined-files.txt 2009-05-30 06:41

Pre-Run: 117,290,721,280 bytes free
Post-Run: 120,951,693,312 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
c:\$win_nt$.~bt\BOOTSECT.DAT="Microsoft Windows XP Professional Setup"

250 --- E O F --- 2009-05-26 10:00

Now open a new notepad file.
Input this into the notepad file:

KILLALL::

File::
c:\windows\006507_.tmp
c:\documents and settings\Bela\Application Data\~ygw.tmp

Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=-
"UpdatesDisableNotify"=-

DDS::
DPF: {108D3206-846A-4A93-BACB-F0572D043ED7} - hxxp://dvr.icrealtimewest.com/dvrweb.cab
DPF: {145F2C4A-A607-11D5-A439-000021033F40} - hxxp://www.silicor.com/SilicorWebRemote.cab
DPF: {562F7004-BE6D-42D0-AFE3-D149F7F3DD6C} - hxxp://www.goddns.org/vtvt/DIVIS_NET.cab
DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} - hxxp://208.57.207.76/ActiveView.cab
DPF: {69F62FC3-3FEC-4073-BF33-5C64401C0E5D} - hxxp://divis.serveftp.com/ImageCalc.cab
DPF: {886F18E5-DF38-4AFD-8C9C-38A6DC1D6265} - hxxp://69.230.80.178:60002/Skyweb.cab
DPF: {8F393A31-0BB8-4F15-88AA-7FC258781B7D} - hxxp://netpromax.net/Files/FXWEBSVC.CAB
DPF: {949987D2-EAA6-4092-9563-7C221FC718FB} - hxxp://2008dvr.dvrip.com.tw/RemoteClient.cab
DPF: {B37D8AB5-3A6C-4219-BC46-93B26EF0E53D} - hxxp://211.174.251.155/XViewer.cab
DPF: {BA5E57BB-88D5-422A-AC9E-C01A6EEE2537} - hxxp://69.234.184.251/WebDvr3.cab
DPF: {F92211F4-3913-4DC2-A275-756374D848B0} - hxxp://208.50.31.230/MP4DVR.cab
DPF: {FE681FA4-1F59-4B05-B186-F948F5965DC4} - hxxp://vs1312.dyndns.org/ICLAXPlayer16.cab

Domains::

RegNull::
[HKEY_USERS\S-1-5-21-2646134407-1993050365-1204694373-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{8704C2EA-42AE-D91B-95DE-6B414E8BFD67}*]

Save this as CFScript.txt, save it to your desktop also.
Then drag and drop CFScript.txt into combofix as seen below:


This will open combofix again, agree to it's terms and allow it to run.
It may want to reboot after it's done. (It will warn you if it wants to)
Post the resulting log back here.

ComboFix 09-05-30.03 - Dan 05/30/2009 12:00.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1014.504 [GMT -7:00]
Running from: c:\documents and settings\Dan\Desktop\avgvirusremoval05\Combo-Fix.exe
Command switches used :: c:\documents and settings\Dan\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\documents and settings\Bela\Application Data\~ygw.tmp"
"c:\windows\006507_.tmp"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Bela\Application Data\~ygw.tmp
c:\windows\006507_.tmp

.
((((((((((((((((((((((((( Files Created from 2009-04-28 to 2009-05-30 )))))))))))))))))))))))))))))))
.

2009-05-30 06:12 . 2009-05-30 06:12 -------- d--h--w c:\windows\PIF
2009-05-25 22:50 . 2009-05-25 22:50 -------- d-----w C:\$WIN_NT$.~LS
2009-05-25 22:50 . 2009-05-25 22:50 -------- d-----w C:\$WIN_NT$.~BT
2009-05-24 17:30 . 2009-05-24 17:30 -------- d-----w c:\windows\system32\en
2009-05-24 17:30 . 2009-05-24 17:30 -------- d-----w c:\windows\system32\bits
2009-05-21 06:09 . 2009-05-21 06:09 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-05-21 05:55 . 2009-05-21 05:55 410984 ----a-w c:\windows\system32\deploytk.dll
2009-05-21 05:55 . 2009-05-21 05:55 152576 ----a-w c:\documents and settings\Dan\Application Data\Sun\Java\jre1.6.0_13\lzma.dll
2009-05-21 03:24 . 2009-05-21 03:24 -------- d-----w c:\documents and settings\Dan\Local Settings\Application Data\PC_Drivers_Headquarters
2009-05-18 23:45 . 2009-05-08 01:21 312088 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avglngx.dll
2009-05-18 23:44 . 2009-05-08 01:21 1437464 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.dll
2009-05-16 17:36 . 2009-05-16 17:35 2051864 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgcorex.dll
2009-05-16 17:36 . 2009-05-08 01:21 3288344 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\setup.exe
2009-05-16 17:36 . 2009-05-08 01:21 2302232 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avguiadv.dll
2009-05-16 17:36 . 2009-05-08 01:21 3399960 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgui.exe
2009-05-16 17:36 . 2009-05-08 04:39 1262880 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwd.dll
2009-05-16 17:36 . 2009-05-08 01:21 424472 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgwdwsc.dll
2009-05-16 17:36 . 2009-05-08 01:21 354584 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgxch32.dll
2009-05-16 17:36 . 2009-05-08 01:21 177432 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgmail.dll
2009-05-16 17:36 . 2009-05-08 01:21 486168 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgrsx.exe
2009-05-16 17:35 . 2009-05-08 04:39 1083672 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avgupd.exe
2009-05-16 17:35 . 2009-05-08 01:21 755992 ----a-w c:\documents and settings\All Users\Application Data\avg8\update\backup\avginet.dll
2009-05-11 21:59 . 2009-05-11 21:59 -------- d-----w c:\documents and settings\Dan\Application Data\aAvgApi
2009-05-09 19:37 . 2009-05-09 19:37 -------- d-----w c:\documents and settings\Bela\Application Data\AVGTOOLBAR
2009-05-08 04:31 . 2009-05-08 04:31 -------- d-----w c:\documents and settings\Dan\Application Data\AVG8
2009-05-08 01:27 . 2009-05-30 15:58 -------- d--h--w C:\$AVG8.VAULT$
2009-05-08 01:22 . 2009-05-08 01:22 11952 ----a-w c:\windows\system32\avgrsstx.dll
2009-05-08 01:22 . 2009-05-08 01:22 108552 ----a-w c:\windows\system32\drivers\avgtdix.sys
2009-05-08 01:22 . 2009-05-08 01:22 325896 ----a-w c:\windows\system32\drivers\avgldx86.sys
2009-05-08 01:22 . 2009-05-08 01:22 27784 ----a-w c:\windows\system32\drivers\avgmfx86.sys
2009-05-08 01:22 . 2009-05-30 15:59 -------- d-----w c:\windows\system32\drivers\Avg
2009-05-08 01:22 . 2009-05-09 20:19 -------- d-----w c:\documents and settings\Dan\Application Data\AVGTOOLBAR
2009-05-08 01:21 . 2009-05-08 13:33 -------- d-----w c:\documents and settings\All Users\Application Data\avg8
2009-05-08 01:21 . 2009-05-08 01:21 -------- d-----w c:\program files\AVG

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-30 06:05 . 2006-05-15 03:48 -------- d-----w c:\program files\Spybot - Search & Destroy
2009-05-30 05:59 . 2006-05-09 19:25 -------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-05-30 05:59 . 2006-05-15 03:48 -------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-05-30 05:56 . 2006-05-09 19:22 -------- d--h--w c:\program files\InstallShield Installation Information
2009-05-26 05:57 . 2009-03-05 06:30 -------- d-----w c:\documents and settings\Dan\Application Data\U3
2009-05-24 21:39 . 2007-10-06 23:03 -------- d-----w c:\documents and settings\Bela\Application Data\IMVU
2009-05-21 21:11 . 2008-07-01 17:35 -------- d-----w c:\program files\NOS
2009-05-21 21:11 . 2008-07-01 17:35 -------- d-----w c:\documents and settings\All Users\Application Data\NOS
2009-05-21 06:08 . 2006-05-16 15:58 -------- d-----w c:\program files\Common Files\Adobe
2009-05-21 06:00 . 2006-05-09 19:14 -------- d-----w c:\program files\Java
2009-05-21 03:23 . 2007-02-16 02:31 -------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2009-05-08 11:24 . 2008-09-29 21:13 849184 ----a-w c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\Components\DownloadQB18\Patch\qbpatch.exe
2009-05-08 02:51 . 2005-08-17 01:54 -------- d-----w c:\program files\DIGStream
2009-05-05 17:14 . 2006-05-18 06:04 6686 --sha-w c:\windows\system32\KGyGaAvL.sys
2009-05-05 17:14 . 2006-05-18 06:04 88 --sh--r c:\windows\system32\F80C9CA4FB.sys
2009-04-24 14:17 . 2009-04-16 18:14 -------- d-----w c:\program files\Serial Simulator
2009-04-23 17:45 . 2006-06-08 03:55 56 --sh--r c:\windows\system32\FBA49C0CF8.sys
2009-04-16 18:14 . 2006-05-15 03:59 249856 ------w c:\windows\Setup1.exe
2009-04-16 18:14 . 2006-05-15 03:59 73216 ----a-w c:\windows\ST6UNST.EXE
2009-04-16 17:59 . 2009-04-16 17:59 -------- d-----w c:\program files\PC Drivers HeadQuarters
2009-04-16 17:59 . 2009-04-16 17:59 -------- d-----w c:\documents and settings\All Users\Application Data\PC Drivers HeadQuarters
2009-04-13 16:17 . 2009-04-13 16:17 -------- d-----w c:\program files\webrec
2009-04-06 01:03 . 2008-09-20 06:00 5368 ----a-w c:\documents and settings\All Users\Application Data\Intuit\QuickBooks 2008\qbbackup.sys
2009-03-06 14:22 . 2005-08-16 09:18 284160 ----a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2005-08-16 09:18 826368 ----a-w c:\windows\system32\wininet.dll
2008-03-01 17:48 . 2008-03-01 17:48 0 ----a-w c:\program files\temp01
2007-09-28 04:18 . 2007-09-28 04:20 774144 ----a-w c:\program files\RngInterstitial.dll
2007-09-18 15:35 . 2007-09-18 15:35 659380 ----a-w c:\program files\BDoC Manager.zip
.

((((((((((((((((((((((((((((( SnapShot@2009-05-30_06.37.53 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-30 19:13 . 2009-05-30 19:13 16384 c:\windows\temp\Perflib_Perfdata_72c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"msnmsgr"="c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-06-29 286720]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-09-26 267064]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb07.exe" [2003-03-10 188416]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-05-08 1947928]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-05-21 148888]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-28 35696]

c:\documents and settings\Bela\Start Menu\Programs\Startup\
IMVU.lnk - c:\my games\IMVU\IMVUClient.exe [2007-9-17 40192]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-9 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-9 28672]
QuickBooks Update Agent.lnk - c:\program files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2008-10-22 972064]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-05-08 01:22 11952 ----a-w c:\windows\system32\avgrsstx.dll

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 2000 Series.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\hp psc 2000 Series.lnk
backup=c:\windows\pss\hp psc 2000 Series.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\QuickBooks Update Agent.lnk
backup=c:\windows\pss\QuickBooks Update Agent.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Bela^Start Menu^Programs^Startup^Expedia Fare Alert.lnk]
path=c:\documents and settings\Bela\Start Menu\Programs\Startup\Expedia Fare Alert.lnk
backup=c:\windows\pss\Expedia Fare Alert.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\NetMeeting\\conf.exe"=
"c:\\Program Files\\BDoC Manager\\D-Link2.exe"=
"c:\\dvr.plugins\\MDVR\\mdvr.exe"=
"c:\\WINDOWS\\system32\\fxsclnt.exe"=
"c:\\networkdvr\\remote.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\Intuit\\QuickBooks 2006\\QBDBMgrN.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Inter-Tel 3000\\jre\\bin\\javaw.exe"=
"c:\\Documents and Settings\\Dan\\Desktop\\FAXconsol.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiag.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgdiagex.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [5/7/2009 6:22 PM 325896]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [5/7/2009 6:22 PM 108552]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [5/7/2009 6:21 PM 298776]
R2 iomgmt;TMT IO Managment Protocol Driver;c:\windows\system32\drivers\iomgmt.sys [5/14/2006 9:04 PM 33664]
R2 QuickBooksDB18;QuickBooksDB18;c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB18 --> c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe -hvQuickBooksDB18 [?]
.
Contents of the 'Scheduled Tasks' folder

2009-05-07 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 21:57]

2009-05-29 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4200284678.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 00:56]

2009-05-30 c:\windows\Tasks\FRU Task 2003-04-10 00:56ewlett-Packard2003-04-10 00:56p psc 2200 series272A572217594EBCF1CEE215E352B92AD073FDE4217033178.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-10 00:56]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
mStart Page = hxxp://www.yahoo.com/
mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Bela\Start Menu\Programs\>Accessories\IMVU\Run IMVU.lnk
FF - ProfilePath - c:\documents and settings\Dan\Application Data\Mozilla\Firefox\Profiles\2rcdjld2.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npracplug.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll

---- FIREFOX POLICIES ----
FF - user.js: yahoo.homepage.dontask - true.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-30 12:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

*

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Intuit\QuickBooks\QBCFMonitorService.exe
c:\progra~1\Intuit\QUICKB~1\QBDBMgrN.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\fxssvc.exe
c:\windows\ehome\mcrdsvc.exe
c:\program files\Canon\CAL\CALMAIN.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wscntfy.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\windows\system32\HPZipm12.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe
.
**************************************************************************
.
Completion time: 2009-05-30 12:27 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-30 19:27
ComboFix2.txt 2009-05-30 06:41

Pre-Run: 120,951,930,880 bytes free
Post-Run: 120,935,882,752 bytes free

219 --- E O F --- 2009-05-26 10:00

Please download the OTMoveIt3 by OldTimer.

• Save it to your desktop.
  
• Please double-click OTMoveIt3.exe to run it.
  
• Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  :files
  c:\documents and settings\All Users\Application Data\Viewpoint
  
  
  
• Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  
• Click the red Moveit! button.
  
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  
• Close OTMoveIt3
  

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.

========== FILES ==========
File/Folder c:\documents and settings\All Users\Application Data\Viewpoint:files not found.

OTMoveIt3 by OldTimer - Version 1.0.11.0 log created on 05302009_132831

Please download and run this tool.

Download Malwarebytes' Anti-Malware from Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  

Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.

Post the contents of the MBAM Log.

Malwarebytes' Anti-Malware 1.37
Database version: 2198
Windows 5.1.2600 Service Pack 3

5/30/2009 4:16:38 PM
mbam-log-2009-05-30 (16-16-38).txt

Scan type: Quick Scan
Objects scanned: 115768
Time elapsed: 3 minute(s), 53 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 18
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 12
Files Infected: 128

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{2e9937fc-cf2f-4f56-af54-5a6a3dd375cc} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{741de825-a6f0-4497-9aa6-8023cf9b0fff} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d518921a-4a03-425e-9873-b9a71756821e} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{d714a94f-123a-45cc-8f03-040bcaf82ad6} (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{56256a51-b582-467e-b8d4-7786eda79ae0} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{59c7fc09-1c83-4648-b3e6-003d2bbc7481} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68af847f-6e91-45dd-9b68-d6a12c30e5d7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9170b96c-28d4-4626-8358-27e6caeef907} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{d1a71fa0-ff48-48dd-9b6d-7a13a3e42127} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{ddb1968e-ead6-40fd-8dae-ff14757f60c7} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{f138d901-86f0-4383-99b6-9cdd406036da} (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\RunDll32Policy\f3ScrCtr.dll (Adware.MyWay) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\The Weather Channel (Adware.Hotbar) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Fun Web Products (Adware.MyWebSearch) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\MyWebSearch (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
c:\documents and settings\Bela\Application Data\SpamBlockerUtility_Icons (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\Application Data\SpamBlockerUtility_Icons (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\Application Data\SpamBlockerUtility_Icons (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\Application Data\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\SpamBlockerUtility (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\TooltipXML (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\ustat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad (Adware.Hotbar) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.
c:\documents and settings\Bela\application data\spamblockerutility_icons\MobileSidewalk_2.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Bela\application data\spamblockerutility_icons\MobileSidewalk_4.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Bela\application data\spamblockerutility_icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\application data\spamblockerutility_icons\MobileSidewalk_2.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\application data\spamblockerutility_icons\Software_Online_8.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\application data\spamblockerutility_icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility_icons\MobileSidewalk_2.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility_icons\MobileSidewalk_4.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility_icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\SpamBlockerUtility.log (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\761357.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\25043 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\26664 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\27503 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\42915 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\79079 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\80193 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\ads.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\btntrans1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\business_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\buttondir.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\components.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\default.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz1.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz10.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz11.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz12.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz13.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility

Files Infected:
C:\Program Files\Windows Live\Messenger\msimg32.dll (Adware.MyWebSearch) -> Delete on reboot.
c:\documents and settings\Bela\application data\spamblockerutility_icons\MobileSidewalk_2.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Bela\application data\spamblockerutility_icons\MobileSidewalk_4.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Bela\application data\spamblockerutility_icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\application data\spamblockerutility_icons\MobileSidewalk_2.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\application data\spamblockerutility_icons\Software_Online_8.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Dan\application data\spamblockerutility_icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility_icons\MobileSidewalk_2.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility_icons\MobileSidewalk_4.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility_icons\wallpapere1.ico (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\SpamBlockerUtility.log (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\761357.sdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\25043 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\26664 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\27503 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\42915 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\79079 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\dynamic\tooltipxml\80193 (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\ads.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\btntrans1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\business_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\buttondir.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\components.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\default.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz1.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz10.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz11.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz12.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz13.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz14.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz15.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz16.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz17.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz18.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz19.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz2.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz20.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz3.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz4.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz5.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz6.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz7.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz8.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_bidz9.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_categorize.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_comparison.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_em_PROFL_CA_flow_b_IEB.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_explorer-Mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_explorer-people.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_fastutilities.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_favorites.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Games.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Hide.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_hotbarcom.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Hotmail.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_hsskin.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jemster.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jemsterie.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jemsteruk.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_jobsearch.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_Mails.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_new.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_reun.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_ringtones.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_SearchBoxTrapper.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_searchfor.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_searchgo.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_weather.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Default_yellowpages.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_1000.res (Adware.Hotbar) -> Quarantined and deleted successfully.

:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_1000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_2000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_3000.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_bar.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_bbar1.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_logos.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_buttons_other.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\d_icons_weather.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\email-def-511724-9595.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\email-t1-bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hotbar-premium-hotbar-premium.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hotbar-premium.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\hotbar_promo.htm (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\icons2.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\keywords.idx (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\keywords1.dat (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\layout.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\linkpathlegal.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\progress.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\sales_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\s_icons_buttons.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\t2_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\top7.cdf (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\Top7_theweb.mnu (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\1\tsd_bg.res (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\ads.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\BtnTrans.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\BtnTrans1.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\business_promo.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\buttondir.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\default.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_1000.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_2000.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_3000.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_bar.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_bbar1.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_logos.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_buttons_other.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\d_icons_weather.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\email-t1-bg.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\hotbar-premium.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\hotbar_promo.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\icons2.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\keywords.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\keywords1.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\layout.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\linkpathlegal.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\progress.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\sales_buttons.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\samplegroups2.txt (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\samplegroups2.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\sbuwallpaper.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\s_icons_buttons.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\t2_bg.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\top7.xip (Adware.Hotbar) -> Quarantined and deleted successfully.
c:\documents and settings\Shabri\application data\spamblockerutility\v3.0\spamblockerutility\static\DownLoad\tsd_bg.xip (Adware.Hotbar) -> Quarantined and deleted successfully.

Haven't got reply back please let me know if all the Virus and Malware are removed or if any further steps need to be taken. Once you let me know then I will like to Donate for your time.

Yep, that should do it.
Let us know how the machine is running

Great, works good. Thanks for your support.