Here is the log it provided. I tried closing AVG, but it said it was still running. I hope this doesn't interfere too much.
ComboFix 09-03-06.02 - Reno 2009-03-10 0:11:41.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1022.590 [GMT -5:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\Vachitah\Local Settings\Temporary Internet Files\ijjistarter_verinfo.dat
c:\windows\system32\eduvahum.ini
c:\windows\system32\gijotoda.dll
c:\windows\system32\jawepuwa.dll
c:\windows\system32\mertdx.dll
c:\windows\system32\tomavita.dll
c:\windows\system32\uyepegaj.ini
c:\windows\system32\viyiyini.dll
.
((((((((((((((((((((((((( Files Created from 2009-02-10 to 2009-03-10 )))))))))))))))))))))))))))))))
.
2009-03-09 11:25 . 2009-03-09 11:25 d——– c:\documents and settings\All Users.WINDOWS\Application Data\yozuyosa
2009-03-09 11:25 . 2009-03-09 17:39 d——– c:\documents and settings\All Users.WINDOWS\Application Data\kewowupa
2009-03-09 11:25 . 2009-03-09 11:25 d——– c:\documents and settings\All Users.WINDOWS\Application Data\bikuhagu
2009-03-08 16:28 . 2009-03-08 16:28 10,240 –a—— c:\windows\instsp1.exe
2009-03-06 17:13 . 2009-03-08 23:15 d–hs—- c:\documents and settings\Vachitah\Application Data\Virus Melt
2009-03-06 17:13 . 2009-03-06 17:13 d–hs—- c:\documents and settings\All Users.WINDOWS\Application Data\System Data
2009-03-06 17:12 . 2009-03-08 23:15 d–hs—- c:\documents and settings\All Users.WINDOWS\Application Data\c7ea711
2009-03-06 14:29 . 2009-03-06 14:05 15,688 –a—— c:\windows\system32\lsdelete.exe
2009-03-06 14:06 . 2009-03-06 14:05 64,160 –a—— c:\windows\system32\drivers\Lbd.sys
2009-03-06 14:04 . 2009-03-06 14:04 d——– c:\program files\Lavasoft
2009-03-06 14:04 . 2009-03-06 14:06 d——– c:\documents and settings\All Users.WINDOWS\Application Data\Lavasoft
2009-03-06 14:04 . 2009-03-06 14:04 d–h-c— c:\documents and settings\All Users.WINDOWS\Application Data\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-06 13:50 . 2009-03-06 13:50 d——– c:\program files\Trend Micro
2009-03-06 01:23 . 2009-03-09 11:48 d–h—– C:\$AVG8.VAULT$
2009-03-06 01:18 . 2009-03-09 18:33 d——– c:\windows\system32\drivers\Avg
2009-03-06 01:18 . 2009-03-06 01:18 d——– c:\program files\AVG
2009-03-06 01:18 . 2009-03-10 00:09 d——– c:\documents and settings\All Users.WINDOWS\Application Data\avg8
2009-03-06 01:18 . 2009-03-06 01:18 325,640 –a—— c:\windows\system32\drivers\avgldx86.sys
2009-03-06 01:18 . 2009-03-06 01:18 107,912 –a—— c:\windows\system32\drivers\avgtdix.sys
2009-03-06 01:18 . 2009-03-06 01:18 10,520 –a—— c:\windows\system32\avgrsstx.dll
2009-02-25 18:11 . 2009-02-25 18:11 d——– c:\documents and settings\All Users.WINDOWS\Application Data\Visual Watermark
2009-02-25 17:49 . 2009-02-25 18:11 d——– c:\program files\Visual Watermark
2009-02-25 17:46 . 2009-02-25 17:46 d——– c:\program files\EasySector
2009-02-25 17:35 . 2009-02-25 17:45 d——– C:\MIR
2009-02-25 17:17 . 2009-02-25 17:17 d——– c:\program files\Multiple Image Resizer .NET
2009-02-21 14:03 . 2009-02-21 14:03 d——– C:\ijji
2009-02-19 23:58 . 2009-02-19 23:58 d——– c:\program files\Webroot
2009-02-19 23:58 . 2009-02-19 23:58 d——– c:\program files\Common Files\Webroot Shared
2009-02-19 23:58 . 2009-02-19 23:58 d——– c:\documents and settings\Reno.MASHIMA-5F0922B\Application Data\Webroot
2009-02-19 23:58 . 2005-04-20 10:34 487,936 –a—— c:\windows\system32\wwSecure.exe
2009-02-19 23:58 . 2005-04-18 13:49 57,344 –a—— c:\windows\Unwash6.exe
2009-02-18 19:59 . 2009-02-18 19:59 d——– c:\documents and settings\Vachitah\Program Files
2009-02-18 19:59 . 2009-03-09 18:50 d——– c:\documents and settings\Vachitah\Application Data\DNA
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-10 05:17 ——— d—–w c:\program files\Steam
2009-03-09 07:29 ——— d—–w c:\program files\Soulseek
2009-03-08 09:44 ——— d—–w c:\documents and settings\Reno.MASHIMA-5F0922B\Application Data\mIRC
2009-03-08 09:32 ——— d—–w c:\program files\mIRC
2009-03-06 04:48 ——— d—–w c:\documents and settings\Reno.MASHIMA-5F0922B\Application Data\uTorrent
2009-02-25 22:18 ——— d–h–w c:\program files\InstallShield Installation Information
2009-02-25 22:16 ——— d—–w c:\program files\Common Files\InstallShield
2009-02-21 19:03 ——— d–h–w c:\documents and settings\Vachitah\Application Data\ijjigame
2009-02-03 05:11 ——— d—–w c:\documents and settings\Reno.MASHIMA-5F0922B\Application Data\foobar2000
2009-02-03 04:41 ——— d—–w c:\program files\Java
2009-02-03 00:32 ——— d—–w c:\documents and settings\Vachitah\Application Data\InstallShield Installation Information
2009-01-19 11:28 ——— d—–w c:\documents and settings\Vachitah\Application Data\DivX
2009-01-17 07:34 ——— d—–w c:\program files\GoldWave
2009-01-16 17:20 ——— d—–w c:\documents and settings\Reno.MASHIMA-5F0922B\Application Data\Viewpoint
2009-01-12 08:04 ——— d—–w c:\program files\K-Lite Codec Pack
1601-01-01 00:12 79,872 –sha-w c:\windows\system32\dimisawo.dll
1601-01-01 00:12 79,872 –sha-w c:\windows\system32\medemovo.dll
.
——- Sigcheck ——-
2005-12-18 12:30 359040 27a5959c94ee173a063ca06bd14f021a c:\windows\system32\drivers\tcpip.sys
2009-01-27 23:55 502272 6225f14b8ce08ccba8b25ad27843c674 c:\windows\system32\winlogon.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Steam"="c:\program files\Steam\Steam.exe" [2008-12-02 1410296]
"Aim6"="c:\program files\AIM6\aim6.exe" [2008-10-21 50472]
"Window Washer"="c:\program files\Webroot\Washer\wwDisp.exe" [2005-04-20 894464]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-11-20 290088]
"Adobe Photo Downloader"="c:\program files\Adobe\Adobe Photoshop Lightroom 1.3\apdproxy.exe" [2007-11-05 61440]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-02 136600]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-03-06 1932568]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-06 515416]
"CPM17b9516f"="c:\docume~1\ALLUSE~1.WIN\APPLIC~1\yozuyosa\yozuyosa.dll" [2009-03-09 84992]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4}"= "c:\docume~1\alluse~1.win\applic~1\yozuyosa\yozuyosa.dll" [2009-03-09 84992]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"SSODL"= {EC43E3FD-5C60-46a6-97D7-E0B85DBDD6C4} - c:\docume~1\alluse~1.win\applic~1\yozuyosa\yozuyosa.dll [2009-03-09 84992]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-03-06 01:18 10520 c:\windows\system32\avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\docume~1\alluse~1.win\applic~1\yozuyosa\yozuyosa.dll
"LoadAppInit_DLLs"=1 (0x1)
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgnsx.exe"=
"c:\\Program Files\\Viewpoint\\Common\\ViewpointService.exe"=
"c:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\bin\\AppleMobileDeviceService.exe"=
R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-03-06 64160]
R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-03-06 325640]
R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-03-06 107912]
R2 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-03-06 908056]
R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-03-06 298264]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 951120]
R2 libusbd;LibUsb-Win32 - Daemon, Version 0.1.10.1;system32\libusbd-nt.exe –> system32\libusbd-nt.exe [?]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2008-12-02 24652]
R3 libusb0;LibUsb-Win32 - Kernel Driver, Version 0.1.10.1;c:\windows\system32\drivers\libusb0.sys [2009-01-07 33792]
.
Contents of the 'Scheduled Tasks' folder
2009-03-06 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-06 14:05]
2009-03-04 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]
.
- - - - ORPHANS REMOVED - - - -
BHO-{06277766-d113-4843-be4c-c0eb80529d64} - c:\windows\system32\sekisahi.dll
HKLM-Run-148a62f3 - c:\windows\system32\jagepeyu.dll
HKLM-Run-ligigopano - c:\windows\system32\hafatipo.dll
.
——- Supplementary Scan ——-
.
uInternet Settings,ProxyOverride = *.local
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2009-03-10 00:18:17
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————
[HKEY_USERS\S-1-5-21-1960408961-1844237615-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9CB76BE9-92AC-AC31-8484-B019C548F24E}*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
"iacednefjoeklhdcmm"=hex:6a,61,67,68,6c,6f,62,70,63,67,69,6f,6f,66,61,70,68,6a,
68,65,00,00
"hamdjkifflbomcgi"=hex:6a,61,67,68,6c,6f,62,70,63,67,69,6f,6f,66,61,70,68,6a,
68,65,00,00
.
——————— DLLs Loaded Under Running Processes ———————
- - - - - - - > 'winlogon.exe'(720)
c:\windows\system32\Ati2evxx.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\windows\system32\ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\windows\ehome\ehRecvr.exe
c:\windows\ehome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\windows\system32\libusbd-nt.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\wwSecure.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
c:\program files\AIM6\aolsoftware.exe
.
**************************************************************************
.
Completion time: 2009-03-10 0:21:29 - machine was rebooted [Reno]
ComboFix-quarantined-files.txt 2009-03-10 05:21:26
Pre-Run: 593,469,440 bytes free
Post-Run: 1,137,905,664 bytes free
196