AZ help for Trojan.vundo.h

Hello,
I cant seem to get rid of trojan horse. I have run ATF, and downloaded Malwarebytes - and have run that. But every time I reboot, I get a program named pwkxdts trying to load, and it keeps taking on different names (mostly as a US Robotics systme file) - Win Patrol keeps bringing it up and I keep blocking it

Here are my malwarebytes log, and my HijackThis logs:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:33:50 AM, on 5/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://channels.aimtoday.com/search/aimtoolbar.jsp
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O2 - BHO: (no name) - {225d39f7-15d0-4b6f-966e-ade4cd3f840e} - C:\WINDOWS\system32\gypbcpav.dll
O2 - BHO: (no name) - {46306440-d0b4-4dcb-afb5-641267edef70} - C:\WINDOWS\system32\gypbcpav.dll
O2 - BHO: (no name) - {cfcb8710-4ca5-45ff-baa9-5bca3cb854fc} - c:\windows\system32\pwxkdts.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O20 - Winlogon Notify: ekjrfhva - C:\WINDOWS\SYSTEM32\pwxkdts.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: EMP_UDSA - Unknown owner - C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

–
End of file - 7400 bytes


Malwarebytes' Anti-Malware 1.36
Database version: 2070
Windows 5.1.2600 Service Pack 3

5/3/2009 11:43:11 AM
mbam-log-2009-05-03 (11-43-11).txt

Scan type: Quick Scan
Objects scanned: 91408
Time elapsed: 6 minute(s), 59 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\gypbcpav.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{225d39f7-15d0-4b6f-966e-ade4cd3f840e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{225d39f7-15d0-4b6f-966e-ade4cd3f840e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{46306440-d0b4-4dcb-afb5-641267edef70} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{46306440-d0b4-4dcb-afb5-641267edef70} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{225d39f7-15d0-4b6f-966e-ade4cd3f840e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{46306440-d0b4-4dcb-afb5-641267edef70} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\gypbcpav.dll (Trojan.Vundo.H) -> Delete on reboot.

Hello Gringo and Thank you !!

the log files are below
i keep the following messages :

WINPATROL alerts me to a new IE Helper: : afnoinkdsfe.dll - I do not allow the add on
WINPATROL alerts me to a new IE Helper: : pwxkdts.dll - I do not allow the add on
WINPATROL alerts me to a change in the following file: HOSTS at
location c:\windows\system32\drivers\etc\host - I reject the change
these messages occur every 2-3 minutes

Here are you requested log files


1.log from MBAM

Malwarebytes' Anti-Malware 1.36
Database version: 2072
Windows 5.1.2600 Service Pack 3

5/3/2009 5:40:38 PM
mbam-log-2009-05-03 (17-40-38).txt

Scan type: Full Scan (C:\|D:\|J:\|)
Objects scanned: 304537
Time elapsed: 1 hour(s), 53 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\gypbcpav.dll (Trojan.Vundo.H) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{225d39f7-15d0-4b6f-966e-ade4cd3f840e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{225d39f7-15d0-4b6f-966e-ade4cd3f840e} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\gypbcpav.dll (Trojan.Vundo.H) -> Delete on reboot.



2.log from combofix

ComboFix 09-05-03.1 - Mark 05/03/2009 18:22.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.651 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system\kbaas.bak1
c:\windows\system\kbaas.bak2
c:\windows\system\kbaas.ini
c:\windows\system\kbaas.ini2
c:\windows\system\kbaas.tmp
c:\windows\system32\AutoRun.inf
c:\windows\system32\benosafi.dll
c:\windows\system32\uniq.tll
c:\windows\system32\gypbcpav.dll . . . . failed to delete
c:\windows\system32\pwxkdts.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_vypyodqf
——-\Service_vypyodqf


((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.

2009-05-04 01:32 . 2009-05-04 01:32 46 —-a-w c:\windows\system32\p2hhr.bat
2009-05-04 01:31 . 2009-05-04 01:31 15000 —-a-w c:\windows\system32\afnoinkdsfe.dll
2009-05-04 00:06 . 2009-05-04 00:06 ——– d—–w c:\documents and settings\Mark\Application Data\xxdqixfj
2009-05-04 00:06 . 2009-05-04 00:06 ——– d—–w c:\documents and settings\Mark\Local Settings\Application Data\xxdqixfj
2009-05-03 17:54 . 2009-05-03 17:54 ——– d—–w c:\program files\Trend Micro
2009-05-03 17:08 . 2009-05-03 17:08 ——– d—–w c:\documents and settings\Mark\Application Data\Malwarebytes
2009-05-02 23:29 . 2009-05-02 23:29 ——– d—–w c:\documents and settings\NetworkService\Application Data\xxdqixfj
2009-05-02 23:29 . 2009-05-02 23:29 ——– d—–w c:\documents and settings\NetworkService\Local Settings\Application Data\xxdqixfj
2009-05-02 05:54 . 2009-05-02 05:54 ——– d—–w c:\documents and settings\NIkki\Application Data\Malwarebytes
2009-05-02 05:53 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-02 05:53 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 05:53 . 2009-05-02 05:53 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 05:53 . 2009-05-02 05:53 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-01 22:31 . 2009-05-01 22:31 ——– d—–w c:\documents and settings\NIkki\Application Data\xxdqixfj
2009-05-01 22:31 . 2009-05-01 22:31 ——– d—–w c:\documents and settings\NIkki\Local Settings\Application Data\xxdqixfj
2009-04-29 22:55 . 2009-05-04 01:32 101884 —-a-w c:\windows\system32\drivers\3394e25a.sys
2009-04-29 22:55 . 2009-05-04 01:25 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-04-27 04:30 . 2009-05-02 01:00 ——– d—–w c:\program files\Norton Security Scan
2009-04-27 01:04 . 2009-04-27 01:04 ——– d—–w c:\windows\system32\Adobe
2009-04-15 23:51 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 23:51 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 23:51 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 23:51 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 23:51 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 23:51 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 23:51 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 23:51 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 23:51 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 23:51 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 23:49 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 23:49 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 01:31 . 2009-05-04 01:31 17920 —-a-w c:\windows\system32\ak1.exe
2009-05-04 01:31 . 2009-03-26 05:48 868 —-a-w c:\windows\Tasks\Google Software Updater.job
2009-05-04 01:30 . 2004-08-07 13:19 6 —ha-w c:\windows\Tasks\SA.DAT
2009-05-04 01:25 . 2004-08-04 08:00 143872 —-a-w c:\windows\system32\gypbcpav.dll
2009-05-04 01:25 . 2004-08-04 08:00 578560 —-a-w c:\windows\system32\user32.dll
2009-05-04 01:24 . 2004-08-04 08:00 103424 —-a-w c:\windows\system32\ptyvvfg.dll
2009-05-04 01:00 . 2009-04-27 04:31 408 —-a-w c:\windows\Tasks\Norton Security Scan for NIkki.job
2009-05-01 23:24 . 2009-02-01 23:24 52224 –sha-w c:\windows\system32\yotabole.exe
2009-04-30 22:50 . 2009-01-30 22:50 51712 –sha-w c:\windows\system32\zezosivi.exe
2009-04-27 04:31 . 2003-05-03 18:32 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-03-06 14:22 . 2004-08-04 08:00 284160 ——w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-04 08:00 826368 ——w c:\windows\system32\wininet.dll
2009-02-21 00:39 . 2009-02-21 00:39 29684 —h–w c:\windows\system32\mlfcache.dat
2009-02-20 18:09 . 2004-08-04 08:00 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-08-04 08:00 729088 ——w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 08:00 714752 ——w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 08:00 617472 ——w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 08:00 401408 ——w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 08:00 1846784 ——w c:\windows\system32\win32k.sys
2009-02-06 11:11 . 2004-08-04 08:00 110592 ——w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-08-04 08:00 2145280 ——w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-04 08:00 35328 ——w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-04 08:00 2023936 ——w c:\windows\system32\ntkrnlpa.exe
2009-02-03 19:59 . 2004-08-04 08:00 56832 ——w c:\windows\system32\secur32.dll
2006-11-05 20:05 . 2006-11-05 20:05 1604246 –sh–w c:\windows\java\cvmssdn.tmp
2006-04-18 04:46 . 2006-04-18 04:46 769553 –sh–w c:\windows\system32\gjkmp.tmp
.
Infected c:\windows\system32\user32.dll hex repaired


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{cfcb8710-4ca5-45ff-baa9-5bca3cb854fc}]
2004-08-04 08:00 103424 —-a-w c:\windows\system32\pwxkdts.dll

c:\documents and settings\NIkki\Start Menu\Programs\Startup\
BounceBack Launcher.lnk - c:\program files\CMS Products\BounceBack Professional\BBStartup.exe [2009-2-1 40960]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoFolderOptions"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)
"NoFolderOptions"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\SharedTaskScheduler]
"{C2BA40A1-74F3-42BD-F434-12345A2C8953}"= "c:\windows\system32\afnoinkdsfe.dll" [2009-05-04 15000]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-01 21:38 10520 ——w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102743362\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102743362\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R2 DP1112;DP1112; [x]
R2 portD;CMS PortIO Service; [x]
R3 PAC7311;VGA SoC PC-Camera;c:\windows\system32\DRIVERS\PA707UCM.SYS [2005-10-18 154752]
R4 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [2008-07-09 26488]
S0 jygosvsl;jygosvsl;c:\windows\system32\drivers\jygosvsl.sys [2004-08-04 23424]
S1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\System32\Drivers\avgldx86.sys [2009-02-01 325128]
S1 AvgTdiX;AVG8 Network Redirector;c:\windows\System32\Drivers\avgtdix.sys [2009-02-01 107272]
S1 EMP_UDMM;EPSON Network Presentation Service for UD;c:\windows\system32\DRIVERS\EMP_UDMm.sys [2006-06-01 6400]
S2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2009-02-01 903960]
S2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2009-02-01 298264]
S2 EMP_UDSA;EMP_UDSA;c:\program files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe [2006-05-30 94208]
S3 EMCR;EMCR;c:\windows\system32\DRIVERS\EMCR7SK.sys [2003-08-15 68480]
S3 EMP_UDMR;EMP_UDMR;c:\windows\system32\DRIVERS\EMP_UDMr.sys [2006-04-25 6272]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder

2008-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-05-04 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-07-31 05:48]

2009-05-04 c:\windows\Tasks\Norton Security Scan for NIkki.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 12:53]
.
.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
IE: &AIM; Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\3yj34p24.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-03 18:32
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????2?5?9?3??????? ?|?B???????????????B? ??????

scanning hidden files …


c:\windows\system32\drivers\ovfsthnrnfmexcxhqjtiqvhvxriutewadtigyn.sys 83968 bytes executable
c:\docume~1\Mark\LOCALS~1\Temp\ovfsthx000 0 bytes
c:\windows\system32\ovfsthbqgtyldgsbgwbsxuujonfhawpsmaixdp.dat 43 bytes
c:\windows\system32\ovfsthetdpfvkdlhugvarbwucbnstmydvmhxwa.dll 18944 bytes executable
c:\windows\system32\ovfsthlog.dat 552 bytes
c:\windows\system32\ovfsthorlilmnxbyjbppdjjimqrcnuucnyencb.dat 161306 bytes
c:\windows\system32\ovfsthrnpsbsxtlavaesjwrtvxpgiciowoteup.dll 18432 bytes executable
c:\windows\system32\ovfsthvxtyofpvheuqfnvkkbmrdmsbrgqbwtrx.dll 60928 bytes executable

scan completed successfully
hidden files: 8

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(836)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(2908)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
c:\windows\system32\afnoinkdsfe.dll
c:\program files\Bonjour\mdnsNSP.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\windows\system32\PAStiSvc.exe
c:\windows\system32\ati2evxx.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\wscntfy.exe
c:\windows\temp\oknaym.exe
c:\windows\temp\oknaym.exe
c:\program files\Internet Explorer\iexplore.exe
c:\windows\temp\737479356.exe
c:\windows\system32\dla\tfswctrl.exe
c:\program files\Synaptics\SynTP\SynTPLpr.exe
c:\program files\Synaptics\SynTP\SynTPEnh.exe
c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\program files\BillP Studios\WinPatrol\WinPatrol.exe
c:\progra~1\AVG\AVG8\avgtray.exe
c:\program files\iTunes\iTunesHelper.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-05-04 18:41 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-04 01:41

Pre-Run: 47,007,694,848 bytes free
Post-Run: 46,927,028,224 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

259 — E O F — 2009-04-16 14:09


3.uninstall list from hijackthis

32 Bit HP CIO Components Installer
Ad-Aware
Adobe Flash Player Plugin
Adobe Reader 6.0.1
Adobe Shockwave Player 11.5
AIM 6
AIM Toolbar
AIM Toolbar 5.0
AOL Coach Version 2.0(Build:20041026.5 en)
AOL Connectivity Services
AOL Deskbar
AOL Instant Messenger
AOL Uninstaller (Choose which Products to Remove)
AOL You've Got Pictures Screensaver
Apple Mobile Device Support
Apple Software Update
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
AusLogics Disk Defrag
AVG Free 8.0
Bonjour
Cake Mania 2
CCleaner (remove only)
Conexant 56K ACLink Modem
Conexant AC-97 Audio
Conexant Data Fax Modem with SmartCP
Google Earth
Google Updater
HijackThis 2.0.2
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows XP (KB952287)
HP Help and Support
HP Photosmart All-In-One Software 9.0
InterVideo WinDVD
iTunes
J2SE Runtime Environment 5.0 Update 3
Java 2 Runtime Environment, SE v1.4.2_03
Java™ 6 Update 2
Java™ 6 Update 5
Java™ 6 Update 7
Java™ SE Runtime Environment 6 Update 1
LimeWire 4.16.6
Macromedia Flash Player 8
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office XP Standard
Microsoft Visual C++ 2005 Redistributable
MobileMe Control Panel
Mozilla Firefox (3.0.10)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Norton Security Scan
Norton Security Scan (Symantec Corporation)
PC VGA Camera
Picasa 3
Pure Networks Port Magic
Quick Launch Buttons 5.00 B3
QuickTime
RealPlayer Basic
RecordNow!
Safari
Sandlot Games Client Services 1.2.2
SecondLife (remove only)
Security Update for CAPICOM (KB931906)
Security Update for CAPICOM (KB931906)
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Media Player (KB952069)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961373)
Sonic DLA
Sonic Update Manager
Synaptics Pointing Device Driver
The Sims 2
The Sims 2 Pets
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
WildGames
WildTangent Web Driver
Windows Genuine Advantage v1.3.0254.0
Windows XP Service Pack 3
WinPatrol 2007


4.new hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:22:02 PM, on 5/3/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\TEMP\oknaym.exe
C:\WINDOWS\TEMP\oknaym.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\TEMP\1824419764.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O2 - BHO: (no name) - {cfcb8710-4ca5-45ff-baa9-5bca3cb854fc} - c:\windows\system32\pwxkdts.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\.DEFAULT\..\Run: [uidenhiufgsduiazghs] C:\WINDOWS\TEMP\oknaym.exe (User 'Default user')
O4 - HKUS\.DEFAULT\..\Run: [Diagnostic Manager] C:\WINDOWS\TEMP\1824419764.exe (User 'Default user')
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: &AIM; Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL; Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O22 - SharedTaskScheduler: sdfsefsfdvdubgiungfuyd - {C2BA40A1-74F3-42BD-F434-12345A2C8953} - C:\WINDOWS\system32\afnoinkdsfe.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: EMP_UDSA - Unknown owner - C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

–
End of file - 7125 bytes

THANK YOU !! Again .
Mk

good morning Gringo

Here are the requests from your last instructions…
(there are still some strange messages appearing - #3 below after log files)

1.log from combofix

ComboFix 09-05-03.1 - Mark 05/04/2009 6:36.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.669 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mark\Desktop\CFScript.txt.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

FILE ::
c:\windows\java\cvmssdn.tmp
c:\windows\system32\afnoinkdsfe.dll
c:\windows\system32\drivers\3394e25a.sys
c:\windows\System32\drivers\DP.sys
c:\windows\system32\drivers\jygosvsl.sys
c:\windows\system32\gjkmp.tmp
c:\windows\system32\p2hhr.bat
c:\windows\system32\ptyvvfg.dll
c:\windows\system32\yotabole.exe
c:\windows\system32\zezosivi.exe
c:\windows\temp\737479356.exe
c:\windows\temp\oknaym.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\docume~1\Mark\LOCALS~1\Temp\ovfsthx000
c:\documents and settings\Mark\Application Data\xxdqixfj
c:\documents and settings\Mark\Application Data\xxdqixfj\profiles.ini
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\cert8.db
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\compatibility.ini
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\compreg.dat
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\cookies.sqlite
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\formhistory.sqlite
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\key3.db
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\localstore.rdf
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\permissions.sqlite
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\places.sqlite-journal
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\places.sqlite
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\pluginreg.dat
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\prefs.js
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\secmod.db
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\webappsstore.sqlite
c:\documents and settings\Mark\Application Data\xxdqixfj\Profiles\umzrf80z.default\xpti.dat
c:\documents and settings\Mark\Local Settings\Application Data\xxdqixfj
c:\documents and settings\Mark\Local Settings\Application Data\xxdqixfj\Profiles\umzrf80z.default\urlclassifier3.sqlite
c:\documents and settings\Mark\Local Settings\Application Data\xxdqixfj\Profiles\umzrf80z.default\XPC.mfl
c:\documents and settings\NetworkService\Application Data\xxdqixfj
c:\documents and settings\NetworkService\Application Data\xxdqixfj\profiles.ini
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\cert8.db
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\compatibility.ini
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\compreg.dat
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\cookies.sqlite
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\formhistory.sqlite
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\key3.db
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\localstore.rdf
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\permissions.sqlite
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\places.sqlite-journal
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\places.sqlite
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\pluginreg.dat
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\prefs.js
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\secmod.db
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\webappsstore.sqlite
c:\documents and settings\NetworkService\Application Data\xxdqixfj\Profiles\4rgfhy85.default\xpti.dat
c:\documents and settings\NetworkService\Local Settings\Application Data\xxdqixfj
c:\documents and settings\NetworkService\Local Settings\Application Data\xxdqixfj\Profiles\4rgfhy85.default\urlclassifier3.sqlite
c:\documents and settings\NetworkService\Local Settings\Application Data\xxdqixfj\Profiles\4rgfhy85.default\XPC.mfl
c:\documents and settings\NIkki\Application Data\xxdqixfj
c:\documents and settings\NIkki\Application Data\xxdqixfj\profiles.ini
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\cert8.db
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\compatibility.ini
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\compreg.dat
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\cookies.sqlite
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\formhistory.sqlite
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\key3.db
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\localstore.rdf
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\permissions.sqlite
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\places.sqlite-journal
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\places.sqlite
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\pluginreg.dat
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\prefs.js
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\secmod.db
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\webappsstore.sqlite
c:\documents and settings\NIkki\Application Data\xxdqixfj\Profiles\100hax04.default\xpti.dat
c:\documents and settings\NIkki\Local Settings\Application Data\xxdqixfj
c:\documents and settings\NIkki\Local Settings\Application Data\xxdqixfj\Profiles\100hax04.default\urlclassifier3.sqlite
c:\documents and settings\NIkki\Local Settings\Application Data\xxdqixfj\Profiles\100hax04.default\XPC.mfl
c:\windows\java\cvmssdn.tmp
c:\windows\system32\afnoinkdsfe.dll
c:\windows\system32\ak1.exe
c:\windows\system32\drivers\3394e25a.sys
c:\windows\system32\drivers\jygosvsl.sys
c:\windows\system32\drivers\ovfsthnrnfmexcxhqjtiqvhvxriutewadtigyn.sys
c:\windows\system32\gjkmp.tmp
c:\windows\system32\gypbcpav.dll
c:\windows\system32\ovfsthbqgtyldgsbgwbsxuujonfhawpsmaixdp.dat
c:\windows\system32\ovfsthetdpfvkdlhugvarbwucbnstmydvmhxwa.dll
c:\windows\system32\ovfsthlog.dat
c:\windows\system32\ovfsthorlilmnxbyjbppdjjimqrcnuucnyencb.dat
c:\windows\system32\ovfsthrnpsbsxtlavaesjwrtvxpgiciowoteup.dll
c:\windows\system32\ovfsthvxtyofpvheuqfnvkkbmrdmsbrgqbwtrx.dll
c:\windows\system32\p2hhr.bat
c:\windows\system32\ptyvvfg.dll
c:\windows\system32\pwxkdts.dll
c:\windows\system32\yotabole.exe
c:\windows\system32\zezosivi.exe
c:\windows\temp\1824419764.exe
c:\windows\temp\233816574.exe
c:\windows\temp\2470480810.exe
c:\windows\temp\3105568028.exe
c:\windows\temp\737479356.exe
c:\windows\temp\oknaym.exe
J:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_DP1112
——-\Legacy_jygosvsl
——-\Service_DP1112
——-\Service_jygosvsl
——-\Service_3394e25a


((((((((((((((((((((((((( Files Created from 2009-04-04 to 2009-05-04 )))))))))))))))))))))))))))))))
.

2009-05-04 01:36 . 2009-05-04 01:36 ——– d—–w c:\documents and settings\Mark\Application Data\WinPatrol
2009-05-03 17:54 . 2009-05-03 17:54 ——– d—–w c:\program files\Trend Micro
2009-05-03 17:08 . 2009-05-03 17:08 ——– d—–w c:\documents and settings\Mark\Application Data\Malwarebytes
2009-05-02 05:54 . 2009-05-02 05:54 ——– d—–w c:\documents and settings\NIkki\Application Data\Malwarebytes
2009-05-02 05:53 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-02 05:53 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 05:53 . 2009-05-02 05:53 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 05:53 . 2009-05-02 05:53 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-29 22:55 . 2009-05-04 01:25 578560 —-a-w c:\windows\system32\dllcache\user32.dll
2009-04-27 04:30 . 2009-05-02 01:00 ——– d—–w c:\program files\Norton Security Scan
2009-04-27 01:04 . 2009-04-27 01:04 ——– d—–w c:\windows\system32\Adobe
2009-04-15 23:51 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 23:51 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 23:51 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 23:51 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 23:51 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 23:51 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 23:51 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 23:51 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 23:51 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 23:51 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 23:49 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 23:49 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 13:45 . 2009-03-26 05:48 868 —-a-w c:\windows\Tasks\Google Software Updater.job
2009-05-04 13:44 . 2004-08-07 13:19 6 —ha-w c:\windows\Tasks\SA.DAT
2009-05-04 13:37 . 2004-08-04 08:00 23424 —-a-w c:\windows\system32\drivers\skqfxwom.sys
2009-05-04 01:25 . 2004-08-04 08:00 578560 —-a-w c:\windows\system32\user32.dll
2009-05-04 01:00 . 2009-04-27 04:31 408 —-a-w c:\windows\Tasks\Norton Security Scan for NIkki.job
2009-04-27 04:31 . 2003-05-03 18:32 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-03-06 14:22 . 2004-08-04 08:00 284160 ——w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-04 08:00 826368 ——w c:\windows\system32\wininet.dll
2009-02-21 00:39 . 2009-02-21 00:39 29684 —h–w c:\windows\system32\mlfcache.dat
2009-02-20 18:09 . 2004-08-04 08:00 78336 ——w c:\windows\system32\ieencode.dll
2009-02-09 12:10 . 2004-08-04 08:00 729088 ——w c:\windows\system32\lsasrv.dll
2009-02-09 12:10 . 2004-08-04 08:00 714752 ——w c:\windows\system32\ntdll.dll
2009-02-09 12:10 . 2004-08-04 08:00 617472 ——w c:\windows\system32\advapi32.dll
2009-02-09 12:10 . 2004-08-04 08:00 401408 ——w c:\windows\system32\rpcss.dll
2009-02-09 11:13 . 2004-08-04 08:00 1846784 ——w c:\windows\system32\win32k.sys
2009-02-06 11:11 . 2004-08-04 08:00 110592 ——w c:\windows\system32\services.exe
2009-02-06 11:06 . 2004-08-04 08:00 2145280 ——w c:\windows\system32\ntoskrnl.exe
2009-02-06 10:39 . 2004-08-04 08:00 35328 ——w c:\windows\system32\sc.exe
2009-02-06 10:32 . 2004-08-04 08:00 2023936 ——w c:\windows\system32\ntkrnlpa.exe
2009-02-03 19:59 . 2004-08-04 08:00 56832 ——w c:\windows\system32\secur32.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-04_01.32.24 )))))))))))))))))))))))))))))))))))))))))
.
- 2004-11-24 01:00 . 2009-05-04 01:32 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2004-11-24 01:00 . 2009-05-04 13:26 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-05-04 01:33 . 2009-05-04 01:32 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009050320090504\index.dat
+ 2009-05-04 01:33 . 2009-05-04 03:43 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009050320090504\index.dat
- 2004-11-24 01:00 . 2009-05-04 01:32 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2004-11-24 01:00 . 2009-05-04 13:26 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2009-04-29 22:56 . 2009-05-04 03:43 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
- 2009-04-29 22:56 . 2009-05-04 01:32 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
+ 2004-11-24 01:00 . 2009-05-04 13:26 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
- 2004-11-24 01:00 . 2009-05-04 01:32 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-25 122939]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-15 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-15 618496]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-18 204862]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-09 339968]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2007-08-02 292152]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-01 1601304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]

c:\documents and settings\NIkki\Start Menu\Programs\Startup\
BounceBack Launcher.lnk - c:\program files\CMS Products\BounceBack Professional\BBStartup.exe [2009-2-1 40960]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-01 21:38 10520 ——w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102743362\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102743362\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder

2008-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-05-04 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-07-31 05:48]

2009-05-04 c:\windows\Tasks\Norton Security Scan for NIkki.job
- c:\program files\Norton Security Scan\Nss.exe [2009-03-13 12:53]
.
- - - - ORPHANS REMOVED - - - -

BHO-{c2ba40a1-74f3-42bd-f434-12345a2c8953} - c:\windows\system32\afnoinkdsfe.dll
HKCU-Run-RecordNow! - (no file)
HKU-Default-Run-uidenhiufgsduiazghs - c:\windows\TEMP\oknaym.exe
HKU-Default-Run-Diagnostic Manager - c:\windows\TEMP\3105568028.exe


.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
IE: &AIM; Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\3yj34p24.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-04 06:46
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????2?5?9?3??????? ?|?B???????????????B? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(828)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(1748)
c:\program files\BillP Studios\WinPatrol\PATROLPRO.DLL
.
———————— Other Running Processes ————————
.
c:\windows\system32\ati2evxx.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Common Files\AOL\ACS\AOLacsd.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Common Files\AOL\TopSpeed\2.0\aoltpspd.exe
c:\progra~1\AVG\AVG8\avgwdsvc.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\AVG\AVG8\avgrsx.exe
c:\progra~1\AVG\AVG8\avgnsx.exe
c:\program files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
c:\windows\system32\PAStiSvc.exe
c:\progra~1\AVG\AVG8\avgemc.exe
c:\program files\AVG\AVG8\avgcsrvx.exe
c:\windows\system32\ati2evxx.exe
c:\windows\system32\wscntfy.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2009-05-04 6:50 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-04 13:50
ComboFix2.txt 2009-05-04 01:41

Pre-Run: 46,916,935,680 bytes free
Post-Run: 46,911,598,592 bytes free

318 — E O F — 2009-04-16 14:09


2.new log from Hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:58:00 AM, on 5/4/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &AIM; Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL; Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Background Intelligent Transfer Service (BITS) - Unknown owner - C:\WINDOWS\
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: EMP_UDSA - Unknown owner - C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe
O23 - Service: Automatic Updates (wuauserv) - Unknown owner - C:\WINDOWS\

–
End of file - 6569 bytes



3.How is the computer doing now?

I am still getting WinPatrol messages :
first : Scotty has detected a change in the following monitored file.
Filename: HOSTS
Location: c:\windows\system32\drivers\etc\hosts
If this change is expected then choose "Accept Change"
If you did not expect or understand this change then "reject change"

…I KEEP REJECTING THIS
Then, i get another immediate dialog box that says
2 The system cannot find the file specified

also, I assume that after combofix runs, that I should turn my AVG virus protect on

And - When I run combo fix, the program shuts down 2 times - and i have to re-log in - but then it keeps running.. is this correct?
these pop up mesages above occur while combo fix is running - and i answer them - should i just be ignoring them?
thanks much!

mk

Hello Gringo
I have been ill, so it took a while - but here are your last requested scans:

1.log from combofix

ComboFix 09-05-09.05 - Mark 05/10/2009 12:19.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.548 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mark\Desktop\CFScript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)

FILE ::
c:\windows\system32\drivers\skqfxwom.sys
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\skqfxwom.sys

.
((((((((((((((((((((((((( Files Created from 2009-04-10 to 2009-05-10 )))))))))))))))))))))))))))))))
.

2009-05-04 19:58 . 2009-05-10 02:21 ——– d—–w c:\windows\BounceBack
2009-05-04 19:07 . 2009-05-04 19:07 64160 ——w c:\windows\system32\drivers\Lbd.sys
2009-05-04 18:38 . 2009-05-04 18:38 ——– dc-h–w c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-05-04 01:36 . 2009-05-04 01:36 ——– d—–w c:\documents and settings\Mark\Application Data\WinPatrol
2009-05-03 17:54 . 2009-05-03 17:54 ——– d—–w c:\program files\Trend Micro
2009-05-03 17:08 . 2009-05-03 17:08 ——– d—–w c:\documents and settings\Mark\Application Data\Malwarebytes
2009-05-02 05:54 . 2009-05-02 05:54 ——– d—–w c:\documents and settings\NIkki\Application Data\Malwarebytes
2009-05-02 05:53 . 2009-04-06 22:32 15504 ——w c:\windows\system32\drivers\mbam.sys
2009-05-02 05:53 . 2009-04-06 22:32 38496 ——w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-02 05:53 . 2009-05-02 05:53 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-02 05:53 . 2009-05-02 05:53 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-04-29 22:55 . 2009-05-04 01:25 578560 ——w c:\windows\system32\dllcache\user32.dll
2009-04-27 01:04 . 2009-04-27 01:04 ——– d—–w c:\windows\system32\Adobe
2009-04-15 23:51 . 2009-03-06 14:22 284160 ——w c:\windows\system32\dllcache\pdh.dll
2009-04-15 23:51 . 2009-02-06 10:39 35328 ——w c:\windows\system32\dllcache\sc.exe
2009-04-15 23:51 . 2009-02-09 12:10 401408 ——w c:\windows\system32\dllcache\rpcss.dll
2009-04-15 23:51 . 2009-02-06 11:11 110592 ——w c:\windows\system32\dllcache\services.exe
2009-04-15 23:51 . 2009-02-09 12:10 473600 ——w c:\windows\system32\dllcache\fastprox.dll
2009-04-15 23:51 . 2009-02-06 10:10 227840 ——w c:\windows\system32\dllcache\wmiprvse.exe
2009-04-15 23:51 . 2009-02-09 12:10 453120 ——w c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-15 23:51 . 2009-02-09 12:10 729088 ——w c:\windows\system32\dllcache\lsasrv.dll
2009-04-15 23:51 . 2009-02-09 12:10 617472 ——w c:\windows\system32\dllcache\advapi32.dll
2009-04-15 23:51 . 2009-02-09 12:10 714752 ——w c:\windows\system32\dllcache\ntdll.dll
2009-04-15 23:49 . 2008-05-03 11:55 2560 ——w c:\windows\system32\xpsp4res.dll
2009-04-15 23:49 . 2008-04-21 12:08 215552 ——w c:\windows\system32\dllcache\wordpad.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-04 01:25 . 2004-08-04 08:00 578560 ——w c:\windows\system32\user32.dll
2009-04-27 04:31 . 2003-05-03 18:32 ——– d—–w c:\program files\Common Files\Symantec Shared
2009-03-06 14:22 . 2004-08-04 08:00 284160 ——w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2004-08-04 08:00 826368 ——w c:\windows\system32\wininet.dll
2009-02-21 00:39 . 2009-02-21 00:39 29684 —h–w c:\windows\system32\mlfcache.dat
2009-02-20 18:09 . 2004-08-04 08:00 78336 ——w c:\windows\system32\ieencode.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-04_01.32.24 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-29 15:05 . 2008-07-29 15:05 62976 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90rus.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 46080 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90kor.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 46592 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90jpn.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 64512 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90ita.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 66048 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90fra.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esp.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 65024 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90esn.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 56832 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90enu.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 66560 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90deu.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 39936 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90cht.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 38912 c:\windows\WinSxS\x86_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_b0db7d03\mfc90chs.dll
+ 2008-07-29 13:07 . 2008-07-29 13:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90u.dll
+ 2008-07-29 13:07 . 2008-07-29 13:07 59904 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfcm90.dll
+ 2008-07-29 13:07 . 2008-07-29 13:07 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90ud.dll
+ 2008-07-29 13:07 . 2008-07-29 13:07 80896 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfcm90d.dll
+ 2009-05-04 19:07 . 2009-05-04 19:07 64160 c:\windows\system32\DRVSTORE\lbd_4C6E0193F967021F4DECA024CA3950BECD8BF864\Lbd.sys
+ 2004-11-24 01:00 . 2009-05-04 13:26 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2004-11-24 01:00 . 2009-05-04 01:32 49152 c:\windows\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
- 2009-05-04 01:33 . 2009-05-04 01:32 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009050320090504\index.dat
+ 2009-05-04 01:33 . 2009-05-04 03:43 32768 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012009050320090504\index.dat
- 2004-11-24 01:00 . 2009-05-04 01:32 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2004-11-24 01:00 . 2009-05-04 13:26 49152 c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2009-04-29 22:56 . 2009-05-04 01:32 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
+ 2009-04-29 22:56 . 2009-05-04 03:43 32768 c:\windows\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
- 2004-11-24 01:00 . 2009-05-04 01:32 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2004-11-24 01:00 . 2009-05-04 13:26 32768 c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 90112 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\xlicons.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 45056 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\wordicon.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 22528 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\unbndico.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 30720 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\pptico.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 16384 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\PEicons.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 34304 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\misc.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 32768 c:\windows\BounceBack\J\Documents and Settings\NIkki\Local Settings\History\History.IE5\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 32768 c:\windows\BounceBack\J\Documents and Settings\NIkki\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 32768 c:\windows\BounceBack\J\Documents and Settings\NIkki\Cookies\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 32768 c:\windows\BounceBack\J\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 32768 c:\windows\BounceBack\J\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 16384 c:\windows\BounceBack\J\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 16384 c:\windows\BounceBack\J\Documents and Settings\LocalService\Cookies\index.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 16384 c:\windows\BounceBack\J\Documents and Settings\Karen\Local Settings\History\History.IE5\index.dat
+ 2009-05-05 03:34 . 2009-05-05 03:35 16384 c:\windows\BounceBack\J\Documents and Settings\Karen\Cookies\index.dat
+ 2009-05-05 03:34 . 2009-05-05 03:34 87392 c:\windows\BounceBack\J\0647400130f6d5ecf0d30a6ec3433d\mrtstub.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 3584 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\opwicon.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 8192 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\mspicons.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 2560 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\cagicon.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 2048 c:\windows\BounceBack\J\WINDOWS\bootstat.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 8192 c:\windows\BounceBack\J\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 8192 c:\windows\BounceBack\J\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
+ 2008-07-29 15:05 . 2008-07-29 15:05 875520 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcp90d.dll
+ 2008-07-29 10:54 . 2008-07-29 10:54 312832 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcm90d.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 655872 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcr90.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 572928 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcp90.dll
+ 2008-07-29 10:54 . 2008-07-29 10:54 225280 c:\windows\WinSxS\x86_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_6f74963e\msvcm90.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 161784 c:\windows\WinSxS\x86_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_d01483b2\atl90.dll
+ 2009-05-05 03:35 . 2009-05-05 03:35 102400 c:\windows\BounceBack\J\WINDOWS\Installer\{F5C63795-2708-4D15-BF18-5ABBFF7DFFC8}\iTunesIco.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 114688 c:\windows\BounceBack\J\WINDOWS\Installer\{90120409-6000-11D3-8CFE-0050048383C9}\outicon.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 636072 c:\windows\BounceBack\J\Program Files\Internet Explorer\iexplore.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 145920 c:\windows\BounceBack\J\Program Files\BillP Studios\WinPatrol\Setup.exe
+ 2009-05-05 03:35 . 2009-05-05 03:35 262144 c:\windows\BounceBack\J\Documents and Settings\NIkki\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
+ 2009-05-05 03:35 . 2009-05-05 03:35 262144 c:\windows\BounceBack\J\Documents and Settings\Mark\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat
+ 2008-07-29 15:05 . 2008-07-29 15:05 3783672 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90u.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 3768312 c:\windows\WinSxS\x86_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_405b0943\mfc90.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 5982720 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90ud.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 5937144 c:\windows\WinSxS\x86_Microsoft.VC90.DebugMFC_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_c94a3a24\mfc90d.dll
+ 2008-07-29 15:05 . 2008-07-29 15:05 1180672 c:\windows\WinSxS\x86_Microsoft.VC90.DebugCRT_1fc8b3b9a1e18e3b_9.0.30729.1_x-ww_f863c71f\msvcr90d.dll
+ 2009-05-05 03:35 . 2009-05-05 03:35 9361232 c:\windows\BounceBack\J\Program Files\Microsoft Office\Office10\EXCEL.EXE
+ 2009-05-05 03:35 . 2009-05-05 03:35 9934392 c:\windows\BounceBack\J\Program Files\Google\Picasa3\setup.exe
.
– Snapshot reset to current date –
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"dla"="c:\windows\system32\dla\tfswctrl.exe" [2004-03-25 122939]
"SynTPLpr"="c:\program files\Synaptics\SynTP\SynTPLpr.exe" [2003-07-15 110592]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2003-07-15 618496]
"Cpqset"="c:\program files\HPQ\Default Settings\cpqset.exe" [2004-03-18 204862]
"ATIPTA"="c:\program files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-03-09 339968]
"WinPatrol"="c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2009-04-20 337216]
"AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2009-02-01 1601304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-01-06 290088]
"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-05-04 516440]

c:\documents and settings\NIkki\Start Menu\Programs\Startup\
BounceBack Launcher.lnk - c:\program files\CMS Products\BounceBack Professional\BBStartup.exe [2009-2-1 40960]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSetActiveDesktop"= 1 (0x1)
"NoActiveDesktopChanges"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
2009-02-01 21:38 10520 ——w c:\windows\system32\avgrsstx.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINDOWS\\system32\\mshta.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"c:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"c:\\Program Files\\America Online 9.0\\waol.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"=
"c:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102743362\\EE\\AOLServiceHost.exe"=
"c:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"=
"c:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"=
"c:\\Program Files\\AIM\\aim.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpofxm08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hposfx08.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqscnvw.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqkygrp.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpzwiz01.exe"=
"c:\\Program Files\\Hewlett-Packard\\Digital Imaging\\bin\\hpqnrs08.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Common Files\\AOL\\1102743362\\EE\\aolsoftware.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"c:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [5/4/2009 12:07 PM 64160]
R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [6/27/2008 6:51 PM 325128]
R1 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [6/27/2008 6:51 PM 107272]
R1 EMP_UDMM;EPSON Network Presentation Service for UD;c:\windows\system32\drivers\EMP_UDMm.sys [11/22/2006 11:00 AM 6400]
R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [7/14/2008 12:28 PM 903960]
R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [7/14/2008 12:28 PM 298264]
R2 EMP_UDSA;EMP_UDSA;c:\program files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe [11/22/2006 11:00 AM 94208]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 953168]
R3 EMCR;EMCR;c:\windows\system32\drivers\EMCR7SK.sys [8/15/2003 8:10 AM 68480]
R3 EMP_UDMR;EMP_UDMR;c:\windows\system32\drivers\EMP_UDMr.sys [11/22/2006 11:00 AM 6272]
S2 portD;CMS PortIO Service;c:\windows\system32\DRIVERS\portd2k.sys –> c:\windows\system32\DRIVERS\portd2k.sys [?]
S3 PAC7311;VGA SoC PC-Camera;c:\windows\system32\drivers\PA707UCM.SYS [10/18/2005 11:48 AM 154752]
S4 spupdsvc;Windows Service Pack Installer update service;c:\windows\system32\spupdsvc.exe [6/16/2005 3:00 AM 26488]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
HPService REG_MULTI_SZ HPSLPSVC
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Contents of the 'Scheduled Tasks' folder

2009-05-04 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 19:07]

2008-10-01 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 19:34]

2009-05-09 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-07-31 05:48]
.
.
——- Supplementary Scan ——-
.
uInternet Connection Wizard,ShellNext = hxxp://www.hp.com/
IE: &AIM; Search - c:\program files\AIM Toolbar\AIMBar.dll/aimsearch.htm
IE: &AOL; Toolbar search - c:\program files\AOL Toolbar\toolbar.dll/SEARCH.HTML
IE: Add to Google Photos Screensa&ver; - c:\windows\system32\GPhotos.scr/200
IE: E&xport; to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Mark\Application Data\Mozilla\Firefox\Profiles\3yj34p24.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.msn.com/
FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa2.dll
FF - plugin: c:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npqtplugin8.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-10 12:22
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = c:\program files\HPQ\Default Settings\cpqset.exe????????2?5?9?3??`???? ?|?B???????????????B? ??????

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(824)
c:\windows\system32\Ati2evxx.dll
.
Completion time: 2009-05-10 12:26
ComboFix-quarantined-files.txt 2009-05-10 19:26
ComboFix2.txt 2009-05-04 01:41
ComboFix3.txt 2009-05-04 01:41

Pre-Run: 46,510,125,056 bytes free
Post-Run: 46,493,564,928 bytes free

249 — E O F — 2009-04-16 14:09


2.log from kaspersky

——————————————————————————–
KASPERSKY ONLINE SCANNER 7.0 REPORT
Sunday, May 10, 2009
Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600)
Kaspersky Online Scanner version: 7.0.26.13
Program database last update: Sunday, May 10, 2009 21:32:49
Records in database: 2156434
——————————————————————————–

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
J:\

Scan statistics:
Files scanned: 185204
Threat name: 12
Infected objects: 54
Suspicious objects: 0
Duration of the scan: 07:51:58


File name / Threat name / Threats count
C:\Documents and Settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Incomplete\T-3877627-NeverShoutNever - Big City Dreams .mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\3oh3 - Punkbitch.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\3oh3 - still around.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\Augustana - All The Stars And Boulevards.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\hampster on piano.mp3 Infected: Trojan-Downloader.WMA.GetCodec.u 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\I Run This Remix Dirty.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\i run this remix [unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\i run this remix.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\i run this remix.wma Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\kanye west - love locked down (1).mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\kanye west - love locked down .mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\Perry Farrell - Go All Way (Into the Twilight).mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\skin of killer.wma Infected: Trojan-Downloader.WMA.Wimad.n 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\spotight.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\spotlight twilight mix CD quality.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\spotlight twilight mix.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\Twilight - Mutemath - Spotlight (Twilight Mix).mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
C:\Documents and Settings\NIkki\Shared\break teen spirit titus jones.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\Shared\Daniel Powter - Bad Day.wma Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Documents and Settings\NIkki\Shared\Lil Wayne - Tha Carter III - 08 - Tie My Hands.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\Shared\lollipop 3 6 mafia.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
C:\Documents and Settings\NIkki\Shared\Rhymefest - All I Do.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\afnoinkdsfe.dll.vir Infected: Trojan-Downloader.Win32.Agent.bvpx 1
C:\Qoobox\Quarantine\C\WINDOWS\system32\drivers\_jygosvsl_.sys.zip Infected: Trojan.Win32.BHO.ext 1
C:\Qoobox\Quarantine\C\WINDOWS\temp\1824419764.exe.vir Infected: Trojan-Downloader.Win32.Agent.bvpv 1
C:\Qoobox\Quarantine\C\WINDOWS\temp\233816574.exe.vir Infected: Trojan-Downloader.Win32.Agent.bvpv 1
C:\Qoobox\Quarantine\C\WINDOWS\temp\2470480810.exe.vir Infected: Trojan-Downloader.Win32.Agent.bvpv 1
C:\Qoobox\Quarantine\C\WINDOWS\temp\3105568028.exe.vir Infected: Trojan-Downloader.Win32.Agent.bvpv 1
C:\Qoobox\Quarantine\C\WINDOWS\temp\737479356.exe.vir Infected: Trojan-Downloader.Win32.Agent.bvpv 1
J:\Documents and Settings\All Users\Application Data\AOL Downloads\lpaolcom_setupSTUS\comps\toolbar\toolbr.exe Infected: not-a-virus:AdWare.Win32.SearchIt.t 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Incomplete\T-3877627-NeverShoutNever - Big City Dreams .mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Incomplete\T-4061074-hot revolver (rare track).snd Infected: Trojan-Downloader.WMA.GetCodec.s 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\3oh3 - Punkbitch.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\3oh3 - still around.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\Augustana - All The Stars And Boulevards.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\hampster on piano.mp3 Infected: Trojan-Downloader.WMA.GetCodec.u 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\I Run This Remix Dirty.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\i run this remix [unreleased rare track].mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\i run this remix.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\i run this remix.wma Infected: Trojan-Downloader.WMA.Wimad.n 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\kanye west - love locked down (1).mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\kanye west - love locked down .mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\Perry Farrell - Go All Way (Into the Twilight).mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\skin of killer.wma Infected: Trojan-Downloader.WMA.Wimad.n 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\spotight.mp3 Infected: Trojan-Downloader.WMA.GetCodec.r 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\spotlight twilight mix CD quality.mp3 Infected: Trojan-Downloader.WMA.GetCodec.f 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\spotlight twilight mix.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\My Documents\LimeWire\Saved\Twilight - Mutemath - Spotlight (Twilight Mix).mp3 Infected: Trojan-Downloader.WMA.GetCodec.n 1
J:\Documents and Settings\NIkki\Shared\break teen spirit titus jones.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\Shared\Daniel Powter - Bad Day.wma Infected: Trojan-Downloader.WMA.GetCodec.a 1
J:\Documents and Settings\NIkki\Shared\Lil Wayne - Tha Carter III - 08 - Tie My Hands.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\Shared\lollipop 3 6 mafia.mp3 Infected: Trojan-Downloader.WMA.GetCodec.c 1
J:\Documents and Settings\NIkki\Shared\Rhymefest - All I Do.mp3 Infected: Trojan-Downloader.WMA.GetCodec.a 1

The selected area was scanned.



3.log from hijackthis

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:38:03 PM, on 5/10/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Java\jre6\bin\java.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &AIM; Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL; Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Google Photos Screensa&ver; - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: EMP_UDSA - Unknown owner - C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–
End of file - 6846 bytes


Thank You !!
mk

Hi Gringo

Wow, seems like I just deleted a lot of my daughter's downloaded music..
Did she lose all of these files - or are they still on the computer - in a different format - in her itunes library?

Did all of these Limewire downloads have malware embedded?
Should I STOP her from using Limewire? (your opinion)
If I have a virus scanner like AVG and Ad-aware running - are Limewirer downloads safe?

Here are your requested logs:

1.log from combofix

this file is huge - and i cant post it here - it makes my post to long - can i attach the txt file instead?


2.new hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:10:08 PM, on 5/12/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\PAStiSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgnsx.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.hp.com/
O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &AIM Search - res://C:\Program Files\AIM Toolbar\AIMBar.dll/aimsearch.htm
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: WeatherBug - {AF6CABAB-61F9-4f12-A198-B7D41EF1CB52} - C:\Program Files\AWS\WeatherBug\Weather.exe (file missing) (HKCU)
O14 - IERESET.INF: START_PAGE_URL=http://www.hp.com
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: EMP_UDSA - Unknown owner - C:\Program Files\EPSON Projector\EPSON USB Display V1.0\EMP_UDSA.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBPRO.EXE
O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\HPBOID.EXE
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: STI Simulator - Unknown owner - C:\WINDOWS\System32\PAStiSvc.exe

–
End of file - 6714 bytes


thanks
mk