[Resolved] BASELINE

HEY EVERYONE… MY MOMS COMPUTER IS SERIOUSLY RUNNING SLOW… AND MY INTERNET EXPLORE ACTS STUPID.. EVERY TIME I CLOSE IT.. IT OPENS UP TO SOME WEB PAGE THAT CANT BE DISPLAYED… I TRIED INSTALLING FIREFOX BUT WHEN I RUN THAT AND I TRY TO CLICK ON THINGS THAT I SEARCH FOR IT TAKES ME TO SOME OTHER WEBSITE… I COULD REALLY USE SOME HELP… IM SO FRUSTRATED IM ABOUT TO CRY… ((AND THAT DOESNT HAPPEN OFTEN LMMFAO)) ANYWAYS… ANY HELP WOULD BE GREATLY APPRECIATED… THANKS FOR YOUR HELP AND TIME… BELOW IS A COPY OF THE HIJACKTHIS FILE THAT I JUST MADE LIKE UR INSTRUCTIONS SAID… THANKS AGAIN… MOBSTAH KITTAH



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:47:03 PM, on 5/13/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Defender Pro Private Surf\AutomaticUpdate.exe
C:\Program Files\DefenderPro\TSAntiSpy.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\PokerStars\PokerStars.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.insignia-products.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.65.122 browser-security.microsoft.com
O1 - Hosts: 91.212.65.122 antiwareprotect.com
O1 - Hosts: 91.212.65.122 www.antiwareprotect.com
O2 - BHO: (no name) - {0166505B-6A56-4772-9BD5-18857B8315D8} - C:\WINDOWS\system32\zjsvludl.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: QWProtectBHO - {2182220D-AA70-4764-B4E6-1F5BBA322C9C} - C:\Documents and Settings\All Users\Application Data\N1\QWProtect.dll (file missing)
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O2 - BHO: (no name) - {50E0107C-5BA3-4B62-9698-0B00D4ACD0DB} - c:\windows\system32\qhsfxnm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Dit.exe] C:\WINDOWS\Dit.exe
O4 - HKLM\..\Run: [CompleteSecurityUpdate] "C:\Program Files\Defender Pro Private Surf\AutomaticUpdate.exe"
O4 - HKLM\..\Run: [LaunchAntiSpy] C:\Program Files\DefenderPro\TSAntiSpy.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [autochk] rundll32.exe C:\WINDOWS\system32\autochk.dll,_IWMPEvents@16
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: ChkDisk.dll
O4 - Startup: ChkDisk.lnk = ?
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\scieplugin.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Poker Host - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\PokerHostMPP\MPPoker.exe (file missing) (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\PROGRA~2\DEFEND~1\DEFEND~1.0\adialhk.dll
O20 - Winlogon Notify: dybupxzs - C:\WINDOWS\SYSTEM32\qhsfxnm.dll
O23 - Service: Defender Pro Internet Security (AVP) - Defender Pro - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\avz.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 8986 bytes

THANK YOU SO MUCH FOR YOUR HELP…. I DID AS YOU HAVE ASKED… AND HERE ARE THE LOGS THAT YOU ASKED FOR… FIRST IS THE HIJACKTHIS LOG :
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:02:44 PM, on 5/13/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\Dit.exe
C:\Program Files\DefenderPro\TSAntiSpy.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.insignia-products.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.65.122 browser-security.microsoft.com
O1 - Hosts: 91.212.65.122 antiwareprotect.com
O1 - Hosts: 91.212.65.122 www.antiwareprotect.com
O2 - BHO: (no name) - {0166505B-6A56-4772-9BD5-18857B8315D8} - C:\WINDOWS\system32\zjsvludl.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O2 - BHO: (no name) - {50E0107C-5BA3-4B62-9698-0B00D4ACD0DB} - c:\windows\system32\qhsfxnm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Dit.exe] C:\WINDOWS\Dit.exe
O4 - HKLM\..\Run: [CompleteSecurityUpdate] "C:\Program Files\Defender Pro Private Surf\AutomaticUpdate.exe"
O4 - HKLM\..\Run: [LaunchAntiSpy] C:\Program Files\DefenderPro\TSAntiSpy.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [autochk] rundll32.exe C:\DOCUME~1\Mona\protect.dll,_IWMPEvents@16
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\scieplugin.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Poker Host - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\PokerHostMPP\MPPoker.exe (file missing) (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,C:\PROGRA~2\DEFEND~1\DEFEND~1.0\adialhk.dll
O20 - Winlogon Notify: dybupxzs - C:\WINDOWS\SYSTEM32\qhsfxnm.dll
O23 - Service: Defender Pro Internet Security (AVP) - Defender Pro - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\avz.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 8565 bytes



AND NOW HERE IS THE MALWAREBYTES LOG:

Malwarebytes' Anti-Malware 1.36
Database version: 2128
Windows 5.1.2600 Service Pack 2

5/13/2009 6:29:36 PM
mbam-log-2009-05-13 (18-29-26).txt

Scan type: Quick Scan
Objects scanned: 88741
Time elapsed: 11 minute(s), 10 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 2
Registry Keys Infected: 26
Registry Values Infected: 3
Registry Data Items Infected: 2
Folders Infected: 30
Files Infected: 315

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\autochk.dll (Worm.Autorun) -> No action taken.
C:\WINDOWS\system32\zjsvludl.dll (Trojan.Vundo.H) -> No action taken.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0166505b-6a56-4772-9bd5-18857b8315d8} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{0166505b-6a56-4772-9bd5-18857b8315d8} (Trojan.Vundo.H) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0166505b-6a56-4772-9bd5-18857b8315d8} (Trojan.Vundo.H) -> No action taken.
HKEY_CLASSES_ROOT\qwprotect.qwprotectbho (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\qwprotect.qwprotectbho.1 (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{cdb65423-01f2-4caf-b56d-ff0590d26ec7} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{cf54be1c-9359-4395-8533-1657cf209cfe} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{e79dfbcb-5697-4fbd-94e5-5b2a9c7c1612} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{2182220d-aa70-4764-b4e6-1f5bba322c9c} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{27c9dd2c-9f0c-4cb8-b631-26b44dfcdef5} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\AppID\{cdb65423-01f2-4caf-b56d-ff0590d26ec7} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\AppID\{7c11c36c-2ae0-4489-9b09-a6129139d52d} (Rogue.ContraVirus) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2182220d-aa70-4764-b4e6-1f5bba322c9c} (Trojan.FakeAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{100eb1fd-d03e-47fd-81f3-ee91287f9465} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b2} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{c5428486-50a0-4a02-9d20-520b59a9f9b3} (Adware.Shopping.Report) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1d4db7d2-6ec9-47a3-bd87-1e41684e07bb} (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{6fd31ed6-7c94-4bbc-8e95-f927f4d3a949} (Adware.180Solutions) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1f158a1e-a687-4a11-9679-b3ac64b86a1c} (Adware.Seekmo) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2182220d-aa70-4764-b4e6-1f5bba322c9c} (Trojan.FakeAlert) -> No action taken.
HKEY_CLASSES_ROOT\AppID\QWProtect.DLL (Rogue.AntiVirus1) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\AdwareAlert (Rogue.AdwareAlert) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\zangosa (Adware.Zango) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\N1 (Rogue.AntiVirus1) -> No action taken.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autochk (Worm.Autorun) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{07aa283a-43d7-4cbe-a064-32a21112d94d} (Adware.Zango) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Network\UID (Malware.Trace) -> No action taken.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Trojan.FakeAlert) -> Data: c:\windows\system32\sdra64.exe -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\sdra64.exe,) Good: (userinit.exe) -> No action taken.

Folders Infected:
C:\Documents and Settings\Mona\Application Data\AdwareAlert (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Settings (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts (Adware.MyWay) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts\Data (Adware.MyWay) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts\Data\Mona (Adware.MyWay) -> No action taken.
C:\WINDOWS\system32\lowsec (Stolen.Data) -> No action taken.
C:\Documents and Settings\All Users\Application Data\N1 (Rogue.AntiVirus1) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\1 (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\2 (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\KGB Spy (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\IESkins (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\HostOI (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\HostOI\dynamic (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\HostOI\static (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\HostOL (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\HostOL\dynamic (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\HostOL\static (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\ustat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad (Adware.Zango) -> No action taken.

Files Infected:
C:\WINDOWS\system32\zjsvludl.dll (Trojan.Vundo.H) -> No action taken.
C:\WINDOWS\system32\autochk.dll (Worm.Autorun) -> No action taken.
C:\WINDOWS\system32\iehelper.dll (Trojan.BHO) -> No action taken.
C:\Documents and Settings\Mona\protect.dll (Worm.Autorun) -> No action taken.
C:\Program Files\Internet Explorer\msimg32.dll (Adware.MyWebSearch) -> No action taken.
C:\Documents and Settings\Mona\Start Menu\Programs\Startup\ChkDisk.dll (Worm.Autorun) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\rs.dat (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log\2008 Mar 29 - 07_04_39 PM_484.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log\2008 Mar 29 - 07_04_43 PM_156.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log\2008 Mar 29 - 10_07_43 PM_828.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log\2008 Mar 29 - 10_07_47 PM_390.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log\2008 Mar 29 - 12_34_03 PM_000.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\Mona\Application Data\AdwareAlert\Log\2008 Mar 29 - 12_34_08 PM_375.log (Rogue.AdwareAlert) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAAbout.mht (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAau.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSAEula.mht (Adware.Zango) -> No action taken.
C:\Documents and Settings\All Users\Application Data\ZangoSA\ZangoSA_kyf.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts\Data\Mona\avatar.dat (Adware.MyWay) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts\Data\Mona\outfit.dat (Adware.MyWay) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts\Data\Mona\register.dat (Adware.MyWay) -> No action taken.
C:\Documents and Settings\Mona\Application Data\FunWebProducts\Data\Mona\zbucks.dat (Adware.MyWay) -> No action taken.
C:\WINDOWS\system32\lowsec\local.ds (Stolen.Data) -> No action taken.
C:\WINDOWS\system32\lowsec\user.ds (Stolen.Data) -> No action taken.
C:\WINDOWS\system32\lowsec\user.ds.lll (Stolen.Data) -> No action taken.
C:\Documents and Settings\All Users\Application Data\N1\N1.cab (Rogue.AntiVirus1) -> No action taken.
C:\Documents and Settings\All Users\Application Data\N1\n1.exe (Rogue.AntiVirus1) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\key.mpk (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\mpk.db (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39595_2862561458 (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\1\I39595_2897451852 (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\KGB Spy\Help topics.lnk (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\KGB Spy\KGB Spy on the Web.url (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\KGB Spy\KGB Spy.lnk (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\KGB Spy\Order now!.url (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\All Users\Application Data\MPK\KGB Spy\Uninstall KGB Spy.lnk (Refog.Keylogger) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\1.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\1159224.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\221540.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\3251993.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\3262999.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\3469510.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\542084.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\624700.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\625696.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\775501.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\819382.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\880604.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\936439.sdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\domains.txt (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000032081 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\1000093912 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\10807 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\11637 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\118964 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\13562 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\16179 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\18383 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\18906 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\193255 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\194105 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\202699 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\20365 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\218712 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\225148 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\227490 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\261991 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26335 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\26739 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\277907 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\288799 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\29115 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\29547 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\30823 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\308719 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31537 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\31690 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\342303 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35006 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\35047 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\361427 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\367116 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\40726 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\42208 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\427075 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43120 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\43495 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44228 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44458 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\44789 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\449742 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\456216 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\471072 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4763 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\477253 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\4822 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\48923 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\49957 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\5031 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\520179 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\532492 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\54473 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\551547 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\552212 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\58197 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\59913 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\604347 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6208 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\62133 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\64451 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6558 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6559 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\65770 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\66836 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\6873 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\69199 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\712032 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\71602 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\7295 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\73282 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\737665 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\738022 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\745146 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\74777 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\747952 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\750039 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751209 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\751223 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\752499 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753230 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753250 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753378 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753571 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753572 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753574 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\753589 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79246 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79805 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\79819 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\80663 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\81093 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\89658 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93899 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\93921 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98248 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\TooltipXML\98493 (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\dynamic\ustat\37d9.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\avatar.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\btntrans.idx (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\btntrans1.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\buttondir.txt (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\components.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\cursors.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\default.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_511745-514279.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-ca.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_bidzC_ZT_IE-us.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_categorize.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_comparison.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-Mails.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_explorer-people.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_favorites.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_Games.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_Hide.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_hotbarcom.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_Hotmail.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_hsskin.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_jemster.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_jemsterie.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_jemsteruk.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_jobsearch.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_Mails.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_MobileSidewalk.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_new.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_premium.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_reun.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_ringtones.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_SearchBoxTrapper.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_searchfor.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_searchgo.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_weather.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Default_yellowpages.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_1000.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_2000.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_3000.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bar.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_bbar1.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_logos.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_buttons_other.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\d_icons_weather.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\editblbuttons.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-548964.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\email-def-511724-9595.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\email-t1-bg.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\icons2.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\ie_games_icon.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\ie_video.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\keywords.idx (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\keywords1.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\layout.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\linkpathlegal.txt (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\progress.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\sales_buttons.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\sdfmodifier.xml (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\s_icons_buttons.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\t2_bg.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\theweb.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\top7.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\Top7_theweb.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\tsd_bg.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\zango_btn.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\1\zango_ie_menu.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\avatar.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\btntrans.idx (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\btntrans1.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\buttondir.txt (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\components.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\cursors.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\default.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_511745-514279.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-ca.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_bidzC_ZT_IE-us.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_categorize.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_comparison.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-Mails.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_explorer-people.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_favorites.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_Games.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_Hide.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_hotbarcom.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_Hotmail.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_hsskin.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_jemster.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_jemsterie.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_jemsteruk.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_jobsearch.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_Mails.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_MobileSidewalk.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_new.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_premium.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_reun.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_ringtones.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_SearchBoxTrapper.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_searchfor.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_searchgo.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_weather.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Default_yellowpages.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_1000.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_2000.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_3000.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bar.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_bbar1.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_logos.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_buttons_other.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\d_icons_weather.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\editblbuttons.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-548964.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\email-def-511724-9595.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\email-t1-bg.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\icons2.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\ie_games_icon.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\ie_video.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\keywords.idx (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\keywords1.dat (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\layout.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\linkpathlegal.txt (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\progress.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\sales_buttons.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\sdfmodifier.xml (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\s_icons_buttons.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\t2_bg.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\theweb.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\top7.cdf (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\Top7_theweb.mnu (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\tsd_bg.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\zango_btn.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\2\zango_ie_menu.res (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\avatar.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\BtnTrans1.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\buttondir.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\cursors.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\default.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_1000.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_2000.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_3000.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bar.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_bbar1.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_logos.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_buttons_other.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\d_icons_weather.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\editblbuttons.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\email-t1-bg.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\icons2.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_games_icon.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\ie_video.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\keywords1.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\layout.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\linkpathlegal.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\progress.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\sales_buttons.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.txt (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\samplegroups2.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\sdfmodifier.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\s_icons_buttons.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\t2_bg.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\top7.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\tsd_bg.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_btn.xip (Adware.Zango) -> No action taken.
C:\Documents and Settings\Mona\Application Data\Zango\v3.0\Zango\static\DownLoad\zango_ie_menu.xip (Adware.Zango) -> No action taken.
C:\WINDOWS\sysguard.exe (Trojan.Agent) -> No action taken.
C:\Documents and Settings\Mona\Start Menu\Programs\Startup\ChkDisk.lnk (Trojan.FakeAlert) -> No action taken.
C:\WINDOWS\system32\sdra64.exe (Trojan.FakeAlert) -> No action taken.
C:\Documents and Settings\Mona\Local Settings\Temp\nsrbgxod.bak (Trojan.Agent) -> No action taken.


SORRY IT TOOK ME A LITTLE WHILE TO GET BACK TO YOU…. I COULDNT BELIEVE THE NUMBER OF THINGS THAT MALWARE FOUND… I ALMOST FELL OUT OF MY CHAIR….

OK… I THINK I GOT IT…. I FOLLOWED ALL OF THE STEPS AND HERE ARE THE LOGS…. FIRST IS THE COMBO FIX LOG:

ComboFix 09-05-13.04 - Mona 05/14/2009 8:33.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.252 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: Defender Pro Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Defender Pro Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Mona\Application Data\WeatherDPA
c:\documents and settings\Mona\Application Data\WeatherDPA\Weather\WeatherStartup.xml
C:\Documents
c:\program files\Mozilla Firefox\plugins\npclntax_ZangoSA.dll
c:\windows\system32\bszip.dll
c:\windows\system32\qhsfxnm.dll . . . . failed to delete
c:\windows\system32\zjsvludl.dll . . . . failed to delete

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_VRRRFEQG
——-\Service_vrrrfeqg


((((((((((((((((((((((((( Files Created from 2009-04-14 to 2009-05-14 )))))))))))))))))))))))))))))))
.

2009-05-14 15:20 . 2009-05-14 15:20 ——– d—–w C:\HostsXpert 4.3 - Host File Manager
2009-05-14 01:15 . 2009-05-14 01:15 ——– d—–w c:\documents and settings\Mona\Application Data\Malwarebytes
2009-05-14 01:15 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-14 01:15 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-14 01:15 . 2009-05-14 01:15 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-14 01:15 . 2009-05-14 01:29 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-13 21:18 . 2007-12-25 00:37 138384 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-05-13 21:17 . 2009-05-13 22:30 ——– d—–w c:\documents and settings\Mona\Application Data\HouseCall 6.6
2009-05-12 10:45 . 2009-05-12 10:45 56 —ha-w c:\windows\system32\ezsidmv.dat
2009-05-12 10:45 . 2009-05-14 01:35 ——– d—–w c:\documents and settings\Mona\Application Data\skypePM
2009-05-12 10:43 . 2009-05-14 15:41 ——– d—–w c:\documents and settings\Mona\Application Data\Skype
2009-05-12 10:43 . 2009-05-12 10:43 ——– d—–w c:\program files\Common Files\Skype
2009-05-12 10:43 . 2009-05-12 10:43 ——– d—–r c:\program files\Skype
2009-05-12 10:42 . 2009-05-12 10:43 ——– d—–w c:\documents and settings\All Users\Application Data\Skype
2009-05-07 22:32 . 2009-05-07 22:32 ——– d—–w c:\documents and settings\Mona\Application Data\ezappkfk
2009-05-07 22:32 . 2009-05-07 22:32 ——– d—–w c:\documents and settings\Mona\Local Settings\Application Data\ezappkfk
2009-05-05 02:49 . 2009-03-16 21:36 931672 —-a-w c:\windows\system32\XAudioD2_4.dll
2009-05-05 02:49 . 2009-03-16 21:35 125768 —-a-w c:\windows\system32\XAPOFXD1_3.dll
2009-05-05 02:49 . 2009-03-16 21:35 343368 —-a-w c:\windows\system32\XactEngineD3_4.dll
2009-05-05 02:49 . 2009-03-16 21:35 428888 —-a-w c:\windows\system32\XactEngineA3_4.dll
2009-05-05 02:49 . 2009-03-16 21:35 45384 —-a-w c:\windows\system32\X3DAudioD1_6.dll
2009-05-05 02:49 . 2009-03-16 21:35 358728 —-a-w c:\windows\system32\dinput8d.dll
2009-05-05 02:49 . 2009-03-16 21:35 4280136 —-a-w c:\windows\system32\D3dx9d_41.dll
2009-05-05 02:49 . 2009-03-16 21:36 3795784 —-a-w c:\windows\system32\d3dx9d_33.dll
2009-05-05 02:49 . 2009-03-16 21:35 497480 —-a-w c:\windows\system32\D3DX10d_41.dll
2009-05-05 02:49 . 2009-03-16 21:35 348504 —-a-w c:\windows\system32\d3dref9.dll
2009-05-05 02:49 . 2009-03-16 21:36 3083592 —-a-w c:\windows\system32\d3d9d.dll
2009-05-05 02:44 . 2007-10-12 22:14 3734536 —-a-w c:\windows\system32\d3dx9_36.dll
2009-05-05 02:40 . 2009-05-05 02:49 ——– d—–w c:\program files\Microsoft DirectX SDK (March 2009)
2009-05-05 02:39 . 2009-05-05 02:42 ——– d—–w c:\windows\Logs
2009-05-05 02:39 . 2009-05-05 02:39 118104 —-a-w c:\windows\dxsdkuninst.exe
2009-04-23 00:56 . 2009-04-23 00:56 ——– d-sh–w c:\windows\system32\config\systemprofile\IETldCache
2009-04-18 03:13 . 2009-04-18 03:13 ——– d—–w c:\windows\LastGood(3)
2009-04-15 06:49 . 2004-08-04 06:07 42368 -c–a-w c:\windows\system32\dllcache\agp440.sys
2009-04-15 06:49 . 2004-08-04 06:07 42368 -c–a-w c:\windows\system32\drivers\agp440.sys
2009-04-15 06:49 . 2004-08-04 06:07 44928 -c–a-w c:\windows\system32\dllcache\agpcpq.sys
2009-04-15 06:49 . 2004-08-04 06:07 44928 -c–a-w c:\windows\system32\drivers\agpcpq.sys
2009-04-15 06:49 . 2004-08-04 06:07 42752 -c–a-w c:\windows\system32\dllcache\alim1541.sys
2009-04-15 06:49 . 2004-08-04 06:07 42752 -c–a-w c:\windows\system32\drivers\alim1541.sys
2009-04-15 06:49 . 2004-08-04 06:07 43008 -c–a-w c:\windows\system32\dllcache\amdagp.sys
2009-04-15 06:49 . 2004-08-04 06:07 43008 -c–a-w c:\windows\system32\drivers\amdagp.sys
2009-04-15 06:49 . 2004-08-04 06:07 41088 -c–a-w c:\windows\system32\dllcache\sisagp.sys
2009-04-15 06:49 . 2004-08-04 06:07 41088 -c–a-w c:\windows\system32\drivers\sisagp.sys
2009-04-15 06:49 . 2004-08-04 06:07 42240 -c–a-w c:\windows\system32\dllcache\viaagp.sys
2009-04-15 06:49 . 2004-08-04 06:07 42240 -c–a-w c:\windows\system32\drivers\viaagp.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-14 15:41 . 2008-05-04 07:12 17981984 –sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-14 15:40 . 2008-05-04 07:12 109136416 –sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-14 15:39 . 2008-05-04 07:12 1686740 –sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-14 15:39 . 2008-05-04 07:12 2695388 –sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-14 15:36 . 2007-05-08 23:37 143872 —-a-w c:\windows\system32\zjsvludl.dll
2009-05-14 15:35 . 2007-05-08 23:37 103936 —-a-w c:\windows\system32\hbkfixt.dll
2009-05-13 18:27 . 2008-03-26 10:19 ——– d—–w c:\program files\PokerStars
2009-05-12 10:43 . 2008-03-26 07:53 ——– d—–w c:\program files\Google
2009-05-11 16:06 . 2008-03-26 09:58 ——– d—–w c:\program files\Full Tilt Poker
2009-04-29 12:51 . 2008-06-14 23:38 ——– d—–w c:\program files\RealArcade
2009-04-27 01:05 . 2009-02-24 20:32 ——– d—–w c:\program files\PokerHost
2009-04-09 00:27 . 2009-04-09 00:27 ——– d—–w c:\program files\Microsoft Silverlight
2009-03-21 14:18 . 2009-04-15 06:48 986112 -c–a-w c:\windows\system32\kernel32(2)(2).dll
2009-03-18 00:03 . 2008-04-14 09:04 ——– d—–w c:\program files\JibJab
2009-03-16 21:18 . 2009-05-05 02:45 69448 —-a-w c:\windows\system32\XAPOFX1_3.dll
2009-03-16 21:18 . 2009-05-05 02:45 517448 —-a-w c:\windows\system32\XAudio2_4.dll
2009-03-16 21:18 . 2009-05-05 02:45 235352 —-a-w c:\windows\system32\xactengine3_4.dll
2009-03-16 21:18 . 2009-05-05 02:45 22360 —-a-w c:\windows\system32\X3DAudio1_6.dll
2009-03-09 22:27 . 2009-05-05 02:45 453456 —-a-w c:\windows\system32\d3dx10_41.dll
2009-03-09 22:27 . 2009-05-05 02:45 4178264 —-a-w c:\windows\system32\D3DX9_41.dll
2009-03-09 22:27 . 2009-05-05 02:45 1846632 —-a-w c:\windows\system32\D3DCompiler_41.dll
2009-03-08 11:34 . 2006-06-23 18:33 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2007-05-08 23:36 43008 -c–a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2007-05-08 23:34 18944 -c–a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2007-05-08 23:38 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2007-05-08 23:34 72704 -c–a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2007-05-08 23:35 71680 -c–a-w c:\windows\system32\iesetup.dll
2009-03-08 11:31 . 2007-05-08 23:35 34816 —-a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2007-05-08 23:36 48128 -c–a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2007-05-08 23:36 45568 -c–a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2007-05-08 23:36 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-06 14:44 . 2007-05-08 23:37 283648 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 18:33 826368 -c–a-w c:\windows\system32\wininet(5)(3).dll
2009-02-26 04:26 . 2007-05-14 07:24 16 -c–a-w c:\windows\popcinfo.dat
2009-02-20 18:09 . 2007-05-08 23:38 105984 -c–a-w c:\windows\system32\url(5)(3).dll
2009-02-20 18:09 . 2006-08-31 03:42 1160192 -c–a-w c:\windows\system32\urlmon(5)(3).dll
2009-02-20 18:09 . 2007-08-14 02:34 268288 -c–a-w c:\windows\system32\iertutil(2)(3).dll
2007-05-11 21:05 . 2008-03-26 10:24 774144 -c–a-w c:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0166505B-6A56-4772-9BD5-18857B8315D8}]
2009-05-14 15:36 143872 —-a-w c:\windows\system32\zjsvludl.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{326507fd-2b3e-4aa2-8731-18c55d8c3a91}]
2009-03-11 15:01 1883672 -c–a-w c:\program files\JibJab\tbJib0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50E0107C-5BA3-4B62-9698-0B00D4ACD0DB}]
2002-08-29 02:00 103936 —-a-w c:\windows\system32\qhsfxnm.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{326507fd-2b3e-4aa2-8731-18c55d8c3a91}"= "c:\program files\JibJab\tbJib0.dll" [2009-03-11 1883672]

[HKEY_CLASSES_ROOT\clsid\{326507fd-2b3e-4aa2-8731-18c55d8c3a91}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{326507FD-2B3E-4AA2-8731-18C55D8C3A91}"= "c:\program files\JibJab\tbJib0.dll" [2009-03-11 1883672]

[HKEY_CLASSES_ROOT\clsid\{326507fd-2b3e-4aa2-8731-18c55d8c3a91}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-05 4363504]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-25 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-12-15 118784]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-23 32881]
"Dit.exe"="c:\windows\Dit.exe" [2002-09-06 69632]
"CompleteSecurityUpdate"="c:\program files\Defender Pro Private Surf\AutomaticUpdate.exe" [2004-12-18 151552]
"LaunchAntiSpy"="c:\program files\DefenderPro\TSAntiSpy.exe" [2007-09-05 1630208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-05-15 67072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll
"wave6"= serwvdrv.dll
"wave7"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Mona^Start Menu^Programs^Startup^ChkDisk.lnk]
path=c:\documents and settings\Mona\Start Menu\Programs\Startup\ChkDisk.lnk
backup=c:\windows\pss\ChkDisk.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"iPod Service"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)
"Omniquad MyPrivacy"=2 (0x2)
"gusvc"=3 (0x3)
"wuauserv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Defender Pro\\Defender Pro Internet Security 6.0\\avp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\MSN\\MsnInstaller\\msniadm.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53603:TCP"= 53603:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [6/19/2008 1:05 AM 39472]
R0 mlrqdhyq;mlrqdhyq;c:\windows\system32\drivers\mlrqdhyq.sys [5/8/2007 4:37 PM 23424]
R2 NwSapAgent;SAP Agent;c:\windows\System32\svchost.exe -k netsvcs [5/8/2007 4:37 PM 14336]
R3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [5/28/2008 5:32 PM 2385896]
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\drivers\IIUSBISP.SYS [7/8/2004 10:12 AM 15883]
.
Contents of the 'Scheduled Tasks' folder

2009-04-15 c:\windows\Tasks\$~$Sys0$.job
- c:\windows\System32\SchedSvc.dll [2007-05-08 07:56]
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)


.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uInternet Connection Wizard,ShellNext = hxxp://www.insignia-products.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Mona\Application Data\Mozilla\Firefox\Profiles\fbmv0ja7.default\
FF - prefs.js: browser.search.selectedEngine - MySpace.com
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Web&orig=IMC-FF&qry=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npkanevapatch.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

—- FIREFOX POLICIES —-
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 250
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-14 08:41
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(756)
c:\windows\system32\klogon.dll

- - - - - - - > 'explorer.exe'(4044)
c:\program files\Defender Pro\Defender Pro Internet Security 6.0\scrchpg.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\netdde.exe
c:\windows\system32\clipsrv.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
c:\windows\PCHealth\HelpCtr\Binaries\helpsvc.exe
c:\windows\system32\sessmgr.exe
c:\windows\DitExp.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
c:\program files\Skype\Plugin Manager\skypePM.exe
c:\windows\system32\msiexec.exe
.
**************************************************************************
.
Completion time: 2009-05-14 8:49 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-14 15:49

Pre-Run: 58,455,781,376 bytes free
Post-Run: 58,405,285,888 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional Edition" /fastdetect /NoExecute=OptIn

283 — E O F — 2009-05-14 15:43


AND THE NEW HIJACKTHIS LOG:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:56:56 AM, on 5/14/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.insignia-products.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {0166505B-6A56-4772-9BD5-18857B8315D8} - C:\WINDOWS\system32\zjsvludl.dll
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O2 - BHO: (no name) - {50E0107C-5BA3-4B62-9698-0B00D4ACD0DB} - c:\windows\system32\qhsfxnm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Dit.exe] C:\WINDOWS\Dit.exe
O4 - HKLM\..\Run: [CompleteSecurityUpdate] "C:\Program Files\Defender Pro Private Surf\AutomaticUpdate.exe"
O4 - HKLM\..\Run: [LaunchAntiSpy] C:\Program Files\DefenderPro\TSAntiSpy.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\scieplugin.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Poker Host - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\PokerHostMPP\MPPoker.exe (file missing) (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Defender Pro Internet Security (AVP) - Defender Pro - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\avz.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 7410 bytes


AGAIN THANK YOU FOR YOUR HELP…. ILL BE HERE WAITING FOR WHENEVER YOU RETURN FROM THE FUNERAL… MY CONDOLENCES…..

OK… I RAN MALWARE TWICE ACTUALLY… HERE ARE THE LOGS FROM THOSE:
Malwarebytes' Anti-Malware 1.36
Database version: 2128
Windows 5.1.2600 Service Pack 2

5/15/2009 12:33:55 PM
mbam-log-2009-05-15 (12-33-55).txt

Scan type: Quick Scan
Objects scanned: 87677
Time elapsed: 8 minute(s), 26 second(s)

Memory Processes Infected: 1
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 1
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
C:\WINDOWS\sysguard.exe (Trojan.Vundo.V) -> Unloaded process successfully.

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0166505b-6a56-4772-9bd5-18857b8315d8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0166505b-6a56-4772-9bd5-18857b8315d8} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bbd4551a-9b23-41cd-9bcd-818aa2da7b63} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{bbd4551a-9b23-41cd-9bcd-818aa2da7b63} (Trojan.Vundo.H) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50e0107c-5ba3-4b62-9698-0b00d4acd0db} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{50e0107c-5ba3-4b62-9698-0b00d4acd0db} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\AvScan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\system tool (Trojan.Vundo.V) -> Quarantined and deleted successfully.

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\zjsvludl.dll (Trojan.Vundo.H) -> Delete on reboot.
C:\WINDOWS\system32\iehelper.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
c:\WINDOWS\system32\qhsfxnm.dll (Trojan.BHO.H) -> Delete on reboot.
C:\WINDOWS\sysguard.exe (Trojan.Vundo.V) -> Quarantined and deleted successfully.
C:\Documents and Settings\Mona\Local Settings\Temporary Internet Files\Content.IE5\NUS9UKEX\install[1].exe (Trojan.Vundo.V) -> Quarantined and deleted successfully.

THE SECOND MALWARE LOG IS HERE:
Malwarebytes' Anti-Malware 1.36
Database version: 2128
Windows 5.1.2600 Service Pack 2

5/15/2009 1:24:44 PM
mbam-log-2009-05-15 (13-24-44).txt

Scan type: Quick Scan
Objects scanned: 87813
Time elapsed: 7 minute(s), 42 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50e0107c-5ba3-4b62-9698-0b00d4acd0db} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{50e0107c-5ba3-4b62-9698-0b00d4acd0db} (Trojan.BHO.H) -> Delete on reboot.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\qhsfxnm.dll (Trojan.BHO.H) -> Delete on reboot.

AND THE NEW HIJACKTHIS REPORT IS HERE:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:39:28 PM, on 5/15/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_04

\bin\jusched.exe
C:\WINDOWS\Dit.exe
C:\Program Files\Defender Pro Private

Surf\AutomaticUpdate.exe
C:\Program Files\DefenderPro\TSAntiSpy.exe
C:\WINDOWS\system32\clipsrv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\DitExp.exe
C:\Program Files\Microsoft

LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~2\Yahoo!\MESSEN~1

\YahooMessenger.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend

Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Page_URL =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Default_Search_URL =

http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet

Explorer\Main,Search Page =

http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet

Explorer\Main,Start Page =

http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet

Explorer\SearchURL,(Default) =

http://us.rd.yahoo.com/customize/ie/defaults/su/m

sgr9/*http://www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection

Wizard,ShellNext = http://www.insignia-

products.com/
R1 -

HKCU\Software\Microsoft\Windows\CurrentVersion

\Internet Settings,ProxyOverride = *.local
O1 - Hosts: ::1 localhost
O1 - Hosts: 94.232.248.66 browser-

security.microsoft.com
O1 - Hosts: 94.232.248.66 antivguardian.com
O1 - Hosts: 94.232.248.66 www.antivguardian.com
O2 - BHO: (no name) - {02478D38-C3F9-4efb-

9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper -

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} -

C:\Program Files\Common

Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) -

{22BF413B-C6D2-4d91-82A9-A0F997BA588C} -

C:\Program Files\Skype\Toolbars\Internet

Explorer\SkypeIEPlugin.dll
O2 - BHO: JibJab Toolbar - {326507fd-2b3e-4aa2-

8731-18c55d8c3a91} - C:\Program

Files\JibJab\tbJib0.dll
O2 - BHO: (no name) - {50E0107C-5BA3-4B62-

9698-0B00D4ACD0DB} - c:\windows\system32

\qhsfxnm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-

462C-B6EB-D4DAF1D92D43} - C:\Program

Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-

01DD-4d91-8333-CF10577473F7} - C:\Program

Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch -

{C84D72FE-E17D-4195-BB24-76C02E2E7C4E} -

C:\Program Files\Google\Google

Toolbar\Component\fastsearch_A8904FB862BD95

64.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-

4740-988e-03dc2f38c34f} - C:\Program

Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: JibJab Toolbar - {326507fd-2b3e-

4aa2-8731-18c55d8c3a91} - C:\Program

Files\JibJab\tbJib0.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-

49d6-B9E9-AB4C880C8414} - C:\Program

Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-

11d4-9B18-009027A5CD4F} - C:\Program

Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HotKeysCmds]

C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched]

C:\Program Files\Java\j2re1.4.2_04

\bin\jusched.exe
O4 - HKLM\..\Run: [Dit.exe] C:\WINDOWS\Dit.exe
O4 - HKLM\..\Run: [CompleteSecurityUpdate]

"C:\Program Files\Defender Pro Private

Surf\AutomaticUpdate.exe"
O4 - HKLM\..\Run: [LaunchAntiSpy] C:\Program

Files\DefenderPro\TSAntiSpy.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program

Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe]

C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)]

"C:\Program Files\Yahoo!

\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program

Files\Skype\Phone\Skype.exe" /nosplash

/minimized
O4 - HKCU\..\Run: [swg] C:\Program

Files\Google\GoogleToolbarNotifier\GoogleToolbarN

otifier.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM]

C:\Program Files\MySpace\IM\MySpaceIM.exe

(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM]

C:\Program Files\MySpace\IM\MySpaceIM.exe

(User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet

Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet

Explorer\Control Panel present
O9 - Extra button: Web Anti-Virus statistics -

{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} -

C:\Program Files\Defender Pro\Defender Pro

Internet Security 6.0\scieplugin.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16

-4e43-B6D8-661B03F6A1EF} - C:\Program

Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7

-9980-D32B190E9B07} - C:\Program

Files\Skype\Toolbars\Internet

Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-

9AA2-40F1-9C6B-12A255F085E1} - C:\Program

Files\PartyGaming\PartyPoker\RunApp.exe (file

missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com -

{B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} -

C:\Program

Files\PartyGaming\PartyPoker\RunApp.exe (file

missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-

4134-82b7-f2ba38496583} - C:\WINDOWS\Network

Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001

- {e2e2dd38-d088-4134-82b7-f2ba38496583} -

C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-

ED21-4dc1-853E-D1495792D4C5} - C:\Program

Files\Bodog Poker\BPGame.exe
O9 - Extra button: Poker Host - {00000000-0000-

0000-0000-000000000000} -

C:\MicroGaming\Poker\PokerHostMPP\MPPoker.e

xe (file missing) (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-

7535-495c-91F6-8C13714ED485} - C:\Documents

and Settings\Mona\Start Menu\Programs\Absolute

Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker -

{13C1DBF6-7535-495c-91F6-8C13714ED485} -

C:\Documents and Settings\Mona\Start

Menu\Programs\Absolute Poker\Absolute

Poker.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP:

c:\windows\system32\nwprovau.dll
O14 - IERESET.INF:

START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-

314DEE697D83} (Facebook Photo Uploader 5

Control) -

http://upload.facebook.com/controls/2008.10.10_v5

.5.8/FacebookPhotoUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-

2D05CB959537} (MSN Photo Upload Tool) -

http://gfx2.hotmail.com/mail/w3/resources/MSNPU

pld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-

4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2

\COMMON~1\Skype\Skype4COM.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-

B0F1-B719FE26E377} - C:\Program

Files\Google\Google

Toolbar\Component\fastsearch_A8904FB862BD95

64.dll
O23 - Service: Defender Pro Internet Security

(AVP) - Defender Pro - C:\Program Files\Defender

Pro\Defender Pro Internet Security 6.0\avz.exe
O23 - Service: GameConsoleService -

WildTangent, Inc. - C:\Program

Files\WildGames\Game Console -

WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT)

- Macrovision Corporation - C:\Program

Files\Common Files\InstallShield\Driver\11\Intel 32

\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP -

C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 7644 bytes

THE ONE THING I NOTICED IS THAT EVEN THOUGH MALWARE SAID THAT CERTAIN FILES WOULD BE DELETED ON REBOOT.. IT DIDNT SEEM LIKE THEY WERE.. 3 OF THEM ON THE SECOND GO AROUND WERE BHO'S AND I BELIEVE I SAW THEM ON THE FIRST GO ALSO…. IDK…. ILL BE HERE…. AND AGAIN THANK YOU FOR YOUR HELP….

THANK YOU SO MUCH FOR YOUR PATIENCE… HERE IS THE NEW COMBOFIX LOG:
NOW THERE IS THE ONE THING THAT I NOTICED WHILE TRYING TO RUN COMBO FIX… IT SAID THAT MY DEFENDER PROGRAM WAS RUNNING EVENTHOUGH I DISABLED IT LIKE IT SAID IN THE DIRECTIONS????

ComboFix 09-05-15.08 - Mona 05/16/2009 7:54.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.503.181 [GMT -7:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Mona\Desktop\cfscript.txt
AV: Defender Pro Internet Security *On-access scanning enabled* (Updated) {2C4D4BC6-0793-4956-A9F9-E252435469C0}
FW: Defender Pro Internet Security *enabled* {2C4D4BC6-0793-4956-A9F9-E252435469C0}

FILE ::
c:\documents and settings\Mona\Local Settings\Application Data\ezappkfk
c:\windows\system32\qhsfxnm.dll
c:\windows\system32\zjsvludl.dll
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\qhsfxnm.dll . . . . failed to delete
c:\windows\system32\zjsvludl.dll . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2009-04-16 to 2009-05-16 )))))))))))))))))))))))))))))))
.

2009-05-14 15:20 . 2009-05-14 15:20 ——– d—–w C:\HostsXpert 4.3 - Host File Manager
2009-05-14 01:15 . 2009-05-14 01:15 ——– d—–w c:\documents and settings\Mona\Application Data\Malwarebytes
2009-05-14 01:15 . 2009-04-06 22:32 15504 —-a-w c:\windows\system32\drivers\mbam.sys
2009-05-14 01:15 . 2009-04-06 22:32 38496 —-a-w c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-14 01:15 . 2009-05-14 01:15 ——– d—–w c:\documents and settings\All Users\Application Data\Malwarebytes
2009-05-14 01:15 . 2009-05-14 01:29 ——– d—–w c:\program files\Malwarebytes' Anti-Malware
2009-05-13 21:18 . 2007-12-25 00:37 138384 —-a-w c:\windows\system32\drivers\tmcomm.sys
2009-05-13 21:17 . 2009-05-13 22:30 ——– d—–w c:\documents and settings\Mona\Application Data\HouseCall 6.6
2009-05-12 10:45 . 2009-05-12 10:45 56 —ha-w c:\windows\system32\ezsidmv.dat
2009-05-12 10:45 . 2009-05-16 07:41 ——– d—–w c:\documents and settings\Mona\Application Data\skypePM
2009-05-12 10:43 . 2009-05-16 14:35 ——– d—–w c:\documents and settings\Mona\Application Data\Skype
2009-05-12 10:43 . 2009-05-12 10:43 ——– d—–w c:\program files\Common Files\Skype
2009-05-12 10:43 . 2009-05-12 10:43 ——– d—–r c:\program files\Skype
2009-05-12 10:42 . 2009-05-12 10:43 ——– d—–w c:\documents and settings\All Users\Application Data\Skype
2009-05-07 22:32 . 2009-05-07 22:32 ——– d—–w c:\documents and settings\Mona\Application Data\ezappkfk
2009-05-07 22:32 . 2009-05-07 22:32 ——– d—–w c:\documents and settings\Mona\Local Settings\Application Data\ezappkfk
2009-05-05 02:49 . 2009-03-16 21:36 931672 —-a-w c:\windows\system32\XAudioD2_4.dll
2009-05-05 02:49 . 2009-03-16 21:35 125768 —-a-w c:\windows\system32\XAPOFXD1_3.dll
2009-05-05 02:49 . 2009-03-16 21:35 343368 —-a-w c:\windows\system32\XactEngineD3_4.dll
2009-05-05 02:49 . 2009-03-16 21:35 428888 —-a-w c:\windows\system32\XactEngineA3_4.dll
2009-05-05 02:49 . 2009-03-16 21:35 45384 —-a-w c:\windows\system32\X3DAudioD1_6.dll
2009-05-05 02:49 . 2009-03-16 21:35 358728 —-a-w c:\windows\system32\dinput8d.dll
2009-05-05 02:49 . 2009-03-16 21:35 4280136 —-a-w c:\windows\system32\D3dx9d_41.dll
2009-05-05 02:49 . 2009-03-16 21:36 3795784 —-a-w c:\windows\system32\d3dx9d_33.dll
2009-05-05 02:49 . 2009-03-16 21:35 497480 —-a-w c:\windows\system32\D3DX10d_41.dll
2009-05-05 02:49 . 2009-03-16 21:35 348504 —-a-w c:\windows\system32\d3dref9.dll
2009-05-05 02:49 . 2009-03-16 21:36 3083592 —-a-w c:\windows\system32\d3d9d.dll
2009-05-05 02:44 . 2007-10-12 22:14 3734536 —-a-w c:\windows\system32\d3dx9_36.dll
2009-05-05 02:40 . 2009-05-05 02:49 ——– d—–w c:\program files\Microsoft DirectX SDK (March 2009)
2009-05-05 02:39 . 2009-05-05 02:42 ——– d—–w c:\windows\Logs
2009-05-05 02:39 . 2009-05-05 02:39 118104 —-a-w c:\windows\dxsdkuninst.exe
2009-04-23 00:56 . 2009-04-23 00:56 ——– d-sh–w c:\windows\system32\config\systemprofile\IETldCache
2009-04-18 03:13 . 2009-04-18 03:13 ——– d—–w c:\windows\LastGood(3)

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-05-16 15:02 . 2008-05-04 07:12 109976864 –sha-w c:\windows\system32\drivers\fidbox.dat
2009-05-16 15:02 . 2008-05-04 07:12 18100256 –sha-w c:\windows\system32\drivers\fidbox2.dat
2009-05-16 14:59 . 2008-05-04 07:12 1697876 –sha-w c:\windows\system32\drivers\fidbox2.idx
2009-05-16 14:59 . 2008-05-04 07:12 2695388 –sha-w c:\windows\system32\drivers\fidbox.idx
2009-05-14 17:53 . 2008-03-26 10:19 ——– d—–w c:\program files\PokerStars
2009-05-14 15:36 . 2007-05-08 23:37 143872 —-a-w c:\windows\system32\zjsvludl.dll
2009-05-14 15:35 . 2007-05-08 23:37 103936 —-a-w c:\windows\system32\hbkfixt.dll
2009-05-12 10:43 . 2008-03-26 07:53 ——– d—–w c:\program files\Google
2009-05-11 16:06 . 2008-03-26 09:58 ——– d—–w c:\program files\Full Tilt Poker
2009-04-29 12:51 . 2008-06-14 23:38 ——– d—–w c:\program files\RealArcade
2009-04-27 01:05 . 2009-02-24 20:32 ——– d—–w c:\program files\PokerHost
2009-04-09 00:27 . 2009-04-09 00:27 ——– d—–w c:\program files\Microsoft Silverlight
2009-03-21 14:18 . 2009-04-15 06:48 986112 -c–a-w c:\windows\system32\kernel32(2)(2).dll
2009-03-18 00:03 . 2008-04-14 09:04 ——– d—–w c:\program files\JibJab
2009-03-16 21:18 . 2009-05-05 02:45 69448 —-a-w c:\windows\system32\XAPOFX1_3.dll
2009-03-16 21:18 . 2009-05-05 02:45 517448 —-a-w c:\windows\system32\XAudio2_4.dll
2009-03-16 21:18 . 2009-05-05 02:45 235352 —-a-w c:\windows\system32\xactengine3_4.dll
2009-03-16 21:18 . 2009-05-05 02:45 22360 —-a-w c:\windows\system32\X3DAudio1_6.dll
2009-03-09 22:27 . 2009-05-05 02:45 453456 —-a-w c:\windows\system32\d3dx10_41.dll
2009-03-09 22:27 . 2009-05-05 02:45 4178264 —-a-w c:\windows\system32\D3DX9_41.dll
2009-03-09 22:27 . 2009-05-05 02:45 1846632 —-a-w c:\windows\system32\D3DCompiler_41.dll
2009-03-08 11:34 . 2006-06-23 18:33 914944 —-a-w c:\windows\system32\wininet.dll
2009-03-08 11:34 . 2007-05-08 23:36 43008 -c–a-w c:\windows\system32\licmgr10.dll
2009-03-08 11:33 . 2007-05-08 23:34 18944 -c–a-w c:\windows\system32\corpol.dll
2009-03-08 11:33 . 2007-05-08 23:38 420352 —-a-w c:\windows\system32\vbscript.dll
2009-03-08 11:32 . 2007-05-08 23:34 72704 -c–a-w c:\windows\system32\admparse.dll
2009-03-08 11:32 . 2007-05-08 23:35 71680 -c–a-w c:\windows\system32\iesetup.dll
2009-03-08 11:31 . 2007-05-08 23:35 34816 —-a-w c:\windows\system32\imgutil.dll
2009-03-08 11:31 . 2007-05-08 23:36 48128 -c–a-w c:\windows\system32\mshtmler.dll
2009-03-08 11:31 . 2007-05-08 23:36 45568 -c–a-w c:\windows\system32\mshta.exe
2009-03-08 11:22 . 2007-05-08 23:36 156160 —-a-w c:\windows\system32\msls31.dll
2009-03-06 14:44 . 2007-05-08 23:37 283648 —-a-w c:\windows\system32\pdh.dll
2009-03-03 00:18 . 2006-06-23 18:33 826368 -c–a-w c:\windows\system32\wininet(5)(3).dll
2009-02-26 04:26 . 2007-05-14 07:24 16 -c–a-w c:\windows\popcinfo.dat
2009-02-20 18:09 . 2007-05-08 23:38 105984 -c–a-w c:\windows\system32\url(5)(3).dll
2009-02-20 18:09 . 2006-08-31 03:42 1160192 -c–a-w c:\windows\system32\urlmon(5)(3).dll
2009-02-20 18:09 . 2007-08-14 02:34 268288 -c–a-w c:\windows\system32\iertutil(2)(3).dll
2007-05-11 21:05 . 2008-03-26 10:24 774144 -c–a-w c:\program files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-05-14_15.41.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-05-16 15:02 . 2009-05-16 15:02 16384 c:\windows\temp\Perflib_Perfdata_b24.dat
+ 2004-05-11 18:53 . 2004-05-11 18:53 1230336 c:\windows\system32\msxml4.dll
+ 2007-05-11 21:04 . 2009-05-07 07:16 24699336 c:\windows\system32\MRT.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{326507fd-2b3e-4aa2-8731-18c55d8c3a91}]
2009-03-11 15:01 1883672 -c–a-w c:\program files\JibJab\tbJib0.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{50E0107C-5BA3-4B62-9698-0B00D4ACD0DB}]
2002-08-29 02:00 103936 —-a-w c:\windows\system32\qhsfxnm.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{326507fd-2b3e-4aa2-8731-18c55d8c3a91}"= "c:\program files\JibJab\tbJib0.dll" [2009-03-11 1883672]

[HKEY_CLASSES_ROOT\clsid\{326507fd-2b3e-4aa2-8731-18c55d8c3a91}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
"{326507FD-2B3E-4AA2-8731-18C55D8C3A91}"= "c:\program files\JibJab\tbJib0.dll" [2009-03-11 1883672]

[HKEY_CLASSES_ROOT\clsid\{326507fd-2b3e-4aa2-8731-18c55d8c3a91}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Messenger (Yahoo!)"="c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-02-05 4363504]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-04-21 24264488]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-08-25 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-12-15 118784]
"SunJavaUpdateSched"="c:\program files\Java\j2re1.4.2_04\bin\jusched.exe" [2004-02-23 32881]
"Dit.exe"="c:\windows\Dit.exe" [2002-09-06 69632]
"CompleteSecurityUpdate"="c:\program files\Defender Pro Private Surf\AutomaticUpdate.exe" [2004-12-18 151552]
"LaunchAntiSpy"="c:\program files\DefenderPro\TSAntiSpy.exe" [2007-09-05 1630208]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-11-04 413696]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\SOUNDMAN.EXE [2004-05-15 67072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-12-12 9555968]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveTrack"= 1 (0x1)
"NoFileAssociate"= 0 (0x0)

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32
"wave"= serwvdrv.dll
"wave6"= serwvdrv.dll
"wave7"= serwvdrv.dll

[HKLM\~\startupfolder\C:^Documents and Settings^Mona^Start Menu^Programs^Startup^ChkDisk.lnk]
path=c:\documents and settings\Mona\Start Menu\Programs\Startup\ChkDisk.lnk
backup=c:\windows\pss\ChkDisk.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"FLEXnet Licensing Service"=3 (0x3)
"iPod Service"=3 (0x3)
"WMPNetworkSvc"=2 (0x2)
"Omniquad MyPrivacy"=2 (0x2)
"gusvc"=3 (0x3)
"wuauserv"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\WINDOWS\\system32\\mmc.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Defender Pro\\Defender Pro Internet Security 6.0\\avp.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"=
"c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=
"c:\\Program Files\\MSN\\MsnInstaller\\msniadm.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"53603:TCP"= 53603:TCP:@xpsp2res.dll,-22009

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R0 hotcore3;hotcore3;c:\windows\system32\drivers\hotcore3.sys [6/19/2008 1:05 AM 39472]
R0 mlrqdhyq;mlrqdhyq;c:\windows\system32\drivers\mlrqdhyq.sys [5/8/2007 4:37 PM 23424]
R2 NwSapAgent;SAP Agent;c:\windows\System32\svchost.exe -k netsvcs [5/8/2007 4:37 PM 14336]
R3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [5/28/2008 5:32 PM 2385896]
S3 IIUSBISP;USB Mass Storage for USB ISP;c:\windows\system32\drivers\IIUSBISP.SYS [7/8/2004 10:12 AM 15883]
.
.
——- Supplementary Scan ——-
.
uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}
uInternet Connection Wizard,ShellNext = hxxp://www.insignia-products.com/
uInternet Settings,ProxyOverride = *.local
uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr9/*http://www.yahoo.com
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Mona\Application Data\Mozilla\Firefox\Profiles\fbmv0ja7.default\
FF - prefs.js: browser.search.selectedEngine - MySpace.com
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/
FF - prefs.js: keyword.URL - hxxp://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&type=Web&orig=IMC-FF&qry=
FF - plugin: c:\program files\Mozilla Firefox\plugins\npkanevapatch.dll
FF - plugin: c:\program files\Real\RealArcade\Plugins\Mozilla\npracplug.dll
FF - plugin: c:\program files\Unity\WebPlayer\loader\npUnity3D32.dll

—- FIREFOX POLICIES —-
FF - user.js: network.prefetch-next - true
FF - user.js: nglayout.initialpaint.delay - 250
FF - user.js: layout.spellcheckDefault - 1
FF - user.js: browser.urlbar.autoFill - false
FF - user.js: browser.search.openintab - false
FF - user.js: browser.tabs.closeButtons - 1
FF - user.js: browser.tabs.opentabfor.middleclick - true
FF - user.js: browser.tabs.tabMinWidth - 100
FF - user.js: browser.urlbar.hideGoButton - false
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-05-16 08:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•A~*]
"AB141C35E9F4BF344B9FC010BB17F68A"=""
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(760)
c:\windows\system32\klogon.dll

- - - - - - - > 'explorer.exe'(1580)
c:\program files\Defender Pro\Defender Pro Internet Security 6.0\scrchpg.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\windows\system32\netdde.exe
c:\windows\system32\clipsrv.exe
c:\program files\Microsoft LifeCam\MSCamS32.exe
c:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
c:\windows\system32\sessmgr.exe
c:\windows\DitExp.exe
c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
.
**************************************************************************
.
Completion time: 2009-05-16 8:06 - machine was rebooted
ComboFix-quarantined-files.txt 2009-05-16 15:06
ComboFix2.txt 2009-05-14 15:49

Pre-Run: 58,145,443,840 bytes free
Post-Run: 58,188,144,640 bytes free

257 — E O F — 2009-05-16 10:00

HERE IS THE NEW HIJACKTHIS REPORT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:16:12 AM, on 5/16/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\netdde.exe
C:\WINDOWS\system32\clipsrv.exe
C:\Program Files\Microsoft LifeCam\MSCamS32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
C:\WINDOWS\Dit.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\DitExp.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.insignia-products.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O2 - BHO: (no name) - {50E0107C-5BA3-4B62-9698-0B00D4ACD0DB} - c:\windows\system32\qhsfxnm.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: MSN Toolbar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: JibJab Toolbar - {326507fd-2b3e-4aa2-8731-18c55d8c3a91} - C:\Program Files\JibJab\tbJib0.dll
O3 - Toolbar: MSN Toolbar - {1E61ED7C-7CB8-49d6-B9E9-AB4C880C8414} - C:\Program Files\MSN\Toolbar\3.0.1203.0\msneshellx.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe
O4 - HKLM\..\Run: [Dit.exe] C:\WINDOWS\Dit.exe
O4 - HKLM\..\Run: [CompleteSecurityUpdate] "C:\Program Files\Defender Pro Private Surf\AutomaticUpdate.exe"
O4 - HKLM\..\Run: [LaunchAntiSpy] C:\Program Files\DefenderPro\TSAntiSpy.exe /startup
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: Web Anti-Virus statistics - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\scieplugin.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O9 - Extra button: Poker Host - {00000000-0000-0000-0000-000000000000} - C:\MicroGaming\Poker\PokerHostMPP\MPPoker.exe (file missing) (HKCU)
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\Mona\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk (file missing) (HKCU)
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.bestbuy.msn.com
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2008.1…toUploader5.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail.com/mail/w3/resources/MSNPUpld.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\Skype4COM.dll
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Defender Pro Internet Security (AVP) - Defender Pro - C:\Program Files\Defender Pro\Defender Pro Internet Security 6.0\avz.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe

–
End of file - 7363 bytes
AND JUST FYI I ALSO RAN THE MALWARE AGAIN AND IT STILL FOUND THE SAME 3 OBJECTS AS REPORTED HERE:

Malwarebytes' Anti-Malware 1.36
Database version: 2128
Windows 5.1.2600 Service Pack 2

5/16/2009 8:25:51 AM
mbam-log-2009-05-16 (08-25-50).txt

Scan type: Quick Scan
Objects scanned: 86029
Time elapsed: 7 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50e0107c-5ba3-4b62-9698-0b00d4acd0db} (Trojan.BHO.H) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{50e0107c-5ba3-4b62-9698-0b00d4acd0db} (Trojan.BHO.H) -> Delete on reboot.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
c:\WINDOWS\system32\qhsfxnm.dll (Trojan.BHO.H) -> Delete on reboot.