[Closed] severe trojan/infection please help

hi thanks for your help… sorry it took me a little bit to respond.. i have school in the evenings so sometimes i dont get around to my computer until late in the evening… anyhooooo…. here are the logs you asked for i have sent them as attachments i hope thats ok :-) if not let me know and i will post them instead thanks again shawnav DDS (Ver_09-12-01.01) - NTFSx86 Run by [removed] at 23:40:11.35 on Mon 03/08/2010 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_17 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.144 [GMT -8:00] AV: Enterprise Suite *On-access scanning enabled* (Updated) {68DB42A5-573A-44C9-8E89-83DAD97E2FCB} FW: Enterprise Suite *enabled* {F78CC7E5-15F3-4570-BA28-58AF99B2A0B7} ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\WINDOWS\system32\svchost.exe -k imgsvc C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\SoftwareDistribution\Download\Install\mpas-fe_bd.exe c:\27b02297957a8cd49a7d999a4dc40b78\MPSigStub.exe C:\Documents and Settings\MONA\Desktop\dds.scr ============== Pseudo HJT Report =============== uSearch Page = uSearch Bar = BHO: PlaySushi: {21608b66-026f-4dcb-9244-0daca328dced} - c:\program files\playsushi\PSText.dll uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide IE: {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - c:\program files\bodog poker\BPGame.exe IE: {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - {EBD24BD3-E272-4FA3-A8BA-C5D709757CAB} - c:\program files\playsushi\PSText.dll DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll Notify: AtiExtEvent - Ati2evxx.dll Notify: igfxcui - igfxsrvc.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: Microsoft AntiMalware ShellExecuteHook: {091eb208-39dd-417d-a5dd-7e2c2d8fb9cb} - c:\progra~1\window~4\MpShHook.dll IFEO: image file execution options - svchost.exe ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\mona\applic~1\mozilla\firefox\profiles\j0anwn8z.shawna\ FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\dotnetassistantextension\ FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} —- FIREFOX POLICIES —- c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true); ============= SERVICES / DRIVERS =============== R1 hwinterface32B01;hwinterface32B01;c:\windows\system32\drivers\hwinterface32B01.sys [2010-1-20 4930] R2 cpuz132;cpuz132;c:\windows\system32\drivers\cpuz132_x32.sys [2010-2-6 12672] S2 WinDefend;Windows Defender;"c:\program files\windows defender\msmpeng.exe" –> c:\program files\windows defender\MsMpEng.exe [?] S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [2010-1-18 29184] S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [2009-6-26 2069504] =============== Created Last 30 ================ 2010-03-09 07:24:42 0 d—–w- C:\27b02297957a8cd49a7d999a4dc40b78 2010-03-09 07:19:40 0 d—–w- c:\windows\system32\wbem\Repository 2010-03-08 16:51:25 0 d—–w- c:\docume~1\mona\applic~1\MSNInstaller 2010-03-08 15:59:24 737280 —-a-w- c:\windows\iun6002.exe 2010-03-08 15:59:22 0 d—–w- c:\program files\Defender Pro 2010-03-08 15:57:41 0 d—–w- c:\docume~1\alluse~1\applic~1\Kaspersky Anti-Virus Personal 2010-03-08 13:25:54 0 d—–w- c:\program files\ESET 2010-03-08 09:42:36 0 d—–w- c:\program files\Defender 2010-03-08 04:42:08 0 d—–w- c:\program files\common files\EZB Systems 2010-03-08 04:42:01 0 d—–w- c:\program files\EVPmaker 2010-03-08 04:13:39 0 d—–w- c:\windows\pss 2010-03-08 00:46:05 0 d—–w- c:\docume~1\mona\applic~1\QuickScan 2010-02-26 07:53:22 0 d—–w- c:\docume~1\alluse~1\applic~1\GameHouse 2010-02-25 09:19:01 15 —-a-w- c:\windows\popcinfo.dat 2010-02-25 09:10:49 0 d—–w- c:\program files\Oberon Media 2010-02-25 09:10:49 0 d—–w- c:\program files\MSN Games 2010-02-22 21:33:36 69 —-a-w- c:\windows\NeroDigital.ini 2010-02-20 23:43:30 0 d—–w- c:\program files\Nero 2010-02-20 23:42:03 0 d—–w- c:\docume~1\alluse~1\applic~1\Nero 2010-02-20 06:37:21 0 d–h–w- c:\windows\PIF 2010-02-15 17:51:22 0 d—–w- c:\documents and settings\mona\.thumbnails 2010-02-15 12:37:58 0 d—–w- c:\documents and settings\mona\.gimp-2.6 2010-02-15 11:24:14 691696 —-a-w- c:\windows\system32\drivers\sptd.sys 2010-02-15 07:31:24 0 d—–w- c:\docume~1\mona\applic~1\WinBatch 2010-02-14 19:34:10 0 d—–w- c:\program files\UltraISO 2010-02-14 02:34:25 0 d—–w- c:\program files\TrendMicro 2010-02-12 00:22:32 57151 —-a-w- c:\windows\system32\igfx.hlp 2010-02-11 05:02:49 0 d—–w- c:\program files\GIMP-2.0 2010-02-08 02:41:24 0 d—–w- c:\windows\system32\appmgmt 2010-02-08 02:31:11 212 —-a-w- c:\windows\system32\QuickTime.qtp 2010-02-08 02:31:08 969216 —-a-w- c:\windows\system32\qd3d.dll 2010-02-08 02:31:08 747008 —-a-w- c:\windows\system32\Indeo4.qtx 2010-02-08 02:31:08 596992 —-a-w- c:\windows\system32\rave.dll 2010-02-08 02:31:08 44032 —-a-w- c:\windows\system32\QD3DCustomElements.q3x 2010-02-08 02:31:08 370176 —-a-w- c:\windows\system32\QuickTimeVR.qtx 2010-02-08 02:31:08 253952 —-a-w- c:\windows\system32\QD3D_IR2.q3x 2010-02-08 02:31:08 202240 —-a-w- c:\windows\system32\QuickTime.cpl 2010-02-08 02:31:08 126976 —-a-w- c:\windows\system32\3DViewer.dll 2010-02-08 02:31:07 6047744 —-a-w- c:\windows\system32\QuickTime.qts 2010-02-08 02:31:07 2124288 —-a-w- c:\windows\system32\QuickTimeMusicalInstruments.qtx 2010-02-08 02:29:14 0 d—–w- c:\documents and settings\mona\WINDOWS 2010-02-07 20:38:54 0 d—–w- c:\program files\LeoCAD ==================== Find3M ==================== 2010-02-24 17:16:06 181632 ——w- c:\windows\system32\MpSigStub.exe 2010-02-15 19:00:28 20 —h–w- c:\docume~1\alluse~1\applic~1\PKP_DLdw.DAT 2010-02-15 18:53:14 20 —h–w- c:\docume~1\alluse~1\applic~1\PKP_DLdu.DAT 2010-01-20 19:12:47 4930 —-a-w- c:\windows\system32\drivers\hwinterface32B01.sys 2009-12-21 19:14:05 916480 —-a-w- c:\windows\system32\wininet.dll 2009-12-16 18:43:27 343040 —-a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:08:23 33280 —-a-w- c:\windows\system32\csrsrv.dll ============= FINISH: 23:40:54.21 ===============

sorry it took me so long to reply… i have been bogged down with mid-terms … at any rate here are the new logs you asked me for
combofix:
ComboFix 10-03-11.03 - MONA 03/11/2010 22:28:56.3.1 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.510.315 [GMT -8:00]
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Defender Pro\AntiSpy\Def\CnsMin.dsc
c:\program files\Mozilla Firefox\searchplugins\search.xml
c:\recycler\S-1-5-21-583907252-854245398-1801674531-500

.
original MBR restored successfully !
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Service_WudfRd


((((((((((((((((((((((((( Files Created from 2010-02-12 to 2010-03-12 )))))))))))))))))))))))))))))))
.

2010-03-09 11:03 . 2010-03-09 11:07 ——– d—–w- c:\program files\ThreatExpert Memory Scanner
2010-03-09 07:44 . 2010-03-12 06:27 ——– d—–w- c:\documents and settings\HelpAssistant.MONA-F584205318
2010-03-09 07:24 . 2010-03-09 07:24 ——– d—–w- C:\27b02297957a8cd49a7d999a4dc40b78
2010-03-09 07:19 . 2010-03-09 07:19 ——– d—–w- c:\windows\system32\wbem\Repository
2010-03-09 07:11 . 2010-03-09 07:11 ——– d—–w- c:\documents and settings\Administrator.MONA-F584205318\Local Settings\Application Data\Mozilla
2010-03-09 07:07 . 2010-03-09 07:07 ——– d—–w- c:\documents and settings\Administrator.MONA-F584205318\IETldCache
2010-03-09 07:07 . 2010-03-09 07:19 ——– d—–w- c:\documents and settings\Administrator.MONA-F584205318\Local Settings\Application Data\Microsoft
2010-03-09 07:07 . 2010-03-09 07:19 ——– d-s—w- c:\documents and settings\Administrator.MONA-F584205318
2010-03-08 22:56 . 2010-03-09 12:26 ——– d—–w- c:\documents and settings\MONA\Local Settings\Application Data\tdqwva
2010-03-08 20:42 . 2010-03-08 20:42 ——– d—–w- c:\documents and settings\HelpAssistant\WINDOWS
2010-03-08 20:42 . 2010-03-08 20:42 ——– d—–w- c:\documents and settings\HelpAssistant\PrivacIE
2010-03-08 13:34 . 2010-03-09 02:11 ——– d—–w- c:\documents and settings\HelpAssistant
2010-03-08 13:25 . 2010-03-08 20:42 ——– d—–w- c:\program files\ESET
2010-03-08 09:42 . 2010-03-08 09:42 ——– d—–w- c:\program files\Defender
2010-03-08 04:42 . 2010-03-08 04:42 ——– d—–w- c:\program files\Common Files\EZB Systems
2010-03-08 04:42 . 2010-03-08 04:42 ——– d—–w- c:\program files\EVPmaker
2010-03-08 04:07 . 2010-03-08 04:07 13664 —-a-w- c:\documents and settings\Administrator\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-08 03:18 . 2010-03-08 03:18 ——– d—–w- c:\documents and settings\Administrator\PrivacIE
2010-03-08 03:18 . 2010-03-08 03:18 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Adobe
2010-03-08 01:51 . 2010-03-08 01:51 ——– d—–w- c:\documents and settings\Administrator\IETldCache
2010-03-08 01:43 . 2010-03-08 01:43 ——– d—–w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-03-08 01:18 . 2010-03-08 04:41 ——– d—–w- c:\documents and settings\Administrator\Local Settings\Application Data\Microsoft
2010-03-08 01:18 . 2010-03-08 04:41 ——– d-s—w- c:\documents and settings\Administrator
2010-03-08 00:46 . 2010-03-08 00:51 ——– d—–w- c:\documents and settings\MONA\Application Data\QuickScan
2010-02-26 07:53 . 2010-02-26 07:53 ——– d—–w- c:\documents and settings\All Users\Application Data\GameHouse
2010-02-25 09:19 . 2010-02-26 07:41 15 —-a-w- c:\windows\popcinfo.dat
2010-02-25 09:11 . 2010-02-26 08:53 ——– d—a-w- c:\documents and settings\All Users\Application Data\TEMP
2010-02-25 09:10 . 2010-03-04 04:14 ——– d—–w- c:\program files\Oberon Media
2010-02-25 09:10 . 2010-02-26 08:56 ——– d—–w- c:\program files\MSN Games
2010-02-21 00:17 . 2010-02-21 00:18 ——– d—–w- c:\documents and settings\MONA\Application Data\Nero
2010-02-20 23:43 . 2010-02-21 00:11 ——– d—–w- c:\program files\Nero
2010-02-20 23:42 . 2010-02-20 23:49 ——– d—–w- c:\documents and settings\All Users\Application Data\Nero
2010-02-20 23:42 . 2010-02-20 23:59 ——– d—–w- c:\program files\Common Files\Nero
2010-02-20 06:37 . 2010-02-20 06:37 ——– d–h–w- c:\windows\PIF
2010-02-16 16:14 . 2010-03-03 08:15 ——– d—–w- c:\documents and settings\All Users\Application Data\WinZip
2010-02-15 17:51 . 2010-02-15 17:51 ——– d—–w- c:\documents and settings\MONA\.thumbnails
2010-02-15 12:37 . 2010-02-28 17:33 ——– d—–w- c:\documents and settings\MONA\.gimp-2.6
2010-02-15 11:24 . 2010-02-15 11:24 691696 —-a-w- c:\windows\system32\drivers\sptd.sys
2010-02-15 07:31 . 2010-02-15 07:31 ——– d—–w- c:\documents and settings\MONA\Application Data\WinBatch
2010-02-14 19:34 . 2010-03-08 04:42 ——– d—–w- c:\program files\UltraISO
2010-02-14 02:34 . 2010-02-14 02:34 388096 —-a-r- c:\documents and settings\MONA\Application Data\Microsoft\Installer\{0761C9A8-8F3A-4216-B4A7-B7AFBF24A24A}\HiJackThis.exe
2010-02-14 02:34 . 2010-02-14 02:34 ——– d—–w- c:\program files\TrendMicro
2010-02-12 00:22 . 2010-02-12 00:22 ——– d—–w- c:\documents and settings\MONA\Local Settings\Application Data\Help
2010-02-11 05:02 . 2010-02-11 05:02 ——– d—–w- c:\program files\GIMP-2.0

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-03-08 20:42 . 2010-03-08 15:57 ——– d—–w- c:\documents and settings\All Users\Application Data\Kaspersky Anti-Virus Personal
2010-03-08 20:41 . 2010-03-08 16:51 ——– d—–w- c:\documents and settings\MONA\Application Data\MSNInstaller
2010-03-08 16:51 . 2010-03-08 16:51 1244648 —-a-w- c:\documents and settings\MONA\Application Data\MSNInstaller\msnauins.exe
2010-03-08 16:18 . 2010-03-08 15:59 ——– d—–w- c:\program files\Defender Pro
2010-03-08 15:59 . 2010-03-08 15:59 737280 —-a-w- c:\windows\iun6002.exe
2010-03-08 12:13 . 2009-11-24 06:44 ——– d—–w- c:\program files\HP
2010-03-08 05:21 . 2010-01-11 01:12 ——– d—–w- c:\program files\Malwarebytes' Anti-Malware
2010-03-08 04:49 . 2009-11-24 07:04 13104 —-a-w- c:\documents and settings\MONA\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-03 08:18 . 2009-11-24 00:25 ——– d–h–w- c:\program files\InstallShield Installation Information
2010-02-25 01:18 . 2010-02-25 01:18 2855 —-a-w- c:\windows\PIF\COMMAND.PIF
2010-02-24 17:16 . 2010-02-04 05:34 181632 ——w- c:\windows\system32\MpSigStub.exe
2010-02-15 19:00 . 2009-11-28 18:10 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdw.DAT
2010-02-15 18:59 . 2009-11-28 18:22 ——– d—–w- c:\documents and settings\MONA\Application Data\Nikon
2010-02-15 18:58 . 2009-11-28 18:07 49152 —-a-r- c:\documents and settings\MONA\Application Data\Microsoft\Installer\{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}\ARPPRODUCTICON.exe
2010-02-15 18:58 . 2009-11-28 18:07 335872 —-a-r- c:\documents and settings\MONA\Application Data\Microsoft\Installer\{237CD223-1B9D-47E8-A76C-E478B83CCEA2}\ARPPRODUCTICON.exe
2010-02-15 18:57 . 2009-11-28 18:11 57344 —-a-r- c:\documents and settings\MONA\Application Data\Microsoft\Installer\{87441A59-5E64-4096-A170-14EFE67200C3}\ARPPRODUCTICON.exe
2010-02-15 18:53 . 2009-11-28 18:05 20 —h–w- c:\documents and settings\All Users\Application Data\PKP_DLdu.DAT
2010-02-11 15:56 . 2010-01-29 08:57 ——– d—–w- c:\program files\Bodog Poker
2010-02-07 20:38 . 2010-02-07 20:38 ——– d—–w- c:\program files\LeoCAD
2010-02-07 00:36 . 2010-02-07 00:36 ——– d—–w- c:\documents and settings\MONA\Application Data\Uniblue
2010-02-06 08:01 . 2010-02-06 08:01 ——– d—–w- c:\program files\Celestia
2010-02-04 01:32 . 2009-11-24 04:21 ——– d—–w- c:\program files\PokerStars
2010-02-03 10:20 . 2010-02-03 10:19 ——– d-sh–w- c:\documents and settings\All Users\Application Data\0036091
2010-02-03 10:19 . 2010-02-03 10:19 ——– d-sh–w- c:\documents and settings\All Users\Application Data\WEKATS
2010-01-31 20:30 . 2009-12-05 11:39 ——– d—–w- c:\program files\Absolute Poker
2010-01-30 16:56 . 2009-11-24 04:22 ——– d—–w- c:\program files\Full Tilt Poker
2010-01-30 13:32 . 2010-01-19 07:08 ——– d—–w- c:\program files\DoylesRoom
2010-01-24 08:44 . 2010-01-20 18:56 ——– d—–w- c:\program files\Olympus
2010-01-24 07:18 . 2010-01-24 07:18 ——– d—–w- c:\program files\Datel2
2010-01-20 19:29 . 2010-01-20 19:29 ——– d—–w- c:\program files\Audacity
2010-01-20 19:12 . 2010-01-20 19:12 4930 —-a-w- c:\windows\system32\drivers\hwinterface32B01.sys
2010-01-20 18:55 . 2010-01-20 18:55 ——– d—–w- c:\program files\Digital Recorder
2010-01-19 05:26 . 2010-01-19 05:26 ——– d—–w- c:\program files\Datel
2010-01-16 06:31 . 2009-12-05 11:39 ——– d—–w- c:\program files\_uninstallation_info
2010-01-13 09:37 . 2009-12-12 02:39 ——– d—–w- c:\documents and settings\MONA\Application Data\Skype
2010-01-11 13:22 . 2010-01-11 13:22 ——– d—–w- c:\program files\MSBuild
2010-01-11 13:22 . 2010-01-11 13:22 ——– d—–w- c:\program files\Reference Assemblies
2010-01-11 03:54 . 2009-11-23 23:42 86327 —-a-w- c:\windows\pchealth\helpctr\OfflineCache\index.dat
2010-01-08 00:07 . 2010-01-11 01:12 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-01-08 00:07 . 2010-01-11 01:12 19160 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-01-06 05:58 . 2010-02-03 10:19 457688 —-a-w- c:\documents and settings\All Users\Application Data\0036091\sqlite3.dll
2010-01-06 05:58 . 2010-02-03 10:19 722392 —-a-w- c:\documents and settings\All Users\Application Data\0036091\mozcrt19.dll
2009-12-31 16:50 . 2006-02-28 12:00 353792 —-a-w- c:\windows\system32\drivers\srv.sys
2009-12-24 03:07 . 2009-12-26 07:22 52224 —-a-w- c:\documents and settings\MONA\Application Data\Mozilla\Firefox\Profiles\s8owchhj.default\extensions\{69d1a568-ffdf-4ef5-8919-7003582e0ee8}\components\FFExternalAlert.dll
2009-12-24 03:07 . 2009-12-26 07:22 101376 —-a-w- c:\documents and settings\MONA\Application Data\Mozilla\Firefox\Profiles\s8owchhj.default\extensions\{69d1a568-ffdf-4ef5-8919-7003582e0ee8}\components\RadioWMPCore.dll
2009-12-21 19:14 . 2006-02-28 12:00 916480 —-a-w- c:\windows\system32\wininet.dll
2009-12-19 07:46 . 2009-11-30 05:06 79488 —-a-w- c:\documents and settings\MONA\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2009-12-16 18:43 . 2009-11-23 23:38 343040 —-a-w- c:\windows\system32\mspaint.exe
2009-12-14 07:08 . 2006-02-28 12:00 33280 —-a-w- c:\windows\system32\csrsrv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"65533:TCP"= 65533:TCP:Services
"52344:TCP"= 52344:TCP:Services
"2479:TCP"= 2479:TCP:Services
"4640:TCP"= 4640:TCP:Services
"3389:TCP"= 3389:TCP:Remote Desktop
"4709:TCP"= 4709:TCP:Services

R0 sptd;sptd;c:\windows\system32\drivers\sptd.sys [2/15/2010 3:24 AM 691696]
R1 hwinterface32B01;hwinterface32B01;c:\windows\system32\drivers\hwinterface32B01.sys [1/20/2010 11:12 AM 4930]
S2 WinDefend;Windows Defender;"c:\program files\Windows Defender\MsMpEng.exe" –> c:\program files\Windows Defender\MsMpEng.exe [?]
S3 dsiarhwprog;dsiarhwprog;c:\windows\system32\drivers\dsiarhwprog.sys [1/18/2010 9:29 PM 29184]
S3 VX6000;Microsoft LifeCam VX-6000;c:\windows\system32\drivers\VX6000Xp.sys [6/26/2009 5:21 PM 2069504]
.
.
——- Supplementary Scan ——-
.
DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - hxxp://lads.myspace.com/upload/MySpaceUploader2.cab
FF - ProfilePath - c:\documents and settings\MONA\Application Data\Mozilla\Firefox\Profiles\j0anwn8z.Shawna\
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

AddRemove-CPUID CPU-Z_is1 - c:\program files\CPUID\CPU-Z\unins000.exe
AddRemove-Playsushi - c:\program files\PlaySushi\psuninst.exe
AddRemove-QuickTime 3.0 - c:\program files\QuickTime\DeIsL1.isu



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-03-11 22:40
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: MBR read successfully
called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x82B93CF0]<<
kernel: MBR read successfully
detected MBR rootkit hooks:
\Driver\Disk -> CLASSPNP.SYS @ 0xf879ff28
\Driver\ACPI -> 0x82b93cf0
\Driver\atapi -> atapi.sys @ 0xf859cb40
IoDeviceObjectType -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
\Device\Harddisk0\DR0 -> DeleteProcedure -> ntoskrnl.exe @ 0x805a0598
ParseProcedure -> ntoskrnl.exe @ 0x8056ea15
NDIS: Realtek RTL8139 Family PCI Fast Ethernet NIC -> SendCompleteHandler -> 0x828ee330
PacketIndicateHandler -> NDIS.sys @ 0xf8494a0d
SendHandler -> NDIS.sys @ 0xf84a8b40
Warning: possible MBR rootkit infection !
copy of MBR has been found in sector 0x0DF8F900
malicious code @ sector 0x0DF8F903 !
PE file found in sector at 0x0DF8F919 !
MBR rootkit infection detected ! Use: "mbr.exe -f" to fix.

**************************************************************************
.
——————— LOCKED REGISTRY KEYS ———————

[HKEY_USERS\S-1-5-21-583907252-854245398-1801674531-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-583907252-854245398-1801674531-1003\Software\Policies\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (S-1-5-21-583907252-854245398-1801674531-1003)
@Allowed: (Read) (S-1-5-21-583907252-854245398-1801674531-1003)
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
——————— DLLs Loaded Under Running Processes ———————

- - - - - - - > 'winlogon.exe'(552)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(3560)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
———————— Other Running Processes ————————
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2010-03-11 22:47:14 - machine was rebooted
ComboFix-quarantined-files.txt 2010-03-12 06:47
ComboFix2.txt 2010-01-11 02:59

Pre-Run: 94,707,646,464 bytes free
Post-Run: 94,766,587,904 bytes free

- - End Of File - - B587E3D9ADF0F7E2CDEAA76801B0C521
and also a new hijackthis log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:53:13 AM, on 3/12/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?p…amp;ar=iesearch
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {9C23D886-43CB-43DE-B2DB-112A68D7E10A} - http://lads.myspace.com/upload/MySpaceUploader2.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Windows Defender (WinDefend) - Unknown owner - C:\Program Files\Windows Defender\MsMpEng.exe (file missing)

–
End of file - 2398 bytes
thanks again for your help and my apologies for the delay

Hi,

As far as your replies, this forum gets real busy and threads with no replies in about 4 or 5 days are closed. You still have problems going on.

c:\program files\Defender Pro <–Not the best program out there, its been know to cause problems, your call to keep it or not


c:\windows\iun6002.exe <–This was put there by desktop surveillance software, can steal data and send it back to the author

• Please download OTM by OldTimer and save it to your desktop.
• Double click the [external image: Posted Image] icon on your desktop.
• Paste the following code under the [external image: Posted Image] area.
  Do not include the word "Code".
  
  

  :Processes
  explorer.exe
  
  :Files
  c:\windows\iun6002.exe
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [reboot]

• Push the large [external image: Posted Image] button.
• OTM may ask to reboot the machine. Please do so if asked.
• Copy/Paste the contents under the [external image: Posted Image] line here in your next reply.
• If you are unable to copy/paste from this window (as will be the case if the machine was rebooted), open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTM\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.

Download TDSSKiller and save it to your Desktop.
http://support.kaspersky.com/downloads/utils/tdsskiller.zip

Extract the file and run it.
Once completed it will create a log in your C:\ drive
Please post the contents of that log