Oh yeah, one more thing, during a couple of the ad-aware memory scans avast reported a trojan in a winlogon.exe.mdmp file which I put in the "chest" It also reported another trojan thing but I didn't have enough time to pin point it before the blue screen hit
Hope this isn't too much info, I included both the avast log and the hijackthis log below. Look forward to any advice.
Dave
Avast Log (the files with * are in the "chest")
*11/04/2006 1:48:48 PM admin 3204 Sign of "JS:Exploit-Bytverify-2" has been found in "C:\Documents and Settings\admin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\archive.jar-3e7298f0-10018892.zip\A.class" file.
*11/04/2006 2:04:30 PM admin 3204 Sign of "Uruguay 6/7/8" has been found in "C:\Documents and Settings\admin\Local Settings\Temporary Internet Files\Content.IE5\FI4JVTCD\i46668382_13341_4[1].gif" file.
*11/04/2006 2:14:56 PM admin 3204 Sign of "Win32:Adware-gen. [Adw]" has been found in "C:\Documents and Settings\admin\My Documents\My Applications\setup.exe" file.
*11/04/2006 3:17:25 PM admin 3204 Sign of "Win32:Trojan-gen. {Other}" has been found in "C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP568\A0067054.dll" file.
11/04/2006 8:26:37 PM SYSTEM 1400 Sign of "Win32:Trojano-1165 [Trj]" has been found in "C:\WINDOWS\PCHealth\ErrorRep\UserDumps\winlogon.exe.20060412-022627-00.mdmp" file.
*11/04/2006 8:28:49 PM admin 1404 Sign of "Win32:Trojano-1165 [Trj]" has been found in "C:\DOCUME~1\admin\LOCALS~1\Temp\WER7da3.dir00\winlogon.exe.mdmp" file.
11/04/2006 10:57:50 PM SYSTEM 1392 Sign of "Win32:Trojano-1165 [Trj]" has been found in "C:\WINDOWS\PCHealth\ErrorRep\UserDumps\winlogon.exe.20060412-045744-00.mdmp" file.
Logfile of HijackThis v1.99.1
Scan saved at 11:33:43 PM, on 11/04/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Microsoft SQL Server\MSSQL$ASIFD\Binn\sqlservr.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Rendezvous\bin\mDNSResponder.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Primus High Speed Dial Up\primusdialaccel.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Alwil Software\Avast4\ashSimpl.exe
C:\Program Files\Alwil Software\Avast4\ashChest.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\admin\Desktop\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://sympatico.msn.ca/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5401
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_18_0.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: PBlockHelper Class - {4115122B-85FF-4DD3-9515-F075BEDE5EB5} - C:\Program Files\Primus High Speed Dial Up\PBHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\System32\mllml.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\ycomp5_3_18_0.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\ypager.exe" -quiet
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O4 - Global Startup: Primus High Speed Dial Up Accelerator.lnk = C:\Program Files\Primus High Speed Dial Up\primusdialaccel.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Show All Original Images - res://C:\Program Files\Primus High Speed Dial Up\primusdialaccel.exe/250
O8 - Extra context menu item: Show Original Image - res://C:\Program Files\Primus High Speed Dial Up\primusdialaccel.exe/227
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesca.dll
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesca.dll
O9 - Extra button: Rendezvous - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Rendezvous\bin\ExplorerPlugin.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmat...enWebRadio.html (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\rendezvous\bin\mdnsnsp.dll
O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.web...otoUploader.CAB
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn...pDownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{980CEA95-102F-45F1-98F8-FA48835B5D81}: NameServer = 216.254.141.3 209.90.160.221
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: mllml - C:\WINDOWS\System32\mllml.dll
O23 - Service: Apple mDNSResponder - Apple Computer, Inc. - C:\Program Files\Rendezvous\bin\mDNSResponder.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)