Getting married soon and have been hijacked!

I'm desperate. I took last Friday off so that I could finish up some last minute wedding woes and first thing that happens is my PC gets infected…no not infected, INFESTED with PC critters. I've run every scan that's recommended, spent countless days cross eyed and stupified and I've come to this conclusion…I absolutely cannot handle this alone. Time to call in the big guns. It looks like everyone is posting hijackthis logs, so I'll do the same.
Here goes…


Logfile of HijackThis v1.99.1
Scan saved at 11:38:33 PM, on 10/17/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Camera\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Filseclab\xfilter\xfilter.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\ProgramFiles\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\Program Files\Camera\Digital Imaging\bin\hpqtra08.exe
C:\ProgramFiles\SanDisk\SanDisk TransferMate\SD Monitor.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\ProgramFiles\Camera\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Camera\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = 4O_MMSBSoftware\Microsoft\Internet Explorer\MainSearch Bar
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\System32\pavdr.exe,C:\WINDOWS\System32\userinit.exe,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Camera\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [hcuvnhb.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\hcuvnhb.dll,bjxymoe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [XFILTER] "C:\Program Files\Filseclab\xfilter\xfilter.exe" -a
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\ProgramFiles\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\ProgramFiles\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Filseclab Messenger.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Camera\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\ProgramFiles\Camera\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Monitor.lnk = C:\ProgramFiles\SanDisk\SanDisk TransferMate\SD Monitor.exe
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebuzz.com/common/programs/swicdad.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://69.43.133.72/plugin/axversion/1400/printquick1400.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098648900717
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers…ll/pinstall.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} - http://h30155.www3.hp.com/ediags/gs/instal…edsolutions.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_…inematycoon.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O20 - Winlogon Notify: winiro32 - winiro32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing)
O23 - Service: Pantech&Curitel Utility Service - Unknown owner - C:\Program Files\UTStarcom\Sprint\Sprint PCS Connection Manager\PnCUtilityService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: ZBQKOCJ - Sysinternals - www.sysinternals.com - C:\DOCUME~1\KELSEY~1.HOT\LOCALS~1\Temp\ZBQKOCJ.exe


Please help…pulling clumps of hair out 24 days before my wedding is bound to do some damage…
Thanks-
Kelsey

Ok. I ran combofix and a new HJT log. Thanks for any additional help waterfalls.
-Kelsey

ComboFix 06.10.16 - Running from: "C:\Documents and Settings\Kelsey Lane.HOTBOX\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\components


((((((((((((((((((((((((((((((( Files Created from 2006-09-18 to 2006-10-18 ))))))))))))))))))))))))))))))))))


2006-10-17 03:38 9,728 –a—— C:\WINDOWS\system32\drivers\pxscinst.dll
2006-10-17 03:38 7,680 –a—— C:\WINDOWS\system32\drivers\pxinst.dll
2006-10-17 03:38 7,552 –a—— C:\WINDOWS\system32\drivers\pxcom.sys
2006-10-17 03:38 266,112 –a—— C:\WINDOWS\system32\drivers\pxfsf.sys
2006-10-17 03:38 18,432 –a—— C:\WINDOWS\system32\drivers\pxtdi.sys
2006-10-17 03:38 13,568 –a—— C:\WINDOWS\system32\drivers\pxrd.sys
2006-10-17 03:38 11,648 –a—— C:\WINDOWS\system32\drivers\pxscrmbl.sys
2006-10-17 03:38 100,864 –a—— C:\WINDOWS\system32\drivers\PxEmu.sys
2006-10-17 02:29 53,248 –a—— C:\WINDOWS\system32\Process.exe
2006-10-17 02:29 40,960 –a—— C:\WINDOWS\system32\swsc.exe
2006-10-17 02:29 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2006-10-17 02:29 135,168 –a—— C:\WINDOWS\system32\swreg.exe
2006-10-16 19:13 143,380 –a—— C:\WINDOWS\system32\cukqsssy.exe
2006-10-16 00:26 124,752 –a—— C:\WINDOWS\system32\xpacket.sys
2006-10-16 00:03 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-15 21:35 36,176 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2006-10-15 21:35 16,352 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2006-10-15 21:34 24,560 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2006-10-15 21:33 87,424 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2006-10-15 21:33 85,952 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2006-10-15 21:32 90,112 –a—— C:\WINDOWS\system32\AVASTSS.scr
2006-10-15 21:32 666,240 –a—— C:\WINDOWS\system32\aswBoot.exe
2006-10-15 21:13 23,104 –a—— C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-10-15 19:13 143,380 –a—— C:\WINDOWS\system32\amfebalq.exe
2006-10-15 19:00 0 –a—— C:\AUTOEXEC.BAT
2006-10-15 18:56 95,744 –a—— C:\WINDOWS\system32\wuaueng.dll
2006-10-15 18:56 112,128 –a—— C:\WINDOWS\system32\wuauclt.exe
2006-10-15 18:48 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2006-10-15 18:48 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2006-10-13 09:32 28,672 –a—— C:\WINDOWS\system32\drivers\CO_Mon.sys
2006-10-13 08:49 143,380 –a—— C:\WINDOWS\system32\beqiptdx.exe
2006-10-13 08:37 93,696 –a—— C:\WINDOWS\system32\hcuvnhb.dll
2006-10-11 01:51 163,840 C:\WINDOWS\system32PhotoImpression Screen Saver.scr
2006-10-11 01:45 11,776 –a—— C:\WINDOWS\system32\drivers\afc.sys


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-10-18 07:25 ——– d——– C:\Program Files\Prevx1
2006-10-17 23:38 ——– d——– C:\Program Files\Hijackthis
2006-10-17 12:45 ——– d——– C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\Prevx
2006-10-17 12:39 ——– d——– C:\Program Files\BHODemon 2
2006-10-17 03:25 ——– d——– C:\Program Files\Internet Explorer
2006-10-17 03:25 ——– d——– C:\Program Files\Common Files\Filseclab
2006-10-17 01:55 ——– d——– C:\Program Files\Java
2006-10-17 01:55 ——– d——– C:\Program Files\Common Files\Java
2006-10-17 01:55 ——– d——– C:\Program Files\Common Files
2006-10-17 00:43 ——– d——– C:\Program Files\Avira
2006-10-17 00:41 ——– d——– C:\Program Files\Yahoo!
2006-10-17 00:37 ——– d——– C:\Program Files\CCleaner
2006-10-16 23:39 ——– d——– C:\Program Files\WT RegCleaner XP
2006-10-16 23:25 ——– d——– C:\Program Files\InCode Solutions
2006-10-16 23:07 ——– d——– C:\Program Files\IObit
2006-10-16 12:22 ——– d——– C:\Program Files\RegScrubXP
2006-10-16 00:55 ——– d——– C:\Program Files\Common Files\InstallShield
2006-10-16 00:26 ——– d–h—– C:\Program Files\InstallShield Installation Information
2006-10-16 00:26 ——– d——– C:\Program Files\Filseclab
2006-10-16 00:02 ——– d——– C:\Program Files\Grisoft
2006-10-15 23:55 ——– d—s—- C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\Microsoft
2006-10-15 23:48 ——– d——– C:\Program Files\Common Files\Microsoft Shared
2006-10-15 21:32 ——– d——– C:\Program Files\Alwil Software
2006-10-15 20:48 ——– d——– C:\Program Files\Lavasoft
2006-10-15 20:48 ——– d——– C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\Lavasoft
2006-10-15 20:39 ——– d——– C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\ArcSoft
2006-10-15 20:36 ——– d——– C:\Program Files\Common Files\HP
2006-10-15 19:13 ——– d——– C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\SearchToolbarCorp
2006-10-15 19:11 ——– d——– C:\Program Files\Camera
2006-10-15 19:10 ——– d——– C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\Identities
2006-10-15 19:10 ——– d——– C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\AVG7
2006-10-15 19:07 ——– d–h—– C:\Program Files\WindowsUpdate
2006-10-15 19:00 ——– d——– C:\Program Files\xerox
2006-10-15 19:00 ——– d——– C:\Program Files\Windows Media Player
2006-10-15 19:00 ——– d——– C:\Program Files\microsoft frontpage
2006-10-15 18:58 ——– d——– C:\Program Files\Online Services
2006-10-15 18:57 ——– d——– C:\Program Files\Outlook Express
2006-10-15 18:57 ——– d——– C:\Program Files\NetMeeting
2006-10-15 18:57 ——– d——– C:\Program Files\Movie Maker
2006-10-15 18:57 ——– d——– C:\Program Files\Common Files\System
2006-10-15 18:57 ——– d——– C:\Program Files\Common Files\Services
2006-10-15 18:57 ——– d——– C:\Program Files\Common Files\MSSoap
2006-10-15 18:56 ——– d——– C:\Program Files\Windows NT
2006-10-15 18:56 ——– d——– C:\Program Files\MSN Gaming Zone
2006-10-15 18:56 ——– d——– C:\Program Files\MSN
2006-10-15 18:56 ——– d——– C:\Program Files\ComPlus Applications
2006-10-15 18:48 62 –ahs—- C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\desktop.ini
2006-10-15 18:48 ——– d——– C:\Program Files\Common Files\SpeechEngines
2006-09-27 09:02 778656 –a—— C:\WINDOWS\system32\drivers\avg7core.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\System32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"AVG7_CC"="C:\\PROGRA~2\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"HP Software Update"="C:\\Program Files\\Camera\\HP Software Update\\HPWuSchd2.exe"
"Cmaudio"="RunDll32 cmicnfg.cpl,CMICtrlWnd"
"hcuvnhb.dll"="C:\\WINDOWS\\System32\\rundll32.exe C:\\WINDOWS\\System32\\hcuvnhb.dll,bjxymoe"
"avast!"="C:\\PROGRA~2\\ALWILS~1\\Avast4\\ashDisp.exe"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"
"XFILTER"="\"C:\\Program Files\\Filseclab\\xfilter\\xfilter.exe\" -a"
"SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe"
"PrevxOne"="\"C:\\Program Files\\Prevx1\\PXConsole.exe\""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,12,03,00,00,23,00,00,00,dc,00,00,00,d2,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~2\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~2\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system\Shell]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"LinkResolveIgnoreLinkInfo"=dword:00000000
"NoActiveDesktop"=dword:00000000
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000
"NoActiveDesktopChanges"=dword:00000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"NoDispAppearancePage"=dword:00000000
"NoColorChoice"=dword:00000000
"NoSizeChoice"=dword:00000000
"NoDispBackgroundPage"=dword:00000000
"NoDispScrSavPage"=dword:00000000
"NoDispCPL"=dword:00000000
"NoVisualStyleChoice"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"LinkResolveIgnoreLinkInfo"=dword:00000000
"NoResolveSearch"=dword:00000001
"NoActiveDesktop"=dword:00000000
"NoSaveSettings"=dword:00000000
"ClassicShell"=dword:00000000
"NoThemesTab"=dword:00000000
"NoActiveDesktopChanges"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"ffis"="C:\\WINDOWS\\isrvs\\ffisearch.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"BITS"=dword:00000003

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winiro32

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-10-18 7:29:09.50
C:\ComboFix.txt … 06-10-18 07:29




Logfile of HijackThis v1.99.1
Scan saved at 7:30:54 AM, on 10/18/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Camera\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\System32\rundll32.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Filseclab\xfilter\xfilter.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINDOWS\System32\ctfmon.exe
C:\ProgramFiles\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\Program Files\Camera\Digital Imaging\bin\hpqtra08.exe
C:\ProgramFiles\SanDisk\SanDisk TransferMate\SD Monitor.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\ProgramFiles\Camera\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Camera\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = 4O_MMSBSoftware\Microsoft\Internet Explorer\MainSearch Bar
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\System32\pavdr.exe,C:\WINDOWS\System32\userinit.exe,
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Camera\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [hcuvnhb.dll] C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\hcuvnhb.dll,bjxymoe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [XFILTER] "C:\Program Files\Filseclab\xfilter\xfilter.exe" -a
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\ProgramFiles\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\ProgramFiles\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Filseclab Messenger.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Camera\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\ProgramFiles\Camera\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Monitor.lnk = C:\ProgramFiles\SanDisk\SanDisk TransferMate\SD Monitor.exe
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebuzz.com/common/programs/swicdad.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://69.43.133.72/plugin/axversion/1400/printquick1400.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098648900717
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers…ll/pinstall.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} - http://h30155.www3.hp.com/ediags/gs/instal…edsolutions.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_…inematycoon.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O20 - Winlogon Notify: winiro32 - winiro32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing)
O23 - Service: Pantech&Curitel Utility Service - Unknown owner - C:\Program Files\UTStarcom\Sprint\Sprint PCS Connection Manager\PnCUtilityService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)
O23 - Service: ZBQKOCJ - Unknown owner - C:\DOCUME~1\KELSEY~1.HOT\LOCALS~1\Temp\ZBQKOCJ.exe (file missing)

Logfile of HijackThis v1.99.1
Scan saved at 11:05:32 PM, on 10/22/2006
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Camera\HP Software Update\HPWuSchd2.exe
C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Filseclab\xfilter\xfilter.exe
C:\Program Files\Prevx1\PXConsole.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~2\AWS\WEATHE~1\Weather.exe
C:\ProgramFiles\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\ProgramFiles\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Common Files\Filseclab\FilMsg.exe
C:\Program Files\Camera\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
C:\ProgramFiles\SanDisk\SanDisk TransferMate\SD Monitor.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Prevx1\PXAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Camera\Digital Imaging\Product Assistant\bin\hprblog.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\BHODemon 2\BHODemon.exe
C:\ProgramFiles\Camera\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\regedit /s C:\pav.reg,C:\WINDOWS\System32\pavdr.exe,C:\WINDOWS\System32\userinit.exe,
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users.WINDOWS\Application Data\Prevx\pxbho.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Camera\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~2\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [XFILTER] "C:\Program Files\Filseclab\xfilter\xfilter.exe" -a
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [Weather] C:\PROGRA~2\AWS\WEATHE~1\Weather.exe 1
O4 - Startup: BHODemon 2.0.lnk = C:\Program Files\BHODemon 2\BHODemon.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\ProgramFiles\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\ProgramFiles\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Filseclab Messenger.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Camera\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\ProgramFiles\Camera\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Monitor.lnk = C:\ProgramFiles\SanDisk\SanDisk TransferMate\SD Monitor.exe
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O10 - Unknown file in Winsock LSP: c:\program files\filseclab\xfilter\xfilter.dll
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups.yahoo.com/ocx/us/yexplorer1_8us.cab
O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall-beta.trendmicro.com/housecall/xscan60.cab
O16 - DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} (iCC Class) - http://www.pcpitstop.com/internet/pcpConnCheck.cab
O16 - DPF: {20AD521D-3A3E-11D4-BC32-0050040D952B} (SwIcdInstall Class) - http://www.picturebuzz.com/common/programs/swicdad.cab
O16 - DPF: {2B96D5CC-C5B5-49A5-A69D-CC0A30F9028C} (MiniBugTransporterX Class) - http://wdownload.weatherbug.com/minibug/tr…Transporter.cab?
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {5242A5A1-EF1E-11D5-B3EE-0050DAC5EBD0} (printQuick Browser Add In (Ver4)) - http://69.43.133.72/plugin/axversion/1400/printquick1400.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co…b?1098648900717
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {6BEA1C48-1850-486C-8F58-C7354BA3165E} (Install Class) - http://updates.lifescapeinc.com/installers…ll/pinstall.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline Control) - http://www.bitdefender.com/scan/Msie/bitdefender.cab
O16 - DPF: {88D969C0-F192-11D4-A65F-0040963251E5} (XML DOM Document 4.0) - http://ipgweb.cce.hp.com/rdqna/downloads/msxml4.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {9B17FE0E-51F2-4692-8B32-8EFB805FC0E7} - http://h30155.www3.hp.com/ediags/gs/instal…edsolutions.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secur…loadManager.ocx
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://download.games.yahoo.com/games/web_…outLauncher.cab
O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_…inematycoon.cab
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} - http://download.games.yahoo.com/games/web_…aploader_v6.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/en/check/qdiagh.cab?325
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: winiro32 - winiro32.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
O23 - Service: iPodService - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Machine Debug Manager (MDM) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing)
O23 - Service: Pantech&Curitel Utility Service - Unknown owner - C:\Program Files\UTStarcom\Sprint\Sprint PCS Connection Manager\PnCUtilityService.exe (file missing)
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)




SUPERAntiSpyware Scan Log
Generated 10/22/2006 at 10:47 PM

Application Version : 3.3.1020

Core Rules Database Version : 3110
Trace Rules Database Version: 1136

Scan type : Complete Scan
Total Scan Time : 00:44:24

Memory items scanned : 505
Memory threats detected : 1
Registry items scanned : 4360
Registry threats detected : 9
File items scanned : 31640
File threats detected : 59

Trojan.Downloader-DoneDU
C:\WINDOWS\SYSTEM32\HCUVNHB.DLL
C:\WINDOWS\SYSTEM32\HCUVNHB.DLL

Adware.Tracking Cookie
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@cpvfeed[2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@overture[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@tacoda[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@indexstats[2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@directtrack[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@winantivirus[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@1069839660[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@franceguide[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@trafficmp[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@qksrv[2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey [removed][2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@ad[2].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@mdlfr[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@apmebf[2].txt
C:\Documents and Settings\Docs to keep\Cookies\kelsey lane@indexstats[2].txt
C:\Documents and Settings\Docs to keep\Local Settings\Temp\Cookies\kelsey lane@revsci[2].txt
C:\Documents and Settings\Docs to keep\Local Settings\Temp\Cookies\kelsey [removed][1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@doubleclick[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@tribalfusion[1].txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Cookies\kelsey lane@tribalfusion[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey [removed][1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey [removed][1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey [removed][1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey lane@directtrack[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey lane@exitexchange[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey lane@keywordmax[1].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey [removed][2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey lane@winantivirus[2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey [removed][2].txt
C:\WINDOWS\system32\config\systemprofile\Cookies\kelsey [removed][1].txt

Trojan.Unknown Origin
HKLM\SOFTWARE\Microsoft\MSSMGR
HKLM\SOFTWARE\Microsoft\MSSMGR#Data
HKLM\SOFTWARE\Microsoft\MSSMGR#LSTV
HKLM\SOFTWARE\Microsoft\MSSMGR#Brnd
HKLM\SOFTWARE\Microsoft\MSSMGR#MSLIST
HKLM\SOFTWARE\Microsoft\MSSMGR#PID
HKLM\SOFTWARE\Microsoft\MSSMGR#Rid
HKLM\SOFTWARE\Microsoft\MSSMGR#LID
C:\DOCUMENTS AND SETTINGS\DOCS TO KEEP\LOCAL SETTINGS\TEMP\B104.EXE
C:\WINDOWS\SYSTEM32\OT.ICO
C:\WINDOWS\SYSTEM32\TS.ICO

Trojan.Security Toolbar
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Online Security Guide.url
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Security Troubleshooting.url

Adware.VSToolbar
HKU\S-1-5-21-57989841-436374069-839522115-1003\Software\Search Toolbar Corp
C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\SearchToolbarCorp\Toolbar Vision\PageHistory.txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\SearchToolbarCorp\Toolbar Vision\WebHistory.txt
C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\SearchToolbarCorp\Toolbar Vision
C:\Documents and Settings\Kelsey Lane.HOTBOX\Application Data\SearchToolbarCorp
C:\SYSTEM VOLUME INFORMATION\_RESTORE{93310670-1B86-4ACF-90FF-7A29A4BD80B4}\RP2\A0000246.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{93310670-1B86-4ACF-90FF-7A29A4BD80B4}\RP6\A0000514.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{93310670-1B86-4ACF-90FF-7A29A4BD80B4}\RP9\A0003581.DLL

Trojan.Freeprod
C:\DOCUMENTS AND SETTINGS\DOCS TO KEEP\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\2PE7ATOB\WLZIP32[1].EXE
C:\DOCUMENTS AND SETTINGS\DOCS TO KEEP\LOCAL SETTINGS\TEMP\WIN83.TMP.EXE

Trojan.Downloader-LargeInterest
C:\DOCUMENTS AND SETTINGS\DOCS TO KEEP\LOCAL SETTINGS\TEMP\TEMPORARY INTERNET FILES\CONTENT.IE5\CDM3WH2B\ANTI4[1].EXE

Trojan.Downloader-Gen/BHO
C:\SYSTEM VOLUME INFORMATION\_RESTORE{93310670-1B86-4ACF-90FF-7A29A4BD80B4}\RP8\A0002540.DLL

Adware.ClickSpring/Yazzle
C:\SYSTEM VOLUME INFORMATION\_RESTORE{93310670-1B86-4ACF-90FF-7A29A4BD80B4}\RP8\A0002579.EXE

Trojan.Downloader-VSToolbar
C:\WINDOWS\SYSTEM32\AMFEBALQ.EXE
C:\WINDOWS\SYSTEM32\BEQIPTDX.EXE
C:\WINDOWS\SYSTEM32\CUKQSSSY.EXE


Waterfalls, thanks for the assist thus far. My PC is running much better. So what do the new logs tell you?