Can't Get Rid Of Ie Popups

Hi - Looking for help here - a few days ago I started seeing a lot of IE popups that came up for no reason (I believe I got infected with something while playing yahoo chess - it uses Java, and had an old version of Java installed. Started seeing the popups right after that, and it was the first time I used yahoo games).

Popups are triggered by launching IE. Initially they also came up randomly, but I think I stopped that.

I've updated Java and installed the critical windows updates, and scanned with counterspy, vundofix, trend micro online virus scan, McAfee online scan, and the Symantec Beagle removing program - still getting popups. Counterspy, vundofix, trend micro, and mcafee found stuff which I removed. Beagle found nothing (mcafee found Beagle trojan files - I deleted them manually since McAfee online scan has no option to remove).

Still getting popups, triggered by opening IE. Last time it kept opening new instances of IE until I had to reboot (website was http://www.treekindsearch.com/rdr2.php but it came up with a 404 error). Computer slow when booting into Windows.
Any help very appreciated.

Here is my hijackthis file (BTW, point-n-click is not a virus):

Logfile of HijackThis v1.99.1
Scan saved at 3:44:45 PM, on 5/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CounterSpy\SBCSSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\CounterSpy\SBCSTray.exe
C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com/?ei=UTF-8&save=0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8118
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *se1.attbb.net
O1 - Hosts: 87.118.98.131 www.winmx.com
O2 - BHO: Tensons.Application.DownloadAcceleratorManager.BHO - {00000003-1118-11da-8cd6-0800200c9888} - mscoree.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {2432F099-F8E2-43C9-B765-3AF002FFC6A7} - C:\WINDOWS\system32\byxyxvu.dll (file missing)
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: (no name) - {4B646AFB-9341-4330-8FD1-C32485AEE619} - C:\WINDOWS\system32\wwvidfpg.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E010374F-0D30-4B5B-8E50-7E329C69FCAB} - C:\WINDOWS\system32\mljji.dll (file missing)
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\System32\NeroCheck.exe
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Startup: Point-N-Click.LNK = C:\Program Files\Point-N-Click\Point-N-Click.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: HushEncryptionEngine - https://mailserver2.hushmail.com/shared/Hus…ptionEngine.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {43F25BA2-C4AB-4327-924C-1ED6AF4A6BA1} (activePhone Control) - http://www.webacall.com/activePhone.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180433360406
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://vpn.uconn.edu/dana-cached/setup/JuniperSetup.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…041/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0C6BE20-18D7-478A-9511-C39B3667E25B}: NameServer = 205.152.144.23,205.152.132.23
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: hplun.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Tracks Eraser Pro\delautocomp.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Freenet 0.7 darknet-8888 (freenet-darknet-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: Freenet 0.7 darknet-8888-8888 (freenet-darknet-8888-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: Freenet 0.7 darknet-8888-8888-8888 (freenet-darknet-8888-8888-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: Freenet 0.7 darknet-8888-8888-8888-8888 (freenet-darknet-8888-8888-8888-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\CounterSpy\SBCSSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Hi - Thank you!!

3 of the 4 freenet files are still in as services in the hijackthis log file though I selected them to be removed.

Here's the log files:

Combofix:

"DK" - 2007-05-30 22:54:51 Service Pack 2
ComboFix 07-05.27.BV - Running from: "C:\#new\"


(((((((((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\wwvidfpg.dll


* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


"C:\WINDOWS\hosts"


((((((((((((((((((((((((((((((( Files Created from 2007-04-28 to 2007-05-31 ))))))))))))))))))))))))))))))))))


2007-05-29 22:26 d——– C:\WINDOWS\McAfee.com
2007-05-29 20:06 d——– C:\Documents and Settings\DK\.housecall6.6
2007-05-29 20:06 d——– C:\DOCUME~1\DK\.housecall6.6
2007-05-29 18:27 3,968 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-05-29 18:26 d——– C:\Program Files\AVG Anti-Spyware 7.5
2007-05-29 12:09 d——– C:\Program Files\MSXML 4.0
2007-05-29 11:59 80,699,258 –a—— C:\May292007.reg
2007-05-29 05:28 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Windows Genuine Advantage
2007-05-29 05:20 d——– C:\WINDOWS\system32\PreInstall
2007-05-29 05:10 18,200 –a—— C:\WINDOWS\system32\wups2.dll
2007-05-29 05:10 d——– C:\WINDOWS\system32\SoftwareDistribution
2007-05-29 02:45 d——– C:\Program Files\Enigma Software Group
2007-05-29 00:16 0 –a—— C:\WINDOWS\system32\SBRC.dat
2007-05-29 00:16 0 –a—— C:\WINDOWS\system32\SBFC.dat
2007-05-29 00:13 15,544 –a—— C:\WINDOWS\system32\drivers\sbhr.sys
2007-05-29 00:12 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sunbelt Software
2007-05-29 00:08 d——– C:\Program Files\CounterSpy
2007-05-28 21:34 0 –a—— C:\WINDOWS\PowerReg.dat
2007-05-26 18:16 d——– C:\WINDOWS\FLV Player
2007-05-26 18:16 d——– C:\Program Files\FLV Player
2007-05-26 14:26 d——– C:\#youtube
2007-05-16 00:21 d——– C:\civ3
2007-05-15 11:49 3,972 ——— C:\WINDOWS\system32\drivers\PciBus.sys
2007-05-15 11:49 21,664 –a—— C:\WINDOWS\system32\drivers\Entech.sys
2007-05-15 11:49 d——– C:\WINDOWS\system32\Futuremark
2007-05-15 11:48 d——– C:\Program Files\3DMark03
2007-05-13 21:13 d——– C:\#new
2007-05-11 15:57 1,744 –a—— C:\WINDOWS\system32\d3d9caps.dat
2007-05-11 15:56 d——– C:\DOCUME~1\DK\APPLIC~1\Joost
2007-05-11 15:55 d——– C:\Program Files\Joost
2007-05-11 15:45 10,167,086 –a—— C:\JoostSetup-FriendsEdition-0.10.2.exe
2007-05-11 09:57 d——– C:\Program Files\AVI MPEG RM WMV Splitter
2007-05-11 09:55 3,927,196 –a—— C:\avi_mpg_splitter.exe
2007-05-11 09:12 d——– C:\Levy Is Internet TV Finally Here - Newsweek Steven Levy - MSNBC.com_files
2007-05-10 12:55 d——– C:\MST3K - 1003 - Merlin's Shop of Mystical Wonders
2007-05-08 20:00 d——– C:\FAFSA done_files
2007-05-06 20:25 842,950 –a—— C:\jgc_viper210_xp.exe
2007-05-05 18:35 d——– C:\Trailer Park Boys
2007-05-03 16:55 d——– C:\HLM final
2007-04-30 01:28 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2007-04-30 01:11 d——– C:\WINDOWS\Prefetch
2007-04-30 01:00 22,528 –a—— C:\WINDOWS\system32\fltMc.exe
2007-04-30 01:00 16,896 –a—— C:\WINDOWS\system32\fltlib.dll
2007-04-30 01:00 124,800 –a—— C:\WINDOWS\system32\drivers\fltMgr.sys
2007-04-30 00:54 4,274,816 –a—— C:\WINDOWS\system32\nv4_disp.dll
2007-04-30 00:54 1,897,408 –a—— C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-30 00:48 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2007-04-30 00:48 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2007-04-29 17:27 d——– C:\##### to backup
2007-04-28 17:32 d——– C:\#from G
2007-04-27 20:56 d——– C:\ebay
2007-04-01 23:35 d——– C:\temp-frost-07-Jan-2007


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-30 03:23:25 ——– d—–w C:\Program Files\Filetopia3
2007-05-29 17:16:35 ——– d—–w C:\Program Files\Messenger
2007-05-29 10:37:28 ——– d—–w C:\Program Files\CyberLink
2007-05-29 10:37:25 ——– d–h–w C:\Program Files\InstallShield Installation Information
2007-05-29 10:03:02 9,208 —-a-w C:\WINDOWS\mozver.dat
2007-05-29 07:34:15 ——– d—–w C:\Program Files\mIRC
2007-05-29 06:44:49 ——– d—–w C:\Program Files\BSPlayer
2007-05-29 04:57:38 ——– d—–w C:\DOCUME~1\DK\APPLIC~1\Tor
2007-05-29 03:24:23 ——– d—–w C:\Program Files\eMule
2007-05-29 02:36:45 12,464 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-05-15 23:27:18 ——– d—–w C:\DOCUME~1\DK\APPLIC~1\Azureus
2007-05-14 15:18:02 ——– d—–w C:\Program Files\BOINC
2007-05-05 23:37:30 ——– d—–w C:\Program Files\Azureus
2007-05-04 00:27:40 ——– d—–w C:\Program Files\SPSS2
2007-05-04 00:02:45 27,376 —-a-w C:\DOCUME~1\DK\APPLIC~1\GDIPFONTCACHEV1.DAT
2007-04-30 06:00:52 ——– d—–w C:\Program Files\Movie Maker
2007-04-30 05:59:11 23,372 —-a-w C:\WINDOWS\system32\emptyregdb.dat
2007-04-30 05:58:33 ——– d—–w C:\Program Files\Windows NT
2007-04-29 23:00:14 ——– d—–w C:\Program Files\download
2007-04-29 22:22:47 ——– d—–w C:\Program Files\newpgen
2007-03-17 13:43:01 292,864 —-a-w C:\WINDOWS\system32\winsrv.dll
2007-03-15 17:23:16 497,496 —-a-w C:\WINDOWS\system32\XceedZip.dll
2007-03-15 17:19:58 526,184 —-a-w C:\WINDOWS\system32\XceedCry.dll
2007-03-15 09:36:49 9,612 —-a-w C:\BLA2.DAT
2007-03-15 09:36:18 8,870 —-a-w C:\BLA.DAT
2007-03-15 09:32:56 8,767 —-a-w C:\RIND.DAT
2007-03-15 08:48:39 895 —-a-w C:\NUMM2A.DAT
2007-03-15 08:39:58 816 —-a-w C:\NUMM2.DAT
2007-03-15 07:17:34 0 —-a-w C:\DDFSF.DAT
2007-03-15 07:15:18 1,625 —-a-w C:\NUM2.DAT
2007-03-15 07:10:26 0 —-a-w C:\FRM_HW.DAT
2007-03-15 06:28:40 92,700 —-a-w C:\meta.exe
2007-03-09 14:57:40 27,376 —-a-w C:\WINDOWS\system32\SBBD.exe
2007-03-08 15:36:28 577,536 —-a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 —-a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 —-a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 —-a-w C:\WINDOWS\system32\win32k.sys
2003-12-02 21:28:56 56 –sha-r C:\WINDOWS\system32\1ADD368A6C.sys


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{00000003-1118-11da-8cd6-0800200c9888}=mscoree.dll []
{39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}=C:\Program Files\BitComet\tools\BitCometBHO.dll [2006-11-29 08:52]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"SSBkgdUpdate"="C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2003-09-29 15:00]
"Zone Labs Client"="C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-23 22:38]
"avast!"="C:\PROGRA~1\Avast4\ashDisp.exe" [2007-01-15 12:28]
"@"="" []
"SBCSTray"="C:\Program Files\CounterSpy\SBCSTray.exe" [2007-03-09 10:31]
"!AVG Anti-Spyware"="C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" [2006-10-07 07:20]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoLowDiskSpaceChecks"=1 (0x1)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2006-09-28 09:13]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=hplun.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages scecli scecli

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\SBCSSvc]

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*

*Newly Created Service* - SBAPIFS

Contents of the 'Scheduled Tasks' folder
2007-04-16 13:08:36 C:\WINDOWS\tasks\alarm.job
2007-05-30 05:00:00 C:\WINDOWS\tasks\At1.job
2007-05-30 14:00:00 C:\WINDOWS\tasks\At10.job
2007-05-30 15:00:00 C:\WINDOWS\tasks\At11.job
2007-05-30 16:00:00 C:\WINDOWS\tasks\At12.job
2007-05-30 17:00:00 C:\WINDOWS\tasks\At13.job
2007-05-30 18:00:00 C:\WINDOWS\tasks\At14.job
2007-05-30 19:00:01 C:\WINDOWS\tasks\At15.job
2007-05-30 20:00:00 C:\WINDOWS\tasks\At16.job
2007-05-30 21:00:00 C:\WINDOWS\tasks\At17.job
2007-05-29 22:00:00 C:\WINDOWS\tasks\At18.job
2007-05-29 23:00:00 C:\WINDOWS\tasks\At19.job
2007-05-30 06:00:01 C:\WINDOWS\tasks\At2.job
2007-05-31 00:00:00 C:\WINDOWS\tasks\At20.job
2007-05-31 01:00:01 C:\WINDOWS\tasks\At21.job
2007-05-31 02:00:00 C:\WINDOWS\tasks\At22.job
2007-05-31 03:00:00 C:\WINDOWS\tasks\At23.job
2007-05-31 04:00:00 C:\WINDOWS\tasks\At24.job
2007-05-30 07:00:00 C:\WINDOWS\tasks\At3.job
2007-05-30 08:00:00 C:\WINDOWS\tasks\At4.job
2007-05-30 09:00:00 C:\WINDOWS\tasks\At5.job
2007-05-30 10:00:00 C:\WINDOWS\tasks\At6.job
2007-05-30 11:00:00 C:\WINDOWS\tasks\At7.job
2007-05-30 12:00:00 C:\WINDOWS\tasks\At8.job
2007-05-30 13:00:00 C:\WINDOWS\tasks\At9.job

********************************************************************

catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-30 23:03:08
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0


********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\freenet-darknet-8888]
"ImagePath"="\"C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe\" -s \"C:\Program Files\Freenet7\wrapper.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\freenet-darknet-8888-8888]
"ImagePath"="\"C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe\" -s \"C:\Program Files\Freenet7\wrapper.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\freenet-darknet-8888-8888-8888]
"ImagePath"="\"C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe\" -s \"C:\Program Files\Freenet7\wrapper.conf\""

[HKEY_LOCAL_MACHINE\system\ControlSet003\Services\freenet-darknet-8888-8888-8888-8888]
"ImagePath"="\"C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe\" -s \"C:\Program Files\Freenet7\wrapper.conf\""

Completion time: 2007-05-30 23:05:15
C:\ComboFix-quarantined-files.txt … 2007-05-30 23:05

— E O F —




Hijackthis:
Logfile of HijackThis v1.99.1
Scan saved at 11:09:32 PM, on 5/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avast4\aswUpdSv.exe
C:\Program Files\Avast4\ashServ.exe
C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\CounterSpy\SBCSSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Avast4\ashMaiSv.exe
C:\Program Files\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\devldr32.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\PROGRA~1\Avast4\ashDisp.exe
C:\Program Files\CounterSpy\SBCSTray.exe
C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.yahoo.com/?ei=UTF-8&save=0
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8118
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *se1.attbb.net
O1 - Hosts: 87.118.98.131 www.winmx.com
O2 - BHO: Tensons.Application.DownloadAcceleratorManager.BHO - {00000003-1118-11da-8cd6-0800200c9888} - mscoree.dll (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe -Embedding -boot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Startup: Point-N-Click.LNK = C:\Program Files\Point-N-Click\Point-N-Click.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O8 - Extra context menu item: Download all links using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: Download all videos using BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: Download link using &BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {9819CC0E-9669-4D01-9CD7-2C66DA43AC6C} - (no file)
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: HushEncryptionEngine - https://mailserver2.hushmail.com/shared/Hus…ptionEngine.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {43F25BA2-C4AB-4327-924C-1ED6AF4A6BA1} (activePhone Control) - http://www.webacall.com/activePhone.ocx
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1180433360406
O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} - http://us.dl1.yimg.com/download.yahoo.com/…utocomplete.cab
O16 - DPF: {E5F5D008-DD2C-4D32-977D-1A0ADF03058B} (JuniperSetup Control) - https://vpn.uconn.edu/dana-cached/setup/JuniperSetup.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/…041/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B0C6BE20-18D7-478A-9511-C39B3667E25B}: NameServer = 205.152.144.23,205.152.132.23
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: hplun.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Avast4\aswUpdSv.exe
O23 - Service: AutoComplete Service (Autocomplete) - Acesoft - C:\Program Files\Tracks Eraser Pro\delautocomp.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Freenet 0.7 darknet-8888 (freenet-darknet-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: Freenet 0.7 darknet-8888-8888-8888 (freenet-darknet-8888-8888-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: Freenet 0.7 darknet-8888-8888-8888-8888 (freenet-darknet-8888-8888-8888-8888) - Unknown owner - C:\Program Files\Freenet7\bin\wrapper-windows-x86-32.exe" -s "C:\Program Files\Freenet7\wrapper.conf (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\CounterSpy\SBCSSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe