[Closed]Hijackthis Log, Help!

Hi,

I have been getting some virtumonde and other annoying popup problems. please help me remove the problematic files!

Logfile of HijackThis v1.99.1
Scan saved at 12:53:39 AM, on 8/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe
C:\Program Files\McAfee Wireless Security\WscGuard.exe
E:\Mabinogi\npkcmsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\iTunes\iTunes.exe
C:\Documents and Settings\corea\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O1 - Hosts: 218.5.79.70 www.fdbb.net
O1 - Hosts: 218.85.139.74 www.cm8898.net
O1 - Hosts: 218.83.155.166 www2.ii55.net
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ??? ??(&N) - {D09CFF09-A42A-4EDC-9804-E61224F59CA1} - C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Linksys Wireless Guard.lnk = C:\Program Files\McAfee Wireless Security\WscGuard.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} (CyImage2Ctl Class) - http://cyimg7.cyworld.com/ImageUpload/CyIm…pload_10212.cab
O16 - DPF: {057E566C-74EE-495E-81D9-7A17AA835070} (MMServer Control) - http://www.mnet.com/Ver2/App/totalApp/maxmemo/MaxMemo.cab
O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab
O16 - DPF: {0C72835A-34C5-4273-A700-A2347E784B58} (NPPWebInstallV2 Control) - http://name.siren24.com/nprotect/down/NPPWebInstallV2.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {65291107-C218-4C81-BBDC-6E59A8D7C40A} (ItemPFLauncher Class) - http://itemimage.playforum.net:8080/itempf_launcher.cab
O16 - DPF: {7623BE59-D4CF-4379-ABC4-B39E11854D66} (MabinogiWebAvatarRenderer Class) - http://avatar.mabinogi.com:88/renderer/mabiweb.2007.4.4.cab
O16 - DPF: {882A7CC6-0163-4BC1-8BC1-505E36C9FFA2} (MaxHelper Control) - http://www.mnet.com/Ver2/App/totalApp/maxh…r/maxhelper.cab
O16 - DPF: {A1832535-5218-42F9-8959-19E2BCABFABF} (INIwallet50 Control) - https://plugin.inicis.com/wallet50/INIwallet50.cab
O16 - DPF: {A1D886C6-4039-4451-97A9-515F5BE5D4C2} (mkdplusCtrl Class) - http://ahnlabdownload.nefficient.co.kr/asp/cab/mkdplus.cab
O16 - DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} (skcbgmset Class) - http://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - https://www.isaackorea.net/update/ansim/ilkactx.cab
O16 - DPF: {B8C4B31D-6DCE-4DF0-BF73-44686849F67D} (PDRInst1 Class) - http://imgcdn.pandora.tv/pan_img/p3player/…age/pdrinst.cab
O16 - DPF: {B8ECD16B-EC0C-407E-AF2D-7B4A6B6F8DCB} (AllatPayXATL Class) - https://tx.allatpay.com/component/AllatPayX.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BFBC3059-9C61-5BA1-2075-85C8B6ECFC07} ({BFBC3059-9C61-5BA1-2075-85C8B6ECFC07}) - http://mabinogi.or.tp/etc/mwfre.2.cab
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} (KvpIspCtlD Control) - http://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\System32\btxppanel.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - E:\Mabinogi\npkcmsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: McAfee Wireless Security Network Manager Service (WSCNetManager) - McAfee, Inc. - C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe


Thank you!

Hi,

Here is my Hijack log after running VundoFix.

Logfile of HijackThis v1.99.1
Scan saved at 10:59:00 AM, on 8/20/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
E:\Mabinogi\npkcmsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe
C:\Program Files\McAfee Wireless Security\WscGuard.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\corea\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O1 - Hosts: 218.5.79.70 www.fdbb.net
O1 - Hosts: 218.85.139.74 www.cm8898.net
O1 - Hosts: 218.83.155.166 www2.ii55.net
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: 0 - {CED1E2E7-0171-42B1-21AA-5376FF06B644} - C:\Program Files\MSN Gaming Zone\lavugati74.dll (file missing)
O2 - BHO: (no name) - {D18891B0-4FAA-4433-8890-122A7B7B7407} - C:\WINDOWS\System32\ddccy.dll (file missing)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: ??? ??(&N) - {D09CFF09-A42A-4EDC-9804-E61224F59CA1} - C:\Program Files\naver\NaverToolbar\NaverTB_3_0_1_56.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Linksys Wireless Guard.lnk = C:\Program Files\McAfee Wireless Security\WscGuard.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} (CyImage2Ctl Class) - http://cyimg7.cyworld.com/ImageUpload/CyIm…pload_10212.cab
O16 - DPF: {057E566C-74EE-495E-81D9-7A17AA835070} (MMServer Control) - http://www.mnet.com/Ver2/App/totalApp/maxmemo/MaxMemo.cab
O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab
O16 - DPF: {0C72835A-34C5-4273-A700-A2347E784B58} (NPPWebInstallV2 Control) - http://name.siren24.com/nprotect/down/NPPWebInstallV2.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {65291107-C218-4C81-BBDC-6E59A8D7C40A} (ItemPFLauncher Class) - http://itemimage.playforum.net:8080/itempf_launcher.cab
O16 - DPF: {7623BE59-D4CF-4379-ABC4-B39E11854D66} (MabinogiWebAvatarRenderer Class) - http://avatar.mabinogi.com:88/renderer/mabiweb.2007.4.4.cab
O16 - DPF: {882A7CC6-0163-4BC1-8BC1-505E36C9FFA2} (MaxHelper Control) - http://www.mnet.com/Ver2/App/totalApp/maxh…r/maxhelper.cab
O16 - DPF: {A1832535-5218-42F9-8959-19E2BCABFABF} (INIwallet50 Control) - https://plugin.inicis.com/wallet50/INIwallet50.cab
O16 - DPF: {A1D886C6-4039-4451-97A9-515F5BE5D4C2} (mkdplusCtrl Class) - http://ahnlabdownload.nefficient.co.kr/asp/cab/mkdplus.cab
O16 - DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} (skcbgmset Class) - http://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - https://www.isaackorea.net/update/ansim/ilkactx.cab
O16 - DPF: {B8C4B31D-6DCE-4DF0-BF73-44686849F67D} (PDRInst1 Class) - http://imgcdn.pandora.tv/pan_img/p3player/…age/pdrinst.cab
O16 - DPF: {B8ECD16B-EC0C-407E-AF2D-7B4A6B6F8DCB} (AllatPayXATL Class) - https://tx.allatpay.com/component/AllatPayX.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BFBC3059-9C61-5BA1-2075-85C8B6ECFC07} ({BFBC3059-9C61-5BA1-2075-85C8B6ECFC07}) - http://mabinogi.or.tp/etc/mwfre.2.cab
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} (KvpIspCtlD Control) - http://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\System32\btxppanel.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - E:\Mabinogi\npkcmsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: McAfee Wireless Security Network Manager Service (WSCNetManager) - McAfee, Inc. - C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe

Hello! Thank you for helping. Here is the ComboFix log:

ComboFix 07-08-17.2 - "corea" 2007-08-22 20:29:06.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.205 [GMT -4:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\DOCUME~1\corea\APPLIC~1.\stem32~1\??plorer.exe
C:\DOCUME~1\corea\APPLIC~1\WinAntiSpyware 2006
C:\DOCUME~1\corea\APPLIC~1\WinAntiSpyware 2006\Logs\update.log
C:\DOCUME~1\corea\MYDOCU~1.\dobe~1
C:\DOCUME~1\corea\MYDOCU~1.\dobe~1\d?dplay.exe
C:\Program Files\MSN Gaming Zone\profsyrtyny.html
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\DOWNLO~1\UWA7P_0001_N91M0809NetInstaller.exe
C:\WINDOWS\system32\f02WtR
C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
C:\WINDOWS\system32\icroso~1.net
C:\WINDOWS\system32\ixsshvwq.dll
C:\WINDOWS\system32\swinomdt.exe
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\wnsxs~1
C:\WINDOWS\wnsxs~1\W?nSxS\


((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


——-\LEGACY_CMDSERVICE


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-22 20:27 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-21 15:05 d——– C:\Program Files\InterMute
2007-08-21 13:06 d——– C:\DOCUME~1\corea\APPLIC~1\??stem32
2007-08-20 10:47 d——– C:\VundoFix Backups
2007-08-18 00:43 1,572,864 –ah—– C:\DOCUME~1\ADMINI~1.000\NTUSER.DAT
2007-08-17 11:30 d–hs—- C:\WINDOWS\dXNlcg
2007-08-17 11:30 d——– C:\WINDOWS\system32\tmps6
2007-08-17 11:30 d——– C:\WINDOWS\system32\ICM3
2007-08-17 11:30 d——– C:\WINDOWS\system32\dll66
2007-08-17 11:30 d——– C:\WINDOWS\system32\CC1
2007-08-17 11:30 d——– C:\WINDOWS\system32\bgfig5
2007-08-17 11:29 d——– C:\Temp
2007-08-16 20:34 d——– C:\Program Files\7-Zip
2007-08-16 20:27 d——– C:\Program Files\Project64 1.6
2007-08-13 21:26 d——– C:\Program Files\iPod
2007-08-13 21:21 d——– C:\Program Files\QuickTime
2007-08-13 21:19 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-08 07:00 1,531,904 -ra—— C:\WINDOWS\system32\clubbox.exe
2007-08-07 21:31 279,912 –a—— C:\WINDOWS\system32\skcinst1.dll
2007-08-07 21:31 275,816 –a—— C:\WINDOWS\system32\skcinst2.dll
2007-08-06 02:29 394,704 –a—— C:\WINDOWS\system32\NJUninst.exe
2007-08-05 22:02 d——– C:\WINDOWS\Downloaded Installations
2007-08-05 22:02 d——– C:\Program Files\McAfee Wireless Security
2007-08-05 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WSC Guard
2007-07-29 03:37 808,720 –a—— C:\WINDOWS\system32\pdrtvctl.dll
2007-07-29 03:37 210,704 –a—— C:\WINDOWS\system32\pdrtvf2.dll
2007-07-29 03:37 206,608 –a—— C:\WINDOWS\system32\pdrtvsvr.exe
2007-07-29 03:37 153,360 –a—— C:\WINDOWS\system32\pdrtvf1.dll
2007-07-29 03:37 1,097,488 –a—— C:\WINDOWS\system32\pavc.dll
2007-07-22 22:50 d——– C:\Program Files\Lavasoft
2007-07-22 22:50 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-22 22:49 d——– C:\Program Files\Common Files\Wise Installation Wizard


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-22 20:30 ——— d——– C:\Program Files\MSN Gaming Zone
2007-08-22 20:30 ——— d——– C:\DOCUME~1\corea\APPLIC~1\??stem32
2007-08-21 12:25 77824 –a—— C:\WINDOWS\system32\nod.dll
2007-08-20 23:48 ——— d——– C:\DOCUME~1\corea\APPLIC~1\U3
2007-08-15 01:07 ——— d——– C:\Program Files\iTunes
2007-08-13 21:19 ——— d——– C:\Program Files\Apple Software Update
2007-08-11 21:32 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-11 21:32 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-05 23:56 ——— d–h—– C:\DOCUME~1\corea\APPLIC~1\Move Networks
2007-08-01 18:17 ——— d——– C:\Program Files\Common Files\ESRI
2007-08-01 18:13 ——— d——– C:\Program Files\ESRI
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-26 23:42 8320 –a—— C:\WINDOWS\system32\drivers\scsk4.sys
2007-07-26 14:23 128384 –a—— C:\WINDOWS\system32\drivers\Mkd2kfNT.sys
2007-07-22 22:48 ——— d——– C:\DOCUME~1\corea\APPLIC~1\Lavasoft
2007-07-20 00:25 643072 –a—— C:\WINDOWS\system32\INIcrypt32.dll
2007-07-20 00:24 995328 –a—— C:\WINDOWS\system32\INIcd50.dll
2007-07-19 20:20 ——— d——– C:\Program Files\MSN Messenger
2007-07-18 21:41 229376 –a—— C:\WINDOWS\system32\MaxBSLoader.exe
2007-07-12 18:56 129536 –a—— C:\WINDOWS\system32\IJL15.dll
2007-07-12 11:32 93440 –a—— C:\WINDOWS\system32\drivers\Mkd2UsbF.sys
2007-07-04 20:40 ——— d——– C:\Program Files\support.com
2007-06-28 21:41 ——— d——– C:\Program Files\Google
2007-06-26 09:07 356352 –a—— C:\WINDOWS\system32\p3max.dll
2007-06-26 09:07 192512 –a—— C:\WINDOWS\system32\p3mf2.dll
2007-06-21 23:21 512000 –a—— C:\WINDOWS\system32\ISPPopUpDlg.exe
2007-06-21 12:38 394748 –a—— C:\WINDOWS\system32\SCSKAPPLINK.DLL
2007-06-21 12:38 2904176 –a—— C:\WINDOWS\system32\KvpVcmd.dll
2007-06-20 16:20 135168 –a—— C:\WINDOWS\system32\p3maxf1.dll
2007-06-20 12:17 159744 –a—— C:\WINDOWS\system32\P3MxSvr.exe
2007-06-07 11:25 735016 –a—— C:\WINDOWS\system32\p3mxvctl.dll
2007-05-29 02:42 517744 –a—— C:\WINDOWS\system32\skcppl.dll
2007-05-29 02:42 468592 –a—— C:\WINDOWS\system32\skcbgm.dll
2007-05-29 02:42 198256 –a—— C:\WINDOWS\system32\skcwmf.dll
2007-05-29 02:42 169584 –a—— C:\WINDOWS\system32\skcbgm.exe
2007-05-29 02:42 145008 –a—— C:\WINDOWS\system32\skcbgmf1.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-26 01:00]
"ClubBox"="" []
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 15:12]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 17:48]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 21:24 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-23 08:00]
"Dzsju"="C:\Documents and Settings\corea\Application Data\??stem32\??plorer.exe" []
"Aaab"="C:\WINDOWS\WNSXS~1\javaw.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-21 21:41:37]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
BTTray.lnk - C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe [2004-10-01 16:12:18]
Linksys Wireless Guard.lnk - C:\Program Files\McAfee Wireless Security\WscGuard.exe [2005-09-19 15:44:02]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= C:\Program Files\MSN Gaming Zone\profsyrtyny.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{47A6F676-27C5-4A10-98EE-A415EB3D9A4A}"= C:\Program Files\Common Files\Microsoft Shared\MSINFO\OIFFP.CNC [2007-04-10 23:06 22528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TabUserW.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk
backup=C:\WINDOWS\pss\TabUserW.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^corea^Start Menu^Programs^Startup^TA_Start.lnk]
path=C:\Documents and Settings\corea\Start Menu\Programs\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aaab]
"C:\PROGRA~1\SSTEM3~1\mshta.exe" -vt yazb

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
C:\WINDOWS\System32\swinomdt.exe CHD003

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hory]
C:\Program Files\Common Files\hory22011.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\System32\iesly.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
rundll32.exe "C:\WINDOWS\System32\hoteblfy.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{C0-08-80-0A-ZN}]
c:\windows\system32\lndsrngq.exe CHD003

R2 npkcmsvc;npkcmsvc;E:\Mabinogi\npkcmsvc.exe
R2 WSCNetManager;McAfee Wireless Security Network Manager Service;"C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe"
R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\System32\DRIVERS\SonyPI.sys
S3 Mkd2kfNt;Mkd2kfNt;C:\WINDOWS\System32\drivers\Mkd2kfNt.sys
S3 Mkd2Usbf;Mkd2Usbf;C:\WINDOWS\System32\drivers\Mkd2Usbf.sys
S3 scsk4;SCSK4 Driver Service;C:\WINDOWS\System32\drivers\scsk4.sys

*Newly Created Service* - ALG
*Newly Created Service* - IPNAT

Contents of the 'Scheduled Tasks' folder
2007-08-14 01:19:52 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 20:33:23
Windows 5.1.2600 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 20:35:06 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-22 20:34

— E O F —

Here is the second ComboFix log. Thanks for the help!

ComboFix 07-08-17.2 - "corea" 2007-08-22 21:10:45.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.0.1252.1.1033.18.183 [GMT -4:00]
Command switches used :: C:\Documents and Settings\corea\Desktop\CFScript.txt
* Created a new restore point

FILE::
C:\WINDOWS\WNSXS~1\javaw.exe
C:\PROGRA~1\SSTEM3~1\mshta.exe
C:\WINDOWS\System32\swinomdt.exe
C:\Program Files\Common Files\hory22011.exe
C:\WINDOWS\System32\iesly.exe
C:\WINDOWS\System32\hoteblfy.dll


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\dXNlcg


((((((((((((((((((((((((( Files Created from 2007-07-23 to 2007-08-23 )))))))))))))))))))))))))))))))


2007-08-22 20:27 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-21 13:06 d——– C:\DOCUME~1\corea\APPLIC~1\??stem32
2007-08-20 10:47 d——– C:\VundoFix Backups
2007-08-18 00:43 1,572,864 –ah—– C:\DOCUME~1\ADMINI~1.000\NTUSER.DAT
2007-08-17 11:30 d——– C:\WINDOWS\system32\tmps6
2007-08-17 11:30 d——– C:\WINDOWS\system32\ICM3
2007-08-17 11:30 d——– C:\WINDOWS\system32\dll66
2007-08-17 11:30 d——– C:\WINDOWS\system32\CC1
2007-08-17 11:30 d——– C:\WINDOWS\system32\bgfig5
2007-08-17 11:29 d——– C:\Temp
2007-08-16 20:34 d——– C:\Program Files\7-Zip
2007-08-16 20:27 d——– C:\Program Files\Project64 1.6
2007-08-13 21:26 d——– C:\Program Files\iPod
2007-08-13 21:21 d——– C:\Program Files\QuickTime
2007-08-13 21:19 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Apple
2007-08-08 07:00 1,531,904 -ra—— C:\WINDOWS\system32\clubbox.exe
2007-08-07 21:31 279,912 –a—— C:\WINDOWS\system32\skcinst1.dll
2007-08-07 21:31 275,816 –a—— C:\WINDOWS\system32\skcinst2.dll
2007-08-06 02:29 394,704 –a—— C:\WINDOWS\system32\NJUninst.exe
2007-08-05 22:02 d——– C:\WINDOWS\Downloaded Installations
2007-08-05 22:02 d——– C:\Program Files\McAfee Wireless Security
2007-08-05 22:02 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\WSC Guard
2007-07-29 03:37 808,720 –a—— C:\WINDOWS\system32\pdrtvctl.dll
2007-07-29 03:37 210,704 –a—— C:\WINDOWS\system32\pdrtvf2.dll
2007-07-29 03:37 206,608 –a—— C:\WINDOWS\system32\pdrtvsvr.exe
2007-07-29 03:37 153,360 –a—— C:\WINDOWS\system32\pdrtvf1.dll
2007-07-29 03:37 1,097,488 –a—— C:\WINDOWS\system32\pavc.dll
2007-07-22 22:50 d——– C:\Program Files\Lavasoft
2007-07-22 22:50 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-07-22 22:49 d——– C:\Program Files\Common Files\Wise Installation Wizard


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-22 20:30 ——— d——– C:\Program Files\MSN Gaming Zone
2007-08-22 20:30 ——— d——– C:\DOCUME~1\corea\APPLIC~1\??stem32
2007-08-21 12:25 77824 –a—— C:\WINDOWS\system32\nod.dll
2007-08-20 23:48 ——— d——– C:\DOCUME~1\corea\APPLIC~1\U3
2007-08-15 01:07 ——— d——– C:\Program Files\iTunes
2007-08-13 21:19 ——— d——– C:\Program Files\Apple Software Update
2007-08-11 21:32 9344 –a—— C:\WINDOWS\system32\drivers\NSDriver.sys
2007-08-11 21:32 8320 –a—— C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-08-05 23:56 ——— d–h—– C:\DOCUME~1\corea\APPLIC~1\Move Networks
2007-08-01 18:17 ——— d——– C:\Program Files\Common Files\ESRI
2007-08-01 18:13 ——— d——– C:\Program Files\ESRI
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-26 23:42 8320 –a—— C:\WINDOWS\system32\drivers\scsk4.sys
2007-07-26 14:23 128384 –a—— C:\WINDOWS\system32\drivers\Mkd2kfNT.sys
2007-07-22 22:48 ——— d——– C:\DOCUME~1\corea\APPLIC~1\Lavasoft
2007-07-20 00:25 643072 –a—— C:\WINDOWS\system32\INIcrypt32.dll
2007-07-20 00:24 995328 –a—— C:\WINDOWS\system32\INIcd50.dll
2007-07-19 20:20 ——— d——– C:\Program Files\MSN Messenger
2007-07-18 21:41 229376 –a—— C:\WINDOWS\system32\MaxBSLoader.exe
2007-07-12 18:56 129536 –a—— C:\WINDOWS\system32\IJL15.dll
2007-07-12 11:32 93440 –a—— C:\WINDOWS\system32\drivers\Mkd2UsbF.sys
2007-07-04 20:40 ——— d——– C:\Program Files\support.com
2007-06-28 21:41 ——— d——– C:\Program Files\Google
2007-06-26 09:07 356352 –a—— C:\WINDOWS\system32\p3max.dll
2007-06-26 09:07 192512 –a—— C:\WINDOWS\system32\p3mf2.dll
2007-06-21 23:21 512000 –a—— C:\WINDOWS\system32\ISPPopUpDlg.exe
2007-06-21 12:38 394748 –a—— C:\WINDOWS\system32\SCSKAPPLINK.DLL
2007-06-21 12:38 2904176 –a—— C:\WINDOWS\system32\KvpVcmd.dll
2007-06-20 16:20 135168 –a—— C:\WINDOWS\system32\p3maxf1.dll
2007-06-20 12:17 159744 –a—— C:\WINDOWS\system32\P3MxSvr.exe
2007-06-07 11:25 735016 –a—— C:\WINDOWS\system32\p3mxvctl.dll
2007-05-29 02:42 517744 –a—— C:\WINDOWS\system32\skcppl.dll
2007-05-29 02:42 468592 –a—— C:\WINDOWS\system32\skcbgm.dll
2007-05-29 02:42 198256 –a—— C:\WINDOWS\system32\skcwmf.dll
2007-05-29 02:42 169584 –a—— C:\WINDOWS\system32\skcbgm.exe
2007-05-29 02:42 145008 –a—— C:\WINDOWS\system32\skcbgmf1.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-26 01:00]
"ClubBox"="" []
"ISBMgr.exe"="C:\Program Files\Sony\ISB Utility\ISBMgr.exe" [2004-02-20 15:12]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"{0228e555-4f9c-4e35-a3ec-b109a192b4c2}"="C:\Program Files\Google\Gmail Notifier\gnotify.exe" [2005-07-15 17:48]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-07-31 18:44]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 21:24 C:\WINDOWS\system32\Ati2mdxx.exe]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"ctfmon.exe"="C:\WINDOWS\System32\ctfmon.exe" [2001-08-23 08:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2006-11-21 21:41:37]
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 23:05:26]
BTTray.lnk - C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe [2004-10-01 16:12:18]
Linksys Wireless Guard.lnk - C:\Program Files\McAfee Wireless Security\WscGuard.exe [2005-09-19 15:44:02]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
Source= C:\Program Files\MSN Gaming Zone\profsyrtyny.html
FriendlyName=

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{47A6F676-27C5-4A10-98EE-A415EB3D9A4A}"= C:\Program Files\Common Files\Microsoft Shared\MSINFO\OIFFP.CNC [2007-04-10 23:06 22528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TabUserW.exe.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk
backup=C:\WINDOWS\pss\TabUserW.exe.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^corea^Start Menu^Programs^Startup^TA_Start.lnk]
path=C:\Documents and Settings\corea\Start Menu\Programs\Startup\TA_Start.lnk
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
C:\WINDOWS\System32\swinomdt.exe CHD003

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
"C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Load]
C:\WINDOWS\System32\iesly.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
C:\WINDOWS\System32\IME\PINTLGNT\ImScInst.exe /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /IMEName

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SystemOptimizer]
rundll32.exe "C:\WINDOWS\System32\hoteblfy.dll",forkonce

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{C0-08-80-0A-ZN}]
c:\windows\system32\lndsrngq.exe CHD003

R2 npkcmsvc;npkcmsvc;E:\Mabinogi\npkcmsvc.exe
R2 WSCNetManager;McAfee Wireless Security Network Manager Service;"C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe"
R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\System32\DRIVERS\SonyPI.sys
S3 Mkd2kfNt;Mkd2kfNt;C:\WINDOWS\System32\drivers\Mkd2kfNt.sys
S3 Mkd2Usbf;Mkd2Usbf;C:\WINDOWS\System32\drivers\Mkd2Usbf.sys
S3 scsk4;SCSK4 Driver Service;C:\WINDOWS\System32\drivers\scsk4.sys

*Newly Created Service* - ALG
*Newly Created Service* - CATCHME
*Newly Created Service* - IPNAT

Contents of the 'Scheduled Tasks' folder
2007-08-14 01:19:52 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-22 21:12:12
Windows 5.1.2600 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-22 21:12:58
C:\ComboFix-quarantined-files.txt … 2007-08-22 21:12
C:\ComboFix2.txt … 2007-08-22 20:35

— E O F —

Hi LDTate, thanks for the amazingly speedy replies. So far no pop ups have occured. Yay! But that's what I had thought a few days ago, only to have Outerinfo pop up earlier today. Here is the HijackThis log:

Logfile of HijackThis v1.99.1
Scan saved at 9:31:41 PM, on 8/22/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\Ati2evxx.exe
E:\Mabinogi\npkcmsvc.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\Tablet.exe
C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Sony\ISB Utility\ISBMgr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Google\Gmail Notifier\gnotify.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Bluetooth\Bluetooth Software\BTTray.exe
C:\Program Files\McAfee Wireless Security\WscGuard.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\corea\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [ISBMgr.exe] C:\Program Files\Sony\ISB Utility\ISBMgr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] C:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Linksys Wireless Guard.lnk = C:\Program Files\McAfee Wireless Security\WscGuard.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Bluetooth\Bluetooth Software\btsendto_ie.htm
O16 - DPF: {04E7BADF-F3B9-420D-B82D-8D8CADEFE4F9} (CyImage2Ctl Class) - http://cyimg6.cyworld.com/ImageUpload/CyIm…pload_10217.cab
O16 - DPF: {072039AB-2117-4ED5-A85F-9B9EB903E021} (NowStarter Control) - http://www.clubbox.co.kr/neo.fld/NowStarter.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo…otoUploader.cab
O16 - DPF: {65291107-C218-4C81-BBDC-6E59A8D7C40A} (ItemPFLauncher Class) - http://itemimage.playforum.net:8080/itempf_launcher.cab
O16 - DPF: {7623BE59-D4CF-4379-ABC4-B39E11854D66} (MabinogiWebAvatarRenderer Class) - http://avatar.mabinogi.com:88/renderer/mabiweb.2007.4.4.cab
O16 - DPF: {A1832535-5218-42F9-8959-19E2BCABFABF} (INIwallet50 Control) - https://plugin.inicis.com/wallet50/INIwallet50.cab
O16 - DPF: {A1D886C6-4039-4451-97A9-515F5BE5D4C2} (mkdplusCtrl Class) - http://ahnlabdownload.nefficient.co.kr/asp/cab/mkdplus.cab
O16 - DPF: {A671DC03-71D0-4CF0-895C-7D4A248FC1F1} (skcbgmset Class) - http://cyimg7.cyworld.nate.com/cymusic/package/skcbgmset.cab
O16 - DPF: {B45E969D-924F-4C83-ACF3-38CDD115AA2C} (MpiPlugin Class) - https://www.isaackorea.net/update/ansim/ilkactx.cab
O16 - DPF: {B8C4B31D-6DCE-4DF0-BF73-44686849F67D} (PDRInst1 Class) - http://imgcdn.pandora.tv/pan_img/p3player/…age/pdrinst.cab
O16 - DPF: {B8ECD16B-EC0C-407E-AF2D-7B4A6B6F8DCB} (AllatPayXATL Class) - https://tx.allatpay.com/component/AllatPayX.cab
O16 - DPF: {BCEF5CDE-BAD4-4532-A30B-9D16D502DE69} (BugsInstallEx Control) - http://install.bugs.co.kr/install/BugsInstallerEx.cab
O16 - DPF: {BFBC3059-9C61-5BA1-2075-85C8B6ECFC07} ({BFBC3059-9C61-5BA1-2075-85C8B6ECFC07}) - http://mabinogi.or.tp/etc/mwfre.2.cab
O16 - DPF: {E78928A6-3D2A-4BF7-A100-F3FBAA351B49} (KvpIspCtlD Control) - http://www.vpay.co.kr/kvpfiles/KVPISPCTLD.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: widimg - {EE7C2AFF-5742-44FF-BD0E-E521B0D3C3BA} - C:\WINDOWS\System32\btxppanel.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation - C:\Program Files\Bluetooth\Bluetooth Software\bin\btwdins.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: npkcmsvc - INCA Internet Co., Ltd. - E:\Mabinogi\npkcmsvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\System32\Tablet.exe
O23 - Service: McAfee Wireless Security Network Manager Service (WSCNetManager) - McAfee, Inc. - C:\Program Files\McAfee Wireless Security\WscNetMgrSvc.exe

Thanks.