[Resolved] Adssite removal required

Hi Scotty, it's a new day and the pain has eased enough for me to concentrate, Well let's get back to removing these little devils.

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Saturday, October 06, 2007 5:33:23 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.93.1
Kaspersky Anti-Virus database last update: 6/10/2007
Kaspersky Anti-Virus database records: 428249
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - Folders:
C:\

Scan Statistics:
Total number of scanned objects: 70132
Number of viruses found: 5
Number of infected objects: 16
Number of suspicious objects: 0
Duration of the scan process: 02:09:46

Infected Object Name / Virus Name / Last Action
C:\Archivos de programa\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Archivos de programa\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Archivos de programa\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Archivos de programa\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Archivos de programa\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Archivos de programa\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Archivos de programa\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Data\master.mdf Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Data\mastlog.ldf Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Data\model.mdf Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Data\modellog.ldf Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Data\tempdb.mdf Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Data\templog.ldf Object is locked skipped
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\LOG\ERRORLOG Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Kontiki\error.log Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\MyWayMyBar.zip/myBar/1.bin/MYBAR.DLL Infected: not-a-virus:AdWare.Win32.MyWay.m skipped
C:\Documents and Settings\All Users\Datos de programa\Spybot - Search & Destroy\Recovery\MyWayMyBar.zip ZIP: infected - 1 skipped
C:\Documents and Settings\LocalService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\Content.IE5\WDPNJ6ZM\setup[1].exe/stream/data0001 Infected: not-a-virus:AdWare.Win32.Agent.ma skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\Content.IE5\WDPNJ6ZM\setup[1].exe/stream Infected: not-a-virus:AdWare.Win32.Agent.ma skipped
C:\Documents and Settings\XP\Configuración local\Archivos temporales de Internet\Content.IE5\WDPNJ6ZM\setup[1].exe NSIS: infected - 2 skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Historial\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Historial\History.IE5\MSHist012007100620071007\index.dat Object is locked skipped
C:\Documents and Settings\XP\Configuración local\Temp\~DFBA77.tmp Object is locked skipped
C:\Documents and Settings\XP\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\cert8.db Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\history.dat Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\key3.db Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\parent.lock Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\search.sqlite Object is locked skipped
C:\Documents and Settings\XP\Datos de programa\Mozilla\Firefox\Profiles\eitxrm3x.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\XP\ntuser.dat Object is locked skipped
C:\Documents and Settings\XP\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\XP\Shared\pagemaker training video.zip/setup.exe/data0006/stream/data0004 Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\XP\Shared\pagemaker training video.zip/setup.exe/data0006/stream Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\XP\Shared\pagemaker training video.zip/setup.exe/data0006 Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\XP\Shared\pagemaker training video.zip/setup.exe Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\Documents and Settings\XP\Shared\pagemaker training video.zip ZIP: infected - 4 skipped
C:\Documents and Settings\XP\UserData\index.dat Object is locked skipped
C:\qoobox\Quarantine\C\Archivos de programa\NoAdware4\noadwareutils.dll.vir Infected: not-a-virus:FraudTool.Win32.NoAdware.a skipped
C:\qoobox\Quarantine\C\Download\eMule0.47a-Installer.exe.vir/stream/data0247 Infected: not-a-virus:AdWare.Win32.Webdir.b skipped
C:\qoobox\Quarantine\C\Download\eMule0.47a-Installer.exe.vir/stream Infected: not-a-virus:AdWare.Win32.Webdir.b skipped
C:\qoobox\Quarantine\C\Download\eMule0.47a-Installer.exe.vir NSIS: infected - 2 skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\ninjaext.dll.vir Infected: not-a-virus:AdWare.Win32.Agent.ma skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\nso2D.dll.vir Infected: not-a-virus:AdWare.Win32.BHO.ha skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\fwpktlog.txt Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_148.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_590.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_7a8.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_8c.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Logfile of HijackThis v1.99.1
Scan saved at 18:31:38, on 06/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Archivos de programa\Kontiki\KService.exe
C:\Archivos de programa\Archivos comunes\Microsoft Shared\VS7Debug\mdm.exe
C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Binn\sqlservr.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\ARCHIV~1\SPEEDB~1\VideoAcceleratorEngine.exe
C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe
C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Archivos de programa\PopUp Killer\popupkiller.EXE
C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Archivos de programa\Multimedia Card Reader\shwicon2k.exe
C:\WINDOWS\StartupMonitor.exe
C:\WINDOWS\system32\carpserv.exe
C:\Archivos de programa\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Archivos de programa\Kontiki\KHost.exe
C:\Archivos de programa\Microsoft Student\Microsoft Student 2006 - DVD\EDICT.EXE
C:\WINDOWS\System32\svchost.exe
C:\ARCHIV~1\SPEEDB~1\VideoAccelerator.exe
C:\Archivos de programa\Mozilla Firefox\firefox.exe
C:\Archivos de programa\Microsoft Office\Office10\WINWORD.EXE
C:\WINDOWS\msagent\AgentSvr.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Archivos de programa\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Vínculos
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Archivos de programa\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\ARCHIV~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Complemento del Asistente para Internet de Encarta - {955BE0B8-BC85-4CAF-856E-8E0D8B610560} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de programa\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {FFFFFEF0-5B30-21D4-945D-000000000000} - C:\ARCHIV~1\STARDO~1\SDIEInt.dll
O3 - Toolbar: Asistente para Internet de Encarta - {147D6308-0614-4112-89B1-31402F9B82C4} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Web Companion\ENCWCBAR.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Archivos de programa\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Archivos de programa\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [PopUpKiller] C:\Archivos de programa\PopUp Killer\popupkiller.EXE
O4 - HKLM\..\Run: [avast!] C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Sunkist2k] C:\Archivos de programa\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Run StartupMonitor] StartupMonitor.exe
O4 - HKLM\..\Run: [CARPService] carpserv.exe
O4 - HKLM\..\Run: [USB Storage Toolbox] C:\Archivos de programa\USB Disk Win98 Driver\Res.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Archivos de programa\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [kdx] C:\Archivos de programa\Kontiki\KHost.exe -all
O4 - HKCU\..\Run: [L06EXLRD_2843906] "C:\Archivos de programa\Microsoft Student\Microsoft Student 2006 - DVD\EDICT.EXE" -m
O4 - Startup: AOM.lnk = C:\Archivos de programa\Archivos comunes\Adobe\Web\AOM.exe
O8 - Extra context menu item: &Windows Live Search - res://C:\Archivos de programa\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Download with Star Downloader - C:\Archivos de programa\Star Downloader\sdie.htm
O8 - Extra context menu item: E&xportar a Microsoft Excel - res://C:\ARCHIV~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Consola de Sun Java - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Archivos de programa\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra 'Tools' menuitem: Popup Blocker - {0D555BC6-E331-48b3-A60E-AAC0DF79438A} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Archivos de programa\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - C:\Archivos de programa\WinHTTrack\WinHTTrackIEBar.dll
O9 - Extra button: ActualizacionVIP - {76DD9E77-F06C-4471-AB6C-CF03C5C6B5B0} - C:\WINDOWS\system32\ActualizacionVIP (file missing)
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: Descargas - {AF0828BC-CB46-4C8D-95B6-8A7C4988F9FF} - c:\nge-kazemule\local.htm (file missing)
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Archivos de programa\Archivos comunes\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Archivos de programa\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O14 - IERESET.INF: START_PAGE_URL=http://www.beep.es/
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/…lscbase9602.cab
O16 - DPF: {88C51E90-8E9C-4C96-8A45-574D88B63FAF} - http://acceso.masminutos.com/aplicacion.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{B5833B23-3C23-4616-8D04-746511374A47}: NameServer = 62.151.2.8,62.151.8.100
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\ARCHIV~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Archivos de programa\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Archivos de programa\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Archivos de programa\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Archivos de programa\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Archivos de programa\iPod\bin\iPodService.exe
O23 - Service: KService - Unknown owner - C:\Archivos de programa\Kontiki\KService.exe
O23 - Service: MSSQL$NET2 - Unknown owner - C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Binn\sqlservr.exe" -sNET2 (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: SQLAgent$NET2 - Unknown owner - C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Binn\sqlagent.EXE" -i NET2 (file missing)
O23 - Service: VideoAcceleratorEngine - Speedbit Ltd. - C:\ARCHIV~1\SPEEDB~1\VideoAcceleratorEngine.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Well i manage to find those two emails from LycosMailUk but, only after doing a search on pay in Outlook. The emails turned up, with year 2007? Well I had sent them an email, say I thought the mail was false and they responded that indeed it was the case. They supplied my orignal email in their return message to myself.

The above emails have been deleted in answer to your earlier question.

Looks like only a few steps to go. Hope to catch up soon.

Regards
HowardB

Hi, sorry I was not concentrating.

ComboFix 07-10-04.5 - XP 2007-10-06 22:26:10.5 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.3082.18.400 [GMT 2:00]
Se ejecuta desde: C:\Documents and Settings\XP\Escritorio\ComboFix.exe
Command switches used :: C:\Documents and Settings\XP\Escritorio\[removed]
* Creado un nuevo punto de restauración
.

(((((((((((((((((( Archivos creados desde 2007-09-06 - 2007-10-06 )))))))))))))))))))))))))))))))))
.

2007-10-06 10:29 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-10-04 14:44 d——– C:\WINDOWS\system32\Kaspersky Lab
2007-10-04 14:44 d——– C:\Documents and Settings\All Users\Datos de programa\Kaspersky Lab
2007-10-03 18:25 dr–s—- C:\assembly
2007-10-02 17:10 1,901 –a—— C:\WINDOWS\panose.bin
2007-10-02 16:24 6,144 –a—— C:\WINDOWS\system32\W95fiber.dll
2007-10-02 16:24 5,632 –a—— C:\WINDOWS\system32\Mfcuia32.dll
2007-10-02 16:24 322,832 –a—— C:\WINDOWS\system32\Mfc30.dll
2007-10-02 16:24 212,480 –a—— C:\WINDOWS\Pcdlib32.dll
2007-10-02 16:24 210,944 –a—— C:\WINDOWS\system32\Msvcrt10.dll
2007-10-02 16:24 133,904 –a—— C:\WINDOWS\system32\Mfcans32.dll
2007-10-02 16:24 133,392 –a—— C:\WINDOWS\system32\Mfco30.dll
2007-10-01 18:06 d——– C:\Documents and Settings\XP\Shared
2007-10-01 18:06 d——– C:\Documents and Settings\XP\Incomplete
2007-10-01 18:05 d——– C:\Documents and Settings\XP\Datos de programa\LimeWire
2007-09-30 19:16 d——– C:\Documents and Settings\XP\Datos de programa\Scribus
2007-09-30 03:33 d——– C:\Documents and Settings\XP\Datos de programa\OpenOffice.org2
2007-09-30 03:01 d——– C:\Archivos de programa\OpenOffice.org 2.3
2007-09-27 11:03 d——– C:\Documents and Settings\XP\.scribus
2007-09-27 10:52 d——– C:\Archivos de programa\gs
2007-09-26 23:51 d——– C:\Documents and Settings\XP\Datos de programa\gtk-2.0
2007-09-26 22:53 d——– C:\Archivos de programa\GIMP-2.0
2007-09-26 22:39 d——– C:\Archivos de programa\Archivos comunes\GTK
2007-09-26 18:26 d——– C:\Archivos de programa\Hewlett Packard
2007-09-26 16:06 d——– C:\Documents and Settings\XP\.thumbnails
2007-09-26 15:38 d——– C:\Documents and Settings\XP\.gimp-2.2
2007-09-24 02:05 d——– C:\Archivos de programa\WinHTTrack
2007-09-21 18:22 d——– C:\Archivos de programa\Cavaj Java Decompiler
2007-09-19 04:31 398,416 –a—— C:\WINDOWS\system32\Vbrun300.dll
2007-09-19 04:31 31,744 –a—— C:\WINDOWS\system32\Msafinx.dll
2007-09-19 04:31 d——– C:\Archivos de programa\HP-12C Financial Emulator
2007-09-19 03:07 d——– C:\Archivos de programa\CFGCalculator
2007-09-11 20:57 d——– C:\Documents and Settings\XP\Phone Browser
2007-09-11 20:57 d——– C:\Documents and Settings\XP\Datos de programa\PC Suite
2007-09-11 20:54 d——– C:\Archivos de programa\Archivos comunes\PCSuite
2007-09-11 20:54 d——– C:\Archivos de programa\Archivos comunes\Nokia
2007-09-11 20:48 d——– C:\WINDOWS\SxsCaPendDel

.
(((((((((((((((((((((((((((((((((((((( Reporte Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-10-06 22:28 ——— d——– C:\Documents and Settings\All Users\Datos de programa\Kontiki
2007-10-06 17:38 ——— d——– C:\Archivos de programa\PopUp Killer
2007-09-29 02:41 ——— d——– C:\Archivos de programa\cam2pc
2007-09-23 11:03 ——— d——– C:\Archivos de programa\ExtractNow
2007-09-11 20:57 ——— d–h—– C:\Archivos de programa\InstallShield Installation Information
2007-09-11 20:56 ——— d——– C:\Archivos de programa\Nokia
2007-09-06 12:09 801144 –a—— C:\WINDOWS\system32\aswBoot.exe
2007-09-06 12:05 94416 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2007-09-06 12:05 92848 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2007-09-06 12:03 23152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2007-09-06 12:02 42912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2007-09-06 12:00 95608 –a—— C:\WINDOWS\system32\AVASTSS.scr
2007-09-06 12:00 26624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2007-08-26 19:48 ——— d——– C:\Archivos de programa\Orb Networks
2007-08-26 19:47 ——— d——– C:\Archivos de programa\eMule
2007-08-26 19:45 ——— d——– C:\Archivos de programa\directx
2007-08-26 19:45 ——— d——– C:\Archivos de programa\BBC Multimedia
2007-08-26 19:38 ——— d——– C:\Archivos de programa\QuickTime
2007-08-26 15:58 ——— d——– C:\Archivos de programa\Zeta Multimedia
2007-08-26 15:52 ——— d——– C:\Documents and Settings\XP\Datos de programa\IBP
2007-08-25 12:58 ——— d——– C:\Documents and Settings\All Users\Datos de programa\Nokia
2007-08-23 08:53 ——— d——– C:\Archivos de programa\eRightSoft
2007-08-16 09:54 ——— d——– C:\Archivos de programa\MSXML 6.0
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-07-19 08:54 3583488 –a—— C:\WINDOWS\system32\dllcache\mshtml.dll
2007-07-13 01:30 765952 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2006-05-03 09:06:54 163,328 –sh–r C:\WINDOWS\system32\flvDX.dll
2007-02-21 10:47:16 31,232 –sh–r C:\WINDOWS\system32\msfDX.dll
.

((((((((((((((((((((((((((((( snapshot@2007-10-04_13.00.05.18 )))))))))))))))))))))))))))))))))))))))))
.
—-a-w 53,248 2006-05-24 23:22:06 C:\WINDOWS\bdoscandel.exe
—-a-w 135,168 2007-09-28 07:06:08 C:\WINDOWS\catchme.exe
—-a-w 181,760 2007-10-06 11:25:44 C:\WINDOWS\BDOSCAN8\bdcore.dll
—-a-w 142,848 2007-10-06 11:25:45 C:\WINDOWS\BDOSCAN8\libfn.dll
—-a-w 86,016 2007-10-06 11:25:41 C:\WINDOWS\BDOSCAN8\librtvr.dll
—-a-w 118,784 2005-03-01 12:08:48 C:\WINDOWS\Downloaded Program Files\bdupd.dll
—-a-w 53,248 2005-03-01 12:08:52 C:\WINDOWS\Downloaded Program Files\ipsupd.dll
—-a-w 163,328 2007-03-13 08:57:10 C:\WINDOWS\erdnt\subs\ERDNT.EXE
—-a-w 135,168 2007-09-24 20:30:28 C:\WINDOWS\system32\java.exe
—-a-w 135,168 2007-09-24 20:30:30 C:\WINDOWS\system32\javaw.exe
—-a-w 139,264 2007-09-24 21:31:42 C:\WINDOWS\system32\javaws.exe
—-a-w 69,838 2007-10-05 10:04:40 C:\WINDOWS\system32\perfc009.dat
—-a-w 88,850 2007-10-05 10:04:40 C:\WINDOWS\system32\perfc00A.dat
—-a-w 419,202 2007-10-05 10:04:40 C:\WINDOWS\system32\perfh009.dat
—-a-w 480,856 2007-10-05 10:04:40 C:\WINDOWS\system32\perfh00A.dat
—-a-w 844,800 2007-07-22 16:39:27 C:\WINDOWS\system32\swreg.exe
—-a-w 370,688 2006-11-29 15:21:29 C:\WINDOWS\system32\swsc.exe
—-a-w 212,480 2006-12-01 03:20:32 C:\WINDOWS\system32\swxcacls.exe
—-a-w 49,152 2006-11-27 00:34:46 C:\WINDOWS\system32\VFind.exe
—-a-w 213,048 2005-05-24 09:27:16 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavss.dll
—-a-w 946,176 2007-09-07 09:29:00 C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavwebscan.dll
—-atw 16,384 2007-10-06 15:39:57 C:\WINDOWS\Temp\Perflib_Perfdata_120.dat
—-atw 16,384 2007-10-06 15:39:40 C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
—-atw 16,384 2007-10-06 15:39:52 C:\WINDOWS\Temp\Perflib_Perfdata_7a0.dat
—-atw 16,384 2007-10-06 15:39:51 C:\WINDOWS\Temp\Perflib_Perfdata_7e0.dat
.
—-a-w 108,032 2006-05-02 15:28:02 C:\WINDOWS\BDOSCAN8\bdcore.dll
—-a-w 132,608 2006-05-02 15:29:04 C:\WINDOWS\BDOSCAN8\libfn.dll
—-a-w 135,168 2007-07-11 23:22:00 C:\WINDOWS\system32\java.exe
—-a-w 135,168 2007-07-11 23:22:04 C:\WINDOWS\system32\javaw.exe
—-a-w 139,264 2007-07-12 00:22:38 C:\WINDOWS\system32\javaws.exe
—-a-w 69,838 2007-07-27 12:11:56 C:\WINDOWS\system32\perfc009.dat
—-a-w 88,850 2007-07-27 12:11:56 C:\WINDOWS\system32\perfc00A.dat
—-a-w 419,202 2007-07-27 12:11:56 C:\WINDOWS\system32\perfh009.dat
—-a-w 480,856 2007-07-27 12:11:56 C:\WINDOWS\system32\perfh00A.dat
—-atw 16,384 2007-10-04 10:57:45 C:\WINDOWS\Temp\Perflib_Perfdata_58c.dat
.
((((((((((((((((((((((((((((((((( Cargando Puntos Reg ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Nota* entradas vacías & entradas legítimas predeterminadas no son mostradas

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PopUpKiller"="C:\Archivos de programa\PopUp Killer\popupkiller.EXE" [2001-09-22 09:36]
"avast!"="C:\ARCHIV~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 12:06]
"SoundMan"="SOUNDMAN.EXE" [2005-06-20 15:42 C:\WINDOWS\soundman.exe]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-10-29 16:50]
"nwiz"="nwiz.exe" [2004-10-29 16:50 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2004-10-29 16:50]
"Sunkist2k"="C:\Archivos de programa\Multimedia Card Reader\shwicon2k.exe" [2005-10-07 17:42]
"Run StartupMonitor"="StartupMonitor.exe" [2000-05-20 17:23 C:\WINDOWS\StartupMonitor.exe]
"CARPService"="carpserv.exe" [2001-12-23 13:02 C:\WINDOWS\system32\carpserv.exe]
"USB Storage Toolbox"="C:\Archivos de programa\USB Disk Win98 Driver\Res.EXE" []
"SunJavaUpdateSched"="C:\Archivos de programa\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-19 15:42]
"kdx"="C:\Archivos de programa\Kontiki\KHost.exe" [2006-11-08 18:32]
"L06EXLRD_2843906"="C:\Archivos de programa\Microsoft Student\Microsoft Student 2006 - DVD\EDICT.exe" [2005-06-04 18:03]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^BlueSoleil.lnk]
path=C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\BlueSoleil.lnk
backup=C:\WINDOWS\pss\BlueSoleil.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Net2 Server.lnk]
path=C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Net2 Server.lnk
backup=C:\WINDOWS\pss\Net2 Server.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menú Inicio^Programas^Inicio^Privoxy.lnk]
path=C:\Documents and Settings\All Users\Menú Inicio\Programas\Inicio\Privoxy.lnk
backup=C:\WINDOWS\pss\Privoxy.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^XP^Menú Inicio^Programas^Inicio^Registration-InstantCopy.lnk]
path=C:\Documents and Settings\XP\Menú Inicio\Programas\Inicio\Registration-InstantCopy.lnk
backup=C:\WINDOWS\pss\Registration-InstantCopy.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ActualizacionVIP]
rundll32.exe C:\WINDOWS\System32\MSA64CHK.dll,DllMostrar Matrix_HTML:ActualizacionVIP:t

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lycosInside]
C:\Archivos de programa\lycos\Lyc_SysTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsgCenterExe]
"C:\Archivos de programa\Archivos comunes\Real\Update_OB\RealOneMessageCenter.exe" -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Archivos de programa\MSN Messenger\msnmsgr.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NetServer]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"NetSvc"=2 (0x2)
"BthServ"=2 (0x2)

R0 HWFProt;Hywave File Protector HWFProt;C:\WINDOWS\system32\Drivers\HWFProt.sys
R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R0 VOBID;VOBID;C:\WINDOWS\system32\DRIVERS\vobid.sys
R2 MSSQL$NET2;MSSQL$NET2;"C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Binn\sqlservr.exe" -sNET2
R2 sbbotdi;sbbotdi;\??\C:\ARCHIV~1\SPEEDB~1\sbbotdi.sys
R2 StreamDispatcher;StreamDispatcher;C:\WINDOWS\system32\DRIVERS\strmdisp.sys
S2 Ca504av;Mega Camera, WDM Video Capture;C:\WINDOWS\system32\Drivers\Ca504av.sys
S3 adiusbae;USB ADSL LAN Adapter;C:\WINDOWS\system32\DRIVERS\adiusbae.sys
S3 BT4501G;SpeedTouch 121g Wireless USB Adapter Driver;C:\WINDOWS\system32\DRIVERS\BT4501G.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\system32\ntsim.sys
S3 SQLAgent$NET2;SQLAgent$NET2;"C:\Archivos de programa\Microsoft SQL Server\MSSQL$NET2\Binn\sqlagent.EXE" -i NET2
S3 USBCamera;Mega Camera Still Image Capture, Version 1.00;C:\WINDOWS\system32\Drivers\Bulk504.sys
S3 V2210VID;DigitalCam Pro;C:\WINDOWS\system32\DRIVERS\V2210vid.sys
S3 WrKPoET2000;WrKPoET2000;\??\C:\Archivos de programa\WinPoET Broadband Connection\WrKPoET2000.sys

.
Contenido de carpeta 'Tareas Programadas'
"2007-05-26 07:00:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
"2007-10-06 20:28:06 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
.
**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-10-06 22:28:57
Windows 5.1.2600 Service Pack 2 NTFS

escaneando procesos ocultos …

escaneando entradas ocultas de autostart …

escaneando archivos ocultos …

el escaneo se completo con exito
archivos ocultos: 0

**************************************************************************
.
Tiempo completado: 2007-10-06 22:30:02
C:\ComboFix-quarantined-files.txt … 2007-10-06 22:29
C:\ComboFix2.txt … 2007-10-06 10:33
C:\ComboFix3.txt … 2007-10-04 21:59
.
— E O F —
Thanks