[Resolved] Slow operation/blue screen shutdown

Three times today my computer has shut down after flashing a blue screen with text that disappears to quickly to read. After restarting automatically, Windows Error Reporting is corrupted also. Getting frequent messages from SpyBot Resident about changes to registry related to "WinLogon Notifiers" (cryptnet; crypt32; cscdll). Any assistance would be much appreciated.

Logfile of HijackThis v1.99.1
Scan saved at 10:39:48 PM, on 12/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\jschmitz\Desktop\AntiSpy\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {671EB3E7-0955-03FE-2BB4-0495CBA2819E} - (no file)
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ADOBE GAMMA LOADER.EXE.LNK = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRA~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks for your help. Still mucho problemas, but here's what I've got for you:

1) Norton subscription is up to date (67 days remaining).

2a) Virus Total Scan- 0 bytes size received / Se ha recibido un archivo vacio
Jotti Scan- The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware
is prohibiting you from uploading this file.

3) KasperSky Scan- I tried several times to run the Extended scan on My Computer, but my system would shut down at around 30% scanned (which took an hour). So, I ran the Standard scan on Critical Areas and was able to at least complete that scan. Here are the results:

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Saturday, December 29, 2007 3:36:45 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 29/12/2007
Kaspersky Anti-Virus database records: 467234
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: standard
Scan Archives: true
Scan Mail Bases: true

Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\jschmitz\LOCALS~1\Temp\

Scan Statistics:
Total number of scanned objects: 25840
Number of viruses found: 1
Number of infected objects: 2
Number of suspicious objects: 0
Duration of the scan process: 00:49:54

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat
Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\ast_4_mm.exe/WISE0007.BIN Infected: Trojan-Downloader.Win32.VB.ah skipped
C:\WINDOWS\ast_4_mm.exe WiseSFX: infected - 1 skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\DOCUME~1\jschmitz\LOCALS~1\Temp\~DF5E3D.tmp Object is locked skipped
C:\DOCUME~1\jschmitz\LOCALS~1\Temp\~DFF613.tmp Object is locked skipped
C:\DOCUME~1\jschmitz\LOCALS~1\Temp\~DF621A.tmp Object is locked skipped
C:\DOCUME~1\jschmitz\LOCALS~1\Temp\~DF62E1.tmp Object is locked skipped

Scan process completed.

4) HiJack This Uninstall list:
4x4 Evo2
Adaptec DirectCD
Ad-Aware SE Personal
Adobe Acrobat 4.0
Adobe Atmosphere Player for Acrobat and Adobe Reader
Adobe Download Manager 1.2 (Remove Only)
Adobe Flash Player 9 ActiveX
Adobe Photoshop 5.0
Adobe Reader 7.0.8
Adobe Shockwave Player
Apple Mobile Device Support
Apple Software Update
a-squared Free 1.6.1
Audio Manager
AVG Anti-Spyware 7.5
BUM
CardRd81
ccCommon
CCScore
Chopper XP 2.7
C-Media 3D Audio
CR2
Digital Teacher Resources
EnZip
ESSBrwr
ESSCDBK
ESScore
ESSgui
ESShelp
ESSini
ESSPCD
ESSPDock
ESSSONIC
ESSTOOLS
essvatgt
essvatgt
essvcpt
FilmLoop Player
Full Tilt Poker
Google Earth
HijackThis 1.99.1
HLPPDOCK
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB914440)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
hp deskjet 5100 series
HP Photo and Imaging 2.0 - Deskjet Series
ICatch (VI) PC Camera
Instant Play Guitar Deluxe
Intel® Extreme Graphics 2 Driver
Intel® PRO Network Adapters and Drivers
Internet Explorer 7 Beta 2
Internet Worm Protection
iPod for Windows 2006-03-23
iTunes
Java 2 Runtime Environment, SE v1.4.2_05
Joint Task Force
Jumpstart 5th Grade v1.0
Kaspersky Online Scanner
kgcbase
Kodak EasyShare software
KSU
LiveUpdate 3.0 (Symantec Corporation)
LiveUpdate Notice (Symantec Corporation)
Math Blaster Ages 6-9
Math Blaster Ages 9-12 Demo
Math Blaster Mystery Demo
Microsoft .NET Framework 2.0
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 2000 Premium
Microsoft User-Mode Driver Framework Feature Pack 1.0
MSI Live Update 3
MSN Music Assistant
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
Music Coach Player
MusicIP Mixer 1.7
MySpace IM
MySpaceIM
NAVShortcut
Network Play System (Patching)
Norton AntiVirus 2006
Norton AntiVirus 2006 (Symantec Corporation)
Norton AntiVirus Help
Norton AntiVirus Parent MSI
Norton AntiVirus SYMLT MSI
Norton Protection Center
Norton WMI Update
Notifier
OfotoXMI
OTtBP
OTtBPSDK
PrintMaster 7.00
PrintMaster Gold 4.00
QuickTime
Reading Blaster Ages 9-12
RollerCoaster Tycoon
Security Update for Microsoft .NET Framework 2.0 (KB928365)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB883939)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896422)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896424)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB896688)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899588)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB903235)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB905915)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB908531)
Security Update for Windows XP (KB911280)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911567)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB912812)
Security Update for Windows XP (KB912919)
Security Update for Windows XP (KB913446)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917159)
Security Update for Windows XP (KB917422)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920214)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921398)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB921883)
Security Update for Windows XP (KB922616)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923694)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924191)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB944653)
Serif DrawPlus 3.0
SFR
SFR2
SHASTA
SimCity 2000® Special Edition
SimTheme Park
SKIN0001
SKINXSDK
Sound Blaster Live! Value
SPBBC
SpongeBob SquarePants® Operation Krabby Patty
Spybot - Search & Destroy 1.4
SpywareBlaster v3.5.1
SpywareGuard v2.2
Starcraft
staticcr
Stronghold Crusader
Symantec
Symantec KB-DocID:2003093015493306
Symantec Technical Support Web Controls
The Sims
The Third Dimension
TimeLiner 5.0
TuneLand
Uninstall Broadxent DSI Modem
Universal Media Player
Update for Windows XP (KB894391)
Update for Windows XP (KB896727)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB904942)
Update for Windows XP (KB910437)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB929338)
Update for Windows XP (KB930916)
Update for Windows XP (KB931836)
Update for Windows XP (KB933360)
Update for Windows XP (KB936357)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
URGE
USB CompactFlash Reader
USB SmartMedia Reader
Viewpoint Manager (Remove Only)
Viewpoint Media Player
VPRINTOL
Windows Defender Signatures
Windows Installer 3.1 (KB893803)
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Live Sign-in Assistant
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Hotfix - KB867282
Windows XP Hotfix - KB873333
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885250
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB887742
Windows XP Hotfix - KB888113
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890047
Windows XP Hotfix - KB890175
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB890923
Windows XP Hotfix - KB891781
Windows XP Hotfix - KB893066
Windows XP Hotfix - KB893086
WinMX
WinPatrol 8.0
WIRELESS
Worms Armageddon

5) Logfile of HijackThis v1.99.1
Scan saved at 3:49:51 PM, on 12/29/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\jschmitz\Desktop\AntiSpy\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ADOBE GAMMA LOADER.EXE.LNK = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRA~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Standing by for further instructions,
Jeff

Was able to complete all tasks you assigned. Unfortunately, poor performance persists. It takes 2-3 minutes just to open my homepage! Under the processes tab in Windows Task Manager, a process called "services.exe" is sucking up all of my CPU (always 85-100%). I'm also getting prompts that my "Virtual Memory Minimum" is too low. Anyway, here are the logs you requested:

1) Combofix Log

ComboFix 07-12-31.4 - jschmitz 2007-12-30 23:48:41.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.56 [GMT -8:00]
Running from: C:\WINDOWS\Temporary Internet Files\Content.IE5\BKSCKGDY\ComboFix[1].exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\start.exe
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\uninstall.exe

.
((((((((((((((((((((((((( Files Created from 2007-11-28 to 2007-12-31 )))))))))))))))))))))))))))))))
.

2007-12-30 23:45 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-12-30 23:38 . 2007-12-30 23:38 d——– C:\Program Files\Sun
2007-12-30 23:38 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\SYSTEM32\javacpl.cpl
2007-12-30 23:20 . 2007-12-30 23:20 d——– C:\Program Files\Common Files\Java
2007-12-28 15:09 . 2007-12-30 23:05 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-28 15:09 . 2007-12-28 15:09 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-28 13:45 . 2007-12-28 13:45 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-28 13:45 . 2007-12-28 13:45 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-27 22:15 . 2007-12-27 22:15 d–hs—- C:\FOUND.001
2007-12-27 13:51 . 2007-12-27 13:51 d–hs—- C:\FOUND.000
2007-12-25 14:35 . 2007-12-25 14:35 244 –ah—– C:\sqmnoopt03.sqm
2007-12-25 14:35 . 2007-12-25 14:35 244 –ah—– C:\sqmnoopt02.sqm
2007-12-25 14:35 . 2007-12-25 14:35 232 –ah—– C:\sqmdata03.sqm
2007-12-25 14:35 . 2007-12-25 14:35 232 –ah—– C:\sqmdata02.sqm
2007-12-25 14:34 . 2007-12-25 14:34 244 –ah—– C:\sqmnoopt01.sqm
2007-12-25 14:34 . 2007-12-25 14:34 244 –ah—– C:\sqmnoopt00.sqm
2007-12-25 14:34 . 2007-12-25 14:34 232 –ah—– C:\sqmdata01.sqm
2007-12-25 14:34 . 2007-12-25 14:34 232 –ah—– C:\sqmdata00.sqm
2007-12-08 08:29 . 2007-12-08 08:29 d——– C:\Documents and Settings\NetworkService\Application Data\Apple
2007-11-24 23:56 . 2007-10-10 15:55 6,065,664 ——— C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2007-11-24 23:56 . 2007-04-17 01:32 2,455,488 ——— C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dat
2007-11-24 23:56 . 2007-03-07 21:10 991,232 ——— C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll.mui
2007-11-24 23:56 . 2007-10-10 15:55 459,264 ——— C:\WINDOWS\SYSTEM32\dllcache\msfeeds.dll
2007-11-24 23:56 . 2007-10-10 15:55 383,488 ——— C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dll
2007-11-24 23:56 . 2007-10-10 15:55 267,776 ——— C:\WINDOWS\SYSTEM32\dllcache\iertutil.dll
2007-11-24 23:56 . 2007-10-10 15:55 63,488 ——— C:\WINDOWS\SYSTEM32\dllcache\icardie.dll
2007-11-24 23:56 . 2007-10-10 15:55 52,224 ——— C:\WINDOWS\SYSTEM32\dllcache\msfeedsbs.dll
2007-11-24 23:56 . 2007-10-10 02:59 13,824 ——— C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 20:39 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-28 20:39 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-28 20:39 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-28 20:39 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:42 3,590,656 ——w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-28 01:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-28 01:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2007-10-10 23:56 824,832 ——w C:\WINDOWS\SYSTEM32\dllcache\wininet.dll
2007-10-10 23:56 671,232 ——w C:\WINDOWS\SYSTEM32\dllcache\mstime.dll
2007-10-10 23:56 232,960 ——w C:\WINDOWS\SYSTEM32\dllcache\webcheck.dll
2007-10-10 23:56 105,984 ——w C:\WINDOWS\SYSTEM32\dllcache\url.dll
2007-10-10 23:56 102,400 ——w C:\WINDOWS\SYSTEM32\dllcache\occache.dll
2007-10-10 23:56 1,159,680 ——w C:\WINDOWS\SYSTEM32\dllcache\urlmon.dll
2007-10-10 23:55 478,208 ——w C:\WINDOWS\SYSTEM32\dllcache\mshtmled.dll
2007-10-10 23:55 44,544 ——w C:\WINDOWS\SYSTEM32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ——w C:\WINDOWS\SYSTEM32\dllcache\iedkcs32.dll
2007-10-10 23:55 27,648 ——w C:\WINDOWS\SYSTEM32\dllcache\jsproxy.dll
2007-10-10 23:55 230,400 ——w C:\WINDOWS\SYSTEM32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ——w C:\WINDOWS\SYSTEM32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ——w C:\WINDOWS\SYSTEM32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ——w C:\WINDOWS\SYSTEM32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ——w C:\WINDOWS\SYSTEM32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ——w C:\WINDOWS\SYSTEM32\dllcache\advpack.dll
2007-10-10 10:59 70,656 ——w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ——w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2007-10-01 22:49 542,088 —-a-w C:\WINDOWS\SYSTEM32\SymNeti.dll
2007-10-01 22:49 161,160 —-a-w C:\WINDOWS\SYSTEM32\SymRedir.dll
2005-04-16 20:18 23,856 —-a-w C:\Documents and Settings\jschmitz\Application Data\GDIPFONTCACHEV1.DAT
2005-02-21 20:27 271 –sh–w C:\Program Files\desktop.ini
2005-02-21 20:27 23,357 —h–w C:\Program Files\folder.htt
2003-12-31 22:38 203,189 —-a-w C:\Program Files\spampal-1.53-binaries.zip
2003-10-24 20:15 427,303 —-a-w C:\Program Files\spampal-beta-1.52.exe
2003-10-24 20:07 582,937 —-a-w C:\Program Files\spampal-1.50.exe
2002-05-31 05:27 7,432 —-a-w C:\Program Files\AagB2F4.exe
2002-05-31 05:25 7,432 —-a-w C:\Program Files\Msk9223.exe
2002-05-31 05:23 7,432 —-a-w C:\Program Files\Vyd7304.exe
2002-05-31 05:16 7,432 —-a-w C:\Program Files\Vn1A2.exe
2002-05-30 18:43 7,432 —-a-w C:\Program Files\XcqB215.exe
2002-05-30 07:00 7,432 —-a-w C:\Program Files\Ttx312.exe
2002-05-30 06:58 7,432 —-a-w C:\Program Files\QvyA1F2.exe
2002-05-30 06:53 7,432 —-a-w C:\Program Files\Jvo5136.exe
2002-05-30 06:49 7,432 —-a-w C:\Program Files\Ube394.exe
2002-05-30 06:45 7,432 —-a-w C:\Program Files\FofD0C0.exe
2002-05-30 06:43 7,432 —-a-w C:\Program Files\YIB294.EXE
2002-05-30 06:41 7,432 —-a-w C:\Program Files\Ohl9175.exe
2002-05-30 06:30 7,432 —-a-w C:\Program Files\BAYE0A2.EXE
2002-05-30 06:10 7,432 —-a-w C:\Program Files\NksA1A5.exe
2002-05-30 06:05 7,432 —-a-w C:\Program Files\Tf5324.exe
2002-05-30 06:02 7,432 —-a-w C:\Program Files\Rin21F1.exe
2002-05-30 05:43 7,432 —-a-w C:\Program Files\KwbB1A6.exe
2002-05-30 05:38 7,432 —-a-w C:\Program Files\Ctk6335.exe
2002-05-30 05:30 7,432 —-a-w C:\Program Files\YzaE342.exe
2002-05-30 05:20 7,432 —-a-w C:\Program Files\Rhm4061.exe
2002-05-30 05:17 7,432 —-a-w C:\Program Files\Shm10E4.exe
2002-05-30 05:13 7,432 —-a-w C:\Program Files\XerD070.exe
2002-05-30 05:11 7,432 —-a-w C:\Program Files\MgB253.exe
2002-05-30 05:09 7,432 —-a-w C:\Program Files\Fua9103.exe
2002-05-30 05:07 7,432 —-a-w C:\Program Files\Fcj7070.exe
2002-05-27 09:53 7,432 —-a-w C:\Program Files\Ew50F6.exe
2002-05-27 09:31 7,432 —-a-w C:\Program Files\VjhF076.exe
2002-05-27 09:28 7,432 —-a-w C:\Program Files\UpfC141.exe
2002-05-22 19:32 7,432 —-a-w C:\Program Files\Si355.exe
2002-05-22 19:18 7,432 —-a-w C:\Program Files\Ic2211.exe
2002-05-21 19:15 7,432 —-a-w C:\Program Files\GaF091.exe
2002-05-17 08:38 7,432 —-a-w C:\Program Files\HAH62E0.EXE
2002-05-17 08:37 7,432 —-a-w C:\Program Files\WFJ50F0.EXE
2002-05-17 08:34 7,432 —-a-w C:\Program Files\LZ2195.EXE
2002-05-17 08:06 7,432 —-a-w C:\Program Files\Keu62B1.exe
2002-05-17 08:02 7,432 —-a-w C:\Program Files\Kn2353.exe
2002-05-17 08:00 7,432 —-a-w C:\Program Files\Ic2F4.exe
2002-05-17 07:47 7,432 —-a-w C:\Program Files\ExtF1C4.exe
2002-05-17 07:40 7,432 —-a-w C:\Program Files\Cp80A4.exe
2002-05-17 07:39 7,432 —-a-w C:\Program Files\Jav7006.exe
2002-05-17 07:37 7,432 —-a-w C:\Program Files\Ubg5326.exe
2002-05-17 07:36 7,432 —-a-w C:\Program Files\Zhb4085.exe
2002-05-17 07:17 7,432 —-a-w C:\Program Files\Fr11F5.exe
2002-05-17 07:16 7,432 —-a-w C:\Program Files\Pa226.exe
2002-05-17 07:15 7,432 —-a-w C:\Program Files\NvF386.exe
2002-05-17 07:14 7,432 —-a-w C:\Program Files\UjfE286.exe
2002-05-17 07:13 7,432 —-a-w C:\Program Files\HoyD305.exe
2002-05-17 07:12 7,432 —-a-w C:\Program Files\ZgqC015.exe
2002-05-17 05:36 7,432 —-a-w C:\Program Files\Yzo4122.exe
2002-05-17 05:33 7,432 —-a-w C:\Program Files\Fs1301.exe
2002-05-17 05:32 7,432 —-a-w C:\Program Files\Ncv225.exe
2002-05-16 19:11 7,432 —-a-w C:\Program Files\ZxoB075.exe
2002-05-16 17:19 7,432 —-a-w C:\Program Files\Imf3361.exe
2002-05-16 07:11 7,432 —-a-w C:\Program Files\JpzB084.exe
2002-05-16 06:13 7,432 —-a-w C:\Program Files\PbD233.exe
2002-05-15 20:16 7,432 —-a-w C:\Program Files\Ar92.exe
2002-05-15 20:07 7,432 —-a-w C:\Program Files\Ocg7164.exe
2002-05-15 19:37 7,432 —-a-w C:\Program Files\Cat5074.exe
2002-05-15 19:34 7,432 —-a-w C:\Program Files\Zy2052.exe
2002-05-08 20:33 401,408 —-a-w C:\Program Files\Project.exe
2004-11-18 06:12 8 –sh–w C:\WINDOWS\DRM\pdrm.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2004-08-04 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-06 11:45 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-06 11:41 118784]
"Cmaudio"="cmicnfg.cpl" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 02:34 172032]
"LiveMonitor"="C:\Program Files\MSI\Live Update 3\LMonitor.exe" [2005-07-11 10:44 482816]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 00:50 204800]
"gcasServ"="C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" [ ]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19 52840]
"NAV CfgWiz"="C:\Program Files\Norton AntiVirus\CfgWiz.exe" [2006-02-01 22:10 120512]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"QuickTime Task"="C:\WINDOWS\SYSTEM32\qttask.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

C:\Documents and Settings\jschmitz\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ADOBE GAMMA LOADER.EXE.LNK - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-03-10 21:51:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000
"NoRecentDocsHistory"= 01000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000
"NoRecentDocsHistory"= 01000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
"PCCIOMON.exe"="C:\Program Files\Trend Micro\Internet Security\PCCIOMON.exe"
"PCClient.exe"="C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
"TM Outbreak Agent"="C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
"IgfxTray"=C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE
"HotKeysCmds"=C:\WINDOWS\SYSTEM32\HKCMD.EXE
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"HPDJ Taskbar Utility"=C:\WINDOWS\SYSTEM32\hpztsb08.exe
"HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
"DeviceDiscovery"=C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
"EssSpkPhone"=essspk.exe
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

S3 USB20L;Linksys USB 2.0 10/100 Adapter;C:\WINDOWS\system32\DRIVERS\USB200M.sys [2002-09-23 22:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a

*Newly Created Service* - PROCEXP90

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\cc647e57-209b-462f-8a97-655338836cb3]
C:\WINDOWS\qawpap.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
Contents of the 'Scheduled Tasks' folder
"2007-12-06 07:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2007-12-31 07:50:56 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2007-12-25 09:00:04 C:\WINDOWS\Tasks\Maintenance-Defragment programs.job"
- C:\WINDOWS\DEFRAG.EXE
"2007-12-29 04:10:44 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - jschmitz.job"
- C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
"2007-12-29 16:29:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-30 23:54:29
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

C:\WINDOWS\system32cleanmgr.exe 65536 bytes
C:\WINDOWS\system32clean.config 49152 bytes
C:\WINDOWS\system32clean61f6-59e4.sys 131072 bytes

scan completed successfully
hidden files: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\clean61f6-59e4]
"ImagePath"="\??\C:\WINDOWS\system32\clean61f6-59e4.sys"
.
Completion time: 2007-12-30 23:56:31
C:\qoobox\ComboFix-quarantined-files.txt 2007-12-31 07:56:24
.
2007-12-12 11:06:16 — E O F —

2) HiJackThis Log

Logfile of HijackThis v1.99.1
Scan saved at 11:59:06 PM, on 12/30/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Documents and Settings\jschmitz\Desktop\AntiSpy\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ADOBE GAMMA LOADER.EXE.LNK = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRA~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks,
Jeff

Hi

Step 1

Please go to VirusTotal or Jotti and upload C:\Program Files\Project.exe for scanning.

For VirusTotal:

• Please copy and paste C:\Program Files\Project.exe in the text box next to the Browse… button.
• Click on Send File.

For Jotti:

• Please copy and paste C:\Program Files\Project.exe in the text box next to the Browse… button.
• Click on Submit.

Copy/paste the results in Notepad and save them to your desktop.

Also do this for C:\Program Files\AagB2F4.exe.

Step 2

Please download Deckard's System Scanner (DSS) and save it to your desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• When it has finished, Deckard's System Scanner will open two Notepad files: main.txt and extra.txt - please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply, along with the Virusotal/Jotti results and a new HijackThis log.

Performance is improving somewhat. During the Deckard scan, Norton detected and removed Trojan.Peacomm. Here are the scan results you requested:

1) VirusTotal Scan on C:\Program Files\Project.exe

File Project.exe received on 12.31.2007 18:15:58 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED


Result: 0/32 (0%)
Loading server information…
Your file is queued in position: ___.
Estimated start time is between ___ and ___ .
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2008.1.1.10 2007.12.31 -
AntiVir 7.6.0.46 2007.12.31 -
Authentium 4.93.8 2007.12.30 -
Avast 4.7.1098.0 2007.12.30 -
AVG 7.5.0.516 2007.12.31 -
BitDefender 7.2 2007.12.31 -
CAT-QuickHeal 9.00 2007.12.31 -
ClamAV 0.91.2 2007.12.31 -
DrWeb 4.44.0.09170 2007.12.31 -
eSafe 7.0.15.0 2007.12.31 -
eTrust-Vet 31.3.5419 2007.12.31 -
Ewido 4.0 2007.12.31 -
FileAdvisor 1 2007.12.31 -
Fortinet 3.14.0.0 2007.12.31 -
F-Prot 4.4.2.54 2007.12.31 -
F-Secure 6.70.13030.0 2007.12.31 -
Ikarus T3.1.1.15 2007.12.31 -
Kaspersky 7.0.0.125 2007.12.31 -
McAfee 5195 2007.12.28 -
Microsoft 1.3109 2007.12.31 -
NOD32v2 2758 2007.12.31 -
Norman 5.80.02 2007.12.31 -
Panda 9.0.0.4 2007.12.31 -
Prevx1 V2 2007.12.31 -
Rising 20.24.52.00 2007.12.29 -
Sophos 4.24.0 2007.12.31 -
Sunbelt 2.2.907.0 2007.12.30 -
Symantec 10 2007.12.31 -
TheHacker 6.2.9.175 2007.12.29 -
VBA32 3.12.2.5 2007.12.29 -
VirusBuster 4.3.26:9 2007.12.31 -
Webwasher-Gateway 6.6.2 2007.12.31 -
Additional information
File size: 401408 bytes
MD5: 7fa4b98cb09aede9496115320e7d5352
SHA1: bea85e6e9986788bb8c9e7c464625862cf5cbb60
PEiD: Armadillo v1.71

2) VirusTotal Scan on C:\Program Files\AagB2F4.exe

File AagB2F4.exe received on 12.31.2007 18:34:49 (CET)
Current status: Loading … queued waiting scanning finished NOT FOUND STOPPED


Result: 2/32 (6.25%)
Loading server information…
Your file is queued in position: 4.
Estimated start time is between 47 and 68 seconds.
Do not close the window until scan is complete.
The scanner that was processing your file is stopped at this moment, we are going to wait a few seconds to try to recover your result.
If you are waiting for more than five minutes you have to resend your file.
Your file is being scanned by VirusTotal in this moment,
results will be shown as they're generated.
Compact Print results
Your file has expired or does not exists.
Service is stopped in this moments, your file is waiting to be scanned (position: ) for an undefined time.

You can wait for web response (automatic reload) or type your email in the form below and click "request" so the system sends you a notification when the scan is finished.
Email:


Antivirus Version Last Update Result
AhnLab-V3 2008.1.1.10 2007.12.31 -
AntiVir 7.6.0.46 2007.12.31 -
Authentium 4.93.8 2007.12.30 -
Avast 4.7.1098.0 2007.12.30 -
AVG 7.5.0.516 2007.12.31 -
BitDefender 7.2 2007.12.31 -
CAT-QuickHeal 9.00 2007.12.31 (Suspicious) - DNAScan
ClamAV 0.91.2 2007.12.31 -
DrWeb 4.44.0.09170 2007.12.31 -
eSafe 7.0.15.0 2007.12.31 -
eTrust-Vet 31.3.5419 2007.12.31 -
Ewido 4.0 2007.12.31 -
FileAdvisor 1 2007.12.31 -
Fortinet 3.14.0.0 2007.12.31 -
F-Prot 4.4.2.54 2007.12.31 -
F-Secure 6.70.13030.0 2007.12.31 -
Ikarus T3.1.1.15 2007.12.31 -
Kaspersky 7.0.0.125 2007.12.31 -
McAfee 5195 2007.12.28 -
Microsoft 1.3109 2007.12.31 -
NOD32v2 2758 2007.12.31 -
Norman 5.80.02 2007.12.31 -
Panda 9.0.0.4 2007.12.31 Suspicious file
Prevx1 V2 2007.12.31 -
Rising 20.24.52.00 2007.12.29 -
Sophos 4.24.0 2007.12.31 -
Sunbelt 2.2.907.0 2007.12.30 -
Symantec 10 2007.12.31 -
TheHacker 6.2.9.175 2007.12.29 -
VBA32 3.12.2.5 2007.12.29 -
VirusBuster 4.3.26:9 2007.12.31 -
Webwasher-Gateway 6.6.2 2007.12.31 -
Additional information
File size: 7432 bytes
MD5: 1ea478699c44236d1e390dab937651d4
SHA1: 4e32353410ed787e80faaa59d3e4d1d427772520
PEiD: -

3) Deckard Scan Main.txt

Deckard's System Scanner v20071014.68
Run by [removed] on 2007-12-31 10:34:49
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
48: 2007-12-31 18:35:53 UTC - RP898 - Deckard's System Scanner Restore Point
47: 2007-12-31 07:46:58 UTC - RP897 - ComboFix created restore point
46: 2007-12-31 07:34:15 UTC - RP896 - Installed Java™ 6 Update 3
45: 2007-12-31 07:20:08 UTC - RP895 - Installed Java™ SE Development Kit 6 Update 3
44: 2007-12-31 06:53:21 UTC - RP894 - Removed Java 2 Runtime Environment, SE v1.4.2_05


– First Restore Point –
1: 2007-11-25 08:03:32 UTC - RP851 - Installed Windows XP KB915865.


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 248 MiB (512 MiB recommended).


– HijackThis (run as jschmitz.exe) ——————————————–

Unable to find log (file not found); running clone.
– HijackThis Clone ————————————————————


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-12-31 10:38:53
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\SYSTEM32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\SYSTEM32\services.exe
C:\WINDOWS\SYSTEM32\lsass.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\SYSTEM32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\SYSTEM32\svchost.exe
C:\WINDOWS\SYSTEM32\hkcmd.exe
C:\WINDOWS\SYSTEM32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SYSTEM32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Norton AntiVirus\Navw32.exe
C:\WINDOWS\Temporary Internet Files\Content.IE5\WP5CA9H5\dss[1].exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Norton AntiVirus\CfgWiz.exe" /GUID {0D7956A2-5A08-4ec2-A72C-DF8495A66016} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM32\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ADOBE GAMMA LOADER.EXE.LNK = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRA~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O15 - Trusted Zone: https://owa.vusd.k12.ca.us (HKCU)
O16 - DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} (Microsoft Office Template and Media Control) - http://office.microsoft.com/templates/ieawsdc.cab
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4B48D5DF-9021-45F7-A240-60304302A215} (Malicious Software Removal Tool) - http://download.microsoft.com/download/b/d…/WebCleaner.cab
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} () - http://v4.windowsupdate.microsoft.com/CAB/…8146.8594328704
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.macromedia.com/get/flash…ent/swflash.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\MSN Messenger\msgrapp.8.1.0178.00.dll
O18 - Protocol: ndwiat - {13F3EA8B-91D7-4F0A-AD76-D2853AC8BECE} - C:\WINDOWS\SYSTEM32\wiascr.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_0.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\NAVAPSVC.EXE
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe


–
End of file - 10376 bytes

– HijackThis Fixed Entries (C:\DOCUME~1\jschmitz\Desktop\AntiSpy\backups\) —-

backup-20060122-154708-972 R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
backup-20060122-154708-752 O2 - BHO: (no name) - {671EB3E7-0955-03FE-2BB4-0495CBA2819E} - (no file)
backup-20060122-154708-899 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
backup-20060122-154708-722 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
backup-20060122-154708-989 O4 - Global Startup: MICROSOFT OFFICE.LNK = C:\Program Files\Microsoft Office\Office\OSA9.EXE
backup-20071228-133537-453 R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = http://www.begin2search.com/sidesearch.html
backup-20071228-133537-679 O2 - BHO: (no name) - {671EB3E7-0955-03FE-2BB4-0495CBA2819E} - (no file)
backup-20071228-133537-147 O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
backup-20071228-133538-186 O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)
backup-20071228-133538-626 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
backup-20071228-133538-944 O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} (Shockwave ActiveX Control) -
backup-20071228-133548-269 O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
backup-20071228-133550-740 O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} -
backup-20071229-120357-902 O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

– File Associations ———————————————————–

.bat - batfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,-153
.hlp - hlpfile - DefaultIcon - C:\WINDOWS\SYSTEM32\SHELL32.DLL,23
.ini - inifile - DefaultIcon - shell32.dll,-151
.js - JSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,35
.reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
.txt - txtfile - DefaultIcon - shell32.dll,-152
.vbs - VBSFile - DefaultIcon - C:\WINDOWS\system32\migicons.exe,34


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R2 clean61f6-59e4 - c:\windows\system32\clean61f6-59e4.sys

S3 USB20L (Linksys USB 2.0 10/100 Adapter) - c:\windows\system32\drivers\usb200m.sys

I'll look into upgrading my RAM ASAP. I was considering doing it anyway. Don't know what C:\Program Files\Project.exe or C:\Program Files\AagB2F4.exe are for. Should I double-click on them and see what happens? I was able to complete an extended Kaspersky scan this time, & it looks like it detected a bunch of bugs. Here are the scan results you requested.

1) VirusTotal & Jotti Logs

VirusTotal Scan Results:

0 bytes size received / Se ha recibido un archivo vacio


Jotti Scan Results:

The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file

2) ComboFix Log

ComboFix 07-12-31.4 - jschmitz 2008-01-01 18:50:01.2 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.58 [GMT -8:00]
Running from: C:\Program Files\ComboFix\ComboFix.exe
Command switches used :: C:\Program Files\ComboFix\CFScript.txt
* Created a new restore point

FILE
C:\WINDOWS\qawpap.exe
.

((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-01 18:42 . 2008-01-01 18:42 d——– C:\Program Files\ComboFix
2007-12-31 10:34 . 2007-12-31 10:34 d——– C:\Deckard
2007-12-30 23:45 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-12-30 23:38 . 2007-12-30 23:38 d——– C:\Program Files\Sun
2007-12-30 23:38 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\SYSTEM32\javacpl.cpl
2007-12-30 23:20 . 2007-12-30 23:20 d——– C:\Program Files\Common Files\Java
2007-12-28 15:09 . 2007-12-31 11:03 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-28 15:09 . 2007-12-28 15:09 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-28 13:45 . 2007-12-28 13:45 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-28 13:45 . 2007-12-28 13:45 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-27 22:15 . 2007-12-27 22:15 d–hs—- C:\FOUND.001
2007-12-27 13:51 . 2007-12-27 13:51 d–hs—- C:\FOUND.000
2007-12-26 10:12 . 2007-12-31 11:00 45,626 –a—— C:\WINDOWS\SYSTEM32\clean.config
2007-12-25 14:35 . 2007-12-25 14:35 244 –ah—– C:\sqmnoopt03.sqm
2007-12-25 14:35 . 2007-12-25 14:35 244 –ah—– C:\sqmnoopt02.sqm
2007-12-25 14:35 . 2007-12-25 14:35 232 –ah—– C:\sqmdata03.sqm
2007-12-25 14:35 . 2007-12-25 14:35 232 –ah—– C:\sqmdata02.sqm
2007-12-25 14:34 . 2007-12-25 14:34 244 –ah—– C:\sqmnoopt01.sqm
2007-12-25 14:34 . 2007-12-25 14:34 244 –ah—– C:\sqmnoopt00.sqm
2007-12-25 14:34 . 2007-12-25 14:34 232 –ah—– C:\sqmdata01.sqm
2007-12-25 14:34 . 2007-12-25 14:34 232 –ah—– C:\sqmdata00.sqm
2007-12-08 08:29 . 2007-12-08 08:29 d——– C:\Documents and Settings\NetworkService\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 20:39 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-28 20:39 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-28 20:39 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-28 20:39 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:42 3,590,656 ——w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-28 01:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-28 01:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2007-10-10 23:56 824,832 ——w C:\WINDOWS\SYSTEM32\dllcache\wininet.dll
2007-10-10 23:56 671,232 ——w C:\WINDOWS\SYSTEM32\dllcache\mstime.dll
2007-10-10 23:56 232,960 ——w C:\WINDOWS\SYSTEM32\dllcache\webcheck.dll
2007-10-10 23:56 105,984 ——w C:\WINDOWS\SYSTEM32\dllcache\url.dll
2007-10-10 23:56 102,400 ——w C:\WINDOWS\SYSTEM32\dllcache\occache.dll
2007-10-10 23:56 1,159,680 ——w C:\WINDOWS\SYSTEM32\dllcache\urlmon.dll
2007-10-10 23:55 63,488 ——w C:\WINDOWS\SYSTEM32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ——w C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ——w C:\WINDOWS\SYSTEM32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ——w C:\WINDOWS\SYSTEM32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ——w C:\WINDOWS\SYSTEM32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ——w C:\WINDOWS\SYSTEM32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ——w C:\WINDOWS\SYSTEM32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ——w C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ——w C:\WINDOWS\SYSTEM32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ——w C:\WINDOWS\SYSTEM32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ——w C:\WINDOWS\SYSTEM32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ——w C:\WINDOWS\SYSTEM32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ——w C:\WINDOWS\SYSTEM32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ——w C:\WINDOWS\SYSTEM32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ——w C:\WINDOWS\SYSTEM32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ——w C:\WINDOWS\SYSTEM32\dllcache\advpack.dll
2007-10-10 10:59 70,656 ——w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ——w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ——w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2005-04-16 20:18 23,856 —-a-w C:\Documents and Settings\jschmitz\Application Data\GDIPFONTCACHEV1.DAT
2005-02-21 20:27 271 –sh–w C:\Program Files\desktop.ini
2005-02-21 20:27 23,357 —h–w C:\Program Files\folder.htt
2003-12-31 22:38 203,189 —-a-w C:\Program Files\spampal-1.53-binaries.zip
2003-10-24 20:15 427,303 —-a-w C:\Program Files\spampal-beta-1.52.exe
2003-10-24 20:07 582,937 —-a-w C:\Program Files\spampal-1.50.exe
2002-05-31 05:27 7,432 —-a-w C:\Program Files\AagB2F4.exe
2002-05-31 05:25 7,432 —-a-w C:\Program Files\Msk9223.exe
2002-05-31 05:23 7,432 —-a-w C:\Program Files\Vyd7304.exe
2002-05-31 05:16 7,432 —-a-w C:\Program Files\Vn1A2.exe
2002-05-30 18:43 7,432 —-a-w C:\Program Files\XcqB215.exe
2002-05-30 07:00 7,432 —-a-w C:\Program Files\Ttx312.exe
2002-05-30 06:58 7,432 —-a-w C:\Program Files\QvyA1F2.exe
2002-05-30 06:53 7,432 —-a-w C:\Program Files\Jvo5136.exe
2002-05-30 06:49 7,432 —-a-w C:\Program Files\Ube394.exe
2002-05-30 06:45 7,432 —-a-w C:\Program Files\FofD0C0.exe
2002-05-30 06:43 7,432 —-a-w C:\Program Files\YIB294.EXE
2002-05-30 06:41 7,432 —-a-w C:\Program Files\Ohl9175.exe
2002-05-30 06:30 7,432 —-a-w C:\Program Files\BAYE0A2.EXE
2002-05-30 06:10 7,432 —-a-w C:\Program Files\NksA1A5.exe
2002-05-30 06:05 7,432 —-a-w C:\Program Files\Tf5324.exe
2002-05-30 06:02 7,432 —-a-w C:\Program Files\Rin21F1.exe
2002-05-30 05:43 7,432 —-a-w C:\Program Files\KwbB1A6.exe
2002-05-30 05:38 7,432 —-a-w C:\Program Files\Ctk6335.exe
2002-05-30 05:30 7,432 —-a-w C:\Program Files\YzaE342.exe
2002-05-30 05:20 7,432 —-a-w C:\Program Files\Rhm4061.exe
2002-05-30 05:17 7,432 —-a-w C:\Program Files\Shm10E4.exe
2002-05-30 05:13 7,432 —-a-w C:\Program Files\XerD070.exe
2002-05-30 05:11 7,432 —-a-w C:\Program Files\MgB253.exe
2002-05-30 05:09 7,432 —-a-w C:\Program Files\Fua9103.exe
2002-05-30 05:07 7,432 —-a-w C:\Program Files\Fcj7070.exe
2002-05-27 09:53 7,432 —-a-w C:\Program Files\Ew50F6.exe
2002-05-27 09:31 7,432 —-a-w C:\Program Files\VjhF076.exe
2002-05-27 09:28 7,432 —-a-w C:\Program Files\UpfC141.exe
2002-05-22 19:32 7,432 —-a-w C:\Program Files\Si355.exe
2002-05-22 19:18 7,432 —-a-w C:\Program Files\Ic2211.exe
2002-05-21 19:15 7,432 —-a-w C:\Program Files\GaF091.exe
2002-05-17 08:38 7,432 —-a-w C:\Program Files\HAH62E0.EXE
2002-05-17 08:37 7,432 —-a-w C:\Program Files\WFJ50F0.EXE
2002-05-17 08:34 7,432 —-a-w C:\Program Files\LZ2195.EXE
2002-05-17 08:06 7,432 —-a-w C:\Program Files\Keu62B1.exe
2002-05-17 08:02 7,432 —-a-w C:\Program Files\Kn2353.exe
2002-05-17 08:00 7,432 —-a-w C:\Program Files\Ic2F4.exe
2002-05-17 07:47 7,432 —-a-w C:\Program Files\ExtF1C4.exe
2002-05-17 07:40 7,432 —-a-w C:\Program Files\Cp80A4.exe
2002-05-17 07:39 7,432 —-a-w C:\Program Files\Jav7006.exe
2002-05-17 07:37 7,432 —-a-w C:\Program Files\Ubg5326.exe
2002-05-17 07:36 7,432 —-a-w C:\Program Files\Zhb4085.exe
2002-05-17 07:17 7,432 —-a-w C:\Program Files\Fr11F5.exe
2002-05-17 07:16 7,432 —-a-w C:\Program Files\Pa226.exe
2002-05-17 07:15 7,432 —-a-w C:\Program Files\NvF386.exe
2002-05-17 07:14 7,432 —-a-w C:\Program Files\UjfE286.exe
2002-05-17 07:13 7,432 —-a-w C:\Program Files\HoyD305.exe
2002-05-17 07:12 7,432 —-a-w C:\Program Files\ZgqC015.exe
2002-05-17 05:36 7,432 —-a-w C:\Program Files\Yzo4122.exe
2002-05-17 05:33 7,432 —-a-w C:\Program Files\Fs1301.exe
2002-05-17 05:32 7,432 —-a-w C:\Program Files\Ncv225.exe
2002-05-16 19:11 7,432 —-a-w C:\Program Files\ZxoB075.exe
2002-05-16 17:19 7,432 —-a-w C:\Program Files\Imf3361.exe
2002-05-16 07:11 7,432 —-a-w C:\Program Files\JpzB084.exe
2002-05-16 06:13 7,432 —-a-w C:\Program Files\PbD233.exe
2002-05-15 20:16 7,432 —-a-w C:\Program Files\Ar92.exe
2002-05-15 20:07 7,432 —-a-w C:\Program Files\Ocg7164.exe
2004-11-18 06:12 8 –sh–w C:\WINDOWS\DRM\pdrm.dat
.

((((((((((((((((((((((((((((( snapshot@2007-12-30_23.55.35.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 16:00:00 163,328 —-a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2004-08-04 20:00:00 64,000 —-a-w C:\WINDOWS\SYSTEM32\cleanmgr.exe
+ 2004-08-04 20:00:00 64,000 —-a-w C:\WINDOWS\SYSTEM32\dllcache\cleanmgr.exe
- 2007-12-31 07:42:32 2,981,888 —-a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-01 21:28:54 557,056 –sha-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2004-08-04 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-06 11:45 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-06 11:41 118784]
"Cmaudio"="cmicnfg.cpl" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 02:34 172032]
"LiveMonitor"="C:\Program Files\MSI\Live Update 3\LMonitor.exe" [2005-07-11 10:44 482816]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 00:50 204800]
"gcasServ"="C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" [ ]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19 52840]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

C:\Documents and Settings\jschmitz\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ADOBE GAMMA LOADER.EXE.LNK - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-03-10 21:51:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000
"NoRecentDocsHistory"= 01000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000
"NoRecentDocsHistory"= 01000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
"PCCIOMON.exe"="C:\Program Files\Trend Micro\Internet Security\PCCIOMON.exe"
"PCClient.exe"="C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
"TM Outbreak Agent"="C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
"IgfxTray"=C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE
"HotKeysCmds"=C:\WINDOWS\SYSTEM32\HKCMD.EXE
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"HPDJ Taskbar Utility"=C:\WINDOWS\SYSTEM32\hpztsb08.exe
"HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
"DeviceDiscovery"=C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
"EssSpkPhone"=essspk.exe
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

S3 USB20L;Linksys USB 2.0 10/100 Adapter;C:\WINDOWS\system32\DRIVERS\USB200M.sys [2002-09-23 22:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
Contents of the 'Scheduled Tasks' folder
"2007-12-06 07:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2008-01-02 02:58:02 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2008-01-01 09:00:02 C:\WINDOWS\Tasks\Maintenance-Defragment programs.job"
- C:\WINDOWS\DEFRAG.EXE
"2008-01-01 08:30:02 C:\WINDOWS\Tasks\Maintenance-Disk cleanup.job"
- C:\WINDOWS\CLEANMGR.EXE
"2007-12-29 04:10:44 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - jschmitz.job"
- C:\PROGRA~1\NORTON~1\Navw32.exeh/TASK:
"2007-12-29 16:29:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-01 18:56:24
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-01 19:00:01
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-02 02:59:48
C:\qoobox\ComboFix2.txt 2007-12-31 07:56:34
.
2007-12-12 11:06:16 — E O F —

3) KasperSky Scan Results

——————————————————————————-
KASPERSKY ONLINE SCANNER REPORT
Tuesday, January 01, 2008 9:46:54 PM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/01/2008
Kaspersky Anti-Virus database records: 501268
——————————————————————————-

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 74940
Number of viruses found: 11
Number of infected objects: 21
Number of suspicious objects: 0
Duration of the scan process: 01:19:56

Infected Object Name / Virus Name / Last Action
C:\WINDOWS\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\WINDOWS\SYSTEM32\awvvv.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skippedC:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\wbem\REPOSITORY\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\config\system.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\software.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\default.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\config\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\config\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\config\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\h323log.txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{6B96B145-00F7-4821-B3E3-5A62097CA995}.bin Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\SchedLog.Txt Object is locked skipped
C:\WINDOWS\iconzx.exe Infected: not-a-virus:AdWare.Win32.Zestyfind skipped
C:\WINDOWS\ast_4_mm.exe/WISE0001.BIN Infected: not-a-virus:AdWare.Win32.AdWast.a skipped
C:\WINDOWS\ast_4_mm.exe/WISE0007.BIN Infected: Trojan-Downloader.Win32.VB.ah skipped
C:\WINDOWS\ast_4_mm.exe WiseSFX: infected - 2 skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\EENGINE\EPERSIST.DAT Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcrst.dll Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPPolicy.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStart.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\SPStop.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBValid.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBConfig.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBRefr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBNotify.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetCfg2.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetUsr.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStHash.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetLoc.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSetDev.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDetect.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBDebug.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBStMSI.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMReg.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMRSt.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SPBBC\LOGS\BBSMNot.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDSYS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDFW.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDCON.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDALRT.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDIDS.log Object is locked skipped
C:\Program Files\Common Files\Symantec Shared\SNDDBG.log Object is locked skipped
C:\Program Files\Norton AntiVirus\Savrt\0866NAV~.TMP Object is locked skipped
C:\Program Files\Norton AntiVirus\Savrt\0868NAV~.TMP Object is locked skipped
C:\Program Files\Norton AntiVirus\AVVirus.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVApp.log Object is locked skipped
C:\Program Files\Norton AntiVirus\AVError.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\70597E1B.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ar skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\45EE726B.exe Infected: not-a-virus:AdWare.Win32.PurityScan.ar skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E797F9D.tmp Infected: Trojan.Java.ClassLoader.h skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1E7C299A.tmp Infected: Trojan.Java.ClassLoader.d skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AF6662E.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AF6662E.tmp ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\5AF6662E.tmp CryptFF: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\433C6DB6.tmp/File-packed_dataInfo.exe Infected: Email-Worm.Win32.Sober.y skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\433C6DB6.tmp ZIP: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\433C6DB6.tmp CryptFF: infected - 1 skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\569D727B.tmp Infected: Trojan-Downloader.Java.OpenConnection.aj skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\1ACF5ADE.dll Infected: not-a-virus:AdWare.Win32.WurldMedia.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\269C3D02.dll Infected: not-a-virus:AdWare.Win32.WurldMedia.b skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\44F509C6.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus\Quarantine\030953E4.sys Infected: Email-Worm.Win32.Zhelatin.pl skipped
C:\Documents and Settings\All Users\Application Data\Symantec\HPPHomePageActivity.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\HPPAppActivity.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\LiveUpdate\2008-01-01_Log.ALUSchedulerSvc.LiveUpdate Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Symantec\Common Client\settings.dat Object is locked skipped
C:\Documents and Settings\jschmitz\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\jschmitz\Local Settings\Temp\~DF40B2.tmp Object is locked skipped
C:\Documents and Settings\jschmitz\Local Settings\Temp\~DF31A8.tmp Object is locked skipped
C:\Documents and Settings\jschmitz\Local Settings\Temp\~DFA9.tmp Object is locked skipped
C:\Documents and Settings\jschmitz\Local Settings\Temp\~DFBE.tmp Object is locked skipped
C:\Documents and Settings\jschmitz\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\jschmitz\Local Settings\History\History.IE5\MSHist012008010120080102\index.dat Object is locked skipped
C:\Documents and Settings\jschmitz\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\jschmitz\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\jschmitz\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\jschmitz\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\jschmitz\Application Data\Symantec\PendingAlertsQueue.log Object is locked skipped
C:\Documents and Settings\jschmitz\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\System Volume Information\_restore{6BBDF0BF-AFFA-422D-A11D-7B894CBC6B95}\RP898\A0046821.sys Infected: Email-Worm.Win32.Zhelatin.pl skipped
C:\System Volume Information\_restore{6BBDF0BF-AFFA-422D-A11D-7B894CBC6B95}\RP900\change.log Object is locked skipped

Scan process completed.

4) HJT Log

Logfile of HijackThis v1.99.1
Scan saved at 9:49:05 PM, on 1/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
C:\Program Files\MSI\Live Update 3\LMonitor.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpywareGuard\sgmain.exe
C:\Program Files\SpywareGuard\sgbhp.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\jschmitz\Desktop\AntiSpy\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - C:\Program Files\SpywareGuard\dlprotect.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe
O4 - HKLM\..\Run: [LiveMonitor] C:\Program Files\MSI\Live Update 3\LMonitor.exe
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: SpywareGuard.lnk = C:\Program Files\SpywareGuard\sgmain.exe
O4 - Global Startup: ADOBE GAMMA LOADER.EXE.LNK = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: &AIM Search - res://C:\PROGRA~1\AIMTOO~1\AIMBAR.DLL/aimsearch.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/u…can_unicode.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {4E330863-6A11-11D0-BFD8-006097237877} (InstallFromTheWeb ActiveX Control) - http://tw.msi.com.tw/autobios/client/iftwclix.cab
O16 - DPF: {A82C3A33-5C0E-466C-B020-71585433A7E4} (PhxStudent.OeSetup15) - https://mycampus.phoenix.edu/secure/PhxStudent15.CAB
O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj…ploadClient.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} -
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab
O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Unknown owner - C:\WINDOWS\system32\drivers\KodakCCS.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Unknown owner - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PifEng.dll (file missing)
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

Thanks,
Jeff

Computer running much more smoothly now. Thanks a million. Here's the combofix log you requested:

ComboFix 07-12-31.4 - jschmitz 2008-01-02 11:25:27.3 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.56 [GMT -8:00]Running from: C:\Program Files\ComboFix\ComboFix.exe
Command switches used :: C:\Program Files\ComboFix\CFScript.txt
* Created a new restore point

FILE
C:\Program Files\AagB2F4.exe
C:\Program Files\Ar92.exe
C:\Program Files\BAYE0A2.EXE
C:\Program Files\Cat5074.exe
C:\Program Files\Cp80A4.exe
C:\Program Files\Ctk6335.exe
C:\Program Files\Ew50F6.exe
C:\Program Files\ExtF1C4.exe
C:\Program Files\Fcj7070.exe
C:\Program Files\FofD0C0.exe
C:\Program Files\Fr11F5.exe
C:\Program Files\Fs1301.exe
C:\Program Files\Fua9103.exe
C:\Program Files\GaF091.exe
C:\Program Files\HAH62E0.EXE
C:\Program Files\HoyD305.exe
C:\Program Files\Ic2211.exe
C:\Program Files\Ic2F4.exe
C:\Program Files\Imf3361.exe
C:\Program Files\Jav7006.exe
C:\Program Files\JpzB084.exe
C:\Program Files\Jvo5136.exe
C:\Program Files\Keu62B1.exe
C:\Program Files\Kn2353.exe
C:\Program Files\KwbB1A6.exe
C:\Program Files\LZ2195.EXE
C:\Program Files\MgB253.exe
C:\Program Files\Msk9223.exe
C:\Program Files\Ncv225.exe
C:\Program Files\NksA1A5.exe
C:\Program Files\NvF386.exe
C:\Program Files\Ocg7164.exe
C:\Program Files\Ohl9175.exe
C:\Program Files\Pa226.exe
C:\Program Files\PbD233.exe
C:\Program Files\Project.exe
C:\Program Files\QvyA1F2.exe
C:\Program Files\Rhm4061.exe
C:\Program Files\Rin21F1.exe
C:\Program Files\Shm10E4.exe
C:\Program Files\Si355.exe
C:\Program Files\Tf5324.exe
C:\Program Files\Ttx312.exe
C:\Program Files\Ube394.exe
C:\Program Files\Ubg5326.exe
C:\Program Files\UjfE286.exe
C:\Program Files\UpfC141.exe
C:\Program Files\VjhF076.exe
C:\Program Files\Vn1A2.exe
C:\Program Files\Vyd7304.exe
C:\Program Files\WFJ50F0.EXE
C:\Program Files\XcqB215.exe
C:\Program Files\XerD070.exe
C:\Program Files\YIB294.EXE
C:\Program Files\YzaE342.exe
C:\Program Files\Yzo4122.exe
C:\Program Files\ZgqC015.exe
C:\Program Files\Zhb4085.exe
C:\Program Files\ZxoB075.exe
C:\Program Files\Zy2052.exe
C:\WINDOWS\ast_4_mm.exe
C:\WINDOWS\iconzx.exe
C:\WINDOWS\SYSTEM32\awvvv.dll.vir
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\AagB2F4.exe
C:\Program Files\Ar92.exe
C:\Program Files\BAYE0A2.EXE
C:\Program Files\Cat5074.exe
C:\Program Files\Cp80A4.exe
C:\Program Files\Ctk6335.exe
C:\Program Files\Ew50F6.exe
C:\Program Files\ExtF1C4.exe
C:\Program Files\Fcj7070.exe
C:\Program Files\FofD0C0.exe
C:\Program Files\Fr11F5.exe
C:\Program Files\Fs1301.exe
C:\Program Files\Fua9103.exe
C:\Program Files\GaF091.exe
C:\Program Files\HAH62E0.EXE
C:\Program Files\HoyD305.exe
C:\Program Files\Ic2211.exe
C:\Program Files\Ic2F4.exe
C:\Program Files\Imf3361.exe
C:\Program Files\Jav7006.exe
C:\Program Files\JpzB084.exe
C:\Program Files\Jvo5136.exe
C:\Program Files\Keu62B1.exe
C:\Program Files\Kn2353.exe
C:\Program Files\KwbB1A6.exe
C:\Program Files\LZ2195.EXE
C:\Program Files\MgB253.exe
C:\Program Files\Msk9223.exe
C:\Program Files\Ncv225.exe
C:\Program Files\NksA1A5.exe
C:\Program Files\NvF386.exe
C:\Program Files\Ocg7164.exe
C:\Program Files\Ohl9175.exe
C:\Program Files\Pa226.exe
C:\Program Files\PbD233.exe
C:\Program Files\Project.exe
C:\Program Files\QvyA1F2.exe
C:\Program Files\Rhm4061.exe
C:\Program Files\Rin21F1.exe
C:\Program Files\Shm10E4.exe
C:\Program Files\Si355.exe
C:\Program Files\Tf5324.exe
C:\Program Files\Ttx312.exe
C:\Program Files\Ube394.exe
C:\Program Files\Ubg5326.exe
C:\Program Files\UjfE286.exe
C:\Program Files\UpfC141.exe
C:\Program Files\VjhF076.exe
C:\Program Files\Vn1A2.exe
C:\Program Files\Vyd7304.exe
C:\Program Files\WFJ50F0.EXE
C:\Program Files\XcqB215.exe
C:\Program Files\XerD070.exe
C:\Program Files\YIB294.EXE
C:\Program Files\YzaE342.exe
C:\Program Files\Yzo4122.exe
C:\Program Files\ZgqC015.exe
C:\Program Files\Zhb4085.exe
C:\Program Files\ZxoB075.exe
C:\Program Files\Zy2052.exe
C:\WINDOWS\ast_4_mm.exe
C:\WINDOWS\iconzx.exe
C:\WINDOWS\SYSTEM32\awvvv.dll.vir

.
((((((((((((((((((((((((( Files Created from 2007-12-02 to 2008-01-02 )))))))))))))))))))))))))))))))
.

2008-01-01 18:42 . 2008-01-01 18:42 d——– C:\Program Files\ComboFix
2007-12-31 10:34 . 2007-12-31 10:34 d——– C:\Deckard
2007-12-30 23:45 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2007-12-30 23:38 . 2007-12-30 23:38 d——– C:\Program Files\Sun
2007-12-30 23:38 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\SYSTEM32\javacpl.cpl
2007-12-30 23:20 . 2007-12-30 23:20 d——– C:\Program Files\Common Files\Java
2007-12-28 15:09 . 2008-01-01 19:15 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2007-12-28 15:09 . 2007-12-28 15:09 1,409 –a—— C:\WINDOWS\QTFont.for
2007-12-28 13:45 . 2007-12-28 13:45 d——– C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-28 13:45 . 2007-12-28 13:45 d——– C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-27 22:15 . 2007-12-27 22:15 d–hs—- C:\FOUND.001
2007-12-27 13:51 . 2007-12-27 13:51 d–hs—- C:\FOUND.000
2007-12-26 10:12 . 2007-12-31 11:00 45,626 –a—— C:\WINDOWS\SYSTEM32\clean.config
2007-12-25 14:35 . 2007-12-25 14:35 244 –ah—– C:\sqmnoopt03.sqm
2007-12-25 14:35 . 2007-12-25 14:35 244 –ah—– C:\sqmnoopt02.sqm
2007-12-25 14:35 . 2007-12-25 14:35 232 –ah—– C:\sqmdata03.sqm
2007-12-25 14:35 . 2007-12-25 14:35 232 –ah—– C:\sqmdata02.sqm
2007-12-25 14:34 . 2007-12-25 14:34 244 –ah—– C:\sqmnoopt01.sqm
2007-12-25 14:34 . 2007-12-25 14:34 244 –ah—– C:\sqmnoopt00.sqm
2007-12-25 14:34 . 2007-12-25 14:34 232 –ah—– C:\sqmdata01.sqm
2007-12-25 14:34 . 2007-12-25 14:34 232 –ah—– C:\sqmdata00.sqm
2007-12-08 08:29 . 2007-12-08 08:29 d——– C:\Documents and Settings\NetworkService\Application Data\Apple

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-28 20:39 805 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
2007-12-28 20:39 60,800 —-a-w C:\WINDOWS\SYSTEM32\S32EVNT1.DLL
2007-12-28 20:39 123,952 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2007-12-28 20:39 10,740 —-a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
2007-11-13 10:25 20,480 —-a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-10-30 23:42 3,590,656 ——w C:\WINDOWS\SYSTEM32\dllcache\mshtml.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\dllcache\quartz.dll
2007-10-28 01:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\wmasf.dll
2007-10-28 01:40 222,720 —-a-w C:\WINDOWS\SYSTEM32\dllcache\wmasf.dll
2007-10-26 03:34 8,460,288 —-a-w C:\WINDOWS\SYSTEM32\dllcache\shell32.dll
2007-10-10 23:56 824,832 ——w C:\WINDOWS\SYSTEM32\dllcache\wininet.dll
2007-10-10 23:56 671,232 ——w C:\WINDOWS\SYSTEM32\dllcache\mstime.dll
2007-10-10 23:56 232,960 ——w C:\WINDOWS\SYSTEM32\dllcache\webcheck.dll
2007-10-10 23:56 105,984 ——w C:\WINDOWS\SYSTEM32\dllcache\url.dll
2007-10-10 23:56 102,400 ——w C:\WINDOWS\SYSTEM32\dllcache\occache.dll
2007-10-10 23:56 1,159,680 ——w C:\WINDOWS\SYSTEM32\dllcache\urlmon.dll
2007-10-10 23:55 63,488 ——w C:\WINDOWS\SYSTEM32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ——w C:\WINDOWS\SYSTEM32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ——w C:\WINDOWS\SYSTEM32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ——w C:\WINDOWS\SYSTEM32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ——w C:\WINDOWS\SYSTEM32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ——w C:\WINDOWS\SYSTEM32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ——w C:\WINDOWS\SYSTEM32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ——w C:\WINDOWS\SYSTEM32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ——w C:\WINDOWS\SYSTEM32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ——w C:\WINDOWS\SYSTEM32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ——w C:\WINDOWS\SYSTEM32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ——w C:\WINDOWS\SYSTEM32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ——w C:\WINDOWS\SYSTEM32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ——w C:\WINDOWS\SYSTEM32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ——w C:\WINDOWS\SYSTEM32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ——w C:\WINDOWS\SYSTEM32\dllcache\advpack.dll
2007-10-10 10:59 70,656 ——w C:\WINDOWS\SYSTEM32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ——w C:\WINDOWS\SYSTEM32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ——w C:\WINDOWS\SYSTEM32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ——w C:\WINDOWS\SYSTEM32\dllcache\ieakui.dll
2005-04-16 20:18 23,856 —-a-w C:\Documents and Settings\jschmitz\Application Data\GDIPFONTCACHEV1.DAT
2005-02-21 20:27 271 –sh–w C:\Program Files\desktop.ini
2005-02-21 20:27 23,357 —h–w C:\Program Files\folder.htt
2003-12-31 22:38 203,189 —-a-w C:\Program Files\spampal-1.53-binaries.zip
2003-10-24 20:15 427,303 —-a-w C:\Program Files\spampal-beta-1.52.exe
2003-10-24 20:07 582,937 —-a-w C:\Program Files\spampal-1.50.exe
2004-11-18 06:12 8 –sh–w C:\WINDOWS\DRM\pdrm.dat
.

((((((((((((((((((((((((((((( snapshot@2007-12-30_23.55.35.51 )))))))))))))))))))))))))))))))))))))))))
.
+ 2000-08-31 16:00:00 163,328 —-a-w C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE
+ 2004-08-04 20:00:00 64,000 —-a-w C:\WINDOWS\SYSTEM32\cleanmgr.exe
+ 2004-08-04 20:00:00 64,000 —-a-w C:\WINDOWS\SYSTEM32\dllcache\cleanmgr.exe
- 2007-12-31 07:42:32 2,981,888 —-a-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
+ 2008-01-02 06:06:22 557,056 –sha-w C:\WINDOWS\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24 1694208]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SystemTray"="SysTray.Exe" [2004-08-04 12:00 3072 C:\WINDOWS\SYSTEM32\systray.exe]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-06-06 11:45 155648]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-06-06 11:41 118784]
"Cmaudio"="cmicnfg.cpl" []
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb08.exe" [2003-03-26 02:34 172032]
"LiveMonitor"="C:\Program Files\MSI\Live Update 3\LMonitor.exe" [2005-07-11 10:44 482816]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2004-06-03 00:50 204800]
"gcasServ"="C:\Program Files\Microsoft AntiSpyware\gcasServ.exe" [ ]
"HP Software Update"="C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [ ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-22 22:19 52840]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-02 18:36 267048]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]

C:\Documents and Settings\jschmitz\Start Menu\Programs\Startup\
SpywareGuard.lnk - C:\Program Files\SpywareGuard\sgmain.exe [2003-08-29 19:05:35]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
ADOBE GAMMA LOADER.EXE.LNK - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2001-03-10 21:51:08]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000
"NoRecentDocsHistory"= 01000000

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
""= 00000000
"NoRecentDocsHistory"= 01000000

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\setup\disabledrunkeys]
"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security\pccguide.exe"
"PCCIOMON.exe"="C:\Program Files\Trend Micro\Internet Security\PCCIOMON.exe"
"PCClient.exe"="C:\Program Files\Trend Micro\Internet Security\PCClient.exe"
"TM Outbreak Agent"="C:\Program Files\Trend Micro\Internet Security\TMOAgent.exe" /run
"IgfxTray"=C:\WINDOWS\SYSTEM32\IGFXTRAY.EXE
"HotKeysCmds"=C:\WINDOWS\SYSTEM32\HKCMD.EXE
"Cmaudio"=RunDll32 cmicnfg.cpl,CMICtrlWnd
"HPDJ Taskbar Utility"=C:\WINDOWS\SYSTEM32\hpztsb08.exe
"HP Software Update"=C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
"DeviceDiscovery"=C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
"EssSpkPhone"=essspk.exe
"LoadPowerProfile"=Rundll32.exe powrprof.dll,LoadCurrentPwrScheme

S3 USB20L;Linksys USB 2.0 10/100 Adapter;C:\WINDOWS\system32\DRIVERS\USB200M.sys [2002-09-23 22:35]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{5e0ede48-4ac6-11dc-a1fa-000f9f4a4ab1}]
\Shell\AutoRun\command - F:\LaunchU3.exe -a


[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:WIN9X /user /install
"C:\Program Files\Outlook Express\setup50.exe" /APP:OE /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7790769C-0471-11d2-AF11-00C04FA35D02}]
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:WIN9X /user /install
"C:\Program Files\Outlook Express\setup50.exe" /APP:WAB /CALLER:IE50 /user /install

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{9EF0045A-CDD9-438e-95E6-02B9AFEC8E11}]
C:\WINDOWS\SYSTEM32\updcrl.exe -e -u C:\WINDOWS\SYSTEM\verisignpub1.crl
.
Contents of the 'Scheduled Tasks' folder
"2008-01-02 17:00:02 C:\WINDOWS\Tasks\Tune-up Application Start.job"
"2008-01-02 19:30:12 C:\WINDOWS\Tasks\PCHealth Scheduler for Data Collection.job"
- C:\WINDOWS\PCHEALTH\SUPPORT\PCHSCHD.EXE
"2008-01-01 09:00:02 C:\WINDOWS\Tasks\Maintenance-Defragment programs.job"
- C:\WINDOWS\DEFRAG.EXE
"2008-01-01 08:30:02 C:\WINDOWS\Tasks\Maintenance-Disk cleanup.job"
- C:\WINDOWS\CLEANMGR.EXE
"2007-12-29 04:10:44 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - jschmitz.job"
- C:\PROGRA~1\NORTON~1\Navw32.exe
"2007-12-29 16:29:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-02 11:32:19
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-02 11:34:24
C:\qoobox\ComboFix-quarantined-files.txt 2008-01-02 19:34:14
C:\qoobox\ComboFix3.txt 2007-12-31 07:56:34
C:\qoobox\ComboFix2.txt 2008-01-02 03:00:04
.
2007-12-12 11:06:16 — E O F —