Browser redirecting to other sites

Browser is redirecting to other sites– occasionally porn, most are not. SmitFraud and Vundo were detected by Norton and then Comodo AntiVirus (uninstalled Norton before installing Comodo). Ran some of the free fixes for each, but browser still redirects to other sites. Installed Comodo Anti-Malware (BOClean), reconnected to Internet, browsed to a few sites. Seemed OK for one or two sites but then the redirection problem recurred. No alerts appeared from BOClean.

Here is the log. Thanks in advance for the help!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:51:35 PM, on 1/16/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe
C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Comodo\Comodo AntiVirus\Cavaud.exe
C:\WINDOWS\system32\bkekuvwp.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://golfhousetennessee.com/fw/main/default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.0.1/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
F2 - REG:system.ini: Shell=explorer.exe
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A
O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKLM\..\Run: [64ced7fd] rundll32.exe "C:\WINDOWS\system32\cefgasye.dll",b
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Policies\Explorer\Run: [ie.exe] C:\WINDOWS\ie.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\bkekuvwp.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

–
End of file - 6586 bytes

Ran ComboFix successfully. Comodo Anti-Virus quarantined trojan-clicker.win32.pahador.f early in the process. ComboFix and HijackThis logs follow.

ComboFix 08-01-21.7 - Owner 2008-01-23 19:47:26.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.93 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix 2.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\bkR11
C:\Temp\bkR11\ftCa.log
C:\temp\tn3
C:\WINDOWS\mrofinu.exe
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\system32\accdd.ini
C:\WINDOWS\system32\accdd.ini2
C:\WINDOWS\system32\acqgpyjy.dll
C:\WINDOWS\system32\acxvheil.dll
C:\WINDOWS\system32\afgoaccp.dll
C:\WINDOWS\system32\agutlhax.exe
C:\WINDOWS\system32\ahyjqyff.exe
C:\WINDOWS\system32\axhiveso.exe
C:\WINDOWS\system32\baoudgge.ini
C:\WINDOWS\system32\bbc5
C:\WINDOWS\system32\bbc5\gstdrvr8.exe
C:\WINDOWS\system32\bkekuvwp.exe
C:\WINDOWS\system32\bmaavqem.dll
C:\WINDOWS\system32\brxpssyt.dll
C:\WINDOWS\system32\bvtnhtjc.dll
C:\WINDOWS\system32\bwbpngts.dll
C:\WINDOWS\system32\cdjlwsvw.exe
C:\WINDOWS\system32\cgtruvge.dll
C:\WINDOWS\system32\chcpvcoi.exe
C:\WINDOWS\system32\ckyolgra.exe
C:\WINDOWS\system32\cmcmvgvi.exe
C:\WINDOWS\system32\cpsvbgfm.dll
C:\WINDOWS\system32\cqnmomqq.exe
C:\WINDOWS\system32\cxpvtrnp.dll
C:\WINDOWS\system32\cxqldxbc.dll
C:\WINDOWS\system32\daSgo02
C:\WINDOWS\system32\dbujcdtl.exe
C:\WINDOWS\system32\dcjeogeu.exe
C:\WINDOWS\system32\ddcca.dll
C:\WINDOWS\system32\derdwfwb.exe
C:\WINDOWS\system32\dgfxkfga.dll
C:\WINDOWS\system32\dltwmydo.exe
C:\WINDOWS\system32\dngjhica.exe
C:\WINDOWS\system32\doc4
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\dyinnrxj.ini
C:\WINDOWS\system32\ecnkbkfn.dll
C:\WINDOWS\system32\efokwnor.dll
C:\WINDOWS\system32\eggduoab.dll
C:\WINDOWS\system32\egognaeb.exe
C:\WINDOWS\system32\ehsuruho.dll
C:\WINDOWS\system32\ejkwalnf.exe
C:\WINDOWS\system32\emwlyxdk.exe
C:\WINDOWS\system32\enclogwy.exe
C:\WINDOWS\system32\epbmpgmr.exe
C:\WINDOWS\system32\erbjybdp.exe
C:\WINDOWS\system32\erlfriyr.dll
C:\WINDOWS\system32\esoavxow.exe
C:\WINDOWS\system32\esppnout.exe
C:\WINDOWS\system32\ethcqrpk.exe
C:\WINDOWS\system32\etlvtdbs.exe
C:\WINDOWS\system32\etujcfop.exe
C:\WINDOWS\system32\fbwdrwys.exe
C:\WINDOWS\system32\fccayxu.dll
C:\WINDOWS\system32\fefwkppj.dll
C:\WINDOWS\system32\fkxujgln.dll
C:\WINDOWS\system32\fnvqleyd.exe
C:\WINDOWS\system32\frovwcsu.exe
C:\WINDOWS\system32\fsoijmib.exe
C:\WINDOWS\system32\gfrmtcsy.exe
C:\WINDOWS\system32\gifkefqu.exe
C:\WINDOWS\system32\gjjwjdvi.exe
C:\WINDOWS\system32\gpvimsut.dll
C:\WINDOWS\system32\grgmwcnk.exe
C:\WINDOWS\system32\grtlqrjr.dll
C:\WINDOWS\system32\gwkqylaj.ini
C:\WINDOWS\system32\hbrovhtu.dll
C:\WINDOWS\system32\hdocbxib.exe
C:\WINDOWS\system32\hfphcjbg.dll
C:\WINDOWS\system32\hiirubfx.exe
C:\WINDOWS\system32\hokyaeqc.exe
C:\WINDOWS\system32\hqqhdnwu.exe
C:\WINDOWS\system32\hyhekeqq.exe
C:\WINDOWS\system32\ihrixlfr.dll
C:\WINDOWS\system32\ihtirdyu.exe
C:\WINDOWS\system32\ijgjfgre.exe
C:\WINDOWS\system32\ilbifkdu.dll
C:\WINDOWS\system32\iynhiert.exe
C:\WINDOWS\system32\jaltrelc.exe
C:\WINDOWS\system32\jalyqkwg.dll
C:\WINDOWS\system32\jglxmywk.dll
C:\WINDOWS\system32\jihftrva.exe
C:\WINDOWS\system32\jmfjkvag.exe
C:\WINDOWS\system32\jmyyxdhs.exe
C:\WINDOWS\system32\jnfldjns.exe
C:\WINDOWS\system32\jpbanicd.dll
C:\WINDOWS\system32\jqsfwdvh.dll
C:\WINDOWS\system32\jxrnniyd.dll
C:\WINDOWS\system32\kafxlcpu.dll
C:\WINDOWS\system32\kflafkle.dll
C:\WINDOWS\system32\khlpmrib.exe
C:\WINDOWS\system32\kmuhopqj.dll
C:\WINDOWS\system32\knopyand.exe
C:\WINDOWS\system32\knspfydr.exe
C:\WINDOWS\system32\ksqyqndm.exe
C:\WINDOWS\system32\kvbaiwjb.exe
C:\WINDOWS\system32\kxopjovl.dll
C:\WINDOWS\system32\lckyrlbe.exe
C:\WINDOWS\system32\leifledw.dll
C:\WINDOWS\system32\lgjimueu.exe
C:\WINDOWS\system32\lirqtlui.exe
C:\WINDOWS\system32\ljbxuhwo.exe
C:\WINDOWS\system32\lnugfilj.exe
C:\WINDOWS\system32\lohcuamx.dll
C:\WINDOWS\system32\lpejmfbq.exe
C:\WINDOWS\system32\lqhusvaw.exe
C:\WINDOWS\system32\lshghuqf.exe
C:\WINDOWS\system32\mbtwwmao.exe
C:\WINDOWS\system32\mdcidfea.dll
C:\WINDOWS\system32\mdelbadi.exe
C:\WINDOWS\system32\mdsfxnkj.dll
C:\WINDOWS\system32\mfafnahb.dll
C:\WINDOWS\system32\mllxvuwj.exe
C:\WINDOWS\system32\mowciqhy.exe
C:\WINDOWS\system32\mrchhbcd.exe
C:\WINDOWS\system32\mvtwejla.exe
C:\WINDOWS\system32\nbhvyoke.dll
C:\WINDOWS\system32\ndfrekbc.dll
C:\WINDOWS\system32\nfkbknce.ini
C:\WINDOWS\system32\nmqplwku.exe
C:\WINDOWS\system32\nonlphyd.exe
C:\WINDOWS\system32\nslwrwdg.exe
C:\WINDOWS\system32\nuvburxj.dll
C:\WINDOWS\system32\nwauifaf.exe
C:\WINDOWS\system32\nwpuvaxt.exe
C:\WINDOWS\system32\nydyxoyl.dll
C:\WINDOWS\system32\ohurushe.ini
C:\WINDOWS\system32\okdrtolq.exe
C:\WINDOWS\system32\onjfupoq.dll
C:\WINDOWS\system32\opkvgphm.exe
C:\WINDOWS\system32\orioggle.exe
C:\WINDOWS\system32\ouoihtkw.dll
C:\WINDOWS\system32\ouygmbmr.exe
C:\WINDOWS\system32\owcdpkuk.exe
C:\WINDOWS\system32\oxhpjgoi.exe
C:\WINDOWS\system32\oxphkqym.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pacviugo.dll
C:\WINDOWS\system32\pbkajxsy.exe
C:\WINDOWS\system32\pbxwunsr.exe
C:\WINDOWS\system32\pgdshfeu.dll
C:\WINDOWS\system32\ppbvxekt.exe
C:\WINDOWS\system32\pqhpxvxr.exe
C:\WINDOWS\system32\pufqsags.exe
C:\WINDOWS\system32\pugodvem.dll
C:\WINDOWS\system32\puwnpixo.exe
C:\WINDOWS\system32\pvthliuw.dll
C:\WINDOWS\system32\pypchnpw.exe
C:\WINDOWS\system32\pyrfsctw.exe
C:\WINDOWS\system32\qfsmxddc.dll
C:\WINDOWS\system32\qhjvucpb.exe
C:\WINDOWS\system32\qhsoaiyg.exe
C:\WINDOWS\system32\qupycffd.exe
C:\WINDOWS\system32\qwvbvtin.dll
C:\WINDOWS\system32\rex2
C:\WINDOWS\system32\rkwtlxkt.dll
C:\WINDOWS\system32\rrethsdx.exe
C:\WINDOWS\system32\rwbuihxi.exe
C:\WINDOWS\system32\seewxldd.exe
C:\WINDOWS\system32\sflwlehm.dll
C:\WINDOWS\system32\shanvvqf.exe
C:\WINDOWS\system32\simcyosr.dll
C:\WINDOWS\system32\smruvtjd.exe
C:\WINDOWS\system32\soqjjcrb.dll
C:\WINDOWS\system32\srhpwxih.exe
C:\WINDOWS\system32\ssefwprv.dll
C:\WINDOWS\system32\sxtntpcl.exe
C:\WINDOWS\system32\takmrncn.exe
C:\WINDOWS\system32\tjsmkgxf.exe
C:\WINDOWS\system32\tkfugwaa.dll
C:\WINDOWS\system32\tkxltwkr.ini
C:\WINDOWS\system32\tlrorsxb.exe
C:\WINDOWS\system32\tmijcxbx.dll
C:\WINDOWS\system32\tolpyyri.exe
C:\WINDOWS\system32\tpjgudwf.exe
C:\WINDOWS\system32\tvgwxwjn.exe
C:\WINDOWS\system32\udtwxgco.dll
C:\WINDOWS\system32\ufubyxqs.exe
C:\WINDOWS\system32\ugbccoqj.exe
C:\WINDOWS\system32\upnobijw.dll
C:\WINDOWS\system32\uvbwsans.exe
C:\WINDOWS\system32\uxjjxdtu.exe
C:\WINDOWS\system32\vfmycxso.exe
C:\WINDOWS\system32\vfpibgrb.exe
C:\WINDOWS\system32\vfylhnyy.dll
C:\WINDOWS\system32\vghpbdqh.exe
C:\WINDOWS\system32\vgscanqw.dll
C:\WINDOWS\system32\vgsjdgyt.dll
C:\WINDOWS\system32\vimpgdev.exe
C:\WINDOWS\system32\vitogwkv.exe
C:\WINDOWS\system32\wbihystl.exe
C:\WINDOWS\system32\wldaqfgq.exe
C:\WINDOWS\system32\wojsitpo.dll
C:\WINDOWS\system32\wtdxkfgd.dll
C:\WINDOWS\system32\wujnckff.exe
C:\WINDOWS\system32\xheewufh.exe
C:\WINDOWS\system32\xhetxmpl.dll
C:\WINDOWS\system32\xjgegmqw.exe
C:\WINDOWS\system32\xlcxnxpc.dll
C:\WINDOWS\system32\xmncoeqx.exe
C:\WINDOWS\system32\xoyskemh.exe
C:\WINDOWS\system32\xtafqkix.exe
C:\WINDOWS\system32\xvdmeilj.exe
C:\WINDOWS\system32\xwruryow.exe
C:\WINDOWS\system32\yhxcumyt.dll
C:\WINDOWS\system32\ylecnhhj.dll
C:\WINDOWS\system32\ypxosdfo.exe
D:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CORE
——-\LEGACY_DOMAINSERVICE
——-\core
——-\DomainService


((((((((((((((((((((((((( Files Created from 2007-12-24 to 2008-01-24 )))))))))))))))))))))))))))))))
.

2008-01-23 19:44 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\Nircmd.exe
2008-01-23 14:25 . 2008-01-23 14:25 1,854 –ahs—- C:\WINDOWS\system32\dhwtqmkg.ini
2008-01-23 12:46 . 2008-01-23 12:46 1,794 –ahs—- C:\WINDOWS\system32\gsqrihrg.ini
2008-01-23 09:16 . 2008-01-23 09:16 1,734 –ahs—- C:\WINDOWS\system32\wlnhjvvg.ini
2008-01-22 16:58 . 2008-01-22 16:58 1,674 –ahs—- C:\WINDOWS\system32\hecosjsi.ini
2008-01-22 16:58 . 2008-01-22 16:58 1,614 –ahs—- C:\WINDOWS\system32\vpvonnpu.tmp
2008-01-22 15:55 . 2008-01-22 15:55 1,614 –ahs—- C:\WINDOWS\system32\vpvonnpu.ini
2008-01-22 13:31 . 2008-01-22 13:31 1,554 –ahs—- C:\WINDOWS\system32\nnufpqru.ini
2008-01-22 11:58 . 2008-01-22 11:58 1,494 –ahs—- C:\WINDOWS\system32\ufiuoemd.ini
2008-01-22 10:26 . 2008-01-22 10:26 1,434 –ahs—- C:\WINDOWS\system32\lfrfoghu.ini
2008-01-22 09:19 . 2008-01-22 09:19 1,374 –ahs—- C:\WINDOWS\system32\erckoqqe.ini
2008-01-19 10:28 . 2008-01-21 10:28 1,314 –ahs—- C:\WINDOWS\system32\itwxeuei.ini
2008-01-18 17:28 . 2008-01-18 17:28 1,194 –ahs—- C:\WINDOWS\system32\icrxryfq.ini
2008-01-18 16:29 . 2008-01-18 16:29 1,134 –ahs—- C:\WINDOWS\system32\ituphrwt.ini
2008-01-18 15:16 . 2008-01-18 15:16 1,074 –ahs—- C:\WINDOWS\system32\msxpuiev.ini
2008-01-18 10:51 . 2008-01-18 10:51 1,014 –ahs—- C:\WINDOWS\system32\hkkcxnwj.ini
2008-01-17 14:19 . 2008-01-17 14:19 954 –ahs—- C:\WINDOWS\system32\msbyfdyh.ini
2008-01-17 14:19 . 2008-01-17 14:19 894 –ahs—- C:\WINDOWS\system32\efcoirnh.tmp
2008-01-16 12:52 . 2008-01-17 12:52 894 –ahs—- C:\WINDOWS\system32\efcoirnh.ini
2008-01-16 10:43 . 2008-01-16 10:43 834 –ahs—- C:\WINDOWS\system32\eysagfec.ini
2008-01-15 16:42 . 2008-01-16 10:43 774 –ahs—- C:\WINDOWS\system32\vmetgxyb.ini
2008-01-15 15:42 . 2008-01-15 15:42 714 –ahs—- C:\WINDOWS\system32\xycofguu.ini
2008-01-15 14:42 . 2008-01-15 14:42 654 –ahs—- C:\WINDOWS\system32\ceuafbvc.ini
2008-01-15 13:39 . 2008-01-15 13:39 594 –ahs—- C:\WINDOWS\system32\nsfjwgrt.ini
2008-01-13 16:57 . 2008-01-14 17:52 534 –ahs—- C:\WINDOWS\system32\chopgvny.ini
2008-01-13 15:42 . 2008-01-13 15:43 474 –ahs—- C:\WINDOWS\system32\akvujjnl.ini
2008-01-12 09:59 . 2008-01-13 15:24 414 –ahs—- C:\WINDOWS\system32\gscrtoxf.ini
2008-01-12 08:53 . 2008-01-12 08:53 354 –ahs—- C:\WINDOWS\system32\ibnadbhd.ini
2008-01-11 15:03 . 2008-01-11 15:04 989,614 –ahs—- C:\WINDOWS\system32\nrkmtgiv.ini
2008-01-11 13:52 . 2008-01-11 13:53 989,554 –ahs—- C:\WINDOWS\system32\uvavporf.ini
2008-01-11 12:22 . 2008-01-11 12:50 989,494 –ahs—- C:\WINDOWS\system32\qilkhyit.ini
2008-01-11 11:36 . 2008-01-11 11:36 989,374 –ahs—- C:\WINDOWS\system32\jyqwpife.ini
2008-01-11 09:43 . 2008-01-11 09:44 989,314 –ahs—- C:\WINDOWS\system32\seqdbtsa.ini
2008-01-11 09:28 . 2007-11-26 10:38 238,848 –a—— C:\WINDOWS\UNBOC.EXE
2008-01-11 09:28 . 2007-05-08 17:01 208,896 –a—— C:\WINDOWS\CMDLIC.DLL
2008-01-11 09:28 . 2004-08-04 01:56 22,528 –a—— C:\WINDOWS\system32\wsock32.dlb
2008-01-11 09:28 . 2008-01-23 20:11 9,886 –a—— C:\WINDOWS\BOC425.INI
2008-01-11 08:53 . 2008-01-11 09:32 989,254 –ahs—- C:\WINDOWS\system32\dcvumolh.ini
2008-01-09 17:17 . 2008-01-10 17:17 989,134 –ahs—- C:\WINDOWS\system32\yncqucqf.ini
2008-01-09 14:55 . 2008-01-09 14:56 989,074 –ahs—- C:\WINDOWS\system32\jdeotkku.ini
2008-01-09 13:20 . 2008-01-09 13:20 989,014 –ahs—- C:\WINDOWS\system32\ghmmusxt.ini
2008-01-09 12:14 . 2008-01-09 12:14 988,954 –ahs—- C:\WINDOWS\system32\dlpnxeng.ini
2008-01-09 11:11 . 2008-01-09 11:11 988,894 –ahs—- C:\WINDOWS\system32\tsyakogj.ini
2008-01-09 10:08 . 2008-01-09 10:08 988,834 –ahs—- C:\WINDOWS\system32\ugiiijuw.ini
2008-01-09 09:05 . 2008-01-09 09:05 988,774 –ahs—- C:\WINDOWS\system32\tocbkhgj.ini
2008-01-08 17:39 . 2008-01-09 09:05 988,714 –ahs—- C:\WINDOWS\system32\flyrdixt.ini
2008-01-08 16:30 . 2008-01-08 16:30 988,654 –ahs—- C:\WINDOWS\system32\dpjajeey.ini
2008-01-08 15:25 . 2008-01-08 15:26 988,594 –ahs—- C:\WINDOWS\system32\jxdglpjx.ini
2008-01-08 09:15 . 2008-01-08 09:16 988,534 –ahs—- C:\WINDOWS\system32\ikefssxe.ini
2008-01-04 17:23 . 2008-01-08 09:03 988,474 –ahs—- C:\WINDOWS\system32\aulumkvj.ini
2008-01-03 17:12 . 2008-01-03 18:25 988,414 –ahs—- C:\WINDOWS\system32\ojsinmxh.ini
2008-01-03 12:13 . 2007-09-05 23:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-01-03 12:13 . 2006-04-27 16:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-01-03 12:13 . 2003-06-05 20:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-01-03 12:13 . 2004-07-31 17:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-01-03 12:13 . 2007-10-03 23:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2007-12-26 15:09 . 2008-01-01 14:27 988,114 –ahs—- C:\WINDOWS\system32\bawfkqro.ini
2007-12-26 13:12 . 2007-12-26 13:12 987,994 –ahs—- C:\WINDOWS\system32\ylqgxsvl.ini
2007-12-26 11:59 . 2007-12-26 11:59 987,934 –ahs—- C:\WINDOWS\system32\kmqvqyib.ini
2007-12-26 10:56 . 2007-12-26 10:56 987,874 –ahs—- C:\WINDOWS\system32\cppfenlb.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 21:32 ——— d—–w C:\Program Files\Viewpoint
2008-01-11 15:28 ——— d—–w C:\Program Files\Comodo
2008-01-03 18:02 3,680 —-a-w C:\WINDOWS\system32\tmp.reg
2007-12-14 17:27 73,728 —-a-w C:\WINDOWS\system32\CavEmLSP.dll
2007-12-14 17:27 499,712 —-a-w C:\WINDOWS\system32\msvcp71.dll
2007-12-14 17:27 434,252 —-a-w C:\WINDOWS\system32\MSVCRTD.DLL
2007-12-14 17:27 348,160 —-a-w C:\WINDOWS\system32\msvcr71.dll
2007-12-14 17:27 216,576 —-a-w C:\WINDOWS\system32\monln.dll
2007-12-14 17:27 102,400 —-a-w C:\WINDOWS\system32\drivers\cavasm.sys
2007-12-14 17:27 1,060,864 —-a-w C:\WINDOWS\system32\MFC71.dll
2007-12-14 17:07 ——— d—–w C:\Program Files\Norton AntiVirus
2007-12-14 17:07 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2007-12-10 01:50 ——— d—–w C:\Program Files\Trend Micro
2007-12-10 00:06 4,006 —-a-w C:\WINDOWS\viassary-hp.reg
2007-12-06 18:46 35,840 —-a-w C:\WINDOWS\mrofinu77.exe.tmp
2007-10-29 22:43 1,287,680 —-a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 23:39 230,912 —-a-w C:\WINDOWS\system32\wmasf.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"MoneyAgent"="C:\Program Files\Microsoft Money\System\mnyexpr.exe" [2003-06-18 21:00 200704]
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [2004-10-13 10:24 1694208]
"PhotoShow Deluxe Media Manager"="C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe" [2005-05-19 15:59 176128]
"RealPlayer"="C:\Program Files\Real\RealOne Player\realplay.exe" [2006-12-15 13:29 1003520]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2004-01-26 04:24 32881]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736]
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-21 05:23 49152]
"HPHmon05"="C:\WINDOWS\System32\hphmon05.exe" [2003-08-21 05:15 483328]
"KBD"="C:\HP\KBD\KBD.EXE" [2003-02-11 21:02 61440]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 10:01 110592]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-01-26 06:29 151597]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2003-11-03 18:50 221184]
"LTMSG"="LTMSG.exe" [2003-07-14 19:52 40960 C:\WINDOWS\ltmsg.exe]
"PS2"="C:\WINDOWS\system32\ps2.exe" [2003-09-12 21:13 98304]
"Sunkist2k"="C:\Program Files\Multimedia Card Reader\shwicon2k.exe" [2003-10-29 10:17 135168]
"Reminder"="C:\Windows\Creator\Remind_XP.exe" [2003-12-18 01:31 118784]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 07:38 241664]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2003-05-15 17:41 163840]
"VTTimer"="VTTimer.exe" [2004-01-15 21:33 49152 C:\WINDOWS\system32\VTTimer.exe]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-25 06:20 28672]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 12:47 57344 C:\WINDOWS\ALCXMNTR.EXE]
"cnfgCav"="C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe" [2007-12-14 11:27 110592]
"BOC-425"="C:\PROGRA~1\Comodo\CBOClean\BOC425.exe" [2007-11-26 10:38 342272]

C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
spamsubtract.lnk - C:\Program Files\interMute\SpamSubtract\SpamSub.exe [2004-01-27 04:26:18 557056]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2003-09-16 14:19:24 237568]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2003-07-30 06:49:48 57344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\run]
"ie.exe"= C:\WINDOWS\ie.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\monln]
monln.dll 2007-12-14 11:27 216576 C:\WINDOWS\system32\monln.dll

S3 IPN2120;Instant Wireless-B PCI Adapter Driver;C:\WINDOWS\system32\DRIVERS\LSIPNDS.sys [2003-06-24 21:17]
S3 PGRCAM;PGRCAM;C:\WINDOWS\system32\DRIVERS\pgrcam.sys [2004-08-18 13:04]
S3 sonydcam;Generic 1394 Desktop Camera;C:\WINDOWS\system32\DRIVERS\sonydcam.sys [2004-08-04 00:09]

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 20:11:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-23 20:15:29 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-24 02:15:09
.
2007-12-20 18:09:07 — E O F —


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:22:17 PM, on 1/23/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\windows\system\hpsysdrv.exe
C:\WINDOWS\System32\hphmon05.exe
C:\HP\KBD\KBD.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\LTMSG.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe
C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe
C:\Program Files\Comodo\Comodo AntiVirus\Cavaud.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\interMute\SpamSubtract\SpamSub.exe
C:\WINDOWS\System32\HPZipm12.exe
C:\Program Files\Common Files\Real\Update_OB\rnathchk.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://golfhousetennessee.com/fw/main/default.asp
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.0.1/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Common\ycomp5,1,1,0.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe
O4 - HKLM\..\Run: [KBD] C:\HP\KBD\KBD.EXE
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [LTMSG] LTMSG.exe 7
O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [Reminder] "C:\Windows\Creator\Remind_XP.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE
O4 - HKLM\..\Run: [cnfgCav] "C:\Program Files\Comodo\Comodo AntiVirus\CMain.exe"
O4 - HKLM\..\Run: [BOC-425] C:\PROGRA~1\Comodo\CBOClean\BOC425.exe
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [RealPlayer] "C:\Program Files\Real\RealOne Player\realplay.exe" /RunUPGToolCommandReBoot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Policies\Explorer\Run: [ie.exe] C:\WINDOWS\ie.exe
O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkId=39204&clcid=0x409
O20 - Winlogon Notify: monln - C:\WINDOWS\SYSTEM32\monln.dll
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: Comodo Anti-Virus and Anti-Spyware Service - Comodo Inc. - C:\Program Files\Comodo\common\CAVASpy\cavasm.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe

–
End of file - 6137 bytes