[Closed] IE Popups while using Firefox

When using Firefox I've been getting popups from Internet Explorer. IE is never used on my computer. Spybot has found Smitfraud-C.CoreService and nothing seems to be able to get rid of it. I don't know if this is the cause of the issue or not.

Attached are my HijackThis logfile and AVG AntiSpyware scan report.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:01:18 PM, on 1/18/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Ad-Aware\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
F:\PeerGuardian2\pg2.exe
C:\WINDOWS\System32\svchost.exe
F:\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\Documents and Settings\Jason\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: On The Net Search Helper - {4E8F5D76-EF5B-46C8-B35B-C86F8BD6621A} - C:\WINDOWS\system32\memohxca.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {97AE084F-9589-4FA0-8249-2DCC5C755DFB} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [comup] C:\WINDOWS\system32\mobjchku.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Security Service (MYCO) - Unknown owner - C:\WINDOWS\system32\svcd\svchost.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 8529 bytes

———————————————————
AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 10:56:59 PM 1/18/2008

+ Scan result:



C:\System Volume Information\_restore{DF182008-DC89-4EA5-9E77-222B9BAF3C2C}\RP793\A0082104.dll -> Not-A-Virus.Adware.BHO : Cleaned with backup (quarantined).
C:\WINDOWS\system32\memoutis.dll -> Not-A-Virus.Adware.BHO : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{DF182008-DC89-4EA5-9E77-222B9BAF3C2C}\RP788\A0081947.exe -> Proxy.Fackemo.b : Cleaned with backup (quarantined).


::Report end


Any help to fix this issue will be very much appreciated! Thank you!

Hello

You have two anti-virus programs, AVG and Avast, this causes a lot of problems so you need to remove one of these


Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

Thanks for your help - I appreciate it!

I uninstalled AVG and ran DSS.

Main.txt:

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-01-25 19:26:18
Computer is in Normal Mode.
——————————————————————————–

– System Restore ————————————————————–

Successfully created a Deckard's System Scanner Restore Point.


– Last 5 Restore Point(s) –
34: 2008-01-26 01:26:25 UTC - RP804 - Deckard's System Scanner Restore Point
33: 2008-01-26 01:14:30 UTC - RP803 - Installed AVG 7.5
32: 2008-01-26 01:13:29 UTC - RP802 - Removed AVG 7.5
31: 2008-01-25 01:27:32 UTC - RP801 - System Checkpoint
30: 2008-01-24 01:09:38 UTC - RP800 - System Checkpoint


– First Restore Point –
1: 2007-12-30 14:07:27 UTC - RP771 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



– HijackThis (run as Jason.exe) ———————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:27:17 PM, on 1/25/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Ad-Aware\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svcd\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zune\ZuneLauncher.exe
F:\PeerGuardian2\pg2.exe
C:\WINDOWS\System32\svchost.exe
F:\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\Documents and Settings\Jason\Desktop\dss.exe
C:\DOCUME~1\Jason\Desktop\Jason.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo;! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: On The Net Search Helper - {4E8F5D76-EF5B-46C8-B35B-C86F8BD6621A} - C:\WINDOWS\system32\memocbcq.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {97AE084F-9589-4FA0-8249-2DCC5C755DFB} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [comup] C:\WINDOWS\system32\mobjchku.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport; to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Security Service (MYCO) - Unknown owner - C:\WINDOWS\system32\svcd\svchost.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 7703 bytes

– File Associations ———————————————————–

All associations okay.


– Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ———————

R0 Vax347b - c:\windows\system32\drivers\vax347b.sys
R0 Vax347s - c:\windows\system32\drivers\vax347s.sys
R1 avgcleann - c:\windows\system32\drivers\avgcleann.sys
R1 FileDisk - c:\windows\system32\drivers\filedisk.sys

Here is the ComboFix log:

ComboFix 08-01-18.5 - Jason 2008-01-26 9:53:13.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.573 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Jason\Application Data\inst.exe
C:\temp\tn3
C:\WINDOWS\system32\drivers\core.cache.dsk . . . . failed to delete

.
((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-26 09:55 . 2008-01-26 09:55 d——– C:\Temp\tn3
2008-01-26 09:52 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-25 19:26 . 2008-01-25 19:26 d——– C:\Deckard
2008-01-25 19:19 . 2008-01-25 10:07 430,080 –a—— C:\WINDOWS\system32\memohtsl.dll
2008-01-25 19:19 . 2008-01-25 10:07 430,080 –a—— C:\WINDOWS\system32\memocbcq.dll
2008-01-25 19:14 . 2008-01-25 19:14 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-25 01:29 . 2008-01-25 01:29 3,856 –a—— C:\WINDOWS\crmtemp1.dat
2008-01-24 17:19 . 2008-01-24 17:19 d——– C:\WINDOWS\system32\svcd
2008-01-24 17:19 . 2008-01-24 17:19 34,816 –a—— C:\info.exe
2008-01-24 17:19 . 2008-01-26 05:17 114 –a—— C:\WINDOWS\system32\url3
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url2
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url1
2008-01-24 17:19 . 2008-01-26 05:17 8 –a—— C:\WINDOWS\system32\CID
2008-01-24 17:19 . 2008-01-24 17:19 4 –a—— C:\WINDOWS\system32\SvcNm
2008-01-22 18:41 . 2008-01-11 17:39 145,408 –a—— C:\WINDOWS\system32\ZuneMTPZ.dll
2008-01-22 18:41 . 2008-01-11 17:39 70,656 –a—— C:\WINDOWS\system32\ZuneIpTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 62,464 –a—— C:\WINDOWS\system32\ZuneUsbTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 35,840 –a—— C:\WINDOWS\system32\ZuneUsbCOnnection.dll
2008-01-19 10:29 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-19 10:29 . 2008-01-19 10:29 0 –a—— C:\WINDOWS\system32\REN89.tmp
2008-01-18 22:58 . 2008-01-26 09:57 932 ——— C:\WINDOWS\system32\drivers\core.cache.dsk
2008-01-13 16:47 . 2008-01-13 16:47 d——– C:\Documents and Settings\Jason\Application Data\Grisoft
2008-01-13 16:47 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 16:00 . 2008-01-13 16:00 24,576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-13 15:35 . 2008-01-13 15:35 d——– C:\VundoFix Backups
2008-01-13 15:23 . 2008-01-13 15:23 d——– C:\WINDOWS\ERUNT
2008-01-12 20:47 . 2008-01-12 20:47 d——– C:\Documents and Settings\Jason\Application Data\SUPERAntiSpyware.com
2008-01-12 18:55 . 2008-01-12 18:55 d——– C:\Program Files\Alwil Software
2008-01-12 18:55 . 2007-12-04 07:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2008-01-12 18:55 . 2004-01-09 03:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2008-01-12 18:55 . 2007-12-04 06:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2008-01-12 18:55 . 2007-12-04 08:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-12 18:55 . 2007-12-04 08:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-12 18:55 . 2007-12-04 08:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-12 18:55 . 2007-12-04 08:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-12 18:55 . 2007-12-04 08:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-12 15:39 . 2008-01-12 15:39 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-12 15:38 . 2008-01-13 10:21 d——– C:\Program Files\SUPERAntiSpyware
2008-01-12 09:09 . 2008-01-24 18:44 897 –a—— C:\WINDOWS\wininit.ini
2008-01-11 19:08 . 2008-01-25 19:19 54,033 –a—— C:\WINDOWS\system32\memouint.exe
2008-01-11 17:54 . 2008-01-11 17:54 245,664 –a—— C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2008-01-11 17:54 . 2008-01-11 17:54 61,856 –a—— C:\WINDOWS\system32\ZuneBusEnum.exe
2008-01-10 22:52 . 2008-01-10 22:52 d——– C:\Temp\Ryuan1
2008-01-10 22:51 . 2008-01-10 22:52 352,410 –a—— C:\WINDOWS\system32\opeE23.exe
2008-01-10 22:51 . 2008-01-10 22:51 0 –a—— C:\WINDOWS\system32\opeE23.tmp
2008-01-01 12:49 . 2008-01-01 12:49 d——– C:\Documents and Settings\Jason\Application Data\ImgBurn
2008-01-01 12:39 . 2008-01-01 12:39 d——– C:\Program Files\ImgBurn
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01005.Wdf
2007-12-27 17:51 . 2008-01-22 18:41 d——– C:\Program Files\Zune
2007-12-27 17:44 . 2007-07-30 19:18 34,136 –a—— C:\WINDOWS\system32\wucltui.dll.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuapi.dll.mui
2007-12-27 17:44 . 2007-07-30 19:18 20,312 –a—— C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 14:41 . 2007-12-28 21:53 d——– C:\Documents and Settings\Jason\Application Data\Mp3tag
2007-12-26 01:32 . 2007-12-26 01:32 d——– C:\Program Files\DIFX
2007-12-26 01:31 . 2008-01-22 18:41 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-26 01:31 . 2007-12-26 01:31 d——– C:\Program Files\Common Files\ComponentOne
2007-12-26 01:30 . 2006-10-04 08:06 1,197,294 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-12-26 01:30 . 2006-10-04 08:06 764,868 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-12-26 01:30 . 2006-10-04 08:06 217,118 —–c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-12-26 01:29 . 2007-12-26 01:29 d——– C:\WINDOWS\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 01:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-19 16:29 ——— d—–w C:\Program Files\Java
2008-01-19 03:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-16 03:46 ——— d—–w C:\Documents and Settings\Jason\Application Data\dvdcss
2008-01-13 02:40 ——— d–h–r C:\Documents and Settings\Jason\Application Data\yahoo!
2008-01-13 00:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-12 21:37 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-12 19:09 ——— d—–w C:\Program Files\Yahoo!
2008-01-12 19:09 ——— d—–w C:\Program Files\Common Files\Scanner
2008-01-11 23:39 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-01-11 04:52 86,016 —-a-w C:\WINDOWS\system32\drivers\avgcleann.sys
2008-01-05 04:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-01 05:46 ——— d—–w C:\Program Files\Common Files\Ahead
2007-12-24 05:25 ——— d—–w C:\Documents and Settings\Jason\Application Data\EPSON
2007-12-23 05:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\Azureus
2007-12-23 05:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-08 15:24 ——— d—–w C:\Program Files\PeoplePC
2007-12-05 03:04 ——— d–h–w C:\Documents and Settings\Jason\Application Data\Move Networks
2007-12-01 02:52 ——— d—–w C:\Program Files\Common Files\AVSMedia
2007-08-05 02:29 47,360 —-a-w C:\Documents and Settings\Jason\Application Data\pcouffin.sys
2006-10-16 18:47 774,144 —-a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E8F5D76-EF5B-46C8-B35B-C86F8BD6621A}]
2008-01-25 10:07 430080 –a—— C:\WINDOWS\system32\memocbcq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{97AE084F-9589-4FA0-8249-2DCC5C755DFB}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="F:\PeerGuardian2\pg2.exe" [2005-09-18 17:40 1421824]
"comup"="C:\WINDOWS\system32\mobjchku.exe" [2007-12-13 12:25 139264]
"SpybotSD TeaTimer"="F:\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2004-06-21 12:57 143360 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2004-10-01 02:31 53248 C:\WINDOWS\system32\VTTimer.exe]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2004-10-11 00:54 589824]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-07 21:34 180269]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22 86016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 17:54 166304]

C:\Documents and Settings\Tasha\Start Menu\Programs\Startup\
eCalendar.lnk - C:\Program Files\graphiquEcalendar Tuscany\eCalendar.exe [2007-01-02 21:25:50]
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2006-07-12 15:57:49]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PC Alert 4.lnk - C:\Program Files\MSI\PC Alert 4\PCAlert4.exe [2006-02-06 02:03:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
F:\WINDOW~1\wbsrv.dll 2005-12-06 21:16 176128 F:\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys [2004-07-06 08:45]
R1 avgcleann;avgcleann;C:\WINDOWS\system32\drivers\avgcleann.sys [2008-01-10 22:52]
R2 MYCO;Security Service;C:\WINDOWS\system32\svcd\svchost.exe [2008-01-24 17:19]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 17:39]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 17:54]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys [2005-08-25 19:26]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 17:54]

*Newly Created Service* - PCALERTDRIVER
*Newly Created Service* - PGFILTER
.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 23:54:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 10:02:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> F:\WindowBlinds\tray.dll
.
Completion time: 2008-01-26 10:04:13 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-26 16:04:11

And here is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:07:05 AM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Ad-Aware\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svcd\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zune\ZuneLauncher.exe
F:\PeerGuardian2\pg2.exe
F:\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\Documents and Settings\Jason\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: On The Net Search Helper - {4E8F5D76-EF5B-46C8-B35B-C86F8BD6621A} - C:\WINDOWS\system32\memocbcq.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: (no name) - {97AE084F-9589-4FA0-8249-2DCC5C755DFB} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [comup] C:\WINDOWS\system32\mobjchku.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Security Service (MYCO) - Unknown owner - C:\WINDOWS\system32\svcd\svchost.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 7674 bytes

Here's the Combofix log:

ComboFix 08-01-18.5 - Jason 2008-01-26 10:44:05.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.614 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE
C:\info.exe
C:\WINDOWS\system32\memocbcq.dll
C:\WINDOWS\system32\memohtsl.dll
C:\WINDOWS\system32\memouint.exe
C:\WINDOWS\system32\mobjchku.exe
C:\WINDOWS\system32\opeE23.exe
C:\WINDOWS\system32\opeE23.tmp
C:\WINDOWS\system32\REN89.tmp
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\info.exe
C:\Temp\Ryuan1
C:\Temp\Ryuan1\tepU.log
C:\temp\tn3
C:\WINDOWS\system32\CID\
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\memocbcq.dll
C:\WINDOWS\system32\memohtsl.dll
C:\WINDOWS\system32\memouint.exe
C:\WINDOWS\system32\mobjchku.exe
C:\WINDOWS\system32\opeE23.exe
C:\WINDOWS\system32\opeE23.tmp
C:\WINDOWS\system32\REN89.tmp
C:\WINDOWS\system32\svcd
C:\WINDOWS\system32\svcd\svchost.exe
C:\WINDOWS\system32\SvcNm\
C:\WINDOWS\system32\url1\
C:\WINDOWS\system32\url2\
C:\WINDOWS\system32\url3\

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_AVGCLEANN
——-\avgcleann


((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-26 09:52 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-25 19:26 . 2008-01-25 19:26 d——– C:\Deckard
2008-01-25 19:14 . 2008-01-25 19:14 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-25 01:29 . 2008-01-25 01:29 3,856 –a—— C:\WINDOWS\crmtemp1.dat
2008-01-24 17:19 . 2008-01-26 05:17 114 –a—— C:\WINDOWS\system32\url3
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url2
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url1
2008-01-24 17:19 . 2008-01-26 05:17 8 –a—— C:\WINDOWS\system32\CID
2008-01-24 17:19 . 2008-01-24 17:19 4 –a—— C:\WINDOWS\system32\SvcNm
2008-01-22 18:41 . 2008-01-11 17:39 145,408 –a—— C:\WINDOWS\system32\ZuneMTPZ.dll
2008-01-22 18:41 . 2008-01-11 17:39 70,656 –a—— C:\WINDOWS\system32\ZuneIpTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 62,464 –a—— C:\WINDOWS\system32\ZuneUsbTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 35,840 –a—— C:\WINDOWS\system32\ZuneUsbCOnnection.dll
2008-01-19 10:29 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-13 16:47 . 2008-01-13 16:47 d——– C:\Documents and Settings\Jason\Application Data\Grisoft
2008-01-13 16:47 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 16:00 . 2008-01-13 16:00 24,576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-13 15:35 . 2008-01-13 15:35 d——– C:\VundoFix Backups
2008-01-13 15:23 . 2008-01-13 15:23 d——– C:\WINDOWS\ERUNT
2008-01-12 20:47 . 2008-01-12 20:47 d——– C:\Documents and Settings\Jason\Application Data\SUPERAntiSpyware.com
2008-01-12 18:55 . 2008-01-12 18:55 d——– C:\Program Files\Alwil Software
2008-01-12 18:55 . 2007-12-04 07:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2008-01-12 18:55 . 2004-01-09 03:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2008-01-12 18:55 . 2007-12-04 06:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2008-01-12 18:55 . 2007-12-04 08:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-12 18:55 . 2007-12-04 08:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-12 18:55 . 2007-12-04 08:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-12 18:55 . 2007-12-04 08:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-12 18:55 . 2007-12-04 08:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-12 15:39 . 2008-01-12 15:39 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-12 15:38 . 2008-01-13 10:21 d——– C:\Program Files\SUPERAntiSpyware
2008-01-12 09:09 . 2008-01-24 18:44 897 –a—— C:\WINDOWS\wininit.ini
2008-01-11 17:54 . 2008-01-11 17:54 245,664 –a—— C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2008-01-11 17:54 . 2008-01-11 17:54 61,856 –a—— C:\WINDOWS\system32\ZuneBusEnum.exe
2008-01-01 12:49 . 2008-01-01 12:49 d——– C:\Documents and Settings\Jason\Application Data\ImgBurn
2008-01-01 12:39 . 2008-01-01 12:39 d——– C:\Program Files\ImgBurn
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01005.Wdf
2007-12-27 17:51 . 2008-01-22 18:41 d——– C:\Program Files\Zune
2007-12-27 17:44 . 2007-07-30 19:18 34,136 –a—— C:\WINDOWS\system32\wucltui.dll.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuapi.dll.mui
2007-12-27 17:44 . 2007-07-30 19:18 20,312 –a—— C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 14:41 . 2007-12-28 21:53 d——– C:\Documents and Settings\Jason\Application Data\Mp3tag
2007-12-26 01:32 . 2007-12-26 01:32 d——– C:\Program Files\DIFX
2007-12-26 01:31 . 2008-01-22 18:41 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-26 01:31 . 2007-12-26 01:31 d——– C:\Program Files\Common Files\ComponentOne
2007-12-26 01:30 . 2006-10-04 08:06 1,197,294 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-12-26 01:30 . 2006-10-04 08:06 764,868 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-12-26 01:30 . 2006-10-04 08:06 217,118 —–c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-12-26 01:29 . 2007-12-26 01:29 d——– C:\WINDOWS\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 01:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-19 16:29 ——— d—–w C:\Program Files\Java
2008-01-19 03:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-16 03:46 ——— d—–w C:\Documents and Settings\Jason\Application Data\dvdcss
2008-01-13 02:40 ——— d–h–r C:\Documents and Settings\Jason\Application Data\yahoo!
2008-01-13 00:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-12 21:37 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-12 19:09 ——— d—–w C:\Program Files\Yahoo!
2008-01-12 19:09 ——— d—–w C:\Program Files\Common Files\Scanner
2008-01-11 23:39 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-01-11 04:52 86,016 —-a-w C:\WINDOWS\system32\drivers\avgcleann.sys
2008-01-05 04:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-01 05:46 ——— d—–w C:\Program Files\Common Files\Ahead
2007-12-24 05:25 ——— d—–w C:\Documents and Settings\Jason\Application Data\EPSON
2007-12-23 05:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\Azureus
2007-12-23 05:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-08 15:24 ——— d—–w C:\Program Files\PeoplePC
2007-12-05 03:04 ——— d–h–w C:\Documents and Settings\Jason\Application Data\Move Networks
2007-12-01 02:52 ——— d—–w C:\Program Files\Common Files\AVSMedia
2007-08-05 02:29 47,360 —-a-w C:\Documents and Settings\Jason\Application Data\pcouffin.sys
2006-10-16 18:47 774,144 —-a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-26_10.03.54.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-26 15:52:59 1,421,312 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-26 16:44:00 1,421,312 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-26 15:52:59 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-26 16:44:00 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-26 15:52:59 1,417,216 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-26 16:44:00 1,417,216 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-26 15:52:59 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-26 16:44:00 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-26 15:52:59 13,922,304 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-26 16:44:00 13,930,496 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-26 15:52:59 1,351,680 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-26 16:44:01 1,351,680 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2000-08-31 14:00:00 163,328 —-a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
- 2008-01-26 15:57:53 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_64c.dat
+ 2008-01-26 16:48:30 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_64c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="F:\PeerGuardian2\pg2.exe" [2005-09-18 17:40 1421824]
"comup"="C:\WINDOWS\system32\mobjchku.exe" [ ]
"SpybotSD TeaTimer"="F:\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"VTTrayp"="VTtrayp.exe" [2004-06-21 12:57 143360 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2004-10-01 02:31 53248 C:\WINDOWS\system32\VTTimer.exe]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2004-10-11 00:54 589824]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-07 21:34 180269]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22 86016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 17:54 166304]

C:\Documents and Settings\Tasha\Start Menu\Programs\Startup\
eCalendar.lnk - C:\Program Files\graphiquEcalendar Tuscany\eCalendar.exe [2007-01-02 21:25:50]
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2006-07-12 15:57:49]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PC Alert 4.lnk - C:\Program Files\MSI\PC Alert 4\PCAlert4.exe [2006-02-06 02:03:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
F:\WINDOW~1\wbsrv.dll 2005-12-06 21:16 176128 F:\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys [2004-07-06 08:45]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 17:39]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 17:54]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys [2005-08-25 19:26]
S2 MYCO;Security Service;C:\WINDOWS\system32\svcd\svchost.exe []
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 17:54]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 23:54:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 10:49:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> F:\WindowBlinds\tray.dll
.
Completion time: 2008-01-26 10:51:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-26 16:51:46
ComboFix2.txt 2008-01-26 16:04:13

And here's the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:52:37 AM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Ad-Aware\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zune\ZuneLauncher.exe
F:\PeerGuardian2\pg2.exe
F:\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Jason\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [comup] C:\WINDOWS\system32\mobjchku.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: Security Service (MYCO) - Unknown owner - C:\WINDOWS\system32\svcd\svchost.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 7577 bytes

The last fix seemed to stop the popups.

Here's the new ComboFix log:

ComboFix 08-01-18.5 - Jason 2008-01-26 11:46:33.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.627 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\CID\
C:\WINDOWS\system32\drivers\avgcleann.sys
C:\WINDOWS\system32\SvcNm\
C:\WINDOWS\system32\url1\
C:\WINDOWS\system32\url2\
C:\WINDOWS\system32\url3\

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_MYCO
——-\MYCO


((((((((((((((((((((((((( Files Created from 2007-12-26 to 2008-01-26 )))))))))))))))))))))))))))))))
.

2008-01-26 09:52 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-25 19:26 . 2008-01-25 19:26 d——– C:\Deckard
2008-01-25 19:14 . 2008-01-25 19:14 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-25 01:29 . 2008-01-25 01:29 3,856 –a—— C:\WINDOWS\crmtemp1.dat
2008-01-24 17:19 . 2008-01-26 05:17 114 –a—— C:\WINDOWS\system32\url3
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url2
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url1
2008-01-24 17:19 . 2008-01-26 05:17 8 –a—— C:\WINDOWS\system32\CID
2008-01-24 17:19 . 2008-01-24 17:19 4 –a—— C:\WINDOWS\system32\SvcNm
2008-01-22 18:41 . 2008-01-11 17:39 145,408 –a—— C:\WINDOWS\system32\ZuneMTPZ.dll
2008-01-22 18:41 . 2008-01-11 17:39 70,656 –a—— C:\WINDOWS\system32\ZuneIpTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 62,464 –a—— C:\WINDOWS\system32\ZuneUsbTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 35,840 –a—— C:\WINDOWS\system32\ZuneUsbCOnnection.dll
2008-01-19 10:29 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-13 16:47 . 2008-01-13 16:47 d——– C:\Documents and Settings\Jason\Application Data\Grisoft
2008-01-13 16:47 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 16:00 . 2008-01-13 16:00 24,576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-13 15:35 . 2008-01-13 15:35 d——– C:\VundoFix Backups
2008-01-13 15:23 . 2008-01-13 15:23 d——– C:\WINDOWS\ERUNT
2008-01-12 20:47 . 2008-01-12 20:47 d——– C:\Documents and Settings\Jason\Application Data\SUPERAntiSpyware.com
2008-01-12 18:55 . 2008-01-12 18:55 d——– C:\Program Files\Alwil Software
2008-01-12 18:55 . 2007-12-04 07:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2008-01-12 18:55 . 2004-01-09 03:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2008-01-12 18:55 . 2007-12-04 06:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2008-01-12 18:55 . 2007-12-04 08:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-12 18:55 . 2007-12-04 08:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-12 18:55 . 2007-12-04 08:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-12 18:55 . 2007-12-04 08:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-12 18:55 . 2007-12-04 08:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-12 15:39 . 2008-01-12 15:39 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-12 15:38 . 2008-01-13 10:21 d——– C:\Program Files\SUPERAntiSpyware
2008-01-12 09:09 . 2008-01-24 18:44 897 –a—— C:\WINDOWS\wininit.ini
2008-01-11 17:54 . 2008-01-11 17:54 245,664 –a—— C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2008-01-11 17:54 . 2008-01-11 17:54 61,856 –a—— C:\WINDOWS\system32\ZuneBusEnum.exe
2008-01-01 12:49 . 2008-01-01 12:49 d——– C:\Documents and Settings\Jason\Application Data\ImgBurn
2008-01-01 12:39 . 2008-01-01 12:39 d——– C:\Program Files\ImgBurn
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01005.Wdf
2007-12-27 17:51 . 2008-01-22 18:41 d——– C:\Program Files\Zune
2007-12-27 17:44 . 2007-07-30 19:18 34,136 –a—— C:\WINDOWS\system32\wucltui.dll.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuapi.dll.mui
2007-12-27 17:44 . 2007-07-30 19:18 20,312 –a—— C:\WINDOWS\system32\wuaueng.dll.mui
2007-12-26 14:41 . 2007-12-28 21:53 d——– C:\Documents and Settings\Jason\Application Data\Mp3tag
2007-12-26 01:32 . 2007-12-26 01:32 d——– C:\Program Files\DIFX
2007-12-26 01:31 . 2008-01-22 18:41 d—-c— C:\WINDOWS\system32\DRVSTORE
2007-12-26 01:31 . 2007-12-26 01:31 d——– C:\Program Files\Common Files\ComponentOne
2007-12-26 01:30 . 2006-10-04 08:06 1,197,294 —–c— C:\WINDOWS\system32\dllcache\sysmain.sdb
2007-12-26 01:30 . 2006-10-04 08:06 764,868 —–c— C:\WINDOWS\system32\dllcache\apph_sp.sdb
2007-12-26 01:30 . 2006-10-04 08:06 217,118 —–c— C:\WINDOWS\system32\dllcache\apphelp.sdb
2007-12-26 01:29 . 2007-12-26 01:29 d——– C:\WINDOWS\system32\LogFiles

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 01:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-19 16:29 ——— d—–w C:\Program Files\Java
2008-01-19 03:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-16 03:46 ——— d—–w C:\Documents and Settings\Jason\Application Data\dvdcss
2008-01-13 02:40 ——— d–h–r C:\Documents and Settings\Jason\Application Data\yahoo!
2008-01-13 00:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-12 21:37 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-12 19:09 ——— d—–w C:\Program Files\Yahoo!
2008-01-12 19:09 ——— d—–w C:\Program Files\Common Files\Scanner
2008-01-11 23:39 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-01-05 04:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-01 05:46 ——— d—–w C:\Program Files\Common Files\Ahead
2007-12-24 05:25 ——— d—–w C:\Documents and Settings\Jason\Application Data\EPSON
2007-12-23 05:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\Azureus
2007-12-23 05:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-08 15:24 ——— d—–w C:\Program Files\PeoplePC
2007-12-05 03:04 ——— d–h–w C:\Documents and Settings\Jason\Application Data\Move Networks
2007-12-01 02:52 ——— d—–w C:\Program Files\Common Files\AVSMedia
2007-08-05 02:29 47,360 —-a-w C:\Documents and Settings\Jason\Application Data\pcouffin.sys
2006-10-16 18:47 774,144 —-a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-26_10.03.54.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-26 15:52:59 1,421,312 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-26 17:46:27 1,421,312 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-26 15:52:59 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-26 17:46:27 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-26 15:52:59 1,417,216 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-26 17:46:27 1,417,216 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-26 15:52:59 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-26 17:46:27 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-26 15:52:59 13,922,304 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-26 17:46:28 13,930,496 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-26 15:52:59 1,351,680 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-26 17:46:28 1,351,680 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-26 15:53:00 4,816,896 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\NTUSER.DAT
+ 2008-01-26 17:46:28 4,816,896 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\NTUSER.DAT
- 2008-01-26 15:53:00 1,339,392 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000008\UsrClass.dat
+ 2008-01-26 17:46:28 1,339,392 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000008\UsrClass.dat
+ 2000-08-31 14:00:00 163,328 —-a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
+ 2008-01-26 17:53:36 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_634.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="F:\PeerGuardian2\pg2.exe" [2005-09-18 17:40 1421824]
"comup"="C:\WINDOWS\system32\mobjchku.exe" [ ]
"SpybotSD TeaTimer"="F:\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"VTTrayp"="VTtrayp.exe" [2004-06-21 12:57 143360 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2004-10-01 02:31 53248 C:\WINDOWS\system32\VTTimer.exe]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2004-10-11 00:54 589824]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-07 21:34 180269]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22 86016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 17:54 166304]

C:\Documents and Settings\Tasha\Start Menu\Programs\Startup\
eCalendar.lnk - C:\Program Files\graphiquEcalendar Tuscany\eCalendar.exe [2007-01-02 21:25:50]
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2006-07-12 15:57:49]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PC Alert 4.lnk - C:\Program Files\MSI\PC Alert 4\PCAlert4.exe [2006-02-06 02:03:15]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
F:\WINDOW~1\wbsrv.dll 2005-12-06 21:16 176128 F:\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys [2004-07-06 08:45]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 17:39]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 17:54]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys [2005-08-25 19:26]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 17:54]

*Newly Created Service* - PGFILTER
.
Contents of the 'Scheduled Tasks' folder
"2008-01-19 23:54:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 11:54:24
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> F:\WindowBlinds\tray.dll
.
Completion time: 2008-01-26 11:56:40 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-26 17:56:31
ComboFix2.txt 2008-01-26 16:51:49
ComboFix3.txt 2008-01-26 16:04:13


And here's the new Hijack This log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:58:15 AM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\WINDOWS\System32\svchost.exe
F:\PeerGuardian2\pg2.exe
F:\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\Documents and Settings\Jason\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O3 - Toolbar: (no name) - {C17590D2-ECB4-4b15-8820-F58798DCC118} - (no file)
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [comup] C:\WINDOWS\system32\mobjchku.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 7388 bytes

Here is the new HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:50:47 PM, on 1/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
F:\Ad-Aware\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\PeerGuardian2\pg2.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
F:\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Jason\Desktop\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 7209 bytes

Sorry, here's the ComboFix log:

ComboFix 08-01-18.5 - Jason 2008-01-26 22:26:49.5 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.632 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jason\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\CID\
C:\WINDOWS\system32\SvcNm\
C:\WINDOWS\system32\url1\
C:\WINDOWS\system32\url2\
C:\WINDOWS\system32\url3\

.
((((((((((((((((((((((((( Files Created from 2007-12-27 to 2008-01-27 )))))))))))))))))))))))))))))))
.

2008-01-26 09:52 . 2000-08-31 08:00 51,200 –a—— C:\WINDOWS\NirCmd.exe
2008-01-25 19:26 . 2008-01-25 19:26 d——– C:\Deckard
2008-01-25 19:14 . 2008-01-25 19:14 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-25 01:29 . 2008-01-25 01:29 3,856 –a—— C:\WINDOWS\crmtemp1.dat
2008-01-24 17:19 . 2008-01-26 05:17 114 –a—— C:\WINDOWS\system32\url3
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url2
2008-01-24 17:19 . 2008-01-26 05:17 102 –a—— C:\WINDOWS\system32\url1
2008-01-24 17:19 . 2008-01-26 05:17 8 –a—— C:\WINDOWS\system32\CID
2008-01-24 17:19 . 2008-01-24 17:19 4 –a—— C:\WINDOWS\system32\SvcNm
2008-01-22 18:41 . 2008-01-11 17:39 145,408 –a—— C:\WINDOWS\system32\ZuneMTPZ.dll
2008-01-22 18:41 . 2008-01-11 17:39 70,656 –a—— C:\WINDOWS\system32\ZuneIpTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 62,464 –a—— C:\WINDOWS\system32\ZuneUsbTransport.dll
2008-01-22 18:41 . 2008-01-11 17:39 35,840 –a—— C:\WINDOWS\system32\ZuneUsbCOnnection.dll
2008-01-19 10:29 . 2007-09-24 23:31 69,632 –a—— C:\WINDOWS\system32\javacpl.cpl
2008-01-13 16:47 . 2008-01-13 16:47 d——– C:\Documents and Settings\Jason\Application Data\Grisoft
2008-01-13 16:47 . 2007-05-30 06:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 16:00 . 2008-01-13 16:00 24,576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe
2008-01-13 15:35 . 2008-01-13 15:35 d——– C:\VundoFix Backups
2008-01-13 15:23 . 2008-01-13 15:23 d——– C:\WINDOWS\ERUNT
2008-01-12 20:47 . 2008-01-12 20:47 d——– C:\Documents and Settings\Jason\Application Data\SUPERAntiSpyware.com
2008-01-12 18:55 . 2008-01-12 18:55 d——– C:\Program Files\Alwil Software
2008-01-12 18:55 . 2007-12-04 07:04 837,496 –a—— C:\WINDOWS\system32\aswBoot.exe
2008-01-12 18:55 . 2004-01-09 03:13 380,928 –a—— C:\WINDOWS\system32\actskin4.ocx
2008-01-12 18:55 . 2007-12-04 06:54 95,608 –a—— C:\WINDOWS\system32\AvastSS.scr
2008-01-12 18:55 . 2007-12-04 08:55 94,544 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2008-01-12 18:55 . 2007-12-04 08:56 93,264 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2008-01-12 18:55 . 2007-12-04 08:51 42,912 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2008-01-12 18:55 . 2007-12-04 08:49 26,624 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2008-01-12 18:55 . 2007-12-04 08:53 23,152 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2008-01-12 15:39 . 2008-01-12 15:39 d——– C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-01-12 15:38 . 2008-01-13 10:21 d——– C:\Program Files\SUPERAntiSpyware
2008-01-12 09:09 . 2008-01-24 18:44 897 –a—— C:\WINDOWS\wininit.ini
2008-01-11 17:54 . 2008-01-11 17:54 245,664 –a—— C:\WINDOWS\system32\ZuneWlanCfgSvc.exe
2008-01-11 17:54 . 2008-01-11 17:54 61,856 –a—— C:\WINDOWS\system32\ZuneBusEnum.exe
2008-01-01 12:49 . 2008-01-01 12:49 d——– C:\Documents and Settings\Jason\Application Data\ImgBurn
2008-01-01 12:39 . 2008-01-01 12:39 d——– C:\Program Files\ImgBurn
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-12-27 17:52 . 2007-12-27 17:52 0 –ah—– C:\WINDOWS\system32\drivers\Msft_Kernel_zumbus_01005.Wdf
2007-12-27 17:51 . 2008-01-22 18:41 d——– C:\Program Files\Zune
2007-12-27 17:44 . 2007-07-30 19:18 34,136 –a—— C:\WINDOWS\system32\wucltui.dll.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuaucpl.cpl.mui
2007-12-27 17:44 . 2007-07-30 19:19 25,944 –a—— C:\WINDOWS\system32\wuapi.dll.mui
2007-12-27 17:44 . 2007-07-30 19:18 20,312 –a—— C:\WINDOWS\system32\wuaueng.dll.mui

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-26 01:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-19 16:29 ——— d—–w C:\Program Files\Java
2008-01-19 03:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-01-16 03:46 ——— d—–w C:\Documents and Settings\Jason\Application Data\dvdcss
2008-01-13 02:40 ——— d–h–r C:\Documents and Settings\Jason\Application Data\yahoo!
2008-01-13 00:13 ——— d—–w C:\Documents and Settings\All Users\Application Data\Yahoo! Companion
2008-01-12 21:37 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-01-12 19:09 ——— d—–w C:\Program Files\Yahoo!
2008-01-12 19:09 ——— d—–w C:\Program Files\Common Files\Scanner
2008-01-11 23:39 40,832 —-a-w C:\WINDOWS\system32\drivers\zumbus.sys
2008-01-11 04:52 111,835 —-a-w C:\WINDOWS\system32\opeE2A.exe
2008-01-05 04:51 ——— d—–w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-01-01 05:46 ——— d—–w C:\Program Files\Common Files\Ahead
2007-12-29 03:53 ——— d—–w C:\Documents and Settings\Jason\Application Data\Mp3tag
2007-12-26 07:32 ——— d—–w C:\Program Files\DIFX
2007-12-26 07:31 ——— d—–w C:\Program Files\Common Files\ComponentOne
2007-12-24 05:25 ——— d—–w C:\Documents and Settings\Jason\Application Data\EPSON
2007-12-23 05:04 ——— d—–w C:\Documents and Settings\Jason\Application Data\Azureus
2007-12-23 05:03 ——— d—–w C:\Documents and Settings\All Users\Application Data\Azureus
2007-12-11 19:14 151,552 —-a-w C:\WINDOWS\system32\rushoiuz.exe
2007-12-11 19:14 151,552 —-a-w C:\WINDOWS\system32\bkmoopob.exe
2007-12-08 15:24 ——— d—–w C:\Program Files\PeoplePC
2007-12-05 03:04 ——— d–h–w C:\Documents and Settings\Jason\Application Data\Move Networks
2007-12-01 02:52 ——— d—–w C:\Program Files\Common Files\AVSMedia
2007-12-01 00:16 1,419,232 —-a-w C:\WINDOWS\system32\WdfCoInstaller01005.dll
2007-08-05 02:29 47,360 —-a-w C:\Documents and Settings\Jason\Application Data\pcouffin.sys
2006-10-16 18:47 774,144 —-a-w C:\Program Files\RngInterstitial.dll
.

((((((((((((((((((((((((((((( snapshot@2008-01-26_10.03.54.79 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-26 15:52:59 1,421,312 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-27 04:26:34 1,421,312 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-26 15:52:59 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-27 04:26:34 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-26 15:52:59 1,417,216 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
+ 2008-01-27 04:26:34 1,417,216 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
- 2008-01-26 15:52:59 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-27 04:26:34 1,191,936 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-26 15:52:59 13,922,304 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
+ 2008-01-27 04:26:35 13,934,592 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
- 2008-01-26 15:52:59 1,351,680 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-27 04:26:35 1,351,680 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
- 2008-01-26 15:53:00 4,816,896 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\NTUSER.DAT
+ 2008-01-27 04:26:35 4,816,896 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000007\NTUSER.DAT
- 2008-01-26 15:53:00 1,339,392 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000008\UsrClass.dat
+ 2008-01-27 04:26:35 1,339,392 —-a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000008\UsrClass.dat
+ 2000-08-31 14:00:00 163,328 —-a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE
+ 2008-01-26 17:53:36 16,384 —-atw C:\WINDOWS\Temp\Perflib_Perfdata_634.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PeerGuardian"="F:\PeerGuardian2\pg2.exe" [2005-09-18 17:40 1421824]
"SpybotSD TeaTimer"="F:\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 01:04 1415824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"VTTrayp"="VTtrayp.exe" [2004-06-21 12:57 143360 C:\WINDOWS\system32\VTTrayp.exe]
"VTTimer"="VTTimer.exe" [2004-10-01 02:31 53248 C:\WINDOWS\system32\VTTimer.exe]
"RaidTool"="C:\Program Files\VIA\RAID\raid_tool.exe" [2004-10-11 00:54 589824]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-04-07 21:34 180269]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22 7700480]
"nwiz"="nwiz.exe" [2006-10-22 11:22 1622016 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22 86016]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-12-04 07:00 79224]
"QuickTime Task"="F:\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-01-11 17:54 166304]

C:\Documents and Settings\Tasha\Start Menu\Programs\Startup\
eCalendar.lnk - C:\Program Files\graphiquEcalendar Tuscany\eCalendar.exe [2007-01-02 21:25:50]
Webshots.lnk - C:\Program Files\Webshots\Launcher.exe [2006-07-12 15:57:49]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
PC Alert 4.lnk - C:\Program Files\MSI\PC Alert 4\PCAlert4.exe [2006-02-06 02:03:15]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="LogonUI.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
F:\WINDOW~1\wbsrv.dll 2005-12-06 21:16 176128 F:\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

R0 viamraid;viamraid;C:\WINDOWS\system32\drivers\viamraid.sys [2004-07-06 08:45]
R2 zumbus;Zune Bus Enumerator Driver;C:\WINDOWS\system32\DRIVERS\zumbus.sys [2008-01-11 17:39]
R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINDOWS\system32\ZuneBusEnum.exe [2008-01-11 17:54]
R3 PCAlertDriver;PCAlertDriver;C:\Program Files\MSI\PC Alert 4\NTGLM7X.sys [2005-08-25 19:26]
S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINDOWS\system32\ZuneWlanCfgSvc.exe [2008-01-11 17:54]

*Newly Created Service* - PCALERTDRIVER
.
Contents of the 'Scheduled Tasks' folder
"2008-01-26 23:54:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-26 22:28:50
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.2180]
-> F:\WindowBlinds\tray.dll
.
Completion time: 2008-01-26 22:29:26
ComboFix-quarantined-files.txt 2008-01-27 04:29:17
ComboFix2.txt 2008-01-26 23:45:22
ComboFix3.txt 2008-01-26 17:56:40
ComboFix4.txt 2008-01-26 16:51:49
ComboFix5.txt 2008-01-26 16:04:13

Hello

Please download Deckard's System Scanner (DSS) and save it to your Desktop.

• Close all other windows before proceeding.
• Double-click on dss.exe and follow the prompts.
• If your anti-virus or firewall complains, please allow this script to run as it is not malicious.
• When it has finished, dss will open two Notepads main.txt and extra.txt – please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

DSS created a HijackThis log and a main.txt, but not extra.txt.

Here's main.txt:

Deckard's System Scanner v20071014.68
Run by [removed] on 2008-01-28 20:38:02
Computer is in Normal Mode.
——————————————————————————–



– HijackThis (run as Jason.exe) ———————————————–

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:38:09 PM, on 1/28/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
F:\Ad-Aware\aawservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\nvsvc32.exe
F:\Alcohol 120%\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\VIA\RAID\raid_tool.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
F:\QuickTime\qttask.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
F:\PeerGuardian2\pg2.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Adobe\Acrobat 7.0\Reader\AcroRd32.exe
C:\Documents and Settings\Jason\Desktop\dss(2).exe
C:\DOCUME~1\Jason\Desktop\Jason.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?.home=ytie
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/?.home=ytie
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - F:\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn2\yt.dll
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [RaidTool] C:\Program Files\VIA\RAID\raid_tool.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "F:\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKCU\..\Run: [PeerGuardian] F:\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] F:\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-1801674531-1383384898-839522115-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Tasha')
O4 - HKUS\S-1-5-21-1801674531-1383384898-839522115-1003\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" (User 'Tasha')
O4 - HKUS\S-1-5-21-1801674531-1383384898-839522115-1003\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User 'Tasha')
O4 - HKUS\S-1-5-21-1801674531-1383384898-839522115-1003\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (User 'Tasha')
O4 - HKUS\S-1-5-21-1801674531-1383384898-839522115-1003\..\Run: [updateMgr] "F:\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 (User 'Tasha')
O4 - S-1-5-21-1801674531-1383384898-839522115-1003 Startup: eCalendar.lnk = C:\Program Files\graphiquEcalendar Tuscany\eCalendar.exe (User 'Tasha')
O4 - S-1-5-21-1801674531-1383384898-839522115-1003 Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe (User 'Tasha')
O4 - S-1-5-21-1801674531-1383384898-839522115-1003 User Startup: eCalendar.lnk = C:\Program Files\graphiquEcalendar Tuscany\eCalendar.exe (User 'Tasha')
O4 - S-1-5-21-1801674531-1383384898-839522115-1003 User Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe (User 'Tasha')
O4 - Global Startup: PC Alert 4.lnk = C:\Program Files\MSI\PC Alert 4\PCAlert4.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\MICROS~3\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: Yahoo! Chat - http://us.chat1.yimg.com/us.yimg.com/i/cha…t/c381/chat.cab
O16 - DPF: {0645D7F3-C20E-4E0B-A545-557527497C0B} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n…GAPANEL_USA.cab
O16 - DPF: {230C3D02-DA27-11D2-8612-00A0C93EEA3C} (SAXFile FileUpload ActiveX Control) - http://www.winkflash.com/photo/loaders/SAXFile.cab
O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - http://us.dl1.yimg.com/download.yahoo.com/…nst20040510.cab
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1198799057828
O16 - DPF: {A18962F6-E6ED-40B1-97C9-1FB36F38BFA8} (Aurigma Image Uploader 3.0 Control) - http://www.winkflash.com/photo/loaders/ImageUploader3.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - F:\Ad-Aware\aawservice.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Unknown owner - C:\WINDOWS\

–
End of file - 8573 bytes

– Files created between 2007-12-28 and 2008-01-28 —————————–

2008-01-25 19:14:30 0 d——– C:\Documents and Settings\All Users\Application Data\Avg7
2008-01-25 01:29:12 3856 –a—— C:\WINDOWS\crmtemp1.dat
2008-01-24 17:19:24 114 –a—— C:\WINDOWS\system32\url3
2008-01-24 17:19:24 102 –a—— C:\WINDOWS\system32\url2
2008-01-24 17:19:24 102 –a—— C:\WINDOWS\system32\url1
2008-01-24 17:19:24 4 –a—— C:\WINDOWS\system32\SvcNm
2008-01-24 17:19:24 8 –a—— C:\WINDOWS\system32\CID
2008-01-13 16:47:54 0 d——– C:\Documents and Settings\Jason\Application Data\Grisoft
2008-01-13 16:00:27 24576 –a—— C:\WINDOWS\system32\VundoFixSVC.exe