[Closed] Spyware/Adware invasion, my log

Hey guys. My desktop is so infected with spyware that it has taken over my Start bar. The bar disappears, and if/when it ever returns it remains frozen. In the time it took me to type this, three pop-up windows are trying to sell me something about UniversalNightlife. Help!

Logfile of HijackThis v1.99.1
Scan saved at 1:29:28 PM, on 2/13/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
C:\Program Files\GameSpot\DownloadManager_Win32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Works\wkswp.exe
C:\Program Files\Microsoft Works\MSWorks.exe
C:\WINDOWS\System32\hqumtonb.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Andrew\Application Data\s?mbols\??rvices.exe
C:\DOCUME~1\Andrew\LOCALS~1\Temp\!update.exe
C:\PROGRA~1\STEM~1\msiexec.exe
C:\Documents and Settings\Andrew\Desktop\HijackThis.exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKLM\..\Run: [BMcbfef248] Rundll32.exe "C:\WINDOWS\System32\arrhacgr.dll",s
O4 - HKLM\..\Run: [c8cdc1d4] rundll32.exe "C:\WINDOWS\System32\aaqgmvxw.dll",b
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Andrew\Application Data\mvztkjvltmkp.exe
O4 - HKCU\..\Run: [3wPlayer Service] C:\Program Files\3wPlayer\wakeservice.exe
O4 - HKCU\..\Run: [barb corn] C:\DOCUME~1\Andrew\APPLIC~1\README~1\UP EXIT SEND.exe
O4 - HKCU\..\Run: [Rssa] "C:\PROGRA~1\STEM~1\msiexec.exe" -vt ndrv
O4 - HKCU\..\Run: [QdrModule12] "C:\Program Files\QdrModule\QdrModule12.exe"
O4 - HKCU\..\Run: [QdrPack12] "C:\Program Files\QdrPack\QdrPack12.exe"
O4 - HKCU\..\Run: [Drmupgds] C:\Program Files\Drmupgds\Drmupgds.exe
O4 - HKCU\..\Run: [Cxfpznm] "C:\Documents and Settings\Andrew\Application Data\s?mbols\??rvices.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZJfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxanet.net/code/chm/xpre.chm::/xpreload.ocx
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\hqumtonb.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Program Files\Prevx1\PXAgent.exe" -f (file missing)

Appologies, I just realized my version of HijackThis was outdated. I installed v2.0.2 and took a new log:

—————————————

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:37:14 PM, on 2/13/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
C:\Program Files\GameSpot\DownloadManager_Win32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Works\wkswp.exe
C:\Program Files\Microsoft Works\MSWorks.exe
C:\WINDOWS\System32\hqumtonb.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\explorer.exe
C:\PROGRA~1\STEM~1\msiexec.exe
C:\Documents and Settings\Andrew\Application Data\s?mbols\??rvices.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu572.exe 61A847B5BBF728173599284503996897C881250221C8670836AC4FA7C8833201749139
O4 - HKLM\..\Run: [BMcbfef248] Rundll32.exe "C:\WINDOWS\System32\arrhacgr.dll",s
O4 - HKLM\..\Run: [c8cdc1d4] rundll32.exe "C:\WINDOWS\System32\aaqgmvxw.dll",b
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Andrew\Application Data\mvztkjvltmkp.exe
O4 - HKCU\..\Run: [3wPlayer Service] C:\Program Files\3wPlayer\wakeservice.exe
O4 - HKCU\..\Run: [barb corn] C:\DOCUME~1\Andrew\APPLIC~1\README~1\UP EXIT SEND.exe
O4 - HKCU\..\Run: [Rssa] "C:\PROGRA~1\STEM~1\msiexec.exe" -vt ndrv
O4 - HKCU\..\Run: [QdrModule12] "C:\Program Files\QdrModule\QdrModule12.exe"
O4 - HKCU\..\Run: [QdrPack12] "C:\Program Files\QdrPack\QdrPack12.exe"
O4 - HKCU\..\Run: [Drmupgds] C:\Program Files\Drmupgds\Drmupgds.exe
O4 - HKCU\..\Run: [Cxfpznm] "C:\Documents and Settings\Andrew\Application Data\s?mbols\??rvices.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O8 - Extra context menu item: &Search - http://edits.mywebsearch.com/toolbaredits/…html?p=ZJfox000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O16 - DPF: {50BD5CDA-4BA8-4048-8FAA-763F222E41D8} - ms-its:mhtml:file://c:\\nores.mht!http://adxanet.net/code/chm/xpre.chm::/xpreload.ocx
O16 - DPF: {69EF49E5-FE46-4B92-B5FA-2193AB7A6B8A} (GameLauncher Control) - http://www.acclaim.com/cabs/acclaim_v4.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\hqumtonb.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Program Files\Prevx1\PXAgent.exe

–
End of file - 6560 bytes

Thank you for helping me out! =)

Right now my computer is still freezing a lot. Random IE pop-ups are frequent. Whenever I open TaskManager (which is literally every two or three minutes to get rid of the pop-up build up), under the Performance tab, my CPU usage is 100 and does not deviate by a single percent, ever. It's always being used up by what I suspect is maleware/spyware.

Okay. So I clicked on the Winhelp2002 link you gave me, and it led me to a text-only site that had this:

; DelDomains.inf © 11-28-04 | Revised 01-15-06
; Created by: Mike Burgess Microsoft MVP
; http://mvps.org/winhelp2002/
;
; Warning: Deletes all entries in the Restricted & Trusted Zone list
; http://mvps.org/winhelp2002/restricted.htm
;
; Revised to include the EscDomains key
;
; To execute this file: in Explorer - right-click (this file)
; Select Install from the Menu.
; Note: you will not see any onscreen action.

[version]
signature="$CHICAGO$"

[DefaultInstall]
DelReg=DelTemps
AddReg=AddTemps

[DelTemps]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains"

; Recreate the keys to avoid a restart

[AddTemps]
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKLM,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges"
HKCU,"Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains"

————-
As you can see, I didn't get any sort of link to click and Save As. There was nothing to download at the site. What I just posted is exactly what the page listed, and it was ALL text. I tried clicking on everything, but couldn't find the file. Any suggestions?

Deleted an old version of Java (only had one) and installed the newest.

Here's my new log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:05:51 AM, on 2/18/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
C:\Program Files\GameSpot\DownloadManager_Win32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\Rundll32.exe
C:\WINDOWS\System32\svcd\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\WINDOWS\System32\hqumtonb.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe

R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
F3 - REG:win.ini: run="C:\WINDOWS\system32\winupdate.exe"
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O3 - Toolbar: &WinSec Toolbar - {3F5A62E2-51F2-11D3-A075-CC7364CAE42A} - C:\WINDOWS\system32\wscmp.dll
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKCU\..\Run: [Uniblue Registry Booster2] C:\Program Files\Uniblue\RegistryBooster2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Microsft Windows Adapter 5.1.3013] C:\Documents and Settings\Andrew\Application Data\exxwu.exe
O4 - HKCU\..\Run: [3wPlayer Service] C:\Program Files\3wPlayer\wakeservice.exe
O4 - HKCU\..\Run: [Rssa] "C:\PROGRA~1\STEM~1\msiexec.exe" -vt ndrv
O4 - HKCU\..\Run: [barb corn] C:\DOCUME~1\Andrew\APPLIC~1\README~1\UP EXIT SEND.exe
O4 - HKCU\..\Run: [Microsoft Windows Adapter 5.1.3214] C:\Documents and Settings\Andrew\Application Data\ubnrq.exe
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O15 - Trusted Zone: *.amaena.com
O15 - Trusted Zone: *.avsystemcare.com
O15 - Trusted Zone: *.gomyhit.com
O15 - Trusted Zone: *.imageservr.com
O15 - Trusted Zone: *.imagesrvr.com
O15 - Trusted Zone: *.onerateld.com
O15 - Trusted Zone: *.safetydownload.com
O15 - Trusted Zone: *.storageguardsoft.com
O15 - Trusted Zone: *.trustedantivirus.com
O15 - Trusted Zone: *.virusschlacht.com
O15 - Trusted Zone: *.amaena.com (HKLM)
O15 - Trusted Zone: *.avsystemcare.com (HKLM)
O15 - Trusted Zone: *.gomyhit.com (HKLM)
O15 - Trusted Zone: *.imageservr.com (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.onerateld.com (HKLM)
O15 - Trusted Zone: *.safetydownload.com (HKLM)
O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
O15 - Trusted Zone: *.virusschlacht.com (HKLM)
O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: DomainService - - C:\WINDOWS\System32\hqumtonb.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Program Files\Prevx1\PXAgent.exe
O23 - Service: Security Service (RSPA) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe

–
End of file - 5505 bytes

Okay, it worked. Rebooted and took a new log: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 2:42:00 PM, on 2/19/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\alg.exe C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe C:\Program Files\GameSpot\DownloadManager_Win32.exe C:\WINDOWS\System32\hqumtonb.exe C:\WINDOWS\System32\svcd\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\SSTEM3~1\winlogon.exe C:\WINDOWS\System32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\System32\wbem\wmiprvse.exe R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll F3 - REG:win.ini: run="C:\WINDOWS\system32\winupdate.exe" O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O3 - Toolbar: &WinSec Toolbar - {3F5A62E2-51F2-11D3-A075-CC7364CAE42A} - C:\WINDOWS\system32\wscmp.dll O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE O4 - HKCU\..\Run: [barb corn] C:\DOCUME~1\Andrew\APPLIC~1\README~1\UP EXIT SEND.exe O4 - HKCU\..\Run: [Rssa] "C:\WINDOWS\System32\SSTEM3~1\winlogon.exe" -vt ndrv O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe O23 - Service: DomainService - - C:\WINDOWS\System32\hqumtonb.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing) O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Program Files\Prevx1\PXAgent.exe O23 - Service: Security Service (RSPA) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe – End of file - 3807 bytes

My CPU usage in TaskManager has started to stabilize. Thanks a ton for your help little eagle!

New logs:

ComboFix 08-02-21 - Andrew 2008-02-21 4:30:40.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.708 [GMT -6:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Andrew\Application Data\ASKS~1
C:\Documents and Settings\Andrew\Application Data\FunWebProducts
C:\Documents and Settings\Andrew\Application Data\FunWebProducts\Data\Andrew\avatar.dat
C:\Documents and Settings\Andrew\Application Data\FunWebProducts\Data\Andrew\register.dat
C:\Documents and Settings\Andrew\Application Data\FunWebProducts\Data\Andrew\zbucks.dat
C:\Documents and Settings\Andrew\Application Data\SMBOLS~1
C:\Documents and Settings\Andrew\Application Data\SMBOLS~1\??rvices.exe
C:\Documents and Settings\Andrew\load.exe
C:\Documents and Settings\Andrew\My Documents\FNTS~1
C:\Documents and Settings\Andrew\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\Andrew\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\Andrew\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\Andrew\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Andrew\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Andrew\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt
C:\Program Files\Common Files\dobe~1
C:\Program Files\Common Files\lagu.dll
C:\Program Files\Common Files\lagu780.dll
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1281OinAdmin.exe
C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1552OinAdmin.exe
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\Program Files\dobe~1
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\outlook
C:\Program Files\outlook\outlook.exe
C:\Program Files\outlook\p.zip
C:\Program Files\outlook\v.tmp
C:\Program Files\Temporary
C:\Program Files\Windows Media Player\pecy89104.dll
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\isgTi19
C:\Temp\isgTi19\lPig.log
C:\temp\tn3
C:\WINDOWS\b103.exe
C:\WINDOWS\b104.exe
C:\WINDOWS\b122.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\Downloaded Program Files\UGA6P_0001_N122M0611NetInstaller.exe
C:\WINDOWS\Downloaded Program Files\xpreload.ocx
C:\WINDOWS\mrofinu1000106.exe
C:\WINDOWS\mrofinu72.exe
C:\WINDOWS\pppatc~1
C:\WINDOWS\racle~1
C:\WINDOWS\racle~2
C:\WINDOWS\system32\aaqgmvxw.dll
C:\WINDOWS\system32\ac1
C:\WINDOWS\system32\ac1\tliamdll2.exe
C:\WINDOWS\system32\acnskttf.exe
C:\WINDOWS\system32\aefbrlld.exe
C:\WINDOWS\system32\ahqnbplt.ini
C:\WINDOWS\system32\ajayumym.dll
C:\WINDOWS\system32\ajiitspd.dll
C:\WINDOWS\system32\aonlythc.dll
C:\WINDOWS\system32\arbeshmu.dll
C:\WINDOWS\system32\arrhacgr.dll
C:\WINDOWS\system32\aswqosww.dll
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\baalapqu.ini
C:\WINDOWS\system32\bewctqce.dll
C:\WINDOWS\system32\bhyfiocu.dll
C:\WINDOWS\system32\boiulcia.ini
C:\WINDOWS\system32\brbqrvpv.dll
C:\WINDOWS\system32\bslacepp.exe
C:\WINDOWS\system32\bslhgynw.dll
C:\WINDOWS\system32\bxhkulsh.dll
C:\WINDOWS\system32\byrtyoty.ini
C:\WINDOWS\system32\caeavhkv.dll
C:\WINDOWS\system32\cedxcuuq.dll
C:\WINDOWS\system32\cxeplaub.dll
C:\WINDOWS\system32\ddayy.dll
C:\WINDOWS\system32\ddmnustd.dll
C:\WINDOWS\system32\dfcxnkxk.dll
C:\WINDOWS\system32\dgtanrie.ini
C:\WINDOWS\system32\dmcnsggv.exe
C:\WINDOWS\system32\dmobfipv.exe
C:\WINDOWS\system32\dmwblbsi.exe
C:\WINDOWS\system32\dojnmebs.dll
C:\WINDOWS\system32\dovysgso.exe
C:\WINDOWS\system32\dqrgleyq.exe
C:\WINDOWS\system32\drehyfau.ini
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\tunmpp.sys
C:\WINDOWS\system32\ecqtcweb.ini
C:\WINDOWS\system32\efspbuup.dll
C:\WINDOWS\system32\eoymdtdk.ini
C:\WINDOWS\system32\esrjblga.dll
C:\WINDOWS\system32\evtfjshg.dll
C:\WINDOWS\system32\fcccdcc.dll
C:\WINDOWS\system32\fhbksenu.exe
C:\WINDOWS\system32\fpywhxnp.dll
C:\WINDOWS\system32\fsofwsol.dll
C:\WINDOWS\system32\gopbodmb.dll
C:\WINDOWS\system32\gsejdfpc.dll
C:\WINDOWS\system32\gudrwqjy.dll
C:\WINDOWS\system32\gxglacev.dll
C:\WINDOWS\system32\hjixguun.dll
C:\WINDOWS\system32\hnfudtjf.ini
C:\WINDOWS\system32\hqumtonb.exe
C:\WINDOWS\system32\hxhkilyw.exe
C:\WINDOWS\system32\icqmlib.exe
C:\WINDOWS\system32\iepref32.dll
C:\WINDOWS\system32\ierplc.dll
C:\WINDOWS\system32\ieupdates.exe
C:\WINDOWS\system32\ifnspmpo.dll
C:\WINDOWS\system32\iisnpxxj.dll
C:\WINDOWS\system32\ilxrtsel.dll
C:\WINDOWS\system32\ips.dll
C:\WINDOWS\system32\iuhfwtkc.dll
C:\WINDOWS\system32\ixuehomb.dll
C:\WINDOWS\system32\jaodqkri.ini
C:\WINDOWS\system32\jwrbggcb.exe
C:\WINDOWS\system32\kclflfvu.ini
C:\WINDOWS\system32\kdtdmyoe.dll
C:\WINDOWS\system32\krhagbmc.exe
C:\WINDOWS\system32\ladveqih.dll
C:\WINDOWS\system32\laeamukn.exe
C:\WINDOWS\system32\lanmandrv.sys
C:\WINDOWS\system32\lanmanwrk.exe
C:\WINDOWS\system32\laprxy.dllexe
C:\WINDOWS\system32\legcarkb.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mfjswrqr.ini
C:\WINDOWS\system32\mhkkpiga.dll
C:\WINDOWS\system32\mngybefd.exe
C:\WINDOWS\system32\mryydoqu.dll
C:\WINDOWS\system32\mvvwntma.dll
C:\WINDOWS\system32\mvxbmsym.dll
C:\WINDOWS\system32\mxjtvnly.dll
C:\WINDOWS\system32\mymuyaja.ini
C:\WINDOWS\system32\mysmbxvm.ini
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\nGpxx01\nGpxx011065.exe
C:\WINDOWS\system32\njmbyisg.ini
C:\WINDOWS\system32\npqpiods.dll
C:\WINDOWS\system32\nqhbdmxq.dll
C:\WINDOWS\system32\ntload.sys
C:\WINDOWS\system32\nvsegpli.dll
C:\WINDOWS\system32\nxkxukgn.dll
C:\WINDOWS\system32\nxtadxqq.exe
C:\WINDOWS\system32\ocxapi.dll
C:\WINDOWS\system32\ocxloader.exe
C:\WINDOWS\system32\odjdrniu.dll
C:\WINDOWS\system32\oloicubo.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\pasylgsb.dll
C:\WINDOWS\system32\pjnjcoka.dll
C:\WINDOWS\system32\pmqhgmhr.dll
C:\WINDOWS\system32\pnsclgka.exe
C:\WINDOWS\system32\pnxhwypf.ini
C:\WINDOWS\system32\prdenkrs.exe
C:\WINDOWS\system32\puubpsfe.ini
C:\WINDOWS\system32\pxlmbvhs.dll
C:\WINDOWS\system32\pywkrmpx.ini
C:\WINDOWS\system32\qgucrvnf.dll
C:\WINDOWS\system32\qmbsjuff.dll
C:\WINDOWS\system32\qmopt.dll
C:\WINDOWS\system32\qqdjmwhq.dll
C:\WINDOWS\system32\quucxdec.ini
C:\WINDOWS\system32\qvoyyiwu.exe
C:\WINDOWS\system32\riklwtoa.dll
C:\WINDOWS\system32\scurit~1
C:\WINDOWS\system32\sstem3~1
C:\WINDOWS\system32\sstem3~1\s?stem32\
C:\WINDOWS\system32\sstem3~1\winlogon.exe
C:\WINDOWS\system32\txcowvxy.dll
C:\WINDOWS\system32\tyjexnkm.dll
C:\WINDOWS\system32\uaqewsqb.ini
C:\WINDOWS\system32\ueluwauv.dll
C:\WINDOWS\system32\uhldpega.exe
C:\WINDOWS\system32\uhpuycfh.dll
C:\WINDOWS\system32\uinrdjdo.ini
C:\WINDOWS\system32\uldvpuuy.ini
C:\WINDOWS\system32\umpyelas.dll
C:\WINDOWS\system32\umsyglvt.ini
C:\WINDOWS\system32\unmgbcac.exe
C:\WINDOWS\system32\update32.exe
C:\WINDOWS\system32\upwffhcm.dll
C:\WINDOWS\system32\urqqrsp.dll
C:\WINDOWS\system32\uvflflck.dll
C:\WINDOWS\system32\uvqhpuyk.dll
C:\WINDOWS\system32\vicsabeh.dll
C:\WINDOWS\system32\vqaovadv.dll
C:\WINDOWS\system32\vuawuleu.ini
C:\WINDOWS\system32\vutnsdff.dll
C:\WINDOWS\system32\wewnliov.dll
C:\WINDOWS\system32\winsrc.dll
C:\WINDOWS\system32\winupdate.exe
C:\WINDOWS\system32\wscmp.dll
C:\WINDOWS\system32\wtssvit.exe
C:\WINDOWS\system32\wwsoqwsa.ini
C:\WINDOWS\system32\wxvmgqaa.ini
C:\WINDOWS\system32\xnlrcmmn.exe
C:\WINDOWS\system32\xxscysis.dll
C:\WINDOWS\system32\ygujcqes.dll
C:\WINDOWS\system32\yixxvass.exe
C:\WINDOWS\system32\yjwfnpbg.dll
C:\WINDOWS\system32\yorqjfnd.dll
C:\WINDOWS\system32\yoxteqem.dll
C:\WINDOWS\system32\ystem3~1
C:\WINDOWS\system32\yunpgacj.dll
C:\WINDOWS\system32\yyadd.ini
C:\WINDOWS\system32\yyadd.ini2
C:\WINDOWS\tk58.exe
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\\asappsrv.dll
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\\command.exe
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\\oA53u3IVtF1mvZUPuqcW.vbs
C:\WINDOWS\UmljaGFyZCBSb2xsaW5z\command.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\wsusupd.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
——-\LEGACY_CMDSERVICE
——-\LEGACY_DOMAINSERVICE
——-\LEGACY_LANMANDRV
——-\LEGACY_NETWORK_MONITOR
——-\LEGACY_NTLOAD
——-\LEGACY_TUNMPP
——-\cmdService
——-\DomainService
——-\lanmandrv
——-\Network Monitor
——-\ntload
——-\tunmpp


((((((((((((((((((((((((( Files Created from 2008-01-21 to 2008-02-21 )))))))))))))))))))))))))))))))
.

2008-02-18 02:37 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\exxwu.exe
2008-02-18 02:18 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\mtsxwbsylh.exe
2008-02-18 00:56 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\rcxw.exe
2008-02-17 17:20 . 2008-02-17 17:18 14,336 –a—— C:\Documents and Settings\Andrew\Application Data\ubnrq.exe
2008-02-17 17:18 . 2008-02-17 17:18 14,336 –a—— C:\WINDOWS\system32\5dfioyg9.exe
2008-02-16 16:08 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\cgkmstrnhjpy.exe
2008-02-15 03:11 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\okfvxlmw.exe
2008-02-15 02:11 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\musifriy.exe
2008-02-13 20:22 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\vosxkqyqb.exe
2008-02-13 20:05 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\zhuajxwuolyw.exe
2008-02-13 15:04 . 2008-02-19 04:00 3,262 –a—— C:\WINDOWS\system32\sex5.ico
2008-02-13 15:04 . 2008-02-19 04:00 3,262 –a—— C:\WINDOWS\system32\sex4.ico
2008-02-13 15:03 . 2008-02-19 04:02 3,262 –a—— C:\WINDOWS\system32\sex3.ico
2008-02-13 15:03 . 2008-02-19 04:01 3,262 –a—— C:\WINDOWS\system32\sex2.ico
2008-02-13 15:02 . 2008-02-19 04:01 3,262 –a—— C:\WINDOWS\system32\sex1.ico
2008-02-13 14:55 . 2008-02-13 14:55 d——– C:\WINDOWS\system32\svcd
2008-02-13 14:55 . 2008-02-13 14:55 87,040 –a—— C:\WINDOWS\system32\TmpX.exe
2008-02-13 14:55 . 2008-02-13 14:55 34,816 –a—— C:\winpfob.exe
2008-02-13 14:55 . 2008-02-21 04:11 114 –a—— C:\WINDOWS\system32\url3
2008-02-13 14:55 . 2008-02-21 04:11 102 –a—— C:\WINDOWS\system32\url2
2008-02-13 14:55 . 2008-02-21 04:11 102 –a—— C:\WINDOWS\system32\url1
2008-02-13 14:55 . 2008-02-21 04:11 8 –a—— C:\WINDOWS\system32\CID
2008-02-13 14:55 . 2008-02-13 14:55 4 –a—— C:\WINDOWS\system32\SvcNm
2008-02-13 13:37 . 2008-02-13 13:37 d——– C:\Program Files\Trend Micro
2008-02-13 03:18 . 2008-02-13 03:18 153 –a—— C:\WINDOWS\system32\delFSF.bat
2008-02-13 03:18 . 2008-02-13 03:18 0 –a—— C:\90.tmp
2008-02-13 03:18 . 2008-02-13 03:18 0 –a—— C:\8B.tmp
2008-02-13 03:17 . 2008-02-13 03:17 41,771 –a—— C:\winvrea.exe
2008-02-13 03:17 . 2008-02-13 03:17 0 –a—— C:\85.tmp
2008-02-13 03:17 . 2008-02-13 03:17 0 –a—— C:\82.tmp
2008-02-12 16:55 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\mvztkjvltmkp.exe
2008-02-09 01:26 . 2008-02-09 01:26 36,864 –a—— C:\WINDOWS\mrofinu572.exe.tmp
2008-02-09 01:21 . 2008-02-09 01:21 d——– C:\WINDOWS\system32\za7
2008-02-09 01:21 . 2008-02-09 01:21 d——– C:\WINDOWS\system32\wd11
2008-02-09 01:21 . 2008-02-09 01:21 d——– C:\WINDOWS\system32\kp9
2008-02-09 01:21 . 2008-02-21 04:32 d——– C:\Temp
2008-02-09 01:14 . 2008-02-09 01:14 270,698 –a—— C:\WINDOWS\system32\L6C54.tmp
2008-02-09 01:14 . 2008-02-09 01:14 402 –a—— C:\WINDOWS\system32\LA361.tmp
2008-02-09 01:13 . 2008-02-09 01:14 181,965 –a—— C:\WINDOWS\system32\L55ED.tmp
2008-02-09 01:07 . 2008-02-09 01:07 26,032 –a—— C:\WINDOWS\system32\pmnoonk.dll
2008-02-08 12:21 . 2008-02-08 12:21 4,286 –a—— C:\WINDOWS\system32\Jamster.ico
2008-02-05 02:30 . 2008-02-05 02:30 0 –ahs—- C:\Documents and Settings\Andrew\Application Data\0047a81e90.dat
2008-02-05 02:22 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\zra.exe
2008-02-05 01:00 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\wsb.exe
2008-02-05 00:37 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\snrw.exe
2008-01-28 18:07 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\phzthvxuziqy.exe
2008-01-28 14:16 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\ywao.exe
2008-01-26 04:27 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\nqksf.exe
2008-01-26 03:20 . 2008-01-26 03:20 d——– C:\FT Demo
2008-01-26 03:20 . 1999-09-20 08:18 180 –a—— C:\WINDOWS\system32\msftpd.exe
2008-01-25 17:33 . 2008-01-25 17:33 294 –ahs—- C:\WINDOWS\system32\osuxesbb.ini
2008-01-24 17:27 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\ualbtmizk.exe
2008-01-21 21:17 . 2007-12-16 04:47 12,800 –a—— C:\Documents and Settings\Andrew\Application Data\rojvxirmeb.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-21 10:39 ——— d—–w C:\Program Files\Prevx1
2008-02-21 10:21 246 —-a-w C:\Program Files\Common Files\lagu780
2008-02-21 09:27 ——— d—–w C:\Documents and Settings\Andrew\Application Data\uTorrent
2008-02-20 08:56 ——— d—–w C:\Program Files\World of Warcraft
2008-02-18 09:06 ——— d—–w C:\Documents and Settings\Andrew\Application Data\readmekeepball
2008-02-18 09:06 ——— d—–w C:\Documents and Settings\All Users\Application Data\Camp Mess Warn Pop
2008-02-18 08:58 ——— d—–w C:\Program Files\Java
2008-02-15 21:00 ——— d—–w C:\Program Files\Norton Security Scan
2008-02-15 09:13 ——— d—–w C:\Documents and Settings\Andrew\Application Data\Skype
2008-01-28 20:16 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-01-26 09:20 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-01-06 02:02 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2007-12-24 04:38 ——— d—–w C:\Documents and Settings\Andrew\Application Data\Hamachi
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B}]
C:\Program Files\QdrDrive\QdrDrive10.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"barb corn"="C:\DOCUME~1\Andrew\APPLIC~1\README~1\UP EXIT SEND.exe" [2008-02-18 03:05 404480]
"Rssa"="C:\WINDOWS\System32\SSTEM3~1\winlogon.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PrevxOne"="C:\Program Files\Prevx1\PXConsole.exe" [2007-07-05 15:37 1985592]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 08:41 282624]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-06-01 15:51 257088]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06 40048]
"PWRISOVM.EXE"="C:\Program Files\PowerISO\PWRISOVM.EXE" [2007-08-06 18:05 200704]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11 132496]
"WARN POP TRUST LIES"="C:\Documents and Settings\All Users\Application Data\Camp Mess Warn Pop\pop internet.exe" [2008-02-21 04:41 2906112]

C:\Documents and Settings\Andrew\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 18:16:50 113664]
GameSpot Download Manager.lnk - C:\Program Files\GameSpot\GDM_TrayApp.exe [2007-05-09 10:48:26 237568]

R2 DNADownloader;DNADownloader;C:\Program Files\GameSpot\DownloadManager_Win32.exe [2007-05-09 10:48]
R2 RSPA;Security Service;C:\WINDOWS\System32\svcd\svchost.exe [2008-02-13 14:55]

.
Contents of the 'Scheduled Tasks' folder
"2008-02-21 10:00:05 C:\WINDOWS\Tasks\AD3A0E46919985D6.job"
- c:\docume~1\andrew\applic~1\readme~1\amok cdrom bin.exe
"2008-02-18 20:40:05 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-02-15 21:00:58 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-21 04:40:53
Windows 5.1.2600 Service Pack 1 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\taskmgr.exe
.
**************************************************************************
.
Completion time: 2008-02-21 4:45:48 - machine was rebooted
ComboFix-quarantined-files.txt 2008-02-21 10:45:45

================================================================================
=============

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:51:37 AM, on 2/21/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\GameSpot\DownloadManager_Win32.exe
C:\WINDOWS\System32\svcd\svchost.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\GameSpot\GDM_TrayApp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Application Data\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O2 - BHO: BndBlock5 BHO Class - {82EA1A55-9CBC-404b-9D0C-E8BFB7EAAE9B} - C:\Program Files\QdrDrive\QdrDrive10.dll (file missing)
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O4 - HKLM\..\Run: [PrevxOne] "C:\Program Files\Prevx1\PXConsole.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [WARN POP TRUST LIES] C:\Documents and Settings\All Users\Application Data\Camp Mess Warn Pop\pop internet.exe
O4 - HKCU\..\Run: [barb corn] C:\DOCUME~1\Andrew\APPLIC~1\README~1\UP EXIT SEND.exe
O4 - HKCU\..\Run: [Rssa] "C:\WINDOWS\System32\SSTEM3~1\winlogon.exe" -vt ndrv
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: GameSpot Download Manager.lnk = C:\Program Files\GameSpot\GDM_TrayApp.exe
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 2.0\resources\en-US\local\search.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: DNADownloader - CNET Networks - C:\Program Files\GameSpot\DownloadManager_Win32.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Prevx Agent (PREVXAgent) - Prevx - C:\Program Files\Prevx1\PXAgent.exe
O23 - Service: Security Service (RSPA) - Unknown owner - C:\WINDOWS\System32\svcd\svchost.exe

–
End of file - 3993 bytes