[Resolved] Need help was badly infected now only infected

Log following.

Symptons: Beside bad performance, unable to obtain a dhcp lease unless in safe mode. AVG found a load of stuff, and combofix and smitfraud found some things also.

Edit: I notice now that when Ichange web pages I get a quick windows installer window that shows for 1 sec or less.

Logfile of HijackThis v1.99.1
Scan saved at 8:23:55 PM, on 4/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\temp\Desktop\whathe.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

ComboFix 08-04-16.2 - temp 2008-04-18 18:40:35.9 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.333 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-03-18 to 2008-04-18 )))))))))))))))))))))))))))))))
.

2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Documents and Settings\temp\Application Data\Malwarebytes
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-17 20:26 . 2008-04-17 20:26 d——– C:\Documents and Settings\temp\Application Data\Grisoft
2008-04-17 20:24 . 2007-09-06 00:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 20:24 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 20:24 . 2008-04-14 19:28 86,528 –a—— C:\WINDOWS\system32\VACFix.exe
2008-04-17 20:24 . 2008-04-12 13:49 82,432 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-04-17 20:24 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-04-17 20:24 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-04-17 20:24 . 2007-10-04 00:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-04-17 20:04 . 2008-04-17 20:24 2,394 –a—— C:\WINDOWS\system32\tmp.reg
2008-04-17 20:00 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-17 20:00 . 2007-01-18 07:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-04-16 23:39 . 2008-04-16 21:24 139,008 –a—— C:\WINDOWS\system32\guard32.dll
2008-04-16 21:56 . 2008-04-16 21:56 d——– C:\test
2008-04-16 21:43 . 2008-04-16 21:43 d——– C:\WINDOWS\OPTIONS
2008-04-16 21:24 . 2008-04-16 21:24 85,752 –a—— C:\WINDOWS\system32\drivers\cmdguard.sys
2008-04-16 21:24 . 2008-04-16 21:24 23,800 –a—— C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-04-16 19:24 . 2008-04-18 17:48 d——– C:\Documents and Settings\temp\Application Data\AVG7
2008-04-16 19:22 . 2008-04-16 19:22 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-16 19:21 . 2008-04-17 20:00 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-16 19:21 . 2008-04-17 20:58 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-04-16 18:42 . 2008-04-16 18:42 d——– C:\Documents and Settings\temp\Application Data\McAfee.com Personal Firewall
2008-04-16 18:40 . 2008-04-16 22:26 d——– C:\Documents and Settings\temp\Application Data\Comodo
2008-04-16 18:40 . 2008-04-16 18:40 d——– C:\Documents and Settings\temp\Application Data\Arcsoft
2008-04-16 18:36 . 2006-05-13 14:08 d——– C:\Documents and Settings\temp\Application Data\Symantec
2008-04-16 18:36 . 2008-04-17 20:14 d——– C:\Documents and Settings\temp
2008-04-16 18:20 . 2008-04-16 18:20 1,602,593 –ahs—- C:\WINDOWS\system32\vtflheel.ini
2008-04-16 18:19 . 2008-04-16 18:19 d——– C:\Program Files\COMODO
2008-04-16 18:19 . 2008-04-16 21:59 d——– C:\Documents and Settings\All Users\Application Data\comodo
2008-04-16 18:19 . 2008-04-16 18:19 d——– C:\Documents and Settings\Administrator\Application Data\Comodo
2008-04-16 18:16 . 2006-05-13 14:08 d——– C:\Documents and Settings\Administrator\Application Data\Symantec
2008-04-16 18:16 . 2008-04-16 19:22 d——– C:\Documents and Settings\Administrator
2008-04-16 18:16 . 2004-08-03 23:08 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-16 18:16 . 2004-08-04 00:56 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2008-04-13 11:02 . 2008-04-13 11:02 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-13 11:02 . 2008-04-13 11:02 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-06 19:01 . 2008-04-07 12:15 d——– C:\WINDOWS\SxsCaPendDel
2008-04-05 17:24 . 2008-04-06 18:47 2,107,166 –ahs—- C:\WINDOWS\system32\ggomrxxp.ini
2008-04-05 10:31 . 2008-04-05 10:41 1,158 –a—— C:\WINDOWS\mozver.dat
2008-04-03 20:11 . 2008-04-05 17:04 1,558,154 –ahs—- C:\WINDOWS\system32\ccgevmec.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 23:27 ——— d—–w C:\Program Files\QuickTime
2008-04-18 23:27 ——— d—–w C:\Program Files\Common Files\qrim
2008-04-18 23:21 ——— d—–w C:\Program Files\iTunes
2008-04-18 23:21 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-18 23:21 ——— d—–w C:\Program Files\AIM
2008-04-17 02:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-04-16 23:16 ——— d—–w C:\Program Files\DellSupport
2008-04-14 20:45 377,856 —-a-w C:\WINDOWS\mrofinu72.exe.tmp
2008-04-13 16:00 ——— d—–w C:\Program Files\LimeWire
2008-04-13 16:00 ——— d—–w C:\Program Files\Incomplete
2008-04-07 00:11 3,766 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-02-22 22:03 1,244,643 –sha-w C:\WINDOWS\system32\ayljnorn.tmp
2008-02-19 03:13 ——— d—–w C:\Program Files\iPod
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" [ ]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 19:22 579584]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-04-16 21:24 1503488]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-16 19:22 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\544d7c26]
C:\WINDOWS\system32\leehlftv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM577e4fba]
C:\WINDOWS\system32\sgmolvoe.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
c:\program files\mcafee.com\shared\mcappins.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DCDAE1E4DEE1E4E2E]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
C:\WINDOWS\System32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E3E4E7E]


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\MC1795~1.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MS9894~3.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PRISMSVR.EXE]
C:\WINDOWS\system32\PRISMSVR.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\QTTask .exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1159330157\\ee\\AOLServiceHost.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-04-16 21:24]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-04-16 21:24]
S3 2WIREPCP;2Wire USB;C:\WINDOWS\system32\DRIVERS\2WirePCP.sys [2004-09-15 03:42]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2004-11-02 15:12]
S3 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 16:38]

.
Contents of the 'Scheduled Tasks' folder
"2008-04-08 01:54:15 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-11 23:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (LUCIO-Raquel Lucio).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-04-12 01:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Raquel Lucio.job"
- C:\PROGRA~1\NORTON~2\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-18 18:41:29
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-18 18:41:58
ComboFix-quarantined-files.txt 2008-04-18 23:41:50
ComboFix2.txt 2008-04-18 23:33:08
ComboFix3.txt 2008-04-18 02:07:58
ComboFix4.txt 2008-04-18 01:22:00
ComboFix5.txt 2008-04-18 01:11:16

Pre-Run: 103,792,328,704 bytes free
Post-Run: 103,777,992,704 bytes free
.
2008-03-19 08:01:14 — E O F —

Malwarebytes' Anti-Malware 1.11
Database version: 636

Scan type: Quick Scan
Objects scanned: 34143
Time elapsed: 5 minute(s), 16 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 15
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Interface\{e4e3e0f8-cd30-4380-8ce9-b96904bdefca} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{fe8a736f-4124-4d9c-b4b1-3b12381efabe} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{c9c5deaf-0a1f-4660-8279-9edfad6fefe1} (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bndblock4.band (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bndblock4.band.1 (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bndblock4.bho (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\bndblock4.bho.1 (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{d4a714f6-af40-4425-b708-ff03cbbc0a84} (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\AppID\BndBlock4.DLL (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\000050.exe (Adware.Purityscan) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\atmtd.dll (Adware.TargetSaver) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\atmtd.dll._ (Adware.TargetSaver) -> Quarantined and deleted successfully.
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe (Adware.PurityScan) -> Quarantined and deleted successfully.
C:\Documents and Settings\Andrew Lucio\installer.exe (Trojan.Dropper) -> Quarantined and deleted successfully.


All help is appreciated!!

Still unable to get DHCP lease unless in safe mode. Behavior is ok.. fairly sure there is still something hanging around though.

ComboFix 08-04-16.2 - temp 2008-04-22 17:07:23.10 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.341 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\temp\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\ayljnorn.tmp
C:\WINDOWS\system32\ccgevmec.ini
C:\WINDOWS\system32\ggomrxxp.ini
C:\WINDOWS\system32\leehlftv.dll
C:\WINDOWS\system32\sgmolvoe.dll
C:\WINDOWS\system32\vtflheel.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\temp\Application Data\Arcsoft
C:\Documents and Settings\temp\Application Data\Arcsoft\PhotoBase\4.0\PhotoBase.INI
C:\Documents and Settings\temp\Application Data\Comodo
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\AboutLogo.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\AboutLogoCaption.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Activeconnections.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Activeprocesslist.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\activity.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\alert.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\arrow.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\AutoFileSubmitCaption.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\AutoFileSubmitTrayIcon.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\backarrow.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\btnDisabled.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\btnNormal.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\btnOnfocus.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\btnPressed.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\btnRollover.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\button.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonclose.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttoncloses.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonhelp.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonhelps.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonmax.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonmaxs.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonmin.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonmins.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonres.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\buttonress.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\CaptionBar.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfg_dlg_btn_delete.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfg_dlg_btn_export.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfg_dlg_btn_import.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfg_dlg_btn_select.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\CFP-configure.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\CFP-installer.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\CFP-license.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfp-updater1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfp-updater2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\cfp-updater3.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\CFP-welcome.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\CFPLogo.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\checkbox_icon0.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\checkbox_icon1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\checkbox_icon2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\checkbox13.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\checkbox16.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\checkbox25.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\closebutton.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Co_AboutLogoCaption.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Co_CFPLogo.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\COM_interfaces_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\comboboxbevel.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\combobutton.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\combobuttonglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Config.ini
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\configure_defense_settings.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\configure_Learning_Apps.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\configure_profile_settings.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\configure_stealth_settings.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\configure_Welcome.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\create_process.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\create_thread.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\defense+.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Defense+events.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\DefenseTaks_ViewPendingFiles.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\DefenseTasks_MySafeFiles.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\diagnose.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn0_up0.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn0_up1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn0_up2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn0_up3.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn0_up4.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn1_up0.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn1_up1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn1_up2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn1_up3.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn1_up4.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn2_up0.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn2_up1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn2_up2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn2_up3.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn2_up4.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn3_up0.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn3_up1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn3_up2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn3_up3.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn3_up4.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn4_up0.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn4_up1.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn4_up2.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn4_up3.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\dn4_up4.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\DNS_port_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\explorerbarheaderclose.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\explorerbarheaderpin.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fieldoutlinebmp.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Files_Submission_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Files_Submission_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Files_Submission_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\firewall.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Firewallevents.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\firewallsummary.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\firstapptraffic.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fourthapptraffic.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\framebottom.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\framecaption.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\framecaptionmin.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\framecaptionsizing.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\frameleft.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\framemaximized.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\frameright.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-adv-advancd.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-adv-comtasks.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-tasks-bannapp.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-tasks-blkd-nzone.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-tasks-myport.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-tasks-netzone.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-tasks-trustap.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw-tasks-trustdn.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_orange_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_orange_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_orange_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_red_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_red_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_red_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_yellow_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_yellow_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\fw_alert_yellow_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\gripper.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\grippervert.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\groupbox.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\headerbar_left.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\headerbar_middle.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\headerbar_right.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\highlites.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-adv-imgcnt.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-adv-prfine-plcy.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-adv-proac-set.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-adv-secu-plcy.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-tsks-com-grps.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-tsks-com.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-tsks_grpfiles.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips-tsks_reggrps.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_orange_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_orange_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_orange_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_red_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_red_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_red_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_yellow_L.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_yellow_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_alert_yellow_R.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_tasks_protdocs_32.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_tasks_quarfiles_32.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hips_tasks_regiskeys_32.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hipsarrow_down.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\hipsarrow_up.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\ie_personalbarmenu.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\InnerCaptionBar.PNG
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\keyboard_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\leftarrow_disabled.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\leftarrow_hover.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\leftarrow_normal.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\leftarrow_pressed.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\listviewheader.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\listviewheaderbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\load_driver.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogDefenceAllTime.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogDefenceLog.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogDefenceThisMonth.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogDefenceThisWeek.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogDefenceToday.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogFirewallAllTime.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogFirewallLog.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogFirewallThisMonth.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogFirewallThisWeek.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\LogFirewallToday.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\loopback_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\main-firewall-advanced_advattack.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\main-firewall-advanced_fbehaviour.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\main-firewall-advanced_network.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\main-firewall-advanced_securitylevel.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\mainsummary.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\ManageSafeExport.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\ManageSafeImport.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_Check_B.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_Check_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_Check_T.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_finish_B.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_finish_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_finish_T.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_install_B.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_install_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_install_T.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_start_B.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_start_M.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Manual_updater_start_T.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\mdicaptionbutton.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\mdiglyphclose.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\mdiglyphminimize.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\mdiglyphrestore.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_adbout.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_browseforums.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_btn.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_chkupdates.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_helpbig.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_imp_exp_config.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_marksafelist.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\misc_setings.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\MyTrustedSoftwareVendors.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\newzone_gradient.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\NewZoneDetected.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\nextarrow.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\non_target_arrow.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\normalgroupbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\normalgroupcollapse.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\normalgroupexpand.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\normalgrouphead.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\oldbutton.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\open_process.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\physical_mem_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\placebarbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\placebarbuttons.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\pleasewait_32.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\prd_logo_16_16.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\prd_logo_24_24.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\prdinfo.ini
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\proactive.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\progresschunk.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\progresschunkvert.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\progresstrack.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\progresstrackvert.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\question.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\radiobutton13.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\radiobutton16.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\radiobutton25.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\raw_disk_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\read_memory.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\registry_keys_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\reminder_dlg_pleasewait.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\resizegrip2.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\rightarrow_disabled.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\rightarrow_hover.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\rightarrow_normal.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\rightarrow_pressed.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\ScanSystem.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\screen_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollarrowglyphs.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollarrowglyphssmall.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollarrows.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollshafthorizontal.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollshaftvertical.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollthumbgripperhorizontal.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollthumbgrippervertical.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollthumbhorizontal.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\scrollthumbvertical.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\secondapptraffic.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\send_message.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\separator.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\separatorvert.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\set_globalhook.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\shield.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\slidertrack.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\smallclosebutton.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\smallcloseglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\smallframecaption.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\smallframecaptionsizing.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\specialgroupbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\specialgroupcollapse.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\specialgroupexpand.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\specialgrouphead.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinbuttonbackgrounddown.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinbuttonbackgroundleft.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinbuttonbackgroundright.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinbuttonbackgroundup.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spindownglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinleftglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinrightglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\spinupglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\splash.jpg
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\statusbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\statuspane.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\summary_highlites.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_NW_Defense.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_NW_Down.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_NW_UP.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_proactive.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_Proactive_Active.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_Proactive_Init_Mode.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_Proactive_Prev_Mode.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_Proactive_Suspicious.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_RestoreAll.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\Summary_StopAll.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\summaryFirewall.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\summarysummary.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\SummarySystemStatus_Active.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\SummarySystemStatus_InActive.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\SummarySystemStatus_Init.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabbackground133.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabitem.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabitemleft.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabitemright.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabitemtopright.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tabpaneedge.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\terminate_process.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\thirdapptraffic.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\tipoftheday.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbarbackground.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbarbuttons.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbarbuttonssplit.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbarbuttonssplitdropdown.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbarbuttonssplitdropdownglyph.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbargripper.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\toolbargrippervert.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbardown13.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbardown16.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbardown25.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarhorizontal.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarleft13.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarleft16.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarleft25.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarright13.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarright16.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarright25.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarup13.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarup16.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarup25.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\trackbarvertical.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\traffic.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\TrayPopuoCloseButton.ico
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\treeexpandcollapse.png
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\write_file_access.bmp
C:\Documents and Settings\temp\Application Data\Comodo\Firewall Pro\Data\ResFiles\write_memory.bmp
C:\Documents and Settings\temp\Application Data\McAfee.com Personal Firewall
C:\Documents and Settings\temp\Application Data\Symantec
C:\Program Files\Viewpoint
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Common\VistaBoot.sdll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\AxMetaStream_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ClassIDs.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentMgr_0305000D.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\ComponentRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLArt.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\AOLUserShell.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Cursors.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\DataTracking.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\GifReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\JpegReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\LensFlares.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\Mts3Reader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ObjectMovie.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SceneComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ServiceComponent.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SreeDMMX.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\SWFView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VectorView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMgr.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPAudio.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPExtras.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPSpeech.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\VMPVideo2.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\WaveletReader.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\Components\ZoomView.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\DownLoadHist.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\HostRegistry.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamConfig.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MetaStreamID.ini
C:\Program Files\Viewpoint\Viewpoint Experience Technology\MtsAxInstaller.exe
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.xpt
C:\Program Files\Viewpoint\Viewpoint Manager\CPtask.xml
C:\Program Files\Viewpoint\Viewpoint Manager\VETScriptInterpreter.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCP.cpl
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\s.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_av.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_cp.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_header_up.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_inner_bottom.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab_bg.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab1_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_off.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vm_tab2_on.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\images\vwpt_logo.gif
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\options.ini
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\viewpoint.ico
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPData\vmctrl.html
C:\Program Files\Viewpoint\Viewpoint Manager\ViewCPexe.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrCore.dll
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgrInstaller.exe
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\ayljnorn.tmp
C:\WINDOWS\system32\ccgevmec.ini
C:\WINDOWS\system32\ggomrxxp.ini
C:\WINDOWS\system32\vtflheel.ini

.
((((((((((((((((((((((((( Files Created from 2008-03-22 to 2008-04-22 )))))))))))))))))))))))))))))))
.

2008-04-22 17:11 . 2008-04-22 17:11 d——– C:\Documents and Settings\temp\Application Data\Comodo
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Documents and Settings\temp\Application Data\Malwarebytes
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-17 20:26 . 2008-04-17 20:26 d——– C:\Documents and Settings\temp\Application Data\Grisoft
2008-04-17 20:24 . 2007-09-06 00:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 20:24 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 20:24 . 2008-04-14 19:28 86,528 –a—— C:\WINDOWS\system32\VACFix.exe
2008-04-17 20:24 . 2008-04-12 13:49 82,432 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-04-17 20:24 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-04-17 20:24 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-04-17 20:24 . 2007-10-04 00:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-04-17 20:04 . 2008-04-17 20:24 2,394 –a—— C:\WINDOWS\system32\tmp.reg
2008-04-17 20:00 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-17 20:00 . 2007-01-18 07:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-04-16 23:39 . 2008-04-16 21:24 139,008 –a—— C:\WINDOWS\system32\guard32.dll
2008-04-16 21:56 . 2008-04-16 21:56 d——– C:\test
2008-04-16 21:43 . 2008-04-16 21:43 d——– C:\WINDOWS\OPTIONS
2008-04-16 21:24 . 2008-04-16 21:24 85,752 –a—— C:\WINDOWS\system32\drivers\cmdguard.sys
2008-04-16 21:24 . 2008-04-16 21:24 23,800 –a—— C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-04-16 19:24 . 2008-04-22 17:12 d——– C:\Documents and Settings\temp\Application Data\AVG7
2008-04-16 19:22 . 2008-04-16 19:22 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-16 19:21 . 2008-04-17 20:00 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-16 19:21 . 2008-04-17 20:58 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-04-16 18:36 . 2008-04-17 20:14 d——– C:\Documents and Settings\temp
2008-04-16 18:19 . 2008-04-16 18:19 d——– C:\Program Files\COMODO
2008-04-16 18:19 . 2008-04-16 21:59 d——– C:\Documents and Settings\All Users\Application Data\comodo
2008-04-16 18:19 . 2008-04-16 18:19 d——– C:\Documents and Settings\Administrator\Application Data\Comodo
2008-04-16 18:16 . 2006-05-13 14:08 d——– C:\Documents and Settings\Administrator\Application Data\Symantec
2008-04-16 18:16 . 2008-04-16 19:22 d——– C:\Documents and Settings\Administrator
2008-04-16 18:16 . 2004-08-03 23:08 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-16 18:16 . 2004-08-04 00:56 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2008-04-13 11:02 . 2008-04-13 11:02 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-13 11:02 . 2008-04-13 11:02 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-06 19:01 . 2008-04-07 12:15 d——– C:\WINDOWS\SxsCaPendDel
2008-04-05 10:31 . 2008-04-05 10:41 1,158 –a—— C:\WINDOWS\mozver.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 23:27 ——— d—–w C:\Program Files\QuickTime
2008-04-18 23:27 ——— d—–w C:\Program Files\Common Files\qrim
2008-04-18 23:21 ——— d—–w C:\Program Files\iTunes
2008-04-18 23:21 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-18 23:21 ——— d—–w C:\Program Files\AIM
2008-04-17 02:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-04-16 23:16 ——— d—–w C:\Program Files\DellSupport
2008-04-13 16:00 ——— d—–w C:\Program Files\LimeWire
2008-04-13 16:00 ——— d—–w C:\Program Files\Incomplete
2008-04-07 00:11 3,766 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-18_18.32.51.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-18 23:28:09 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-22 22:10:50 2,048 –s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" [ ]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 19:22 579584]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-04-16 21:24 1503488]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-16 19:22 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1159330157\\ee\\AOLServiceHost.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-04-16 21:24]
R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-04-16 21:24]
S3 2WIREPCP;2Wire USB;C:\WINDOWS\system32\DRIVERS\2WirePCP.sys [2004-09-15 03:42]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2004-11-02 15:12]
S3 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []

.
Contents of the 'Scheduled Tasks' folder
"2008-04-08 01:54:15 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-11 23:30:00 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (LUCIO-Raquel Lucio).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-04-12 01:00:00 C:\WINDOWS\Tasks\Norton AntiVirus - Run Full System Scan - Raquel Lucio.job"
- C:\PROGRA~1\NORTON~2\Navw32.exeh/TASK:
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 17:13:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\wdfmgr.exe
.
**************************************************************************
.
Completion time: 2008-04-22 17:17:42 - machine was rebooted
ComboFix-quarantined-files.txt 2008-04-22 22:17:31
ComboFix2.txt 2008-04-18 23:41:59
ComboFix3.txt 2008-04-18 23:33:08
ComboFix4.txt 2008-04-18 02:07:58
ComboFix5.txt 2008-04-18 01:22:00

Pre-Run: 103,785,480,192 bytes free
Post-Run: 103,226,236,928 bytes free
.
2008-03-19 08:01:14 — E O F —

Logfile of HijackThis v1.99.1
Scan saved at 5:19:06 PM, on 4/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\COMODO\Firewall\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\COMODO\Firewall\cfp.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\temp\Desktop\whathe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)

Thanks for your help!


EDIT: Still getting a quick windows installer window when navigating pages in IE.

Yes there are 3 user accounts, Temp was created so work without logging their accounts. Other two are regular users.


ComboFix 08-04-16.2 - temp 2008-04-22 17:38:13.11 - NTFSx86 NETWORK
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.328 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\temp\Desktop\CFScript.txt

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\WINDOWS\mrofinu72.exe.tmp
C:\WINDOWS\system32\ayljnorn.tmp
C:\WINDOWS\system32\ccgevmec.ini
C:\WINDOWS\system32\ggomrxxp.ini
C:\WINDOWS\system32\vtflheel.ini
C:\Documents and Settings\temp :#:
.

((((((((((((((((((((((((( Files Created from 2008-03-22 to 2008-04-22 )))))))))))))))))))))))))))))))
.

2008-04-22 17:11 . 2008-04-22 17:11 d——– C:\Documents and Settings\temp\Application Data\Comodo
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Documents and Settings\temp\Application Data\Malwarebytes
2008-04-17 21:38 . 2008-04-17 21:38 d——– C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-17 20:26 . 2008-04-17 20:26 d——– C:\Documents and Settings\temp\Application Data\Grisoft
2008-04-17 20:24 . 2007-09-06 00:22 289,144 –a—— C:\WINDOWS\system32\VCCLSID.exe
2008-04-17 20:24 . 2006-04-27 17:49 288,417 –a—— C:\WINDOWS\system32\SrchSTS.exe
2008-04-17 20:24 . 2008-04-14 19:28 86,528 –a—— C:\WINDOWS\system32\VACFix.exe
2008-04-17 20:24 . 2008-04-12 13:49 82,432 –a—— C:\WINDOWS\system32\IEDFix.exe
2008-04-17 20:24 . 2003-06-05 21:13 53,248 –a—— C:\WINDOWS\system32\Process.exe
2008-04-17 20:24 . 2004-07-31 18:50 51,200 –a—— C:\WINDOWS\system32\dumphive.exe
2008-04-17 20:24 . 2007-10-04 00:36 25,600 –a—— C:\WINDOWS\system32\WS2Fix.exe
2008-04-17 20:04 . 2008-04-17 20:24 2,394 –a—— C:\WINDOWS\system32\tmp.reg
2008-04-17 20:00 . 2007-05-30 07:10 10,872 –a—— C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-04-17 20:00 . 2007-01-18 07:00 3,968 –a—— C:\WINDOWS\system32\drivers\AvgArCln.sys
2008-04-16 23:39 . 2008-04-16 21:24 139,008 –a—— C:\WINDOWS\system32\guard32.dll
2008-04-16 21:56 . 2008-04-16 21:56 d——– C:\test
2008-04-16 21:43 . 2008-04-16 21:43 d——– C:\WINDOWS\OPTIONS
2008-04-16 21:24 . 2008-04-16 21:24 85,752 –a—— C:\WINDOWS\system32\drivers\cmdguard.sys
2008-04-16 21:24 . 2008-04-16 21:24 23,800 –a—— C:\WINDOWS\system32\drivers\cmdhlp.sys
2008-04-16 19:24 . 2008-04-22 17:25 d——– C:\Documents and Settings\temp\Application Data\AVG7
2008-04-16 19:22 . 2008-04-16 19:22 d——– C:\Documents and Settings\LocalService\Application Data\AVG7
2008-04-16 19:21 . 2008-04-17 20:00 d——– C:\Documents and Settings\All Users\Application Data\Grisoft
2008-04-16 19:21 . 2008-04-17 20:58 d——– C:\Documents and Settings\All Users\Application Data\avg7
2008-04-16 18:36 . 2008-04-17 20:14 d——– C:\Documents and Settings\temp
2008-04-16 18:19 . 2008-04-16 18:19 d——– C:\Program Files\COMODO
2008-04-16 18:19 . 2008-04-16 21:59 d——– C:\Documents and Settings\All Users\Application Data\comodo
2008-04-16 18:19 . 2008-04-16 18:19 d——– C:\Documents and Settings\Administrator\Application Data\Comodo
2008-04-16 18:16 . 2006-05-13 14:08 d——– C:\Documents and Settings\Administrator\Application Data\Symantec
2008-04-16 18:16 . 2008-04-16 19:22 d——– C:\Documents and Settings\Administrator
2008-04-16 18:16 . 2004-08-03 23:08 31,616 –a—— C:\WINDOWS\system32\drivers\usbccgp.sys
2008-04-16 18:16 . 2004-08-04 00:56 21,504 –a—— C:\WINDOWS\system32\hidserv.dll
2008-04-13 11:02 . 2008-04-13 11:02 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-04-13 11:02 . 2008-04-13 11:02 1,409 –a—— C:\WINDOWS\QTFont.for
2008-04-06 19:01 . 2008-04-07 12:15 d——– C:\WINDOWS\SxsCaPendDel
2008-04-05 10:31 . 2008-04-05 10:41 1,158 –a—— C:\WINDOWS\mozver.dat

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-18 23:27 ——— d—–w C:\Program Files\QuickTime
2008-04-18 23:27 ——— d—–w C:\Program Files\Common Files\qrim
2008-04-18 23:21 ——— d—–w C:\Program Files\iTunes
2008-04-18 23:21 ——— d—–w C:\Program Files\Common Files\Symantec Shared
2008-04-18 23:21 ——— d—–w C:\Program Files\AIM
2008-04-17 02:43 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-04-16 23:16 ——— d—–w C:\Program Files\DellSupport
2008-04-13 16:00 ——— d—–w C:\Program Files\LimeWire
2008-04-13 16:00 ——— d—–w C:\Program Files\Incomplete
2008-04-07 00:11 3,766 –sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( snapshot@2008-04-18_18.32.51.84 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-04-18 23:28:09 2,048 –s-a-w C:\WINDOWS\bootstat.dat
+ 2008-04-22 22:20:17 2,048 –s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [ ]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [ ]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe" [ ]
"MMTray"="C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [ ]
"HPDJ Taskbar Utility"="C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe" [ ]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [ ]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-04-16 19:22 579584]
"COMODO Firewall Pro"="C:\Program Files\COMODO\Firewall\cfp.exe" [2008-04-16 21:24 1503488]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25 6731312]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-04-16 19:22 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 15:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"= C:\WINDOWS\system32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
C:\Program Files\Common Files\Symantec Shared\ccApp.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UserFaultCheck]
C:\WINDOWS\system32\dumprep 0 -u

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Common Files\\AOL\\1159330157\\ee\\AOLServiceHost.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=

R1 cmdHlp;COMODO Firewall Pro Helper Driver;C:\WINDOWS\system32\DRIVERS\cmdhlp.sys [2008-04-16 21:24]
S1 cmdGuard;COMODO Firewall Pro Sandbox Driver;C:\WINDOWS\system32\DRIVERS\cmdguard.sys [2008-04-16 21:24]
S3 2WIREPCP;2Wire USB;C:\WINDOWS\system32\DRIVERS\2WirePCP.sys [2004-09-15 03:42]
S3 MBAMCatchMe;MBAMCatchMe;C:\Program Files\Malwarebytes' Anti-Malware\catchme.sys [2008-04-07 20:17]
S3 NAL;Nal Service ;C:\WINDOWS\system32\Drivers\iqvw32.sys [2004-11-02 15:12]
S3 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" []

*Newly Created Service* - CATCHME
.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-22 17:40:17
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\guard32.dll

PROCESS: C:\WINDOWS\system32\lsass.exe
-> C:\WINDOWS\system32\guard32.dll
.
Completion time: 2008-04-22 17:40:59
ComboFix-quarantined-files.txt 2008-04-22 22:40:55
ComboFix2.txt 2008-04-22 22:17:43
ComboFix3.txt 2008-04-18 23:41:59
ComboFix4.txt 2008-04-18 23:33:08
ComboFix5.txt 2008-04-18 02:07:58

Pre-Run: 103,764,631,552 bytes free
Post-Run: 103,748,366,336 bytes free
.
2008-03-19 08:01:14 — E O F —


Logfile of HijackThis v1.99.1
Scan saved at 5:42:43 PM, on 4/22/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Documents and Settings\temp\Desktop\whathe.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_08\bin\jusched.exe"
O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [COMODO Firewall Pro] "C:\Program Files\COMODO\Firewall\cfp.exe" -h
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_08\bin\ssv.dll
O11 - Options group: [INTERNATIONAL] International*
O20 - AppInit_DLLs: C:\WINDOWS\system32\guard32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: COMODO Firewall Pro Helper Service (cmdAgent) - COMODO - C:\Program Files\COMODO\Firewall\cmdagent.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: Viewpoint Manager Service - Unknown owner - C:\Program Files\Viewpoint\Common\ViewpointService.exe (file missing)
O23 - Service: WMP54Gv4SVC - Unknown owner - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe" "WMP54Gv4.exe (file missing)