[Closed] AntiSpywareMaster popup infection

I am helping someone remove some nasty infections from a home PC. They are experiencing sluggish speeds and a variety of popups, including the antispywaremaster rogue application popup. So far, I cleaned the computer with Ccleaner and ATF cleaner which deleted about 1GB worth of junk. I also ran NOD32 which picked up a few more. I then ran Vundofix and Combofix. Vundofix did not find anything and Combofix found some more. I am wondering if there is anything else lurking in the background. Any help would be appreciated. Below is the combofix log and a fresh hijack this log.

ComboFix 08-07-20.A0 - Administrator 2008-07-21 19:26:37.1 - NTFSx86 MINIMAL
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.100 [GMT -5:00]
Running from: G:\My Files\Computer Cleanup\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Tom Quill\Application Data\STEM32~1
C:\Documents and Settings\Tom Quill\Application Data\STEM32~1\msiexec.exe
C:\Documents and Settings\Tom Quill\Start Menu\Programs\Outerinfo
C:\Documents and Settings\Tom Quill\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\Tom Quill\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\AntiSpywareMaster
C:\Program Files\AntiSpywareMaster\asm.exe
C:\Program Files\fnts~1
C:\Program Files\fnts~1\F?nts\
C:\Program Files\inetget2
C:\Program Files\inetget2\popinstall.exe
C:\Program Files\ISM
C:\Program Files\MyWay
C:\Program Files\MyWay\myBar\1.bin\MY2NS.EXE
C:\Program Files\MyWay\myBar\1.bin\MYWAYPLUGINPROXY.CLASS
C:\Program Files\MyWay\myBar\1.bin\NPMYWAY.DLL
C:\Program Files\MyWay\myBar\1.bin\PARTNER.DAT
C:\Program Files\MyWay\myBar\1.bin\UNINSTALL.INF
C:\Program Files\MyWay\myBar\Cache\005C91E0.bin
C:\Program Files\MyWay\myBar\Cache\005CAE80.bin
C:\Program Files\MyWay\myBar\Cache\005CB120.bin
C:\Program Files\MyWay\myBar\Cache\files.ini
C:\Program Files\MyWay\myBar\History\search
C:\Program Files\MyWay\myBar\Settings\prevcfg.htm
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\winpop
C:\Program Files\winpop\winpop.exe
C:\Program Files\winupdates
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\temp\tn3
C:\WINDOWS\BM1377117a.txt
C:\WINDOWS\bundles
C:\WINDOWS\bundles\58kd52fg.exe
C:\WINDOWS\bundles\activeshopper.exe
C:\WINDOWS\bundles\adl_hl.exe
C:\WINDOWS\bundles\AdSmartMedia_bundle.exe
C:\WINDOWS\bundles\adv0ltc0m.exe
C:\WINDOWS\bundles\ast_5_adsav.exe
C:\WINDOWS\bundles\b2s-162813.exe
C:\WINDOWS\bundles\Beryllium.exe
C:\WINDOWS\bundles\bs5-goodyr1.exe
C:\WINDOWS\bundles\CSv10P070.exe
C:\WINDOWS\bundles\cxt_big.exe
C:\WINDOWS\bundles\cxt_wmg.exe
C:\WINDOWS\bundles\d_ic.exe
C:\WINDOWS\bundles\Decade.exe
C:\WINDOWS\bundles\e2g51.exe
C:\WINDOWS\bundles\EDow_vl.exe
C:\WINDOWS\bundles\gogotoolsSILAWO8pi.exe
C:\WINDOWS\bundles\HLInstaller.exe
C:\WINDOWS\bundles\icmedia2_56.exe
C:\WINDOWS\bundles\ICMMedia_1cmm3d1a.exe
C:\WINDOWS\bundles\iehost.exe
C:\WINDOWS\bundles\installcasino.exe
C:\WINDOWS\bundles\KnNe1.exe
C:\WINDOWS\bundles\mfsetup.exe
C:\WINDOWS\bundles\new_vcm.exe
C:\WINDOWS\bundles\newmb.exe
C:\WINDOWS\bundles\NzI0MDo4OjEy.exe
C:\WINDOWS\bundles\package8033_MARKETING5.exe
C:\WINDOWS\bundles\rop_marketing_1_168.exe
C:\WINDOWS\bundles\ropbundle.exe
C:\WINDOWS\bundles\runsearch.exe
C:\WINDOWS\bundles\sahagent-dectest1001.exe
C:\WINDOWS\bundles\sahagent-onlinetrafficbroker1001.exe
C:\WINDOWS\bundles\sahagent-seedcorn1002.exe
C:\WINDOWS\bundles\setup_Incredifind_TrafficSpec.exe
C:\WINDOWS\bundles\setupactiv2.exe
C:\WINDOWS\bundles\SetupCasino.exe
C:\WINDOWS\bundles\ssee.exe
C:\WINDOWS\bundles\stlb2_seed.exe
C:\WINDOWS\bundles\vb6rt.exe
C:\WINDOWS\bundles\vrinstall_icmedia.exe
C:\WINDOWS\bundles\winversion.exe
C:\WINDOWS\cookies.ini
C:\WINDOWS\mainms.vpi
C:\WINDOWS\megavid.cdt
C:\WINDOWS\muotr.so
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\bvnjewsp.ini
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\Cache\chart 1.bmp
C:\WINDOWS\system32\Cache\ding.bmp
C:\WINDOWS\system32\Cache\disk 1.bmp
C:\WINDOWS\system32\Cache\document.bmp
C:\WINDOWS\system32\Cache\mail unreaded.bmp
C:\WINDOWS\system32\Cache\msg.bin
C:\WINDOWS\system32\Cache\peoples 1.bmp
C:\WINDOWS\system32\Cache\search find 2.bmp
C:\WINDOWS\system32\Cache\web app.bmp
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\EMnqBJjl.ini
C:\WINDOWS\SYSTEM32\EMnqBJjl.ini2
C:\WINDOWS\system32\fxngwqog.ini
C:\WINDOWS\system32\g60.exe
C:\WINDOWS\system32\gside.exe
C:\WINDOWS\system32\hwonctai.dll
C:\WINDOWS\system32\iatcnowh.ini
C:\WINDOWS\SYSTEM32\JlTuwyay.ini
C:\WINDOWS\SYSTEM32\JlTuwyay.ini2
C:\WINDOWS\system32\kclcpdiw.dll
C:\WINDOWS\system32\ljJBqnME.dll
C:\WINDOWS\system32\lmdv.bin
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\msnav32.ax
C:\WINDOWS\system32\mtwleygq.ini
C:\WINDOWS\system32\mysidesearch_sidebar_uninstall.exe
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ntibgmyu.ini
C:\WINDOWS\system32\ojpxkodi.ini
C:\WINDOWS\system32\optrlhpf.dll
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\PreUninstall.exe
C:\WINDOWS\system32\rcunlrlc.ini
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\rqRKDvuu.dll
C:\WINDOWS\system32\rwwnw64d.exe
C:\WINDOWS\system32\tajikxuy.dll
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tcntrkdm.exe
C:\WINDOWS\system32\tcntrkdn.exe
C:\WINDOWS\system32\tracert.com
C:\WINDOWS\system32\uninstall.exe
C:\WINDOWS\system32\uqxvdfcm.dll
C:\WINDOWS\SYSTEM32\uuvDKRqr.ini
C:\WINDOWS\SYSTEM32\uuvDKRqr.ini2
C:\WINDOWS\system32\vivblsvo.ini
C:\WINDOWS\system32\vmss
C:\WINDOWS\system32\wghjtnlg.dll
C:\WINDOWS\system32\winpfz33.sys
C:\WINDOWS\SYSTEM32\XHiPYcfe.ini
C:\WINDOWS\SYSTEM32\XHiPYcfe.ini2
C:\WINDOWS\system32\yaywuTlJ.dll
C:\WINDOWS\system32\zxdnt3d.cfg
C:\WINDOWS\wr.txt

.
((((((((((((((((((((((((( Files Created from 2008-06-22 to 2008-07-22 )))))))))))))))))))))))))))))))
.

2008-07-21 18:59 . 2008-07-21 18:58 512,096 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\amon.sys
2008-07-21 18:59 . 2008-07-21 18:58 298,104 –a—— C:\WINDOWS\SYSTEM32\imon.dll
2008-07-21 18:59 . 2008-07-21 18:58 15,424 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\nod32drv.sys
2008-07-21 18:57 . 2008-07-21 18:59 d——– C:\Program Files\ESET
2008-07-21 18:51 . 2008-07-21 18:51 d——– C:\Program Files\CCleaner
2008-07-21 18:47 . 2008-07-21 18:47 d——– C:\Program Files\Trend Micro
2008-07-21 18:22 . 2008-07-21 18:22 d——– C:\VundoFix Backups
2008-07-21 18:07 . 2002-01-15 09:22 d——– C:\Documents and Settings\Administrator\WINDOWS
2008-07-21 18:07 . 2002-01-15 09:21 d——– C:\Documents and Settings\Administrator\Application Data\Symantec
2008-07-21 18:07 . 2008-07-21 18:53 d——– C:\Documents and Settings\Administrator
2008-07-17 19:49 . 2008-07-21 20:59 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-07-17 19:49 . 2008-07-17 19:49 1,409 –a—— C:\WINDOWS\QTFont.for
2008-07-07 20:42 . 2008-07-07 20:42 d——– C:\qrnt
2008-07-03 09:45 . 2008-07-03 09:45 364,544 –a—— C:\WINDOWS\SYSTEM32\qcoarvavuuzxcsmf.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-22 01:59 49,185 —-a-w C:\WINDOWS\SYSTEM32\rwwnw64d.exe
2008-07-10 22:58 ——— d—–w C:\Program Files\altcmd
2008-07-03 22:36 2,216 —-a-w C:\Documents and Settings\Nancy Quill\Application Data\ViewerApp.dat
2008-07-03 21:45 90,922 —-a-w C:\WINDOWS\SYSTEM32\qcoarvavuuzxcsmf.dll-uninst.exe
2008-06-19 04:30 ——— d—–w C:\Documents and Settings\Tom Quill\Application Data\DNA
2008-06-16 20:47 ——— d—–w C:\Documents and Settings\Tom Quill\Application Data\uTorrent
2008-06-13 13:10 272,128 —-a-w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-13 13:10 272,128 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
2008-06-10 22:09 49,179 —-a-w C:\WINDOWS\SYSTEM32\jqwnw64s.exe
2008-06-10 19:54 63,902 —-a-w C:\WINDOWS\SYSTEM32\{b9192b04-1d0e-7364-ba43-fd5af7e31637}.dll-uninst.exe
2008-06-10 19:53 167,976 —-a-w C:\WINDOWS\system32\drivers\core.cache.dsk
2008-06-08 23:12 ——— d—–w C:\Program Files\uTorrent
2008-06-08 23:11 ——— d—–w C:\Documents and Settings\Tom Quill\Application Data\BitTorrent
2008-06-07 00:25 ——— d—–w C:\Documents and Settings\Tom Quill\Application Data\Amazon
2008-06-07 00:24 ——— d—–w C:\Program Files\Amazon
2008-06-07 00:19 ——— d—–w C:\Program Files\BitTorrent
2008-06-07 00:18 ——— d—–w C:\Program Files\DNA
2008-05-27 21:12 ——— d—–w C:\Program Files\Apple Software Update
2008-05-24 06:24 ——— d—–w C:\Program Files\Mywantec
2008-05-23 16:16 ——— d—–w C:\Program Files\iTunes
2008-05-23 16:14 ——— d—–w C:\Program Files\iPod
2008-05-23 16:06 ——— d—–w C:\Program Files\QuickTime
2008-05-08 12:28 202,752 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-05-07 05:18 1,287,680 ——w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2007-07-29 00:09 40,183 –sh–w C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
2006-01-04 21:40 73,024 —-a-w C:\Documents and Settings\Brian Quill\Application Data\GDIPFONTCACHEV1.DAT
2005-07-14 02:42 560 —-a-w C:\Documents and Settings\Brian Quill\Application Data\ViewerApp.dat
2005-01-05 03:26 117 —-a-w C:\Documents and Settings\Brian Quill\Application Data\tvmdmns.dll
2004-07-28 02:04 71,472 —-a-w C:\Documents and Settings\Nancy Quill\Application Data\GDIPFONTCACHEV1.DAT
2004-02-25 21:33 71,472 —-a-w C:\Documents and Settings\Tom Quill\Application Data\GDIPFONTCACHEV1.DAT
2004-02-16 02:07 33,280 –sha-w C:\Program Files\Thumbs.db
2005-01-14 18:54 475 –sha-w C:\WINDOWS\SYSTEM32\zoqgv.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2f339fba-afbb-b8a3-3a94-223e2957f4f2}]
2008-07-03 09:45 364544 –a—— C:\WINDOWS\system32\qcoarvavuuzxcsmf.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{67694BF9-8768-8599-1E12-828DBA2A87C4}]
2007-06-20 09:49 60928 –a—— C:\WINDOWS\system32\khec.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BA6B83CD-9263-4226-AC4B-0AD6A16A6200}]
2005-02-07 18:31 98816 –a—— C:\WINDOWS\System32\ggxyg.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"sysmonnt"="C:\WINDOWS\System32\sysmonnt" [X]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2004-03-04 15:01 4681728]
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-06-07 14:08 4670968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 03:10 49263]
"NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2005-08-29 11:34 7110656]
"NvMediaCenter"="C:\WINDOWS\System32\NvMcTray.dll" [2005-08-29 11:34 86016]
"YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 16:19 129536]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2007-07-29 22:20 230512]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2007-07-29 22:20 185456]
"YOP"="C:\PROGRA~1\Yahoo!\YOP\yop.exe" [2006-07-21 10:43 407032]
"AT&T Yahoo! Dial Connection Manager"="C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe" [2007-05-11 13:07 1158248]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-07-21 18:58 949376]
"nwiz"="nwiz.exe" [2005-08-29 11:34 1519616 C:\WINDOWS\SYSTEM32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ctmp3"= C:\WINDOWS\System32\ctmp3.acm
"aux"= ctwdm32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ComputerAssociatesAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\PROGRA~1\\Yahoo!\\MESSEN~1\\yserver.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Activision\\Call of Duty 2\\CoD2MP_s.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\EA GAMES\\MOHAA\\MOHAA.exe"=
"C:\\Program Files\\Yahoo!\\Yahoo! Music Jukebox\\YahooMusicEngine.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\DNA\\btdna.exe"=
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

S1 AWRTPDD;AWRTPDD;C:\WINDOWS\system32\drivers\AWRTPDD.sys []
.
Contents of the 'Scheduled Tasks' folder
"2008-07-19 22:53:15 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-07-20 07:26:11 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
"2002-01-19 01:24:07 C:\WINDOWS\Tasks\Symantec NetDetect.job"
- C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
.
- - - - ORPHANS REMOVED - - - -

WebBrowser-{339BB23F-A864-48C0-A59F-29EA915965EC} - (no file)
HKCU-Run-Microsoft Works Update Detection - C:\Program Files\Microsoft Works\WkDetect.exe
HKCU-Run-Jawa32 - C:\WINDOWS\jawa32.exe
HKCU-Run-iacenc - C:\WINDOWS\System32\iacenc.exe
HKCU-Run-eZWO - C:\PROGRA~1\Web Offer\wo.exe
HKCU-Run-setupapi - C:\WINDOWS\System32\setupapi.exe
HKCU-Run-eZmmod - C:\PROGRA~1\ezula\mmod.exe
HKCU-Run-196_150_ni - C:\WINDOWS\System32\196_150_ni.exe
HKCU-Run-197_150_ni_5 - C:\WINDOWS\System32\197_150_ni_5.exe
HKCU-Run-odbc32gt - C:\WINDOWS\system32\odbc32gt.exe
HKCU-Run-wldap32 - C:\WINDOWS\system32\wldap32.exe
HKCU-Run-Zwt3RVY3P - e_solss.exe
HKLM-Run-{42-22-24-49-DW} - c:\windows\system32\rwwnw64d.exe
HKLM-Run-104422e6 - C:\WINDOWS\system32\hwonctai.dll
HKLM-Run-BM1377117a - C:\WINDOWS\system32\tajikxuy.dll
Notify-wvUnLCtQ - wvUnLCtQ.dll


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = hxxp://att.yahoo.com
R0 -: HKLM-Main,Start Page = hxxp://www.yahoo.com/
R0 -: HKLM-Main,Search Bar = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/sb/sbcydsl/*http://www.yahoo.com/search/ie.html
R1 -: HKCU-Internet Connection Wizard,ShellNext = hxxp://www.dellnet.com/
R1 -: HKCU-SearchURL,(Default) = hxxp://red.clientapps.yahoo.com/customize/ie/defaults/su/sbcydsl/*http://www.yahoo.com
O8 -: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O8 -: Web Rebates - file://C:\Program Files\Web_Rebates\Sy1150\Tp1150\scri1150a.htm
O17 -: HKLM\CCS\Interface\{0114DB8D-5117-461E-BED3-BEC58B8005F6}: NameServer = 169.254.92.24

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-21 21:02:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Yahoo!\Antivirus\iSafe.exe
C:\WINDOWS\SYSTEM32\CTSVCCDA.EXE
C:\Program Files\ESET\nod32krn.exe
C:\WINDOWS\SYSTEM32\nvsvc32.exe
C:\WINDOWS\SYSTEM32\wdfmgr.exe
C:\WINDOWS\SYSTEM32\MsPMSPSv.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\WINDOWS\SYSTEM32\devldr32.exe
C:\WINDOWS\SYSTEM32\rundll32.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe
C:\Qoobox\Quarantine\C\WINDOWS\SYSTEM32\rwwnw64d.exe.vir
C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe
C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Yahoo!\Antivirus\autodown.exe
.
**************************************************************************
.
Completion time: 2008-07-21 21:20:31 - machine was rebooted [Nancy Quill]
ComboFix-quarantined-files.txt 2008-07-22 02:16:13

Pre-Run: 12,130,213,888 bytes free
Post-Run: 12,316,831,744 bytes free

329 — E O F — 2008-07-10 22:51:29



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:04, on 2008-07-21
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Safe mode

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\ESET\nod32.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dellnet.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = http://www.dellnet.com/
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: mysidesearch search enhancer - {2f339fba-afbb-b8a3-3a94-223e2957f4f2} - C:\WINDOWS\system32\qcoarvavuuzxcsmf.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: (no name) - {67694BF9-8768-8599-1E12-828DBA2A87C4} - C:\WINDOWS\system32\khec.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: SDWin32 Class - {BA6B83CD-9263-4226-AC4B-0AD6A16A6200} - C:\WINDOWS\System32\ggxyg.dll
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {014DA6C9-189F-421a-88CD-07CFE51CFF10} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [AT&T Yahoo! Dial Connection Manager] C:\Program Files\SBC Yahoo!\Connection Manager\ConnectionManager.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: 2Wire Wireless Client Manager.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?
O4 - Global Startup: Picture Package Menu.lnk = ?
O4 - Global Startup: Picture Package VCD Maker.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - http://fdl.msn.com/public/chat/msnchat41.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1128552684120
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1128552668541
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0114DB8D-5117-461E-BED3-BEC58B8005F6}: NameServer = 169.254.92.24
O17 - HKLM\System\CS1\Services\Tcpip\..\{0114DB8D-5117-461E-BED3-BEC58B8005F6}: NameServer = 169.254.92.24
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: msvcrt - Unknown owner - C:\WINDOWS\System32\msvcrt.exe (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: WinFast® Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 7363 bytes

Ran scans with Super AntiSpyware, Adaware 2008, and Malwarebytes Anti Malware. Super AntiSpyware got rid of over 1300 adware/spyware. Adaware 2008 and Anti Malware got rid of additional trojans and spyware. The computer seems to be running a little better, but I know I didn't catch all of them. Below is a log from Anti Malware and a fresh Hijackthis log.


Malwarebytes' Anti-Malware 1.22
Database version: 966
Windows 5.1.2600 Service Pack 2

8:00:13 AM 2008-07-22
mbam-log-7-22-2008 (07-59-54).txt

Scan type: Quick Scan
Objects scanned: 45652
Time elapsed: 8 minute(s), 58 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 11
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 9
Files Infected: 16

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\mysearchtoolbar.settingsplugin (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\mysearchtoolbar.settingsplugin.1 (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{014da6c4-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{014da6c6-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{014da6ca-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{014da6cc-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{014da6c0-189f-421a-88cd-07cfe51cff10} (Adware.MyWebSearch) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\MySearch (Adware.MyWebSearch) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Web Rebates (Adware.WebRebates) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\search404 (Adware.404Search) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\MediaLoads (Adware.Medload) -> No action taken.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\MySearch (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\2.bin (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Cache (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\History (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Settings (Adware.MyWebSearch) -> No action taken.
C:\WINDOWS\SYSTEM32\netrax01 (Trojan.Agent) -> No action taken.
C:\WINDOWS\SYSTEM32\GTK (Trojan.Agent) -> No action taken.
C:\WINDOWS\SYSTEM32\SGI (Trojan.Agent) -> No action taken.

Files Infected:
C:\WINDOWS\SYSTEM32\{b9192b04-1d0e-7364-ba43-fd5af7e31637}.dll-uninst.exe (Adware.Vapsup) -> No action taken.
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe (Adware.PurityScan) -> No action taken.
C:\Program Files\MySearch\bar\Cache\00123E0B (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Cache\00124147 (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Cache\0012431C.bmp (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Cache\00124742.bmp (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Cache\files.ini (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\History\search (Adware.MyWebSearch) -> No action taken.
C:\Program Files\MySearch\bar\Settings\prevcfg.htm (Adware.MyWebSearch) -> No action taken.
C:\WINDOWS\SYSTEM32\netrax01\netrax011065.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\SYSTEM32\GTK\tuxderr.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\BM1377117a.xml (Trojan.Vundo) -> No action taken.
C:\WINDOWS\SYSTEM32\clkcnt.txt (Trojan.Vundo) -> No action taken.
C:\Documents and Settings\Tom Quill\Start Menu\Programs\Startup\Deewoo.lnk (Malware.Links) -> No action taken.
C:\Documents and Settings\Brian Quill\Start Menu\Programs\Startup\Deewoo.lnk (Malware.Links) -> No action taken.


—————————————————————————–



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:53:16 AM, on 2008-07-22
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\devldr32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Nhksrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\System32\CTsvcCDA.EXE
C:\Program Files\Eset\nod32krn.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\WINDOWS\System32\MsPMSPSv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Eset\nod32kui.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,SearchURL = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://att.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/…/search/ie.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/…//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\SearchURL,(Default) = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dellnet.com/
R3 - URLSearchHook: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {BA6B83CD-9263-4226-AC4B-0AD6A16A6200} - (no file)
O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O3 - Toolbar: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Global Startup: 2Wire Wireless Client Manager.lnk = ?
O8 - Extra context menu item: Blubster Support - file://C:\Program Files\BlubsterSupport\System\Temp\blubstershop_script0.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O9 - Extra button: AT&T Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {231B1C6E-F934-42A2-92B6-C2FEFEC24276} (yucsetreg Class) - C:\Program Files\Yahoo!\common\yucconfig.dll
O16 - DPF: {29C13B62-B9F7-4CD3-8CEF-0A58A1A99441} - http://fdl.msn.com/public/chat/msnchat41.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200207…meInstaller.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1128552684120
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1128552668541
O16 - DPF: {E87A6788-1D0F-4444-8898-1D25829B6755} - http://fdl.msn.com/public/chat/msnchat4.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0114DB8D-5117-461E-BED3-BEC58B8005F6}: NameServer = 169.254.92.24
O17 - HKLM\System\CS1\Services\Tcpip\..\{0114DB8D-5117-461E-BED3-BEC58B8005F6}: NameServer = 169.254.92.24
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXE
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: msvcrt - Unknown owner - C:\WINDOWS\System32\msvcrt.exe (file missing)
O23 - Service: Netropa NHK Server (Nhksrv) - Unknown owner - C:\WINDOWS\Nhksrv.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: WinFast® Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

–
End of file - 7759 bytes