[Resolved] Trojan horse Generic11.AFA / Trojan Horse Downloader.A

Every time I open windows, AVG pops up with a resident shield alert on new trojans it found upon opening. I get redirected to many websites. I can hardly do anything on my administrative account, meaning i cant go to many websites. I had to create a limited acct. just to be able to get my e mail or even to get to this site. Here are some of the names of the infections and also the HJT Log. Your help would be greatly appreciated.
Trojan Horse Generic11.AFA
Trojan Horse Generic11.AEN
Trojan Horse Generic11.QZ
Trojan Horse Downloader.Agent.AIRK
Trojan Horse Agent.YZB
Trojan Horse BHO.FAC


Logfile of HijackThis v1.99.1
Scan saved at 11:56:28 AM, on 7/29/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\AVG\AVG8\aAvgApi.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\DOCUME~1\12\LOCALS~1\Temp\Temporary Directory 3 for hijackthis.zip\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bleepingcomputer.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul…//www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [e800ab39] rundll32.exe "C:\WINDOWS\system32\xbhvtxhy.dll",b
O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\12\winlogon.exe
O4 - HKLM\..\Run: [BMeb3398a5] Rundll32.exe "C:\WINDOWS\system32\isendjhc.dll",s
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O8 - Extra context menu item: Send to &Bluetooth Device… - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Send To Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1211001649165
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1212068352018
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

WOW!!! What a noticable difference already. My PC is running way better than it has lately. I did what you asked and here are the two logs (Thank you so much for your help)

Malwarebytes' Anti-Malware 1.23
Database version: 1008
Windows 5.1.2600 Service Pack 2

10:15:06 PM 7/29/2008
mbam-log-7-29-2008 (22-15-06).txt

Scan type: Full Scan (C:\|)
Objects scanned: 72382
Time elapsed: 54 minute(s), 4 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 4
Registry Keys Infected: 11
Registry Values Infected: 3
Registry Data Items Infected: 2
Folders Infected: 2
Files Infected: 28

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\SYSTEM32\tuvSiiJD.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\uhbfnalb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\iifcASJD.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\kzeiyz.dll (Trojan.Vundo) -> Delete on reboot.

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4aecadc4-c176-48ad-918e-834ad27601dc} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{4aecadc4-c176-48ad-918e-834ad27601dc} (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bca98486-b809-4238-b6a3-30bd7b205132} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{bca98486-b809-4238-b6a3-30bd7b205132} (Trojan.Vundo) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{59aad935-db8d-4289-a0a3-67e2b3b55bab} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{59aad935-db8d-4289-a0a3-67e2b3b55bab} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\iifcasjd (Trojan.Vundo) -> Delete on reboot.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Trojan.Vundo) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\e800ab39 (Trojan.Vundo) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{59aad935-db8d-4289-a0a3-67e2b3b55bab} (Trojan.Vundo) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\bmeb3398a5 (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo) -> Data: c:\windows\system32\tuvsiijd -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\tuvsiijd -> Delete on reboot.

Folders Infected:
C:\WINDOWS\SYSTEM32\kBin02 (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Program Files\RegSort v1.1.5 (Rogue.RegSort) -> Quarantined and deleted successfully.

Files Infected:
C:\WINDOWS\SYSTEM32\kzeiyz.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\tuvSiiJD.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\DJiiSvut.ini (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\DJiiSvut.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\klirjpwt.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\twpjrilk.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\rsskxwgi.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\igwxkssr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\uhbfnalb.dll (Trojan.Vundo) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\blanfbhu.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\xbhvtxhy.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\yhxtvhbx.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\iifcASJD.dll (Trojan.Vundo) -> Delete on reboot.
C:\Documents and Settings\12\Local Settings\Temporary Internet Files\Content.IE5\MPHQB454\kb456456[1] (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\Documents and Settings\12\My Documents\LimeWire\Saved\Sonic Foundry Acid Pro 4.0 + Sound FORGE 7.0 + kEYGENS + MANUALS\Sound Forge 7.0 + ssg keygen\keygen.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{05A9F863-EE9D-4F75-A51B-5CB7E8A0569B}\RP1\A0000022.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{05A9F863-EE9D-4F75-A51B-5CB7E8A0569B}\RP1\A0000023.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{05A9F863-EE9D-4F75-A51B-5CB7E8A0569B}\RP3\A0000152.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{28C0CF82-C86F-45F4-B5BF-F98D2CDBC366}\RP19\A0009964.exe (Rogue.RegSort) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{28C0CF82-C86F-45F4-B5BF-F98D2CDBC366}\RP19\A0009965.exe (Rogue.RegSort) -> Quarantined and deleted successfully.
C:\Program Files\RegSort v1.1.5\RegSort.old.log (Rogue.RegSort) -> Quarantined and deleted successfully.
C:\WINDOWS\cookies.ini (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\sdfhddra.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\SYSTEM32\pac.txt (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\nnnkKDtq.dll (Backdoor.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\SYSTEM32\gebdryyp.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMeb3398a5.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
C:\WINDOWS\BMeb3398a5.txt (Trojan.Vundo) -> Delete on reboot.





Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:00:50 AM, on 7/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\SYSTEM32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: (no name) - {084B8C3D-FB45-4250-B431-3E651D168322} - (no file)
O2 - BHO: (no name) - {12D40EC5-028B-468F-B1CC-90932E5CE0A1} - (no file)
O2 - BHO: (no name) - {27780EF9-91D5-4E8E-B7E3-96FB5F39A74A} - C:\WINDOWS\system32\ljJYOiGv.dll (file missing)
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {59AAD935-DB8D-4289-A0A3-67E2B3B55BAB} - C:\WINDOWS\system32\iifcASJD.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: (no name) - {79B94079-F505-455A-8BDC-DC74D1464EB8} - C:\WINDOWS\system32\awtrQGyv.dll (file missing)
O2 - BHO: (no name) - {7ACA0042-AA71-4630-A58B-3E26B808037E} - C:\WINDOWS\system32\efcASlJB.dll (file missing)
O2 - BHO: (no name) - {82308C17-9F8C-43D1-B104-0D6E66A7B26B} - (no file)
O2 - BHO: (no name) - {83B7243D-9E50-44E9-AE85-3CDEA850DEB6} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {9E1B9B93-18AB-477F-B037-32370C0D9999} - C:\WINDOWS\system32\ddcBSMdd.dll (file missing)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: (no name) - {A4570122-4B8C-4B94-B732-7B1782A1C1E8} - (no file)
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: (no name) - {BCA98486-B809-4238-B6A3-30BD7B205132} - C:\WINDOWS\system32\tuvSiiJD.dll
O2 - BHO: (no name) - {BFCF3B32-806A-4D05-BF9A-06B06C58A6B8} - (no file)
O2 - BHO: (no name) - {C897BE8F-E644-4E0C-A610-4990073DC7E5} - (no file)
O2 - BHO: (no name) - {DC902A38-BC5B-4147-AFF3-A874CA907722} - C:\WINDOWS\system32\qoMfcDtu.dll (file missing)
O2 - BHO: (no name) - {DDB5BE44-257F-429F-AFD4-F74EBAEA5B33} - (no file)
O2 - BHO: (no name) - {E91C2855-AC7E-4ED9-B488-0F78FAE8AD2D} - (no file)
O2 - BHO: (no name) - {EB0A8092-A9A6-47BD-BA43-A80D635AA9C7} - (no file)
O2 - BHO: (no name) - {EB1C3449-8D07-4361-8D61-B3D3A9F7E105} - (no file)
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Windows Logon Applicationedc] C:\Documents and Settings\12\winlogon.exe
O4 - HKLM\..\Run: [BMeb3398a5] Rundll32.exe "C:\WINDOWS\system32\sdfhddra.dll",s
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-21-1417001333-764733703-1343024091-1003\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet (User '12')
O4 - HKUS\S-1-5-21-1417001333-764733703-1343024091-1003\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '12')
O4 - HKUS\S-1-5-21-1417001333-764733703-1343024091-1003\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '12')
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1211001649165
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1212068352018
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: byXNddca - byXNddca.dll (file missing)
O20 - Winlogon Notify: iifcASJD - C:\WINDOWS\SYSTEM32\iifcASJD.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 9446 bytes

Here are the requested logs….
ComboFix 08-07-29.1 - sdfh 2008-07-30 19:27:47.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.58 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\sdfh\Application Data\macromedia\Flash Player\#SharedObjects\TF8YAF6X\interclick.com
C:\Documents and Settings\sdfh\Application Data\macromedia\Flash Player\#SharedObjects\TF8YAF6X\interclick.com\ud.sol
C:\Documents and Settings\sdfh\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\sdfh\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Program Files\autorun.inf
C:\WINDOWS\pskt.ini
C:\WINDOWS\SYSTEM32\asyrtkkc.ini
C:\WINDOWS\SYSTEM32\BJlSAcfe.ini
C:\WINDOWS\SYSTEM32\BJlSAcfe.ini2
C:\WINDOWS\system32\bwsfnjag.dll
C:\WINDOWS\system32\cogmixqo.ini
C:\WINDOWS\system32\dbgsvhqp.ini
C:\WINDOWS\SYSTEM32\ddMSBcdd.ini
C:\WINDOWS\SYSTEM32\ddMSBcdd.ini2
C:\WINDOWS\system32\DJiiSvut.ini
C:\WINDOWS\SYSTEM32\DJiiSvut.ini2
C:\WINDOWS\SYSTEM32\dptcfxqr.ini
C:\WINDOWS\system32\dvdgykdi.dll
C:\WINDOWS\system32\efkjjcde.ini
C:\WINDOWS\system32\emepdill.ini
C:\WINDOWS\system32\fPqtAcdd.ini
C:\WINDOWS\SYSTEM32\fPqtAcdd.ini2
C:\WINDOWS\system32\frcfkpav.ini
C:\WINDOWS\SYSTEM32\giwmxdgh.ini
C:\WINDOWS\system32\gysbscyy.dll
C:\WINDOWS\SYSTEM32\HNoWvyay.ini
C:\WINDOWS\SYSTEM32\HNoWvyay.ini2
C:\WINDOWS\SYSTEM32\hRCKlnpo.ini
C:\WINDOWS\SYSTEM32\hRCKlnpo.ini2
C:\WINDOWS\system32\iifcASJD.dll
C:\WINDOWS\system32\jcqocpyc.ini
C:\WINDOWS\system32\kzeiyz.dll
C:\WINDOWS\system32\lrobirey.ini
C:\WINDOWS\system32\luacri.dll
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\mtjcqftl.dll
C:\WINDOWS\system32\mtkvbljt.ini
C:\WINDOWS\system32\nkqfhmyw.ini
C:\WINDOWS\SYSTEM32\PqBcLRqr.ini
C:\WINDOWS\SYSTEM32\PqBcLRqr.ini2
C:\WINDOWS\SYSTEM32\pWvFNXbc.ini
C:\WINDOWS\SYSTEM32\pWvFNXbc.ini2
C:\WINDOWS\system32\pygwks.dll
C:\WINDOWS\system32\rafirdya.ini
C:\WINDOWS\system32\RsvuBJjl.ini
C:\WINDOWS\SYSTEM32\RsvuBJjl.ini2
C:\WINDOWS\SYSTEM32\SrAbJkkj.ini
C:\WINDOWS\SYSTEM32\SrAbJkkj.ini2
C:\WINDOWS\system32\tuvSiiJD.dll
C:\WINDOWS\system32\uhbfnalb.dll
C:\WINDOWS\SYSTEM32\unyfmiln.ini
C:\WINDOWS\system32\usqpnufo.ini
C:\WINDOWS\SYSTEM32\utDcfMoq.ini
C:\WINDOWS\SYSTEM32\utDcfMoq.ini2
C:\WINDOWS\system32\vGiOYJjl.ini
C:\WINDOWS\SYSTEM32\vGiOYJjl.ini2
C:\WINDOWS\SYSTEM32\vGMmmnmp.ini
C:\WINDOWS\SYSTEM32\vGMmmnmp.ini2
C:\WINDOWS\SYSTEM32\vyGQrtwa.ini
C:\WINDOWS\SYSTEM32\vyGQrtwa.ini2
C:\WINDOWS\system32\WvFiPsDd.ini
C:\WINDOWS\SYSTEM32\WvFiPsDd.ini2
C:\WINDOWS\system32\YabHgfii.ini
C:\WINDOWS\SYSTEM32\YabHgfii.ini2
C:\WINDOWS\system32\ybvfdbdu.ini
C:\WINDOWS\system32\yijklcdf.ini
C:\WINDOWS\system32\zqpbru.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.

2008-07-29 15:06 . 2008-07-29 15:06 d——– C:\Documents and Settings\sdfh\Application Data\Malwarebytes
2008-07-29 15:05 . 2008-07-29 15:06 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-07-29 15:05 . 2008-07-29 15:05 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-07-29 15:05 . 2008-07-23 20:09 38,472 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-07-29 15:05 . 2008-07-23 20:09 17,144 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-07-29 11:54 . 2008-07-29 11:55 d——– C:\Program Files\hijackjthis
2008-07-23 22:43 . 2008-07-23 22:43 d——– C:\Temp\epr1
2008-07-22 12:42 . 2008-07-23 02:41 43,633 –ahs—- C:\WINDOWS\SYSTEM32\mqccltpv.ini
2008-07-22 00:10 . 2008-07-22 00:10 dr-h—– C:\Documents and Settings\sdfh\Application Data\yahoo!
2008-07-22 00:09 . 2008-07-22 12:30 d——– C:\Documents and Settings\sdfh\Application Data\AVGTOOLBAR
2008-07-22 00:05 . 2008-07-22 00:05 d——– C:\Documents and Settings\sdfh
2008-07-21 23:05 . 2008-07-21 23:05 0 –a—— C:\WINDOWS\nsreg.dat
2008-07-21 22:20 . 2008-07-22 12:34 43,761 –ahs—- C:\WINDOWS\SYSTEM32\wnkyjycs.ini
2008-07-21 20:31 . 2008-07-21 20:31 d——– C:\Program Files\Trend Micro
2008-07-21 20:28 . 2008-07-21 20:28 d——– C:\Deckard
2008-07-20 20:28 . 2008-07-22 00:46 d——– C:\WINDOWS\SYSTEM32\carH18
2008-07-20 20:28 . 2008-07-20 20:28 d——– C:\Temp\btxv15
2008-07-16 12:03 . 2008-07-18 13:31 d——– C:\WINDOWS\SYSTEM32\aumsDK18
2008-07-16 12:03 . 2008-07-16 12:03 d——– C:\Temp\zpv201
2008-07-13 14:56 . 2007-12-24 17:37 138,384 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2008-07-12 23:36 . 2008-07-12 23:40 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-07-12 22:05 . 2008-07-12 22:05 95 –a—— C:\WINDOWS\wininit.ini
2008-07-12 13:22 . 2008-07-16 17:05 d——– C:\Program Files\Spybot - Search & Destroy
2008-07-12 13:22 . 2008-07-16 17:04 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-07-12 12:46 . 2008-07-12 12:46 dr-h—– C:\Documents and Settings\April\Application Data\yahoo!
2008-07-12 02:25 . 2008-07-12 12:47 d——– C:\Documents and Settings\All Users.WINDOWS\SonicStage
2008-07-12 01:18 . 2008-07-12 01:18 268 –ah—– C:\sqmdata06.sqm
2008-07-12 01:18 . 2008-07-12 01:18 244 –ah—– C:\sqmnoopt06.sqm
2008-07-12 01:10 . 2005-10-31 10:46 36,679 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMD052.sys
2008-07-12 01:09 . 2007-01-13 08:24 770,048 –a—— C:\WINDOWS\SYSTEM32\CDDBUISony.dll
2008-07-12 01:09 . 2007-01-13 08:22 655,360 –a—— C:\WINDOWS\SYSTEM32\CDDBControlSony.dll
2008-07-12 01:09 . 2007-01-13 08:22 589,824 –a—— C:\WINDOWS\SYSTEM32\CddbMusicIDSony.dll
2008-07-12 01:09 . 2007-01-13 08:25 532,480 –a—— C:\WINDOWS\SYSTEM32\CddbPlaylist2Sony.dll
2008-07-12 01:09 . 2007-01-13 08:24 73,728 –a—— C:\WINDOWS\SYSTEM32\CddbLinkSony.dll
2008-07-12 01:07 . 2008-07-12 01:07 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Corporation
2008-07-12 01:02 . 2008-07-12 01:03 d——– C:\Program Files\Common Files\Sony Shared
2008-07-11 23:48 . 2008-07-12 12:46 d——– C:\Program Files\Sony
2008-07-11 23:48 . 2001-09-13 02:15 90,112 ——— C:\WINDOWS\snymsico.dll
2008-07-11 23:48 . 2002-08-08 15:51 38,951 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMDUSB.sys
2008-07-11 23:48 . 2003-11-10 12:31 36,232 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMD033.sys
2008-07-11 23:48 . 2003-04-01 18:55 35,319 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMD031.sys
2008-07-11 23:20 . 2008-07-11 23:20 268 –ah—– C:\sqmdata05.sqm
2008-07-11 23:20 . 2008-07-11 23:20 244 –ah—– C:\sqmnoopt05.sqm
2008-07-11 21:16 . 2008-07-12 12:45 d——– C:\Documents and Settings\April\Application Data\AVGTOOLBAR
2008-07-11 20:41 . 2008-07-11 20:41 268 –ah—– C:\sqmdata04.sqm
2008-07-11 20:41 . 2008-07-11 20:41 244 –ah—– C:\sqmnoopt04.sqm
2008-07-11 19:38 . 2008-07-11 19:38 268 –ah—– C:\sqmdata03.sqm
2008-07-11 19:38 . 2008-07-11 19:38 244 –ah—– C:\sqmnoopt03.sqm
2008-07-11 18:16 . 2008-07-21 20:52 d——– C:\Documents and Settings\April
2008-07-11 03:21 . 2008-07-29 22:54 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2008-07-11 03:20 . 2008-07-13 20:27 d——– C:\Program Files\Google
2008-07-10 15:19 . 2008-07-10 15:19 1,386 –a—— C:\WINDOWS\SYSTEM32\iwhpmnvx.dll
2008-07-09 22:37 . 2008-07-09 22:37 268 –ah—– C:\sqmdata02.sqm
2008-07-09 22:37 . 2008-07-09 22:37 244 –ah—– C:\sqmnoopt02.sqm
2008-07-09 03:06 . 2008-07-09 03:06 268 –ah—– C:\sqmdata01.sqm
2008-07-09 03:06 . 2008-07-09 03:06 244 –ah—– C:\sqmnoopt01.sqm
2008-07-07 23:32 . 2008-07-13 20:21 d——– C:\WINDOWS\SYSTEM32\olixds18
2008-07-07 23:32 . 2008-07-07 23:32 d——– C:\Temp\stmpv4
2008-07-07 23:32 . 2008-07-24 12:58 d——– C:\Temp
2008-07-03 21:44 . 2008-07-03 21:44 268 –ah—– C:\sqmdata00.sqm
2008-07-03 21:44 . 2008-07-03 21:44 244 –ah—– C:\sqmnoopt00.sqm
2008-06-29 14:34 . 2008-07-08 17:25 d——– C:\Program Files\Full Tilt Poker
2008-06-25 03:01 . 2008-06-25 03:01 d——– C:\Program Files\MSXML 4.0
2008-06-24 15:54 . 2008-07-16 15:00 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-06-24 15:54 . 2008-06-24 15:54 1,409 –a—— C:\WINDOWS\QTFont.for
2008-06-24 15:48 . 2008-07-30 17:26 28,504 –a—— C:\logfile
2008-06-24 15:35 . 2008-06-24 15:36 d——– C:\Program Files\QuickTime
2008-06-24 15:35 . 2008-06-24 15:35 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-06-24 15:33 . 2008-06-24 15:33 d——– C:\Program Files\Common Files\Kodak
2008-06-24 15:33 . 2004-08-04 02:56 159,232 –a—— C:\WINDOWS\SYSTEM32\ptpusd.dll
2008-06-24 15:33 . 2001-08-17 22:36 5,632 –a—— C:\WINDOWS\SYSTEM32\ptpusb.dll
2008-06-24 15:30 . 2008-06-24 15:34 d——– C:\Program Files\Kodak
2008-06-24 15:28 . 2008-06-24 15:37 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kodak
2008-06-20 23:40 . 2008-06-20 23:40 0 –a—— C:\WINDOWS\iPlayer.INI
2008-06-20 23:36 . 2008-07-12 12:48 d——– C:\Program Files\InterActual
2008-06-20 12:41 . 2008-06-20 12:41 245,248 —–c— C:\WINDOWS\SYSTEM32\dllcache\mswsock.dll
2008-06-20 05:44 . 2008-06-20 05:44 138,368 —–c— C:\WINDOWS\SYSTEM32\dllcache\afd.sys
2008-06-13 04:08 . 2008-06-24 15:34 d—-c— C:\WINDOWS\SYSTEM32\DRVSTORE
2008-06-13 04:01 . 2008-07-12 12:48 d——– C:\Program Files\Windows Live
2008-06-13 04:01 . 2008-06-13 04:06 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-13 04:01 . 2008-06-13 04:01 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-06-10 17:59 . 2008-06-13 08:10 272,128 —–c— C:\WINDOWS\SYSTEM32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 16:52 ——— d—–w C:\Program Files\LimeWire
2008-07-22 04:35 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-07-21 01:41 ——— d—–w C:\Program Files\Java
2008-07-12 17:47 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-12 06:07 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-07-04 02:43 96,520 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-04 02:43 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-04 02:43 10,520 —-a-w C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\SYSTEM32\mswsock.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-15 19:56 ——— d—–w C:\Program Files\Yahoo!
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 08:01 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\SYSTEM32\wininet.dll
2005-12-30 00:04 0 —-a-w C:\Program Files\test.tmp
2005-12-30 00:04 0 —-a-w C:\Program Files\Common Files\test.tmp
2005-12-09 02:44 266 –sh–w C:\Program Files\desktop.ini
2005-12-09 02:44 11,079 —ha-w C:\Program Files\folder.htt
2001-03-12 13:42 2,441,216 —-a-w C:\Program Files\Ihra.exe
2001-02-26 12:54 9,492 —-a-w C:\Program Files\Readme.txt
2001-02-15 12:19 7,956 —-a-w C:\Program Files\Multiplayer.txt
2001-02-13 09:31 3,637 —-a-w C:\Program Files\Custom Paint and Wheels.txt
2000-12-13 09:34 28,672 —-a-w C:\Program Files\autorun.exe
2000-11-05 20:12 9 —-a-w C:\Program Files\cmdline.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-03 21:44 1232152]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-11 12:26:12 576104]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 04:33:46 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-03 21:43]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-03 21:43]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 21:43]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-03 21:43]
.
- - - - ORPHANS REMOVED - - - -

BHO-{27780EF9-91D5-4E8E-B7E3-96FB5F39A74A} - C:\WINDOWS\system32\ljJYOiGv.dll
BHO-{79B94079-F505-455A-8BDC-DC74D1464EB8} - C:\WINDOWS\system32\awtrQGyv.dll
BHO-{7ACA0042-AA71-4630-A58B-3E26B808037E} - C:\WINDOWS\system32\efcASlJB.dll
BHO-{9E1B9B93-18AB-477F-B037-32370C0D9999} - C:\WINDOWS\system32\ddcBSMdd.dll
BHO-{DC902A38-BC5B-4147-AFF3-A874CA907722} - C:\WINDOWS\system32\qoMfcDtu.dll
HKLM-Run-Windows Logon Applicationedc - C:\Documents and Settings\12\winlogon.exe
HKLM-Run-BMeb3398a5 - C:\WINDOWS\system32\sdfhddra.dll
Notify-byXNddca - byXNddca.dll
Notify-WgaLogon - (no file)


.
——- Supplementary Scan ——-
.
R0 -: HKLM-Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

O16 -: DirectAnimation Java Classes - file://C:\WINDOWS\Java\classes\dajava.cab
C:\WINDOWS\Downloaded Program Files\DirectAnimation Java Classes.osd

O16 -: Microsoft XML Parser for Java - file://C:\WINDOWS\Java\classes\xmldso.cab
C:\WINDOWS\Downloaded Program Files\Microsoft XML Parser for Java.osd


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-30 19:39:01
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\SYSTEM32\wscntfy.exe
C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\SYSTEM32\imapi.exe
.
**************************************************************************
.
Completion time: 2008-07-30 19:44:22 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-31 00:43:49

Pre-Run: 28,777,881,600 bytes free
Post-Run: 28,722,253,824 bytes free

269 — E O F — 2008-07-14 04:01:37




Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:58:19 PM, on 7/30/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1211001649165
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1212068352018
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 6972 bytes

As you requested….

ComboFix 08-07-29.1 - sdfh 2008-07-31 8:34:25.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.111 [GMT -5:00]
Running from: C:\Documents and Settings\[removed]\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\sdfh\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

FILE ::
C:\sqmdata00.sqm
C:\sqmdata01.sqm
C:\sqmdata02.sqm
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmnoopt00.sqm
C:\sqmnoopt01.sqm
C:\sqmnoopt02.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt05.sqm
C:\sqmnoopt06.sqm
C:\Temp\btxv15
C:\Temp\epr1
C:\Temp\stmpv4
C:\Temp\zpv201
C:\WINDOWS\SYSTEM32\aumsDK18
C:\WINDOWS\SYSTEM32\mqccltpv.ini
C:\WINDOWS\SYSTEM32\olixds18
C:\WINDOWS\SYSTEM32\wnkyjycs.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\sqmdata00.sqm
C:\sqmdata01.sqm
C:\sqmdata02.sqm
C:\sqmdata03.sqm
C:\sqmdata04.sqm
C:\sqmdata05.sqm
C:\sqmdata06.sqm
C:\sqmnoopt00.sqm
C:\sqmnoopt01.sqm
C:\sqmnoopt02.sqm
C:\sqmnoopt03.sqm
C:\sqmnoopt04.sqm
C:\sqmnoopt05.sqm
C:\sqmnoopt06.sqm
C:\WINDOWS\SYSTEM32\mqccltpv.ini
C:\WINDOWS\SYSTEM32\wnkyjycs.ini

.
((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-31 )))))))))))))))))))))))))))))))
.

2008-07-29 15:06 . 2008-07-29 15:06 d——– C:\Documents and Settings\sdfh\Application Data\Malwarebytes
2008-07-29 15:05 . 2008-07-29 15:06 d——– C:\Program Files\Malwarebytes' Anti-Malware
2008-07-29 15:05 . 2008-07-29 15:05 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Malwarebytes
2008-07-29 15:05 . 2008-07-23 20:09 38,472 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbamswissarmy.sys
2008-07-29 15:05 . 2008-07-23 20:09 17,144 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\mbam.sys
2008-07-29 11:54 . 2008-07-29 11:55 d——– C:\Program Files\hijackjthis
2008-07-23 22:43 . 2008-07-23 22:43 d——– C:\Temp\epr1
2008-07-22 00:10 . 2008-07-22 00:10 dr-h—– C:\Documents and Settings\sdfh\Application Data\yahoo!
2008-07-22 00:09 . 2008-07-22 12:30 d——– C:\Documents and Settings\sdfh\Application Data\AVGTOOLBAR
2008-07-22 00:05 . 2008-07-22 00:05 d——– C:\Documents and Settings\sdfh
2008-07-21 23:05 . 2008-07-21 23:05 0 –a—— C:\WINDOWS\nsreg.dat
2008-07-21 20:31 . 2008-07-21 20:31 d——– C:\Program Files\Trend Micro
2008-07-21 20:28 . 2008-07-21 20:28 d——– C:\Deckard
2008-07-20 20:28 . 2008-07-22 00:46 d——– C:\WINDOWS\SYSTEM32\carH18
2008-07-20 20:28 . 2008-07-20 20:28 d——– C:\Temp\btxv15
2008-07-16 12:03 . 2008-07-18 13:31 d——– C:\WINDOWS\SYSTEM32\aumsDK18
2008-07-16 12:03 . 2008-07-16 12:03 d——– C:\Temp\zpv201
2008-07-13 14:56 . 2007-12-24 17:37 138,384 –a—— C:\WINDOWS\SYSTEM32\DRIVERS\tmcomm.sys
2008-07-12 23:36 . 2008-07-12 23:40 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Lavasoft
2008-07-12 22:05 . 2008-07-12 22:05 95 –a—— C:\WINDOWS\wininit.ini
2008-07-12 13:22 . 2008-07-16 17:05 d——– C:\Program Files\Spybot - Search & Destroy
2008-07-12 13:22 . 2008-07-16 17:04 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-07-12 12:46 . 2008-07-12 12:46 dr-h—– C:\Documents and Settings\April\Application Data\yahoo!
2008-07-12 02:25 . 2008-07-12 12:47 d——– C:\Documents and Settings\All Users.WINDOWS\SonicStage
2008-07-12 01:10 . 2005-10-31 10:46 36,679 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMD052.sys
2008-07-12 01:09 . 2007-01-13 08:24 770,048 –a—— C:\WINDOWS\SYSTEM32\CDDBUISony.dll
2008-07-12 01:09 . 2007-01-13 08:22 655,360 –a—— C:\WINDOWS\SYSTEM32\CDDBControlSony.dll
2008-07-12 01:09 . 2007-01-13 08:22 589,824 –a—— C:\WINDOWS\SYSTEM32\CddbMusicIDSony.dll
2008-07-12 01:09 . 2007-01-13 08:25 532,480 –a—— C:\WINDOWS\SYSTEM32\CddbPlaylist2Sony.dll
2008-07-12 01:09 . 2007-01-13 08:24 73,728 –a—— C:\WINDOWS\SYSTEM32\CddbLinkSony.dll
2008-07-12 01:07 . 2008-07-12 01:07 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Sony Corporation
2008-07-12 01:02 . 2008-07-12 01:03 d——– C:\Program Files\Common Files\Sony Shared
2008-07-11 23:48 . 2008-07-12 12:46 d——– C:\Program Files\Sony
2008-07-11 23:48 . 2001-09-13 02:15 90,112 ——— C:\WINDOWS\snymsico.dll
2008-07-11 23:48 . 2002-08-08 15:51 38,951 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMDUSB.sys
2008-07-11 23:48 . 2003-11-10 12:31 36,232 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMD033.sys
2008-07-11 23:48 . 2003-04-01 18:55 35,319 ——— C:\WINDOWS\SYSTEM32\DRIVERS\NETMD031.sys
2008-07-11 21:16 . 2008-07-12 12:45 d——– C:\Documents and Settings\April\Application Data\AVGTOOLBAR
2008-07-11 18:16 . 2008-07-21 20:52 d——– C:\Documents and Settings\April
2008-07-11 03:21 . 2008-07-31 00:20 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2008-07-11 03:20 . 2008-07-13 20:27 d——– C:\Program Files\Google
2008-07-10 15:19 . 2008-07-10 15:19 1,386 –a—— C:\WINDOWS\SYSTEM32\iwhpmnvx.dll
2008-07-07 23:32 . 2008-07-13 20:21 d——– C:\WINDOWS\SYSTEM32\olixds18
2008-07-07 23:32 . 2008-07-07 23:32 d——– C:\Temp\stmpv4
2008-07-07 23:32 . 2008-07-24 12:58 d——– C:\Temp
2008-06-29 14:34 . 2008-07-08 17:25 d——– C:\Program Files\Full Tilt Poker
2008-06-25 03:01 . 2008-06-25 03:01 d——– C:\Program Files\MSXML 4.0
2008-06-24 15:54 . 2008-07-16 15:00 54,156 –ah—– C:\WINDOWS\QTFont.qfn
2008-06-24 15:54 . 2008-06-24 15:54 1,409 –a—— C:\WINDOWS\QTFont.for
2008-06-24 15:48 . 2008-07-31 00:12 28,960 –a—— C:\logfile
2008-06-24 15:35 . 2008-06-24 15:36 d——– C:\Program Files\QuickTime
2008-06-24 15:35 . 2008-06-24 15:35 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Apple Computer
2008-06-24 15:33 . 2008-06-24 15:33 d——– C:\Program Files\Common Files\Kodak
2008-06-24 15:33 . 2004-08-04 02:56 159,232 –a—— C:\WINDOWS\SYSTEM32\ptpusd.dll
2008-06-24 15:33 . 2001-08-17 22:36 5,632 –a—— C:\WINDOWS\SYSTEM32\ptpusb.dll
2008-06-24 15:30 . 2008-06-24 15:34 d——– C:\Program Files\Kodak
2008-06-24 15:28 . 2008-06-24 15:37 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kodak
2008-06-20 23:40 . 2008-06-20 23:40 0 –a—— C:\WINDOWS\iPlayer.INI
2008-06-20 23:36 . 2008-07-12 12:48 d——– C:\Program Files\InterActual
2008-06-20 12:41 . 2008-06-20 12:41 245,248 —–c— C:\WINDOWS\SYSTEM32\dllcache\mswsock.dll
2008-06-20 05:44 . 2008-06-20 05:44 138,368 —–c— C:\WINDOWS\SYSTEM32\dllcache\afd.sys
2008-06-13 04:08 . 2008-06-24 15:34 d—-c— C:\WINDOWS\SYSTEM32\DRVSTORE
2008-06-13 04:01 . 2008-07-12 12:48 d——– C:\Program Files\Windows Live
2008-06-13 04:01 . 2008-06-13 04:06 d–hsc— C:\Program Files\Common Files\WindowsLiveInstaller
2008-06-13 04:01 . 2008-06-13 04:01 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\WLInstaller
2008-06-10 17:59 . 2008-06-13 08:10 272,128 —–c— C:\WINDOWS\SYSTEM32\dllcache\bthport.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 16:52 ——— d—–w C:\Program Files\LimeWire
2008-07-22 04:35 ——— d—–w C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-07-21 01:41 ——— d—–w C:\Program Files\Java
2008-07-12 17:47 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-12 06:07 ——— d—–w C:\Program Files\Common Files\InstallShield
2008-07-04 02:43 96,520 —-a-w C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-04 02:43 76,040 —-a-w C:\WINDOWS\system32\drivers\avgtdix.sys
2008-07-04 02:43 10,520 —-a-w C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-06-20 17:41 245,248 —-a-w C:\WINDOWS\SYSTEM32\mswsock.dll
2008-06-20 10:45 360,320 —-a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 —-a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 —-a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-15 19:56 ——— d—–w C:\Program Files\Yahoo!
2008-06-13 13:10 272,128 ——w C:\WINDOWS\system32\drivers\bthport.sys
2008-05-30 08:01 ——— d—–w C:\Program Files\Microsoft CAPICOM 2.1.0.2
2008-05-07 05:18 1,287,680 —-a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-04-23 04:16 826,368 —-a-w C:\WINDOWS\SYSTEM32\wininet.dll
2005-12-30 00:04 0 —-a-w C:\Program Files\test.tmp
2005-12-30 00:04 0 —-a-w C:\Program Files\Common Files\test.tmp
2005-12-09 02:44 266 –sh–w C:\Program Files\desktop.ini
2005-12-09 02:44 11,079 —ha-w C:\Program Files\folder.htt
2001-03-12 13:42 2,441,216 —-a-w C:\Program Files\Ihra.exe
2001-02-26 12:54 9,492 —-a-w C:\Program Files\Readme.txt
2001-02-15 12:19 7,956 —-a-w C:\Program Files\Multiplayer.txt
2001-02-13 09:31 3,637 —-a-w C:\Program Files\Custom Paint and Wheels.txt
2000-12-13 09:34 28,672 —-a-w C:\Program Files\autorun.exe
2000-11-05 20:12 9 —-a-w C:\Program Files\cmdline.txt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-03 21:44 1232152]
"LogitechCommunicationsManager"="C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2007-10-25 16:33 563984]
"LogitechQuickCamRibbon"="C:\Program Files\Logitech\QuickCam\Quickcam.exe" [2007-10-25 16:37 2178832]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-06-29 06:24 286720]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Bluetooth.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-09-11 12:26:12 576104]
Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2007-09-19 04:33:46 282624]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program Files\\AVG\\AVG8\\avgemc.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=

R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-03 21:43]
R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-03 21:43]
R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-03 21:43]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-03 21:43]
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-31 08:41:49
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


C:\DOCUME~1\sdfh\LOCALS~1\Temp\8fa91c70-9a1a-4366-a573-99e10eeadc68.tmp 0 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
———————— Other Running Processes ————————
.
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\logishrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\logishrd\LVCOMSER\LVComSer.exe
C:\Program Files\Common Files\logishrd\LQCVFX\COCIManager.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-31 8:49:07 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-31 13:48:40
ComboFix2.txt 2008-07-31 00:44:25

Pre-Run: 29,066,256,384 bytes free
Post-Run: 29,071,921,152 bytes free

209 — E O F — 2008-07-14 04:01:37


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:51:53 AM, on 7/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\AVG\AVG8\avgupd.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - Cmdmapping - (no file) (HKCU)
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1211001649165
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1212068352018
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 7119 bytes

PC seems to be running great!! This was the first time in a while that when I rebooted and started windows, I did not get an AVG resident shield alert Last 3 times it said trojan horse vundo.AD … But, this time no problems…YOU ROCK


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:15:05 AM, on 7/31/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Logitech\QuickCam\Quickcam.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Common Files\Logishrd\LQCVFX\COCIManager.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\PROGRA~1\AVG\AVG8\avgupd.exe

O2 - BHO: AVG Safe Search - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [LogitechCommunicationsManager] "C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe"
O4 - HKLM\..\Run: [LogitechQuickCamRibbon] "C:\Program Files\Logitech\QuickCam\Quickcam.exe" /hide
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Bluetooth.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photo.walgreens.com/WalgreensActivia.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd…b?1211001649165
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu…b?1212068352018
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe

–
End of file - 6095 bytes

Hi djchucke77

YOU ROCK

Thanks for that
FIRST:
do this

[external image: Posted Image]

NEXT

If your happy, I am happy

I see that your log is clean. You did great cleaning it up,
pat yourself on the back.
As I said there would be more …..here
this is my canned all clean speech.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

Note you may have some of theses programs allready, if so just a reminder to keep updated.

FIRST:
You need to create a new Clean restore point.

Note: This will remove all previous Restore Points

Turn off System Restore:

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.

Restart your computer, turn it back on.

On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Remove the Check Turn off System Restore.
Click Apply, and then click OK.

Double-click My Computer.
Click the Tools menu, and then click Folder Options.
Click the View tab.
Check "Hide file extensions for known file types."
Under the "Hidden files" folder, Uncheck "Show hidden files and folders."
Check "Hide protected operating system files."
Click Apply, and then click OK.
===================================================================
NEXT:
Make your Internet Explorer more secure - This can be done by following these simple instructions:

1. From within Internet Explorer click on the Tools menu and then click on Options.
2. Click once on the Security tab
3. Click once on the Internet icon so it becomes highlighted.
4. Click once on the Custom Level button.

1. Change the Download signed ActiveX controls to Prompt
2. Change theDownload unsigned ActiveX controls to Disable
3. Change the Initialise and script ActiveX controls not marked as safe to Disable
4. Change the Installation of desktop items to Prompt
5. Change the Launching programs and files in an IFRAME to Prompt
6. Change the Navigate sub-frames across different domains to Prompt
7. When all these settings have been made, click on the OK button.
8. If it prompts you as to whether or not you want to save the settings, press the Yes button.

Next press the Apply button and then the OK to exit the Internet Properties page.
====================================================================

Use an Anti Virus Software
It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See these links for a listing of some on line & their stand-alone anti virus programs:
If you don't have one here are some of the better AV products.

Symantec/Norton Antivirus: http://www.symantec.com/nav/nav_9xnt/
Kapersky AV: http://www.kaspersky.com/buyonline.html?info=25
Nod32 : http://www.nod32.com/home/home.htm
Panda AV: http://www.pandasoftware.com/
McAfee Virusscan: http://us.mcafee.com/root/package.asp?pkgid=100
AVG Anti-Virus (Free version available) http://www.grisoft.com/

Update your Anti Virus Software - It is imperitive that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.
============================================================
NEXT:

Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly.
If you don't have one see link below for a free firewall:

ZoneAlarm:
http://www.zonelabs.com/store/content/cata….jsp?lid=nav_za

Sunbelt Kerio:
http://www.sunbelt-software.com/Kerio.cfm

OutPost:
http://www.agnitum.com/products/outpostfree/download.php
================================================================================

Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option.

This will provide real-time spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an anti virus software

Get the download and tutorial for Spybot S&D here:
http://www.bleepingcomputer.com/tutorials/tutorial43.html
=========================================================================


Install SpywareBlaster
SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs. A article on anti-malware products with links for this program and others can be found here:

http://www.javacoolsoftware.com/spywareblaster.html
========================================================================

Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.
Happy surfing the net

I only ask one thing….please
Please post back and let us know what you think about our forum, we are all volunteers and would like a little smile.

Good luck and happy net surfing
Mschroe919