After running tools like ComboFix, Smitfraud Fix, DSS, ATF Cleaner and Malwarebytes I finally no longer had all the uncontrolled browser windows popping up and the anti virus 2008 and 2009 messages. However, I also seem to have lost IE Explorer. I can still use Maxthon however.

Here is the latest HiJack This log for where I am presently at:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:06:59, on 2008-07-31
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
f:\PROGRA~1\POPFile\popfileib.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
f:\Program Files\FaxTalk Messenger Pro 7.0\FAPIEXE.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGR32.exe
C:\Program Files\Maxthon\Maxthon.exe
C:\PROGRA~1\AVG\AVG8\avgscanx.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul…rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {2e0f1d95-7bc8-4bea-8da5-8cc28c8b15b9} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [FaxTalk Messenger Pro 7.0] "F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [FaxTalk CallControl 7.0] "f:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\S-1-5-21-57989841-789336058-1957994488-1003\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
O4 - HKUS\S-1-5-18\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User '?')
O4 - HKUS\.DEFAULT\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" (User 'Default user')
O4 - S-1-5-21-57989841-789336058-1957994488-1003 Startup: Run POPFile.lnk = F:\Program Files\POPFile\runpopfile.exe (User '?')
O4 - .DEFAULT User Startup: Run POPFile.lnk = D:\Program Files\POPFile\runpopfile.exe (User 'Default user')
O4 - Startup: Run POPFile.lnk = F:\Program Files\POPFile\runpopfile.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html
O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FaxTalk Messenger Pro 7.0 - Thought Communications, Inc. - f:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe

–
End of file - 11078 bytes

—————————————————————————————————————–

Here are the other logs:

SmitFraudFix v2.332

Scan done at 12:29:33.40, 2008-07-30
Run from C:\Documents and Settings\JK.NS2\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files


»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll


»»»»»»»»»»»»»»»»»»»»»»»» End


ComboFix 08-07-29.1 - JK 2008-07-29 21:51:03.1 - NTFSx86

Running from: C:\ComboFix.exe
Command switches used :: /killall

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\JK.NS2\Application Data\macromedia\Flash Player\#SharedObjects\4V73UWNX\interclick.com
C:\Documents and Settings\JK.NS2\Application Data\macromedia\Flash Player\#SharedObjects\4V73UWNX\interclick.com\ud.sol
C:\Documents and Settings\JK.NS2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\JK.NS2\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\NetMon
C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService.NT AUTHORITY.000\Application Data\NetMon\log.txt
C:\Program Files\network monitor
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\WINDOWS\BM1be46cde.xml
C:\WINDOWS\cookies.ini
C:\WINDOWS\mrofinu572.exe.tmp
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\atmtd.dll
C:\WINDOWS\system32\atmtd.dll._
C:\WINDOWS\system32\awtqnolK.dll
C:\WINDOWS\system32\byXOeDVp.dll
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\cbXNGyAr.dll
C:\WINDOWS\system32\crack.exe
C:\WINDOWS\system32\ddcArrqQ.dll
C:\WINDOWS\system32\efcARklM.dll
C:\WINDOWS\system32\efcBqomk.dll
C:\WINDOWS\system32\efcYPfCu.dll
C:\WINDOWS\system32\fccaXoNG.dll
C:\WINDOWS\system32\gjjmsmmikh.dll
C:\WINDOWS\system32\jkkkhFxy.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\ncaqinvq.ini
C:\WINDOWS\system32\pnullxgs.ini
C:\WINDOWS\system32\rqRIxyxU.dll
C:\WINDOWS\system32\urqoNhIB.dll
C:\WINDOWS\system32\urqpQHAr.dll
C:\WINDOWS\system32\UxyxIRqr.ini
C:\WINDOWS\system32\UxyxIRqr.ini2
C:\WINDOWS\system32\yayxUOFV.dll
C:\WINDOWS\TlMy\
C:\WINDOWS\TlMy\\n5gV.vbs
C:\WINDOWS\uninstall_nmon.vbs
C:\WINDOWS\winhelp.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

——-\Legacy_CMDSERVICE
——-\Legacy_NETWORK_MONITOR
——-\Service_cmdService
——-\Service_Network Monitor


((((((((((((((((((((((((( Files Created from 2008-06-28 to 2008-07-30 )))))))))))))))))))))))))))))))
.

2008-07-29 22:13 . 2008-07-29 22:13 294 —hs—- C:\WINDOWS\system32\pnullxgs.ini
2008-07-29 21:46 . 2008-07-29 21:46 2,666,409 –a—— C:\ComboFix.exe
2008-07-29 13:42 . 2008-07-29 18:07 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-07-29 08:46 . 2008-07-29 08:46 46,605 –a—— C:\Documents and Settings\JK.NS2\win.exe
2008-07-29 02:29 . 2008-07-29 04:46 d——– C:\WINDOWS\system32\drivers\Avg
2008-07-29 02:29 . 2008-07-29 02:29 d——– C:\Program Files\AVG
2008-07-29 02:29 . 2008-07-29 02:29 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\avg8
2008-07-29 02:29 . 2008-07-29 02:29 96,520 –a—— C:\WINDOWS\system32\drivers\avgldx86.sys
2008-07-28 22:39 . 2008-07-29 03:22 d–h—– C:\$AVG8.VAULT$
2008-07-28 22:35 . 2008-07-28 22:34 105,472 –a—— C:\WINDOWS\system32\jxpgpp.dll
2008-07-28 22:34 . 2008-07-28 22:34 105,472 –a—— C:\WINDOWS\system32\ptcrrmpm.dll
2008-07-28 22:32 . 2008-07-28 22:32 91,648 –a—— C:\WINDOWS\system32\pqajybbo.dll
2008-07-28 22:32 . 2008-07-28 22:32 83,456 –a—— C:\WINDOWS\system32\sgxllunp.dll
2008-07-28 22:29 . 2008-07-28 22:29 10,520 –a—— C:\WINDOWS\system32\avgrsstx.dll
2008-07-28 19:46 . 2008-07-28 19:46 105,472 –a—— C:\WINDOWS\system32\vgtposvl.dll
2008-07-28 19:46 . 2008-07-28 19:46 105,472 –a—— C:\WINDOWS\system32\uspdha.dll
2008-07-28 19:45 . 2008-07-28 19:45 91,648 –a—— C:\WINDOWS\system32\mxgiltue.dll
2008-07-28 13:43 . 2008-07-28 13:43 294 –ahs—- C:\WINDOWS\system32\bhhmsmlh.ini
2008-07-28 13:37 . 2008-07-28 13:37 d——– C:\WINDOWS\system32\on3
2008-07-28 13:37 . 2008-07-29 03:22 d——– C:\WINDOWS\system32\ept
2008-07-28 13:37 . 2008-07-28 13:37 d——– C:\Temp\epr1
2008-07-28 13:37 . 2008-07-29 21:51 d——– C:\Temp
2008-07-28 13:37 . 2008-07-28 13:37 64,841 –a—— C:\WINDOWS\system32\rwenargezdyovur.exe
2008-07-28 12:23 . 2004-08-10 06:00 13,463,552 –a–c— C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-07-28 12:22 . 2004-08-10 06:00 2,134,528 –a–c— C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-07-28 12:21 . 2003-03-24 16:52 20,540 –a–c— C:\WINDOWS\system32\dllcache\admin.dll
2008-07-28 01:58 . 2004-08-03 22:31 20,992 –a—— C:\WINDOWS\system32\drivers\RTL8139.sys
2008-07-28 01:48 . 2004-08-04 06:00 1,086,058 -ra—— C:\WINDOWS\SET35.tmp
2008-07-28 01:48 . 2004-08-04 06:00 1,042,903 -ra—— C:\WINDOWS\SET31.tmp
2008-07-28 01:48 . 2004-08-04 06:00 24,661 –a—— C:\WINDOWS\system32\spxcoins.dll
2008-07-28 01:48 . 2004-08-04 06:00 24,661 –a–c— C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-07-28 01:48 . 2004-08-04 06:00 13,753 -ra—— C:\WINDOWS\SET41.tmp
2008-07-28 01:48 . 2004-08-04 06:00 13,312 –a—— C:\WINDOWS\system32\irclass.dll
2008-07-28 01:48 . 2004-08-04 06:00 13,312 –a–c— C:\WINDOWS\system32\dllcache\irclass.dll
2008-07-24 00:34 . 2001-04-11 13:03 401,484 –a—— C:\WINDOWS\system32\Msvcrtd.dll
2008-07-24 00:34 . 2001-04-11 13:02 322,832 –a—— C:\WINDOWS\system32\Mfc30.dll
2008-07-24 00:34 . 2001-04-11 13:02 212,480 –a—— C:\WINDOWS\Pcdlib32.dll
2008-07-24 00:34 . 2001-04-11 13:03 210,944 –a—— C:\WINDOWS\system32\Msvcrt10.dll
2008-07-24 00:34 . 2001-04-11 13:03 133,904 –a—— C:\WINDOWS\system32\Mfcans32.dll
2008-07-24 00:34 . 2001-04-11 13:03 133,392 –a—— C:\WINDOWS\system32\Mfco30.dll
2008-07-24 00:34 . 2001-04-11 13:03 94,285 –a—— C:\WINDOWS\system32\Msvcirtd.dll
2008-07-24 00:34 . 2001-04-11 13:02 32,792 –a—— C:\WINDOWS\Spwhpt.dll
2008-07-24 00:34 . 2001-04-11 13:03 6,144 –a—— C:\WINDOWS\system32\W95fiber.dll
2008-07-24 00:34 . 2001-04-11 13:03 5,632 –a—— C:\WINDOWS\system32\Mfcuia32.dll
2008-07-24 00:33 . 2008-07-24 00:36 d——– C:\WINDOWS\system32\Color
2008-07-24 00:33 . 2008-07-24 00:33 d——– C:\Kpcms
2008-07-24 00:29 . 1998-10-02 19:00 327,168 –a—— C:\WINDOWS\IsUninst.exe
2008-07-23 23:32 . 2008-07-23 23:32 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\FLEXnet
2008-07-23 23:22 . 2008-07-23 23:22 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\ALM
2008-07-23 23:20 . 2008-07-23 23:20 d——– C:\Program Files\Bonjour
2008-07-23 23:02 . 2008-07-23 23:02 d——– C:\Program Files\Common Files\Macrovision Shared
2008-07-23 17:49 . 2007-07-02 06:46 364,544 -ra—— C:\WINDOWS\system32\hppldcoi.dll
2008-07-23 17:49 . 2007-07-02 06:46 309,760 -ra—— C:\WINDOWS\system32\difxapi.dll
2008-07-23 17:49 . 2004-08-03 22:58 207,360 –a—— C:\WINDOWS\system32\drivers\Dot4.sys
2008-07-23 17:49 . 2001-08-17 13:47 23,808 –a—— C:\WINDOWS\system32\drivers\Dot4usb.sys
2008-07-23 17:49 . 2007-07-02 06:46 16,800 -ra—— C:\WINDOWS\system32\drivers\Hppaufd0.sys
2008-07-23 08:37 . 2008-07-26 20:47 d——– C:\Documents and Settings\JK.NS2\Application Data\Yahoo!
2008-07-23 08:26 . 2008-07-26 20:47 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo!
2008-07-23 08:24 . 2008-07-26 20:47 d——– C:\Program Files\Yahoo!
2008-07-21 14:53 . 2008-07-21 14:53 d—s—- C:\Documents and Settings\JK.NS2\UserData
2008-07-20 13:18 . 2008-07-20 13:18 d——– C:\Program Files\Siber Systems
2008-07-20 13:17 . 2008-07-20 14:13 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\RoboForm
2008-07-20 13:06 . 2008-07-20 13:06 d——– C:\Program Files\uTorrent
2008-07-20 13:06 . 2008-07-24 00:50 d——– C:\Documents and Settings\JK.NS2\Application Data\uTorrent
2008-07-17 21:52 . 2008-07-17 21:52 d——– C:\WINDOWS\Adobe Illustrator CS
2008-07-17 09:54 . 2008-07-17 09:54 d——– C:\Program Files\Common Files\Adobe AIR
2008-07-17 09:49 . 2008-07-17 10:21 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\NOS
2008-07-17 09:48 . 2008-07-17 10:21 d——– C:\Program Files\NOS
2008-07-17 09:47 . 2008-07-17 09:47 d——– C:\Documents and Settings\JK.NS2\Application Data\AdobeUM
2008-07-17 09:44 . 2008-07-17 09:44 d——– C:\Program Files\Common Files\Adobe Systems Shared
2008-07-17 09:44 . 2008-07-17 09:44 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Adobe Systems
2008-07-17 09:09 . 2006-01-04 13:33 16,896 –a—— C:\WINDOWS\system32\ftumn70.dll
2008-07-17 09:05 . 2008-07-17 09:05 d——– C:\Program Files\CONEXANT
2008-07-17 09:05 . 2001-08-17 13:57 16,128 –a—— C:\WINDOWS\system32\drivers\MODEMCSA.sys
2008-07-17 08:40 . 2008-07-17 08:40 d——– C:\Program Files\Common Files\FaxTalk Messenger Pro 7.0
2008-07-17 00:06 . 2008-07-17 00:06 d——– C:\Program Files\Kaspersky Lab
2008-07-17 00:05 . 2008-07-17 00:05 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab Setup Files
2008-07-16 12:15 . 2008-03-26 08:36 24,156 –a—— C:\WINDOWS\olite40.msb
2008-07-16 12:15 . 2008-07-16 12:26 70 –a—— C:\WINDOWS\polite.ini
2008-07-16 11:32 . 2008-07-16 11:32 d–h—– C:\Documents and Settings\JK.NS2\InstallAnywhere
2008-07-16 11:31 . 2008-07-16 11:31 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Hewlett-Packard
2008-07-16 11:31 . 2008-07-16 11:31 3,462 –a—— C:\WINDOWS\hpbvnstp.his
2008-07-16 11:31 . 2008-07-16 11:31 1,318 –a—— C:\WINDOWS\hpbvnstp.ini
2008-07-16 11:30 . 2008-07-23 17:49 d—-c— C:\WINDOWS\system32\DRVSTORE
2008-07-16 11:30 . 2007-01-05 12:07 327,680 –a—— C:\WINDOWS\system32\hppepr02.dll
2008-07-16 11:30 . 2006-09-06 19:42 237,568 –a—— C:\WINDOWS\system32\hppapr02.dll
2008-07-16 11:30 . 2007-01-05 18:07 188,416 –a—— C:\WINDOWS\system32\hppcew02.dll
2008-07-16 11:30 . 2006-04-04 21:19 17,024 –a—— C:\WINDOWS\system32\drivers\hpfxgen.sys
2008-07-16 11:30 . 2006-04-04 21:20 9,344 –a—— C:\WINDOWS\system32\drivers\hpfxbulk.sys
2008-07-16 11:30 . 2006-09-06 19:41 600 –a—— C:\WINDOWS\system32\hppapr02.dat
2008-07-16 10:53 . 2002-07-01 18:30 1,687,625 –a—— C:\WINDOWS\system32\InetClnt.dll
2008-07-16 10:53 . 2000-05-02 11:03 225,280 –a—— C:\WINDOWS\system32\AWRTL30.DLL
2008-07-16 10:53 . 1998-08-04 12:22 111,616 –a—— C:\WINDOWS\system32\LTIH30TB.DLL
2008-07-16 10:52 . 1999-05-10 01:00 1,694,992 –a—— C:\WINDOWS\system32\vba6.dll
2008-07-16 10:52 . 1999-05-07 01:00 1,009,136 –a—— C:\WINDOWS\system32\Mschrt20.ocx
2008-07-16 10:52 . 1998-06-24 00:00 609,584 –a—— C:\WINDOWS\system32\comctl32.ocx
2008-07-16 10:52 . 2002-09-20 09:45 339,968 –a—— C:\WINDOWS\system32\cdintf.dll
2008-07-16 10:52 . 2000-12-06 14:02 209,608 –a—— C:\WINDOWS\system32\TABCTL32.OCX
2008-07-16 10:52 . 2000-05-22 02:00 203,976 –a—— C:\WINDOWS\system32\RICHTX32.OCX
2008-07-16 10:52 . 1996-01-12 01:00 200,704 –a—— C:\WINDOWS\system32\THREED32.OCX
2008-07-16 10:52 . 2000-10-20 02:05 25,088 –a—— C:\WINDOWS\system32\msxml3a.dll
2008-07-15 22:29 . 2004-08-03 22:58 15,104 –a—— C:\WINDOWS\system32\drivers\usbscan.sys
2008-07-14 14:48 . 2008-07-29 09:42 d——– C:\Documents and Settings\All Users.WINDOWS\Application Data\Google Updater
2008-07-14 13:41 . 2001-08-17 13:58 19,200 –a—— C:\WINDOWS\system32\drivers\hidbatt.sys
2008-07-14 13:39 . 2004-08-03 23:07 59,264 –a—— C:\WINDOWS\system32\drivers\USBAUDIO.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-29 19:42 ——— d—–w C:\Program Files\Spybot - Search & Destroy
2008-07-29 08:50 ——— d—–w C:\Program Files\Simple DNS Plus
2008-07-27 02:49 ——— d—–w C:\Program Files\Frey Technologies
2008-07-27 02:49 ——— d—–w C:\Program Files\Common Files\Wise Installation Wizard
2008-07-27 02:47 ——— d—–w C:\Program Files\D-Link AirPlus
2008-07-24 06:33 ——— d—–w C:\Program Files\Common Files\Adobe
2008-07-24 02:50 ——— d–h–w C:\Program Files\InstallShield Installation Information
2008-07-17 15:49 ——— d—–w C:\Program Files\Google
2008-07-17 15:03 86,016 —-a-w C:\WINDOWS\system32\mdmxsdk.dll
2008-07-17 15:03 729,728 —-a-w C:\WINDOWS\system32\drivers\HSF_USR.sys
2008-07-17 15:03 231,168 —-a-w C:\WINDOWS\system32\drivers\USR_BSC2.sys
2008-07-17 15:03 23,599 —-a-w C:\WINDOWS\system32\drivers\usrhsfi.cty
2008-07-17 15:03 13,059 —-a-w C:\WINDOWS\system32\drivers\mdmxsdk.sys
2008-07-17 15:03 110,592 —-a-w C:\WINDOWS\system32\uci100.dll
2008-07-17 15:03 1,035,008 —-a-w C:\WINDOWS\system32\drivers\USR_MDMV.sys
2008-07-16 16:53 ——— d—–w C:\Program Files\Common Files\WexTech Shared
2003-10-09 04:31 192 —-a-w C:\Program Files\INSTALL.LOG
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2e0f1d95-7bc8-4bea-8da5-8cc28c8b15b9}]
2008-07-28 22:34 105472 –a—— C:\WINDOWS\system32\jxpgpp.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 02:06 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-07-14 14:48 68856]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 13:18 160592]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2004-08-10 04:04 59392]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe" [2004-09-28 21:26 32881]
"FaxTalk Messenger Pro 7.0"="F:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe" [2004-12-22 17:04 122880]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2004-12-14 02:12 483328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 02:38 34672]
"FaxTalk CallControl 7.0"="f:\Program Files\FaxTalk Messenger Pro 7.0\FTClCtrl.exe" [2004-12-22 17:04 122880]
"AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-29 02:29 1232152]
"18d75f42"="C:\WINDOWS\system32\sgxllunp.dll" [2008-07-28 22:32 83456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"RoboForm"="C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe" [2008-07-20 13:18 160592]

C:\Documents and Settings\JK.NS2\Start Menu\Programs\Startup\
Run POPFile.lnk - F:\Program Files\POPFile\runpopfile.exe [2008-05-10 08:57:50 71160]

C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-07-17 09:44:09 25214]
QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2004-04-09 13:48:02 651264]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.dvacm"= C:\PROGRA~1\COMMON~1\ULEADS~1\vio\dvacm.acm
"msacm.mpegacm"= mpegacm.acm
"msacm.ulmp3acm"= ulmp3acm.acm

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
.
- - - - ORPHANS REMOVED - - - -

BHO-{42BFABD3-B070-4053-9485-30D7E000D3D3} - (no file)
BHO-{890CB354-034B-4328-9F92-5C5B07F44706} - (no file)
BHO-{f2eaef22-6dfe-2073-c463-524380b48321} - (no file)
HKLM-Run-{34d96e4f-ee0a-98b9-b545-2f3bf14d06f8} - C:\WINDOWS\system32\gjjmsmmikh.dll
Notify-ddcArrqQ - (no file)


.
——- Supplementary Scan ——-
.
R0 -: HKCU-Main,Start Page = about:blank
R0 -: HKCU-Main,Search Page = hxxp://www.google.com
R0 -: HKCU-Main,Search Bar = hxxp://www.google.com/ie
R0 -: HKLM-Main,Default_Search_URL = hxxp://www.google.com/ie
R0 -: HKLM-Main,Search Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 -: HKCU-Internet Settings,ProxyOverride = *.local
R0 -: HKCU-Search,SearchAssistant = hxxp://www.google.com/ie
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
R0 -: HKLM-Search,SearchAssistant = hxxp://www.google.com/ie
O8 -: Convert link target to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert link target to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert selected links to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 -: Convert selected links to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 -: Convert selection to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert selection to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Convert to Adobe PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 -: Convert to existing PDF - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 -: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 -: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html
O8 -: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html
O8 -: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-29 22:12:30
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …


C:\WINDOWS\system32\pnullxgs.ini 294 bytes

scan completed successfully
hidden files: 1

**************************************************************************
.
——————— DLLs Loaded Under Running Processes ———————

PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\sgxllunp.dll
.
———————— Other Running Processes ————————
.
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\ehome\ehRecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
F:\Program Files\FaxTalk Messenger Pro 7.0\FTMSGSVC.EXE
F:\Program Files\FaxTalk Messenger Pro 7.0\FAPIEXE.EXE
C:\WINDOWS\system32\rundll32.exe
F:\PROGRA~1\POPFile\popfileib.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-07-29 22:19:47 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-30 04:19:36

Pre-Run: 9,645,174,784 bytes free
Post-Run: 11,339,468,800 bytes free

294 — E O F — 2008-07-30 04:16:23