Hello everyone!

Recently, I downloaded a program that was actually a virus. I googled for methods to get rid of the malware and I followed instructions on several forums, especially GeekstoGo! However, its been two days and many scans and the malware is still in my computer. Avast keeps giving me a pop up warning about C:\WINDOWS\SVCHOST.EXE as a rootkit. I went into my C:\WINDOWS folder and sure enough there was a svchost exe that wasn't in the system32 subfolder. So I tried numerous times to delete the thing but it would keep returning (along with the avast pop up warning) after a reboot. I have ran combofix, nod32, antivir ve, sophos antirootkit, rootkitrevealer, online scanning bitdefender, avast, mbam, Hijackthis, Spybot, Ad-Aware, ATF cleaner, and CCcleaner many times on normal and safe boot. I used Windows Search, looked through regedit, and checked my msconfig because my computer started loading VERY slowly. I am also getting messages that my explorer.exe is infected with a rootkit too. >_> I have posted a Hijack This log and a MBAM Scan Log with this message. Please help! Thank you for your time.

Sincerely,
Grubub

P.S. Upload of MBAM log successful. Upload of HijackThis Log keeps failing so i will just copy and paste the results below.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:12:18 PM, on 12/18/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16762)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system\explorer.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\OpenDNS Updater\OpenDNS Updater.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\Office10\WINWORD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [imekrmig] C:\IME\IMKR\imekrmig.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: NaturalColorLoad.lnk = C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpenDNS Updater (OpenDNS Updater.exe) - OpenDNS - C:\Program Files\OpenDNS Updater\OpenDNS Updater.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe

--
End of file - 5453 bytes

Hello

Before we begin, you should save these instructions in Notepad to your desktop, or print them, for easy reference. Much of our fix will be done in Safe mode, and you will be unable to access this thread at that time. If you have questions at any point, or are unsure of the instructions, feel free to post here and ask for clarification before proceeding.


Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
  (Report.txt will also be copied to Clipboard ready for posting back on the forum).
• Finally paste the contents of the Report.txt back on the forum.

Wow that was quick Hello Rorscach112, I forgot to mention that I ran SDfix.exe about 4 times in safe boot. It reported in the log that it could not open or delete explorer.exe and i believe it said it deleted svchost.exe. But it didnt..

Can you post the log

I ran SD FIX again because I think I deleted it yesterday after using it, along with the logs.


SDFix: Version 1.240
Run by Owner on Thu 12/18/2008 at 05:06 PM

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\Documents and Settings\Owner.Leonard\Desktop\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\svchost.exe - Deleted


Could Not Remove C:\WINDOWS\system\explorer.exe



Removing Temp Files

ADS Check :



Final Check :

disk not found C:\

please note that you need administrator rights to perform deep scan

Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\Linksys Wireless-G PCI Wireless Network Monitor\\InvokeSvc2.exe"="C:\\Program Files\\Linksys Wireless-G PCI Wireless Network Monitor\\InvokeSvc2.exe:*:Enabled:Wireless Network Monitor"
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Warcraft III\\BNUpdate.exe"="C:\\Program Files\\Warcraft III\\BNUpdate.exe:*:Enabled:BNUpdate"
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"="C:\\Program Files\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\\Program Files\\FrostWire\\FrostWire.exe"="C:\\Program Files\\FrostWire\\FrostWire.exe:*:Enabled:LimeWire"
"C:\\Program Files\\AIM6\\aim6.exe"="C:\\Program Files\\AIM6\\aim6.exe:*:Enabled:AIM"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"="C:\\Program Files\\MSN Messenger\\msnmsgr.exe:*:Enabled:MSN Messenger 7.5"

Remaining Files :

C:\WINDOWS\system\explorer.exe Found

File Backups: - C:\DOCUME~1\OWNER~1.LEO\Desktop\SDFix\backups\backups.zip

Files with Hidden Attributes :

Mon 14 Apr 2008 60,416 A.SH. --- "C:\Program Files\Outlook Express\msimn.exe"
Wed 22 Oct 2008 949,072 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\advcheck.dll"
Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll"
Mon 7 Jul 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon 7 Jul 2008 4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Tue 16 Sep 2008 1,833,296 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Wed 22 Oct 2008 962,896 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\Tools.dll"
Sat 4 Nov 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 2 Nov 2007 0 A.SH. --- "C:\Documents and Settings\All Users\DRM\Cache\Indiv01.tmp"
Mon 12 Feb 2007 3,096,576 A..H. --- "C:\Documents and Settings\Owner.Leonard\Application Data\U3\temp\Launchpad Removal.exe"

Finished!

I just recieved another warning from avast! "Suspiciuos File Found!" 5:18 pm
File name: C:\WINDOWS\system\explorer.exe
Type:Rootkit:hidden process

Available actions: Delete Now or Ignore.

Hello

Download ComboFix from one of these locations:

Link 1
Link 2
Link 3


* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

ComboFix 08-12-18.01 - Owner 2008-12-18 17:28:20.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1449 [GMT -8:00]
Running from: c:\documents and settings\Owner.Leonard\Desktop\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\svchost.exe
c:\windows\system\explorer.exe

c:\windows\explorer.exe . . . is infected!!

.
((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-18 16:59 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix
2008-12-17 23:44 . 2008-12-18 00:36 <DIR> d-------- c:\windows\BDOSCAN8
2008-12-17 22:37 . 2008-12-17 22:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-12-17 15:29 . 2008-12-18 00:43 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-17 15:29 . 2008-12-18 00:43 <DIR> d-------- c:\documents and settings\Owner.Leonard\Application Data\SUPERAntiSpyware.com
2008-12-16 21:42 . 2008-12-16 21:30 23,552 --a------ c:\windows\system32\drivers\phooks.sys
2008-12-16 21:00 . 2005-09-09 13:51 176,128 --a------ c:\windows\system32\nvunrm.exe
2008-12-16 21:00 . 2005-07-29 17:10 100,480 --a------ c:\windows\system32\drivers\nvtcp.sys
2008-12-16 21:00 . 2005-06-03 17:01 3,632 --a------ c:\windows\system32\nvnrm.nvu
2008-12-16 16:59 . 2008-12-16 17:01 5,529,971 --a------ c:\windows\system32\LRKG
2008-12-15 22:04 . 2008-12-15 22:34 <DIR> d-------- c:\program files\Unlocker
2008-12-15 21:06 . 2008-12-15 21:06 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-15 21:06 . 2008-12-15 21:06 <DIR> d-------- c:\documents and settings\Owner.Leonard\Application Data\Malwarebytes
2008-12-15 21:06 . 2008-12-15 21:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-15 21:06 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-15 21:06 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-15 21:05 . 2008-12-15 21:05 <DIR> d-------- c:\program files\Trend Micro
2008-12-14 21:57 . 2008-12-14 21:57 <DIR> d-------- c:\program files\Sophos
2008-12-07 13:30 . 2008-12-07 13:30 <DIR> d-------- c:\documents and settings\Owner.Leonard\Application Data\Nexon
2008-12-07 13:04 . 2008-12-07 20:07 <DIR> d-------- C:\Nexon
2008-12-06 23:37 . 2008-12-06 23:37 <DIR> d-------- c:\program files\OpenDNS Updater
2008-12-05 19:33 . 2008-12-05 19:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\OpenDNS Updater
2008-11-30 11:27 . 2008-11-30 11:28 <DIR> d-------- c:\windows\ERUNT
2008-11-30 11:26 . 2008-11-30 11:26 <DIR> d-------- c:\documents and settings\Owner.Leonard\backups
2008-11-30 11:26 . 2008-11-30 11:26 <DIR> d-------- c:\documents and settings\Owner.Leonard\backupreg
2008-11-30 11:26 . 2008-04-14 04:42 146,432 --a------ c:\documents and settings\Owner.Leonard\editreg.exe
2008-11-30 11:26 . 2008-04-14 04:42 27,136 --a------ c:\documents and settings\Owner.Leonard\rtsdnif.exe
2008-11-30 11:26 . 2008-04-14 04:42 12,288 --a------ c:\documents and settings\Owner.Leonard\attrib.exe
2008-11-30 11:26 . 2004-08-10 11:00 9,216 --a------ c:\documents and settings\Owner.Leonard\dnif.exe
2008-11-23 23:32 . 2008-12-16 20:45 142,096 --a------ c:\windows\system32\drivers\tmcomm.sys
2008-11-23 23:31 . 2008-11-24 17:49 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-23 23:31 . 2008-11-23 23:33 <DIR> d-------- c:\documents and settings\Owner.Leonard\.housecall6.6
2008-11-23 23:31 . 2008-12-18 01:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-23 20:16 . 2008-11-23 20:17 <DIR> d-------- c:\program files\iTunes
2008-11-23 20:16 . 2008-11-23 20:16 <DIR> d-------- c:\program files\iPod
2008-11-23 20:16 . 2008-11-23 20:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-19 01:25 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\SiteAdvisor
2008-12-18 08:43 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-18 06:51 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-17 23:44 --------- d-----w c:\program files\Warcraft III
2008-12-17 05:06 --------- d-----w c:\program files\SpywareBlaster
2008-12-16 05:39 0 ----a-w c:\windows\Fonts\Argentine.ttf
2008-12-13 06:21 --------- d-----w c:\program files\SpeedFan
2008-12-12 07:16 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\FrostWire
2008-12-12 07:12 --------- d-----w c:\program files\FrostWire
2008-11-30 06:09 --------- d-----w c:\program files\Steam
2008-11-29 07:54 --------- d-----w c:\program files\Viewpoint
2008-11-29 07:54 --------- d-----w c:\program files\AIM6
2008-11-29 07:54 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-25 03:01 --------- d-----w c:\program files\Common Files\Adobe
2008-11-24 04:16 --------- d-----w c:\program files\Common Files\Apple
2008-11-24 04:15 --------- d-----w c:\program files\QuickTime
2008-11-23 06:48 --------- d-----w c:\program files\Safari
2008-11-19 05:17 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 05:17 --------- d-----w c:\program files\NetClient
2008-11-11 20:51 25,952 ----a-w c:\windows\system32\drivers\wnsdrvr.sys
2008-11-11 19:34 --------- d-----w c:\program files\BitPim
2008-11-05 23:46 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\CyberLink
2008-10-26 19:12 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\LimeWire
2008-10-26 02:29 --------- d-----w c:\program files\Java
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 02:01 --------- d-----w c:\program files\Windows Live Safety Center
2008-09-19 01:22 39,592 -c--a-w c:\documents and settings\Owner.Leonard\Application Data\GDIPFONTCACHEV1.DAT
2008-01-16 07:35 304 -c--a-w c:\documents and settings\Owner.Leonard\Application Data\wklnhst.dat
2008-05-14 00:46 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051320080514\index.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"imekrmig"="c:\ime\IMKR\imekrmig.exe" [2001-01-09 44544]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

c:\documents and settings\Owner.Leonard\Start Menu\Programs\Startup\
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2008-11-30 155715]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"WMP54Gv4SVC"=2 (0x2)
"helpsvc"=2 (0x2)
"CiSvc"=3 (0x3)
"mnmsrvc"=3 (0x3)
"lanmanserver"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"PrismXL"=2 (0x2)
"SharedAccess"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Linksys Wireless-G PCI Wireless Network Monitor\\InvokeSvc2.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Warcraft III\\BNUpdate.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:UDP"= 6112:UDP:UDP
"6112:TCP"= 6112:TCP:TCP
"6110:TCP"= 6110:TCP:Battlenet1
"6113:TCP"= 6113:TCP:Battlenet2
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 phooks;phooks;c:\windows\system32\drivers\phooks.sys [2008-12-16 23552]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-24 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-06-24 20560]
R2 OpenDNS Updater.exe;OpenDNS Updater;c:\program files\OpenDNS Updater\OpenDNS Updater.exe --run []
S0 daefd;daefd;c:\windows\system32\drivers\tezwmy.sys []
S0 dlvi;dlvi;c:\windows\system32\drivers\sitrs.sys []
S3 ASPI;Advanced SCSI Programming Interface Driver;\??\c:\windows\System32\DRIVERS\ASPI32.sys [2008-05-04 16512]
S3 MEMSWEEP2;MEMSWEEP2;\??\c:\windows\system32\1.tmp []
S3 rkhdrv40;Rootkit Unhooker Driver; []
S3 WnsDrvr;WnsDrvr;c:\windows\system32\drivers\WnsDrvr.sys [2008-11-11 25952]
S4 SNGYNRUP;SNGYNRUP;c:\docume~1\OWNER~1.LEO\LOCALS~1\Temp\SNGYNRUP.exe []
S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2008-11-28 24652]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2d0edb01-510b-11db-b967-806d6172696f}]
\Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe folder.htt 480 480

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{df1cfb6c-6030-11dc-8ec3-0014bf78b845}]
\Shell\AutoRun\command - w2qagd.com
\Shell\explore\Command - w2qagd.com
\Shell\open\Command - w2qagd.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ec0c0cb1-1731-11dd-9015-0014bf78b845}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a
.
Contents of the 'Scheduled Tasks' folder

2008-10-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner.Leonard\Application Data\Mozilla\Firefox\Profiles\c038a4ge.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\1.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Sygate\SPF\Smc.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\windows\system32\nvsvc32.exe
c:\program files\OpenDNS Updater\OpenDNS Updater.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Completion time: 2008-12-18 17:32:35 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-19 01:32:33

Pre-Run: 284,925,358,080 bytes free
Post-Run: 284,900,855,808 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

213 --- E O F --- 2008-12-18 09:30:04

Hello

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:



Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Here is the log.

ComboFix 08-12-18.01 - Owner 2008-12-19 13:48:44.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1918.1490 [GMT -8:00]
Running from: c:\documents and settings\Owner.Leonard\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Owner.Leonard\Desktop\CFScript.txt
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MEMSWEEP2
-------\Legacy_SNGYNRUP
-------\Service_daefd
-------\Service_dlvi
-------\Service_MEMSWEEP2
-------\Service_SNGYNRUP


((((((((((((((((((((((((( Files Created from 2008-11-19 to 2008-12-19 )))))))))))))))))))))))))))))))
.

2008-12-18 16:59 . 2008-11-06 02:03 <DIR> d-------- C:\SDFix
2008-12-17 23:44 . 2008-12-18 00:36 <DIR> d-------- c:\windows\BDOSCAN8
2008-12-17 22:37 . 2008-12-17 22:37 <DIR> d-------- c:\documents and settings\All Users\Application Data\ESET
2008-12-17 15:29 . 2008-12-18 00:43 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-12-17 15:29 . 2008-12-18 00:43 <DIR> d-------- c:\documents and settings\Owner.Leonard\Application Data\SUPERAntiSpyware.com
2008-12-16 21:42 . 2008-12-16 21:30 23,552 --a------ c:\windows\system32\drivers\phooks.sys
2008-12-16 21:00 . 2005-09-09 13:51 176,128 --a------ c:\windows\system32\nvunrm.exe
2008-12-16 21:00 . 2005-07-29 17:10 100,480 --a------ c:\windows\system32\drivers\nvtcp.sys
2008-12-16 21:00 . 2005-06-03 17:01 3,632 --a------ c:\windows\system32\nvnrm.nvu
2008-12-16 16:59 . 2008-12-16 17:01 5,529,971 --a------ c:\windows\system32\LRKG
2008-12-15 22:04 . 2008-12-15 22:34 <DIR> d-------- c:\program files\Unlocker
2008-12-15 21:06 . 2008-12-15 21:06 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-15 21:06 . 2008-12-15 21:06 <DIR> d-------- c:\documents and settings\Owner.Leonard\Application Data\Malwarebytes
2008-12-15 21:06 . 2008-12-15 21:06 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-15 21:06 . 2008-12-03 19:52 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-15 21:06 . 2008-12-03 19:52 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-15 21:05 . 2008-12-15 21:05 <DIR> d-------- c:\program files\Trend Micro
2008-12-14 21:57 . 2008-12-14 21:57 <DIR> d-------- c:\program files\Sophos
2008-12-07 13:30 . 2008-12-07 13:30 <DIR> d-------- c:\documents and settings\Owner.Leonard\Application Data\Nexon
2008-12-07 13:04 . 2008-12-07 20:07 <DIR> d-------- C:\Nexon
2008-12-06 23:37 . 2008-12-06 23:37 <DIR> d-------- c:\program files\OpenDNS Updater
2008-12-05 19:33 . 2008-12-05 19:34 <DIR> d-------- c:\documents and settings\All Users\Application Data\OpenDNS Updater
2008-11-30 11:27 . 2008-11-30 11:28 <DIR> d-------- c:\windows\ERUNT
2008-11-30 11:26 . 2008-11-30 11:26 <DIR> d-------- c:\documents and settings\Owner.Leonard\backups
2008-11-30 11:26 . 2008-11-30 11:26 <DIR> d-------- c:\documents and settings\Owner.Leonard\backupreg
2008-11-30 11:26 . 2008-04-14 04:42 146,432 --a------ c:\documents and settings\Owner.Leonard\editreg.exe
2008-11-30 11:26 . 2008-04-14 04:42 27,136 --a------ c:\documents and settings\Owner.Leonard\rtsdnif.exe
2008-11-30 11:26 . 2008-04-14 04:42 12,288 --a------ c:\documents and settings\Owner.Leonard\attrib.exe
2008-11-30 11:26 . 2004-08-10 11:00 9,216 --a------ c:\documents and settings\Owner.Leonard\dnif.exe
2008-11-23 23:32 . 2008-12-16 20:45 142,096 --a------ c:\windows\system32\drivers\tmcomm.sys
2008-11-23 23:31 . 2008-11-24 17:49 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-11-23 23:31 . 2008-11-23 23:33 <DIR> d-------- c:\documents and settings\Owner.Leonard\.housecall6.6
2008-11-23 23:31 . 2008-12-18 21:32 <DIR> d-------- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2008-11-23 20:16 . 2008-11-23 20:17 <DIR> d-------- c:\program files\iTunes
2008-11-23 20:16 . 2008-11-23 20:16 <DIR> d-------- c:\program files\iPod
2008-11-23 20:16 . 2008-11-23 20:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\{3276BE95_AF08_429F_A64F_CA64CB79BCF6}

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-19 21:45 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\SiteAdvisor
2008-12-19 06:33 --------- d-----w c:\program files\Warcraft III
2008-12-18 08:43 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-12-18 06:51 --------- d---a-w c:\documents and settings\All Users\Application Data\TEMP
2008-12-17 05:06 --------- d-----w c:\program files\SpywareBlaster
2008-12-16 05:39 0 ----a-w c:\windows\Fonts\Argentine.ttf
2008-12-13 06:21 --------- d-----w c:\program files\SpeedFan
2008-12-12 07:16 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\FrostWire
2008-12-12 07:12 --------- d-----w c:\program files\FrostWire
2008-11-30 06:09 --------- d-----w c:\program files\Steam
2008-11-29 07:54 --------- d-----w c:\program files\Viewpoint
2008-11-29 07:54 --------- d-----w c:\program files\AIM6
2008-11-29 07:54 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-11-25 03:01 --------- d-----w c:\program files\Common Files\Adobe
2008-11-24 04:16 --------- d-----w c:\program files\Common Files\Apple
2008-11-24 04:15 --------- d-----w c:\program files\QuickTime
2008-11-23 06:48 --------- d-----w c:\program files\Safari
2008-11-19 05:17 --------- d--h--w c:\program files\InstallShield Installation Information
2008-11-19 05:17 --------- d-----w c:\program files\NetClient
2008-11-11 20:51 25,952 ----a-w c:\windows\system32\drivers\wnsdrvr.sys
2008-11-11 19:34 --------- d-----w c:\program files\BitPim
2008-11-05 23:46 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\CyberLink
2008-10-26 19:12 --------- d-----w c:\documents and settings\Owner.Leonard\Application Data\LimeWire
2008-10-26 02:29 --------- d-----w c:\program files\Java
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-20 02:01 --------- d-----w c:\program files\Windows Live Safety Center
2008-09-19 01:22 39,592 -c--a-w c:\documents and settings\Owner.Leonard\Application Data\GDIPFONTCACHEV1.DAT
2008-01-16 07:35 304 -c--a-w c:\documents and settings\Owner.Leonard\Application Data\wklnhst.dat
2008-05-14 00:46 32,768 -csha-w c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\MSHist012008051320080514\index.dat
.

((((((((((((((((((((((((((((( snapshot@2008-12-18_17.32.10.82 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-19 01:30:52 202,210 ----a-w c:\windows\system32\inetsrv\MetaBase.bin
+ 2008-12-19 21:52:02 202,213 ----a-w c:\windows\system32\inetsrv\MetaBase.bin
+ 2008-12-19 21:51:47 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_608.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"imekrmig"="c:\ime\IMKR\imekrmig.exe" [2001-01-09 44544]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-05-16 13529088]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2008-11-26 81000]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-15 2577632]
"amd_dc_opt"="c:\program files\AMD\Dual-Core Optimizer\amd_dc_opt.exe" [2008-07-22 77824]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-05-16 86016]
"SoundMan"="SOUNDMAN.EXE" [2007-04-16 c:\windows\soundman.exe]

c:\documents and settings\Owner.Leonard\Start Menu\Programs\Startup\
NaturalColorLoad.lnk - c:\program files\SEC\Natural Color\NaturalColorLoad.exe [2008-11-30 155715]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.I420"= i420vfw.dll
"msacm.clmp3enc"= c:\progra~1\CYBERL~1\Power2Go\CLMP3Enc.ACM

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Viewpoint Manager Service"=2 (0x2)
"iPod Service"=3 (0x3)
"WMP54Gv4SVC"=2 (0x2)
"helpsvc"=2 (0x2)
"CiSvc"=3 (0x3)
"mnmsrvc"=3 (0x3)
"lanmanserver"=2 (0x2)
"FastUserSwitchingCompatibility"=3 (0x3)
"PrismXL"=2 (0x2)
"SharedAccess"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" -atboottime

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Linksys Wireless-G PCI Wireless Network Monitor\\InvokeSvc2.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Warcraft III\\BNUpdate.exe"=
"c:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"c:\\Program Files\\FrostWire\\FrostWire.exe"=
"c:\\Program Files\\AIM6\\aim6.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6112:UDP"= 6112:UDP:UDP
"6112:TCP"= 6112:TCP:TCP
"6110:TCP"= 6110:TCP:Battlenet1
"6113:TCP"= 6113:TCP:Battlenet2
"3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009

R0 phooks;phooks;c:\windows\system32\drivers\phooks.sys [2008-12-16 23552]
R1 aswSP;avast! Self Protection;c:\windows\system32\drivers\aswSP.sys [2008-06-24 111184]
R2 aswFsBlk;aswFsBlk;c:\windows\system32\DRIVERS\aswFsBlk.sys [2008-06-24 20560]
R2 OpenDNS Updater.exe;OpenDNS Updater;c:\program files\OpenDNS Updater\OpenDNS Updater.exe --run []
S3 ASPI;Advanced SCSI Programming Interface Driver;\??\c:\windows\System32\DRIVERS\ASPI32.sys [2008-05-04 16512]
S3 rkhdrv40;Rootkit Unhooker Driver; []
S3 WnsDrvr;WnsDrvr;c:\windows\system32\drivers\WnsDrvr.sys [2008-11-11 25952]
S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\Viewpoint\Common\ViewpointService.exe" [2008-11-28 24652]
.
Contents of the 'Scheduled Tasks' folder

2008-10-27 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://google.com/
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\Owner.Leonard\Application Data\Mozilla\Firefox\Profiles\c038a4ge.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll

ATTENTION: FIREFOX POLICES IS IN FORCE
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.version", 3);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.rights.3.shown", false);
.

**************************************************************************

disk not found C:\

please note that you need administrator rights to perform deep scan
scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files:

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vsdatant]
"ImagePath"=""
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Sygate\SPF\Smc.exe
c:\program files\Lavasoft\Ad-Aware\aawservice.exe
c:\program files\Alwil Software\Avast4\aswUpdSv.exe
c:\program files\Alwil Software\Avast4\ashServ.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\ehome\ehrecvr.exe
c:\windows\ehome\ehSched.exe
c:\windows\system32\inetsrv\inetinfo.exe
c:\windows\system32\nvsvc32.exe
c:\program files\OpenDNS Updater\OpenDNS Updater.exe
c:\windows\system32\dllhost.exe
c:\windows\system32\rundll32.exe
c:\program files\Alwil Software\Avast4\Setup\avast.setup
.
**************************************************************************
.
Completion time: 2008-12-19 13:53:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-19 21:53:12
ComboFix2.txt 2008-12-19 01:32:36

Pre-Run: 284,795,977,728 bytes free
Post-Run: 284,822,646,784 bytes free

209 --- E O F --- 2008-12-18 09:30:04

Hello

Please download ATF Cleaner by Atribune.

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.




Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
• If an update is found, it will download and install the latest version.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.






Go to Kaspersky website and perform an online antivirus scan.

1. Read through the requirements and privacy statement and click on Accept button.
2. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run.
3. When the downloads have finished, click on Settings.
4. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
   Spyware, Adware, Dialers, and other potentially dangerous programs
   Archives
   Mail databases
5. Click on My Computer under Scan.
6. Once the scan is complete, it will display the results. Click on View Scan Report.
7. You will see a list of infected items there. Click on Save Report As....
8. Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Then post it here.

YAY! btw, I found a second desktop shortcut to Internet Explorer o.O and if i right click it it allows me to go to internet properties. it looks fishy >_> correct me if im wrong pls
Mbam Log first, Kaspersky Online Log second

Malwarebytes' Anti-Malware 1.31
Database version: 1510
Windows 5.1.2600 Service Pack 3

12/19/2008 3:32:17 PM
mbam-log-2008-12-19 (15-32-17).txt

Scan type: Quick Scan
Objects scanned: 54007
Time elapsed: 3 minute(s), 13 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

-------------------------------------------------------------------

Kaspersky Log

D:\i386\Apps\App00577\comps\toolbar\toolbr.exe

Threat name: not-a-virus:AdWare.Win32.SearchIt.t

Thats fine

Delete this file

D:\i386\Apps\App00577\comps\toolbar\toolbr.exe


And post a new HJT log

Hi.

My D: Folder is actually the Recovery Drive folder. In it, there is System Restore (if i click, it says its protected by pcangel and i can't do anything else with it) and a file called PROD(size:1Kb). So how would I delete D:\i386\Apps\App00577\comps\toolbar\toolbr.exe? Thank you

Try this

Please download the OTMoveIt3 by OldTimer or from here.

• Save it to your desktop.
• Please double-click OTMoveIt3.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
• Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  
  CODE
  :Processes
  explorer.exe
  
  :Services
  
  :Reg
  
  :Files
  D:\i386\Apps\App00577\comps\toolbar\toolbr.exe
  
  :Commands
  [purity]
  [emptytemp]
  [start explorer]
  [Reboot]
  
  
• Return to OTMoveIt3, right click in the "Paste Instructions for Items to be Moved" window (under the yellow bar) and choose Paste.
  
• Click the red Moveit! button.
• Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
• Close OTMoveIt3

Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.