[g4m3r999]

Here's my log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:51:12, on 18/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\antiviirus.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\tmp0.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\JavaCore\JavaCore.exe
C:\Program Files\tmp1.exe
C:\Program Files\VirusIsolator\VirusIsolator.exe
C:\Program Files\tmp2.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\tmp3.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\user\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarerefer...=...6Ojg5&lid=2
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O3 - Toolbar: qtvglped - {65C76A0A-B5A4-4170-8F62-947A0145677C} - C:\WINDOWS\qtvglped.dll
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1188.exe 61A847B5BBF72813339330466188719AB689201522886B092CBD44BD8689220221DD325762EA4EBF
968951185EFC412806867680AEDE604D64C2661373F819EBDCD66A47
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe
O4 - HKLM\..\Run: [5828f184] rundll32.exe "C:\WINDOWS\system32\vhftfkpt.dll",b
O4 - HKLM\..\Run: [BM5b1bc218] Rundll32.exe "C:\WINDOWS\system32\arjqhmhq.dll",s
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [JavaCore] C:\Program Files\\JavaCore\\JavaCore.exe
O4 - HKCU\..\Run: [DLD.EXE] C:\Program Files\Download Direct\DLD.exe
O4 - HKCU\..\Run: [VirusIsolator.exe] C:\Program Files\VirusIsolator\VirusIsolator.exe
O4 - Startup: DW_Start.lnk = C:\WINDOWS\system32\rwwnw64d.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1196167113431
O21 - SSODL: RunOnceDrv - {cd49a267-819b-4c9b-a146-0affe51b84f7} - C:\WINDOWS\Resources\RunOnceDrv.dll
O21 - SSODL: zip - {370e5915-1b69-4901-8fb7-badd4525ca4e} - C:\WINDOWS\Installer\{370e5915-1b69-4901-8fb7-badd4525ca4e}\zip.dll
O21 - SSODL: omlbpkaw - {93DFBF5F-3ED2-4A77-BF05-CE91BED5FF67} - C:\WINDOWS\omlbpkaw.dll
O21 - SSODL: pmsoarbf - {2223ED39-EF11-46C3-8872-B52ABF338690} - C:\WINDOWS\pmsoarbf.dll
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\dXNlcg\command.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe (file missing)
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm

--
End of file - 6974 bytes


I'm having really bad problems, Slow PC, Popups, Change of Background I need help

Thanks in advance

[Advertisements]

Hello g4m3r999

Welcome to G2Go.
=====================
Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
• Finally copy and paste the contents of the results file Report.txt

==================
Then::
Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

[kahdah]

Hello g4m3r999

Welcome to G2Go.
=====================
Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

• Restart your computer
• After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
• Instead of Windows loading as normal, the Advanced Options Menu should appear;
• Select the first option, to run Windows in Safe Mode, then press Enter.
• Choose your usual account.

• Open the extracted SDFix folder and double click RunThis.bat to start the script.
• Type Y to begin the cleanup process.
• It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
• Press any Key and it will restart the PC.
• When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
• Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
• Finally copy and paste the contents of the results file Report.txt

==================
Then::
Download ComboFix from one of the locations below, and save it to your Desktop.

Link 1
Link 2
Link 3

Double click combofix.exe and follow the prompts. Please, never rename Combofix unless instructed.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall

[g4m3r999]

This is the SDfix report:


SDFix: Version 1.173
Run by user on 20/04/2008 at 20:23

Microsoft Windows XP [Version 5.1.2600]
Running From: C:\SDFix

Checking Services :

Name :
cmdService
Network Monitor

Path :
C:\WINDOWS\dXNlcg\command.exe
C:\Program Files\Network Monitor\netmon.exe service

cmdService - Deleted
Network Monitor - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File
Restoring Default HomePage Value
Restoring Default Desktop Components Value

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\Installer\{370e5915-1b69-4901-8fb7-badd4525ca4e}\zip.dll - Deleted
C:\WINDOWS\Resources\RunOnceDrv.dll - Deleted
C:\WINDOWS\dXNlcg\xrh5w0.vbs - Deleted
C:\X.DAT - Deleted
C:\PROGRA~1\COMPLU~1\QUFAWY~1 - Deleted
C:\PROGRA~1\COMPLU~1\QUFAWY.DLL - Deleted
C:\PROGRA~1\COMPLU~1\QUFAWY~1.DLL - Deleted
C:\PROGRA~1\COMPLU~1\QUFAWY~2.DLL - Deleted
C:\PROGRA~1\MSN\KEQOBI~1.DLL - Deleted
C:\Program Files\tmp0.exe - Deleted
C:\Program Files\tmp1.exe - Deleted
C:\Program Files\tmp2.exe - Deleted
C:\Program Files\tmp3.exe - Deleted
C:\Documents and Settings\user\Start Menu\Programs\VirusIsolator\VirusIsolator.lnk - Deleted
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted
C:\Documents and Settings\user\Desktop\Error Cleaner.url - Deleted
C:\Documents and Settings\user\Favorites\Error Cleaner.url - Deleted
C:\Documents and Settings\user\Desktop\Privacy Protector.url - Deleted
C:\Documents and Settings\user\Favorites\Privacy Protector.url - Deleted
C:\Documents and Settings\user\Desktop\Spyware&Malware Protection.url - Deleted
C:\Documents and Settings\user\Favorites\Spyware&Malware Protection.url - Deleted
C:\Temp\1cb\syscheck.log - Deleted
C:\WINDOWS\privacy_danger\index.htm - Deleted
C:\WINDOWS\privacy_danger\images\capt.gif - Deleted
C:\WINDOWS\privacy_danger\images\danger.jpg - Deleted
C:\WINDOWS\privacy_danger\images\down.gif - Deleted
C:\WINDOWS\privacy_danger\images\spacer.gif - Deleted
C:\WINDOWS\system32\n5\madn1107.exe - Deleted
C:\WINDOWS\system32\x1\crecomdll1.exe - Deleted
C:\WINDOWS\system32\Z8\key89104.exe - Deleted
C:\Program Files\JavaCore\JavaCore.exe - Deleted
C:\Program Files\JavaCore\UnInstall.exe - Deleted
C:\Program Files\Temporary\InsiDERInst.exe - Deleted
C:\Program Files\VirusIsolator\VirusIsolator.exe - Deleted
C:\Program Files\VirusIsolator\vscan.tsi - Deleted
C:\Program Files\VirusIsolator\zlib.dll - Deleted
C:\n.bat - Deleted
C:\WINDOWS\b152.exe - Deleted
C:\WINDOWS\b153.exe - Deleted
C:\WINDOWS\b154.exe - Deleted
C:\WINDOWS\lgmxvpatwxm.dll - Deleted
C:\WINDOWS\mrofinu1000106.exe - Deleted
C:\Documents and Settings\user\Application Data\Microsoft\Internet Explorer\Quick Launch\VirusIsolator.lnk - Deleted
C:\Documents and Settings\user\services.exe - Deleted
C:\Documents and Settings\user\Start Menu\Programs\Startup\DW_Start.lnk - Deleted
C:\winlogon.exe - Deleted
C:\x.dat - Deleted
C:\z.dat - Deleted
C:\WINDOWS\Fonts\Setup.exe - Deleted
C:\WINDOWS\npqtsrak.exe - Deleted
C:\WINDOWS\omlbpkaw.dll - Deleted
C:\WINDOWS\pmsoarbf.dll - Deleted
C:\WINDOWS\qtvglped.dll - Deleted
C:\WINDOWS\rtqmekwg.exe - Deleted
C:\WINDOWS\system32\atmtd.dll - Deleted
C:\WINDOWS\system32\atmtd.dll._ - Deleted
C:\WINDOWS\system32\msnav32.ax - Deleted
C:\WINDOWS\system32\pac.txt - Deleted
C:\WINDOWS\system32\zxdnt3d.cfg - Deleted
C:\WINDOWS\tk58.exe - Deleted
C:\WINDOWS\uninstall_nmon.vbs - Deleted

x.dat and z.dat data copied to \SDFix\Data.txt


Folder C:\WINDOWS\Installer\{370e5915-1b69-4901-8fb7-badd4525ca4e} - Removed
Folder C:\Documents and Settings\user\Start Menu\Programs\VirusIsolator - Removed
Folder C:\Program Files\JavaCore - Removed
Folder C:\Program Files\Network Monitor - Removed
Folder C:\Program Files\Temporary - Removed
Folder C:\Program Files\VirusIsolator - Removed
Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed
Folder C:\Temp\1cb - Removed
Folder C:\WINDOWS\Fonts\- - Removed
Folder C:\WINDOWS\privacy_danger - Removed
Folder C:\WINDOWS\system32\n5 - Removed
Folder C:\WINDOWS\system32\X1 - Removed
Folder C:\WINDOWS\system32\Z8 - Removed


Removing Temp Files

ADS Check :

This is the Combofix Log:

ComboFix 08-04-20.2 - user 2008-04-21 9:19:42.1 - NTFSx86
Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
* Created a new restore point
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Temp\sanR24
C:\Temp\sanR24\lDii.log
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\arjqhmhq.dll
C:\WINDOWS\system32\auxelrgn.dll
C:\WINDOWS\system32\awtqpon.dll
C:\WINDOWS\system32\aygmscpm.dll
C:\WINDOWS\system32\b4
C:\WINDOWS\system32\b4\sysdr659.exe
C:\WINDOWS\system32\bblmywuj.ini
C:\WINDOWS\system32\bdvsmlrm.dll
C:\WINDOWS\system32\blrobnce.dll
C:\WINDOWS\system32\bmbefnjv.ini
C:\WINDOWS\system32\bomtqbro.dll
C:\WINDOWS\system32\buevgvlk.dll
C:\WINDOWS\system32\cdefe.ini
C:\WINDOWS\system32\cdefe.ini2
C:\WINDOWS\system32\cgvxrdxf.dll
C:\WINDOWS\system32\chthfhoo.dll
C:\WINDOWS\system32\ctmbefbn.ini
C:\WINDOWS\system32\ddnffpdx.dll
C:\WINDOWS\system32\dhktagqq.dll
C:\WINDOWS\system32\dqihpcvd.ini
C:\WINDOWS\system32\dtntwlyf.dll
C:\WINDOWS\system32\dvcphiqd.dll
C:\WINDOWS\system32\dvqwodix.ini
C:\WINDOWS\system32\ejfpyoia.dll
C:\WINDOWS\system32\eoygpuvs.dll
C:\WINDOWS\system32\epsisnap.dll
C:\WINDOWS\system32\euqwbgmi.dll
C:\WINDOWS\system32\ewuuxyjq.dll
C:\WINDOWS\system32\fccyxwwV.dll
C:\WINDOWS\system32\fqpwqmbl.dll
C:\WINDOWS\system32\fxxbsekn.dll
C:\WINDOWS\system32\fylwtntd.ini
C:\WINDOWS\system32\gbhtaako.dll
C:\WINDOWS\system32\gdxplqyq.dll
C:\WINDOWS\system32\goxuomby.dll
C:\WINDOWS\system32\hbnudvqr.dll
C:\WINDOWS\system32\hmjtfwcy.dll
C:\WINDOWS\system32\iatmrcfe.ini
C:\WINDOWS\system32\ijqsnxtl.dll
C:\WINDOWS\system32\ixmcqksy.dll
C:\WINDOWS\system32\jdvfkxxu.dll
C:\WINDOWS\system32\jebkiuee.dll
C:\WINDOWS\system32\jjaovfqo.dll
C:\WINDOWS\system32\joprmnbn.dll
C:\WINDOWS\system32\kdfylfnh.dll
C:\WINDOWS\system32\ljJYPife.dll
C:\WINDOWS\system32\lrkaelfy.dll
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\mkkvkqen.ini
C:\WINDOWS\system32\mogdqwdt.dll
C:\WINDOWS\system32\mtbdhqvn.dll
C:\WINDOWS\system32\mxvjosmd.dll
C:\WINDOWS\system32\orcjwrrd.dll
C:\WINDOWS\system32\pfopnodm.dll
C:\WINDOWS\system32\pgxehouk.dll
C:\WINDOWS\system32\pjixpgfo.dll
C:\WINDOWS\system32\pjsltpij.dll
C:\WINDOWS\system32\qbbhgkqw.dll
C:\WINDOWS\system32\qgwgoswv.dll
C:\WINDOWS\system32\qpmsxyiy.ini
C:\WINDOWS\system32\qutattol.dll
C:\WINDOWS\system32\ricgqioa.dll
C:\WINDOWS\system32\riltaxos.ini
C:\WINDOWS\system32\rsudrtnn.ini
C:\WINDOWS\system32\rytvnyao.dll
C:\WINDOWS\system32\scntokwd.exe
C:\WINDOWS\system32\soxatlir.dll
C:\WINDOWS\system32\svupgyoe.ini
C:\WINDOWS\system32\t2
C:\WINDOWS\system32\t2\vomb33dll.exe
C:\WINDOWS\system32\tbdicuoq.dll
C:\WINDOWS\system32\tchruylq.dll
C:\WINDOWS\system32\tpkftfhv.ini
C:\WINDOWS\system32\tyjkcspx.dll
C:\WINDOWS\system32\ugibrujc.dll
C:\WINDOWS\system32\ulmxecyj.dll
C:\WINDOWS\system32\uqbuulnc.ini
C:\WINDOWS\system32\uxonbccq.dll
C:\WINDOWS\system32\uyxslrwk.dll
C:\WINDOWS\system32\vcdniiew.ini
C:\WINDOWS\system32\veftstrn.dll
C:\WINDOWS\system32\vjnfebmb.dll
C:\WINDOWS\system32\vnbfskuw.dll
C:\WINDOWS\system32\vsfoburp.dll
C:\WINDOWS\system32\vvwtyhwo.dll
C:\WINDOWS\system32\Vwwxyccf.ini
C:\WINDOWS\system32\Vwwxyccf.ini2
C:\WINDOWS\system32\xecqspmv.dll
C:\WINDOWS\system32\xejgflyw.dll
C:\WINDOWS\system32\xgrusfrj.dll
C:\WINDOWS\system32\xljorkrj.dll
C:\WINDOWS\system32\xmsuijyg.dll
C:\WINDOWS\system32\xpilwdyr.dll
C:\WINDOWS\system32\xrlbcihc.dll
C:\WINDOWS\system32\yfleakrl.ini
C:\WINDOWS\system32\yijkhtvu.ini
C:\WINDOWS\system32\yqolkylu.dll

.
((((((((((((((((((((((((( Files Created from 2008-03-21 to 2008-04-21 )))))))))))))))))))))))))))))))
.

2008-04-21 09:04 . 2008-04-21 09:04 53,312 --a------ C:\WINDOWS\system32\ghwsnvwy.dll
2008-04-20 20:02 . 2008-04-20 20:02 <DIR> d-------- C:\WINDOWS\ERUNT
2008-04-20 19:57 . 2008-04-20 21:03 <DIR> d-------- C:\SDFix
2008-04-20 18:50 . 2008-04-20 18:51 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-04-19 22:11 . 2008-04-19 22:11 53,312 --a------ C:\WINDOWS\system32\vgcehnbr.dll
2008-04-18 18:01 . 2008-04-18 18:01 <DIR> d-------- C:\Documents and Settings\user\Application Data\TmpRecentIcons
2008-04-18 17:11 . 2008-04-18 17:11 53,312 --a------ C:\WINDOWS\system32\euscqngt.dll
2008-04-18 13:18 . 2008-04-18 13:18 876 --a------ C:\WINDOWS\$_hpcst$.hpc
2008-04-18 13:17 . 2008-04-18 13:17 <DIR> d-------- C:\Program Files\Lemonade Tycoon
2008-04-16 20:02 . 2008-04-16 20:02 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-04-16 20:02 . 2008-04-16 20:02 1,409 --a------ C:\WINDOWS\QTFont.for
2008-04-15 18:18 . 2008-04-15 18:34 <DIR> d-------- C:\Program Files\LimeWire
2008-04-14 18:17 . 2006-12-19 15:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-04-14 18:16 . 2007-02-22 20:50 170,408 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-04-14 18:16 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-04-14 18:16 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-04-14 18:16 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-04-14 18:16 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-04-14 18:15 . 2008-04-14 18:15 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-04-12 22:40 . 2008-04-12 22:40 53,312 --a------ C:\WINDOWS\system32\utgakqug.dll
2008-04-11 22:59 . 2008-04-14 18:17 <DIR> d-------- C:\Program Files\McAfee
2008-04-11 22:49 . 2008-04-14 18:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-04-11 16:58 . 2008-04-11 16:58 53,312 --a------ C:\WINDOWS\system32\rongrvfx.dll
2008-04-11 16:56 . 2008-04-11 16:56 0 --a------ C:\WINDOWS\BM5b1bc218.xml
2008-04-10 17:03 . 2008-04-11 17:04 1,546,031 --ahs---- C:\WINDOWS\system32\asxxbpxr.ini
2008-04-10 16:55 . 2008-04-10 16:55 53,312 --a------ C:\WINDOWS\system32\bmtdhkgx.dll
2008-04-09 16:55 . 2008-04-09 16:55 53,312 --a------ C:\WINDOWS\system32\sxysqtem.dll
2008-04-08 16:58 . 2008-04-08 16:58 <DIR> d-------- C:\Program Files\Common Files\Vbox
2008-04-08 16:58 . 2008-04-10 17:00 1,511,925 --ahs---- C:\WINDOWS\system32\fdropjwh.ini
2008-04-08 16:56 . 2008-04-08 16:56 <DIR> d-------- C:\Program Files\Macromedia
2008-04-08 16:56 . 2008-04-08 16:56 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-04-08 16:52 . 2008-04-08 16:53 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-04-08 16:46 . 2008-04-08 16:46 53,312 --a------ C:\WINDOWS\system32\efpkyses.dll
2008-04-07 16:51 . 2008-04-08 16:53 1,518,543 --ahs---- C:\WINDOWS\system32\xwkwqvhs.ini
2008-04-07 16:45 . 2008-04-07 16:45 53,312 --a------ C:\WINDOWS\system32\cvnmymow.dll
2008-04-06 12:59 . 2008-04-07 16:43 1,721,444 --ahs---- C:\WINDOWS\system32\bamcnumq.ini
2008-04-06 12:51 . 2008-04-06 12:51 53,312 --a------ C:\WINDOWS\system32\xcpvvysp.dll
2008-04-05 22:49 . 2008-04-05 22:49 244 --ah----- C:\sqmnoopt08.sqm
2008-04-05 22:49 . 2008-04-05 22:49 232 --ah----- C:\sqmdata08.sqm
2008-04-05 10:50 . 2008-04-06 12:48 2,107,713 --ahs---- C:\WINDOWS\system32\gxxyoqdt.ini
2008-04-05 10:42 . 2008-04-05 10:42 53,312 --a------ C:\WINDOWS\system32\jiujoehn.dll
2008-04-02 20:55 . 2008-04-05 10:40 1,569,464 --ahs---- C:\WINDOWS\system32\yibimnfp.ini
2008-04-02 19:05 . 2008-04-02 19:05 1,601,910 --ahs---- C:\WINDOWS\system32\pmqtykgx.ini
2008-04-01 17:06 . 2008-04-01 17:08 <DIR> d-------- C:\Program Files\Safari
2008-04-01 16:37 . 2008-04-02 17:26 1,594,077 --ahs---- C:\WINDOWS\system32\jxxuuflg.ini
2008-03-31 16:31 . 2008-04-01 04:54 1,597,354 --ahs---- C:\WINDOWS\system32\ivxcnbhn.ini
2008-03-30 14:15 . 2008-03-31 16:29 1,583,697 --ahs---- C:\WINDOWS\system32\bemkamxe.ini
2008-03-29 14:10 . 2008-03-30 14:12 1,583,637 --ahs---- C:\WINDOWS\system32\fqsgokyh.ini
2008-03-27 14:05 . 2008-03-29 17:16 <DIR> d-------- C:\Documents and Settings\user\Application Data\vlc
2008-03-27 13:48 . 2008-03-27 13:48 <DIR> d-------- C:\Program Files\VideoLAN
2008-03-25 17:43 . 1998-06-02 12:56 313,856 --a------ C:\WINDOWS\system32\dx3j.dll
2008-03-25 17:43 . 1998-06-02 15:45 140,048 --a------ C:\WINDOWS\system32\jit.dll
2008-03-25 17:43 . 1998-06-02 13:29 135,168 --a------ C:\WINDOWS\system32\javaee.dll
2008-03-25 17:43 . 1998-06-02 13:41 42,496 --a------ C:\WINDOWS\setdebug.exe
2008-03-25 17:43 . 1998-06-02 13:28 7,356 --a------ C:\WINDOWS\system32\javasup.vxd
2008-03-25 17:43 . 1998-06-02 12:57 6,550 --a------ C:\WINDOWS\jautoexp.dat
2008-03-25 17:40 . 1998-06-02 13:05 103,424 --a------ C:\WINDOWS\extrac32.exe
2008-03-25 00:18 . 2008-03-25 00:18 53,312 --a------ C:\WINDOWS\system32\fgtydtbg.dll
2008-03-25 00:12 . 2008-03-26 00:19 1,531,194 --ahs---- C:\WINDOWS\system32\brkdgbjc.ini
2008-03-24 00:10 . 2008-03-25 00:12 1,579,806 --ahs---- C:\WINDOWS\system32\kulxfbuf.ini
2008-03-23 00:12 . 2008-03-23 23:48 1,543,399 --ahs---- C:\WINDOWS\system32\domwydvm.ini
2008-03-22 20:01 . 2008-03-22 20:01 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-03-22 19:45 . 2008-03-22 19:45 <DIR> d-------- C:\Documents and Settings\user\Application Data\Ahead
2008-03-22 15:08 . 2008-03-22 15:08 <DIR> d-------- C:\Documents and Settings\user\Application Data\dvdcss
2008-03-21 00:09 . 2008-03-23 00:10 1,543,219 --ahs---- C:\WINDOWS\system32\wyahdikj.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-04-20 17:58 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 2
2008-04-15 21:03 --------- d-----w C:\Program Files\Opera
2008-04-15 17:34 --------- d-----w C:\Documents and Settings\user\Application Data\LimeWire
2008-04-13 12:41 --------- d-----w C:\Program Files\Paint.NET
2008-04-01 16:29 --------- d-----w C:\Documents and Settings\user\Application Data\Apple Computer
2008-04-01 16:04 --------- d-----w C:\Program Files\Bonjour
2008-03-19 20:06 --------- d-----w C:\Documents and Settings\user\Application Data\Thinstall
2008-03-17 22:56 --------- d-----w C:\Program Files\Sony Ericsson
2008-03-17 18:01 --------- d-----w C:\Program Files\C4D Studio Bundle v9.012
2008-03-15 11:29 --------- d-----w C:\Program Files\Common Files\Cisco Systems
2008-03-14 17:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-03-14 16:29 --------- d-----w C:\Program Files\QuickTime
2008-03-11 19:43 118,342 ----a-w C:\WINDOWS\Fonts\x.zip
2008-03-11 19:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\FLEXnet
2008-03-11 19:08 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-11 18:08 --------- d-----w C:\Program Files\Common Files\Macrovision Shared
2008-03-10 19:34 --------- d-----w C:\Documents and Settings\All Users\Application Data\WinZip
2008-03-09 00:21 --------- d-----w C:\Documents and Settings\All Users\Application Data\Rabio
2008-03-08 18:32 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-03-08 09:29 --------- d-----w C:\Program Files\Java
2008-03-08 09:24 --------- d-----w C:\Program Files\Common Files\Java
2008-03-07 19:28 --------- d-----w C:\Program Files\Apple Software Update
2008-03-07 19:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2008-03-05 20:48 --------- d-----w C:\Program Files\ReflexiveArcade
2008-03-05 19:44 --------- d-----w C:\Program Files\Common Files\xing shared
2008-03-05 19:43 --------- d-----w C:\Program Files\Common Files\Real
2008-03-05 19:42 --------- d-----w C:\Program Files\Real
2008-02-29 23:41 --------- d-----w C:\Program Files\Pivot Stickfigure Animator
2008-02-29 20:23 --------- d-----w C:\Documents and Settings\user\Application Data\FileZilla
2008-02-26 18:03 --------- d-----w C:\Program Files\FileZilla FTP Client
2008-02-15 17:15 79,360 ----a-w C:\op.com
2008-02-15 17:15 34,816 ----a-w C:\spellcheck.dll
2008-02-15 17:15 3,293,696 ----a-w C:\Opera.dll
2008-02-15 17:15 25,600 ----a-w C:\ouniansi.dll
2008-02-15 16:39 653,124 ----a-w C:\chartables.bin
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2B0B59B4-55A3-4737-9FD5-B93C6430BF75}]
2008-03-25 00:18 53312 --a------ C:\WINDOWS\system32\fgtydtbg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CAB59B4-55A3-4737-9FD5-B93C6430BF75}]
2008-04-21 09:04 53312 --a------ C:\WINDOWS\system32\ghwsnvwy.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AB48E1C2-5F53-43A4-BD92-0D3390276261}]
C:\WINDOWS\system32\efedc.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"DLD.EXE"="C:\Program Files\Download Direct\DLD.exe" [ ]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TFNF5"="TFNF5.exe" [2007-11-27 13:26 73728 C:\WINDOWS\system32\TFNF5.exe]
"000StTHK"="000StTHK.exe" [2001-06-23 21:28 24576 C:\WINDOWS\system32\000StTHK.exe]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-05 20:42 185896]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-02-01 00:13 385024]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2007-02-22 20:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-12-19 11:27 136768]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljJYPife]
ljJYPife.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mljhijj]
mljhijj.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\fccyxwwV

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Opera\\Opera.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
"C:\\Documents and Settings\\user\\My Documents\\Opera Portable\\op.com"=

R0 TVALG;Toshiba Value Added Logical and General Purpose Device Driver;C:\WINDOWS\system32\DRIVERS\TVALG.SYS [2001-09-13 20:53]
R3 TOSHIBASoftModem;Toshiba Soft Modem;C:\WINDOWS\system32\DRIVERS\LTSMT.sys [2001-08-17 14:28]
R3 tridxp;tridxp;C:\WINDOWS\system32\DRIVERS\tridxpm.sys [2007-11-27 13:16]

.
**************************************************************************

catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-04-21 10:03:54
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-04-21 10:14:02
ComboFix-quarantined-files.txt 2008-04-21 09:13:12

Pre-Run: 142,004,498,432 bytes free
Post-Run: 144,737,017,856 bytes free

273 --- E O F --- 2008-04-14 16:15:13


And this is the HijackThis log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:20:00, on 21/04/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.17184)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\TFNF5.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\user\My Documents\Opera Portable\op.com
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\user\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: (no name) - {2B0B59B4-55A3-4737-9FD5-B93C6430BF75} - C:\WINDOWS\system32\fgtydtbg.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: (no name) - {3CAB59B4-55A3-4737-9FD5-B93C6430BF75} - C:\WINDOWS\system32\ghwsnvwy.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {AB48E1C2-5F53-43A4-BD92-0D3390276261} - C:\WINDOWS\system32\efedc.dll (file missing)
O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [DLD.EXE] C:\Program Files\Download Direct\DLD.exe
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1196167113431
O20 - Winlogon Notify: ljJYPife - ljJYPife.dll (file missing)
O20 - Winlogon Notify: mljhijj - mljhijj.dll (file missing)
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe

--
End of file - 6015 bytes


It seems to have deleted all of the malware, CPU Speed is back up

[kahdah]

It seems to have deleted all of the malware, CPU Speed is back up

Not yet
==============
We now suggest that you install the Windows Recovery Console. The Windows recovery console will allow you to boot up into a special recovery mode that allows us to help you in the case that your computer has a problem after an attempted removal of malware.

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System.





Download the file & save it as it's originally named, next to ComboFix.exe.






Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When prompted to scan for infected files chose no, when done a log named CF_RC.txt will open. Please post the contents of that log.


Please do not reboot your machine until we have reviewed the log.