this is the combofix log....
ComboFix 08-08-07.05 - WCBIV 2008-08-07 19:09:34.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.156 [GMT -5:00]
Running from: C:\Documents and Settings\WCBIV\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\WCBIV\Application Data\macromedia\Flash Player\#SharedObjects\WSDUVNBA\interclick.com
C:\Documents and Settings\WCBIV\Application Data\macromedia\Flash Player\#SharedObjects\WSDUVNBA\interclick.com\ud.sol
C:\Documents and Settings\WCBIV\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\WCBIV\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c00A4C90.exe
C:\WINDOWS\system32\__c00FA5C4.dat
C:\WINDOWS\system32\~.exe
C:\WINDOWS\system32\AutoRun.inf
C:\WINDOWS\system32\ccqpakdm.ini
C:\WINDOWS\system32\cvyjxnbx.ini
C:\WINDOWS\system32\ddrpgxvi.ini
C:\WINDOWS\system32\dhdktorv.ini
C:\WINDOWS\system32\hnmdywug.dll
C:\WINDOWS\system32\iiffEuRl.dll
C:\WINDOWS\system32\ivxgprdd.dll
C:\WINDOWS\system32\lRuEffii.ini
C:\WINDOWS\system32\lRuEffii.ini2
C:\WINDOWS\system32\mdkapqcc.dll
C:\WINDOWS\system32\mulemf.dll
C:\WINDOWS\system32\nnnnMGyY.dll
C:\WINDOWS\system32\pkcqnsli.dll
C:\WINDOWS\system32\ueojwu.dll
C:\WINDOWS\system32\vfktlx.dll
C:\WINDOWS\system32\ygcexyrv.dll
C:\xcrashdump.dat
.
((((((((((((((((((((((((( Files Created from 2008-07-08 to 2008-08-08 )))))))))))))))))))))))))))))))
.
2008-08-06 20:00 . 2008-08-06 20:00 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-05 16:29 . 2008-08-05 16:29 2,374 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-05 16:28 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-05 16:28 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-05 16:28 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-05 16:28 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-05 16:28 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-05 16:28 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-05 16:28 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-05 16:28 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-05 16:28 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-05 16:25 . 2008-08-05 16:25 <DIR> d-------- C:\Documents and Settings\WCBIV\Application Data\HP
2008-08-05 16:22 . 2008-08-05 16:22 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Hewlett-Packard
2008-08-05 16:22 . 2007-03-07 23:20 49,920 -ra------ C:\WINDOWS\system32\drivers\HPZid412.sys
2008-08-05 16:22 . 2007-03-07 23:20 16,496 -ra------ C:\WINDOWS\system32\drivers\HPZipr12.sys
2008-08-05 16:20 . 2007-03-30 10:29 267,864 -ra------ C:\WINDOWS\system32\hpzids01.dll
2008-08-05 16:20 . 2007-03-28 14:01 118,272 --a------ C:\WINDOWS\system32\hpz3l5ha.dll
2008-08-05 16:20 . 2007-03-07 23:20 21,568 -ra------ C:\WINDOWS\system32\drivers\HPZius12.sys
2008-08-05 16:19 . 2007-03-17 01:39 958,464 -ra------ C:\WINDOWS\system32\hpotiop4.dll
2008-08-05 16:19 . 2007-03-17 01:39 675,840 -ra------ C:\WINDOWS\system32\hpowiax4.dll
2008-08-05 16:19 . 2007-03-07 23:20 364,544 -ra------ C:\WINDOWS\system32\hppldcoi.dll
2008-08-05 16:19 . 2007-03-07 23:20 309,760 -ra------ C:\WINDOWS\system32\difxapi.dll
2008-08-05 16:19 . 2007-03-17 01:39 303,104 -ra------ C:\WINDOWS\system32\hpovst11.dll
2008-08-05 16:17 . 2008-08-05 16:17 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HPSSUPPLY
2008-08-05 16:10 . 2008-08-05 16:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\HP Product Assistant
2008-08-05 16:09 . 2008-08-05 16:09 <DIR> d-------- C:\Program Files\Common Files\HP
2008-08-05 16:08 . 2008-08-05 16:08 <DIR> d-------- C:\Program Files\Hewlett-Packard
2008-08-05 16:00 . 2008-07-18 10:46 139,785 --------- C:\WINDOWS\hpoins15.dat.temp
2008-08-05 16:00 . 2007-09-20 15:05 1,039 --------- C:\WINDOWS\hpomdl15.dat.temp
2008-08-04 15:44 . 2008-08-04 15:42 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-08-04 15:42 . 2008-08-04 15:49 <DIR> d-------- C:\Documents and Settings\WCBIV\.housecall6.6
2008-08-04 15:30 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2008-08-04 15:30 . 2004-08-03 23:08 31,616 --a------ C:\WINDOWS\system32\dllcache\usbccgp.sys
2008-08-04 15:24 . 2008-08-04 15:24 <DIR> d-------- C:\Program Files\Symantec
2008-08-04 15:24 . 2008-08-04 15:30 <DIR> d-------- C:\Program Files\AWS
2008-08-04 15:22 . 2008-08-04 15:22 <DIR> d-------- C:\Program Files\iTunes
2008-08-04 15:22 . 2008-08-04 15:22 <DIR> d-------- C:\Program Files\iPod
2008-07-22 22:20 . 2008-07-22 22:20 <DIR> d-------- C:\Program Files\Netflix
2008-07-22 15:59 . 2008-08-04 15:22 <DIR> d-------- C:\Program Files\Apple Software Update(2)
2008-07-08 20:06 . 2008-08-04 15:22 <DIR> d-------- C:\Program Files\iPod(2)
2008-07-08 20:05 . 2008-08-04 15:22 <DIR> d-------- C:\Program Files\iTunes(2)
2008-07-08 20:03 . 2008-08-04 15:25 <DIR> d-------- C:\Program Files\Bonjour
2008-07-08 19:57 . 2008-07-08 19:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-07-08 19:57 . 2008-07-08 19:57 1,409 --a------ C:\WINDOWS\QTFont.for
2008-07-08 19:53 . 2008-07-08 19:53 <DIR> d-------- C:\Program Files\Common Files\Apple
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-07 01:06 --------- d-----w C:\Program Files\Java
2008-08-07 00:58 --------- d-----w C:\Documents and Settings\WCBIV\Application Data\AdobeUM
2008-08-05 21:17 --------- d-----w C:\Program Files\HP
2008-08-05 21:16 --------- d-----w C:\Documents and Settings\WCBIV\Application Data\HPAppData
2008-08-04 22:00 --------- d-----w C:\Program Files\Common Files\Adobe
2008-08-04 20:24 --------- d-----w C:\Documents and Settings\All Users\Application Data\Adobe(2)
2008-08-04 20:23 --------- d-----w C:\Program Files\QuickTime
2008-08-04 20:23 --------- d-----w C:\Program Files\LimeWire
2008-08-04 20:23 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-06-30 02:26 --------- d-----w C:\Documents and Settings\WCBIV\Application Data\Corel Photo Album
2008-06-25 21:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\WEBREG
2008-06-25 21:37 --------- d-----w C:\Documents and Settings\All Users\Application Data\HP
2008-06-25 21:33 --------- d-----w C:\Program Files\Common Files\Hewlett-Packard
2008-06-17 17:37 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2006-06-26 01:15 8 --sh--r C:\WINDOWS\system32\C4A4EE2399.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 11:34 5724184]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 04:00 15360]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2008-01-03 11:15 50528]
"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09 460784]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 13:01 67584]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 19:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 19:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 19:50 114688]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2006-05-03 03:12 98304]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 09:44 249856]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 09:44 81920]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 04:20 122940]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-02-23 16:45 278528]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-05-18 16:50 282624]
"MSKDetectorExe"="C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 18:05 1117184]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 21:34 49152]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 03:38:16 29696]
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-15 14:22:09 24576]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2007-03-11 21:26:24 210520]
Smart Wizard Wireless Settings.lnk - C:\Program Files\NETGEAR\WG111 Configuration Utility\WG111CFG.exe [2006-05-18 16:08:19 1044577]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\StubInstaller.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\WINDOWS\\system32\\LEXPPS.EXE"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\AIM6\\aim6.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 16:38]
S3 AngelUsb;Angel USB MPEG Device;C:\WINDOWS\system32\DRIVERS\AngelUsb.sys [2005-02-17 03:06]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
*Newly Created Service* - PCANDIS5
.
Contents of the 'Scheduled Tasks' folder
2008-08-07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe []
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-d41e3572 - C:\WINDOWS\system32\mdkapqcc.dll
Notify-__c00FA5C4 - C:\WINDOWS\system32\__c00FA5C4.dat
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\WCBIV\Application Data\Mozilla\Firefox\Profiles\dm99kb8g.default\
FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.netRootkit scan 2008-08-07 19:22:37
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe
.
**************************************************************************
.
Completion time: 2008-08-07 19:26:58 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-08 00:26:55
Pre-Run: 25,679,384,576 bytes free
Post-Run: 27,546,824,704 bytes free
204 --- E O F --- 2008-05-20 08:00:28