[Greenlight]

What's up?
I've followed the instructions on this site before I posted this log, and use Malwarebytes AntiMalaware which ended up finding this b@#tard of a virus and showed that it removed it. When I restarted my machine the same annoying blue screen loaded up saying, " Warning! Spyware Detected on your computer!...". Please help me resolve this issue. my HJTlog is below
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:37:54 AM, on 8/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\DOCUME~1\MANNYR~1\LOCALS~1\Temp\A2FREE\a2service.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Webroot\Desktop Firewall\wdfsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\All Users\Application Data\qlijupgl\mnwrojgd.exe
C:\WINDOWS\ehome\ehtray.exe
C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe
C:\WINDOWS\system32\dghkjuze.exe
C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\bcbohupe.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Webroot\Desktop Firewall\WDF.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe
C:\DOCUME~1\MANNYR~1\LOCALS~1\Temp\superas\SUPERAntiSpyware.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://g.msn.com/0SE...S01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://g.msn.com/0SE...S01?FORM=TOOLBR
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://g.msn.com/0SE...S01?FORM=TOOLBR
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://redirect.hp.c...&...bd=all&c=64
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] "C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [QlbCtrl] "C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" /Start
O4 - HKLM\..\Run: [Cpqset] "C:\Program Files\HPQ\Default Settings\cpqset.exe"
O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
O4 - HKLM\..\Run: [DLBTCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Webroot Desktop Firewall] "C:\Program Files\Webroot\Desktop Firewall\WDF.exe"
O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1167739833\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe
O4 - HKLM\..\Run: [lphcv9aj0eept] C:\WINDOWS\system32\lphcv9aj0eept.exe
O4 - HKLM\..\Run: [SMrhcr9aj0eept] "C:\Program Files\rhcr9aj0eept\rhcr9aj0eept.exe"
O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\DOCUME~1\MANNYR~1\LOCALS~1\Temp\superas\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [MsgUi] C:\WINDOWS\system32\fmbcjmbw.exe
O4 - HKCU\..\Run: [AppWeb] C:\WINDOWS\system32\kdqpslup.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [appdsc] C:\WINDOWS\system32\bcbohupe.exe
O4 - HKLM\..\Policies\Explorer\Run: [X6viYlK8DR] C:\Documents and Settings\All Users\Application Data\qlijupgl\mnwrojgd.exe
O4 - HKUS\S-1-5-18\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ISUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -scheduler (User 'Default user')
O4 - .DEFAULT User Startup: Vongo Tray.lnk = C:\Program Files\Vongo\Tray.exe (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=64&bd=pavilion&pf=laptop
O16 - DPF: {843EE768-3A97-455C-9076-741BA3AD7B62} (QuickBooks Online Edition Utilities Class v10) - https://accounting.q...113/qboax10.cab
O21 - SSODL: GenCfgApp - {3F248C9A-C092-016C-D71B-06B95090C1A1} - (no file)
O21 - SSODL: msginfo - {1631EC19-9BF1-9456-A0D8-014A36099799} - (no file)
O21 - SSODL: endb - {0D3FEAC3-CD96-F7CD-7835-01865F6101D6} - (no file)
O21 - SSODL: SrvCfgInfo - {230AD557-423B-8A0D-7B8E-093F5702260D} - C:\Program Files\ryilgdc\SrvCfgInfo.dll
O23 - Service: a-squared Free Service (a2free) - Emsi Software GmbH - C:\DOCUME~1\MANNYR~1\LOCALS~1\Temp\A2FREE\a2service.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: dlbt_device - Dell - C:\WINDOWS\system32\dlbtcoms.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildTangent\Apps\My HP Game Console\GameConsoleService.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Webroot Desktop Firewall network service (WDFNet) - Webroot Software, Inc. - C:\Program Files\Webroot\Desktop Firewall\wdfsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe

--
End of file - 14376 bytes

[Advertisements]

Welcome to GTG.

I suggest uninstall A-Squared and SUPERAntiSpyware via the Add/Remove Programs panel. They are installed on the temp folder now. Install them back to the proper Program Files folder.

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Download ATF Cleaner at http://www.atribune..../click.php?id=1
Double-click ATF-Cleaner.exe to run the program. Under Main choose Select All
Click the Empty Selected button.

If you use the Firefox browser click Firefox at the top and choose Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use the Opera browser click 'Opera' at the top and choose 'Select All'
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Uninstall the following via the Add/Remove Panel (Start->Settings->Control Panel->Add/Remove Programs) if found:

AskSBar

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O4 - HKLM\..\Run: [lphcv9aj0eept] C:\WINDOWS\system32\lphcv9aj0eept.exe
O4 - HKLM\..\Run: [SMrhcr9aj0eept] "C:\Program Files\rhcr9aj0eept\rhcr9aj0eept.exe"
O4 - HKCU\..\Run: [MsgUi] C:\WINDOWS\system32\fmbcjmbw.exe
O4 - HKCU\..\Run: [AppWeb] C:\WINDOWS\system32\kdqpslup.exe
O4 - HKCU\..\Run: [appdsc] C:\WINDOWS\system32\bcbohupe.exe
O4 - HKLM\..\Policies\Explorer\Run: [X6viYlK8DR] C:\Documents and Settings\All Users\Application Data\qlijupgl\mnwrojgd.exe
O21 - SSODL: GenCfgApp - {3F248C9A-C092-016C-D71B-06B95090C1A1} - (no file)
O21 - SSODL: msginfo - {1631EC19-9BF1-9456-A0D8-014A36099799} - (no file)
O21 - SSODL: endb - {0D3FEAC3-CD96-F7CD-7835-01865F6101D6} - (no file)
O21 - SSODL: SrvCfgInfo - {230AD557-423B-8A0D-7B8E-093F5702260D} - C:\Program Files\ryilgdc\SrvCfgInfo.dll

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\WINDOWS\system32\dghkjuze.exe
C:\Program Files\AskSBar\
C:\WINDOWS\system32\lphcv9aj0eept.exe
C:\Program Files\rhcr9aj0eept\
C:\WINDOWS\system32\fmbcjmbw.exe
C:\WINDOWS\system32\kdqpslup.exe
C:\WINDOWS\system32\bcbohupe.exe
C:\Documents and Settings\All Users\Application Data\qlijupgl\
C:\Program Files\ryilgdc\

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

[greyknight17]

Welcome to GTG.

I suggest uninstall A-Squared and SUPERAntiSpyware via the Add/Remove Programs panel. They are installed on the temp folder now. Install them back to the proper Program Files folder.

Please print the below instructions or copy them to Notepad. Make sure to work through the fixes in the order mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes.

Download ATF Cleaner at http://www.atribune..../click.php?id=1
Double-click ATF-Cleaner.exe to run the program. Under Main choose Select All
Click the Empty Selected button.

If you use the Firefox browser click Firefox at the top and choose Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

If you use the Opera browser click 'Opera' at the top and choose 'Select All'
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program.

Uninstall the following via the Add/Remove Panel (Start->Settings->Control Panel->Add/Remove Programs) if found:

AskSBar

Run a scan in HijackThis. Check each of the following if they still exist and hit 'Fix Checked' after you checked the last one:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: (no name) - {0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O2 - BHO: Ask Search Assistant BHO - {0579B4B1-0293-4d73-B02D-5EBB0BA0F0A2} - C:\Program Files\AskSBar\SrchAstt\1.bin\A2SRCHAS.DLL
O4 - HKLM\..\Run: [lphcv9aj0eept] C:\WINDOWS\system32\lphcv9aj0eept.exe
O4 - HKLM\..\Run: [SMrhcr9aj0eept] "C:\Program Files\rhcr9aj0eept\rhcr9aj0eept.exe"
O4 - HKCU\..\Run: [MsgUi] C:\WINDOWS\system32\fmbcjmbw.exe
O4 - HKCU\..\Run: [AppWeb] C:\WINDOWS\system32\kdqpslup.exe
O4 - HKCU\..\Run: [appdsc] C:\WINDOWS\system32\bcbohupe.exe
O4 - HKLM\..\Policies\Explorer\Run: [X6viYlK8DR] C:\Documents and Settings\All Users\Application Data\qlijupgl\mnwrojgd.exe
O21 - SSODL: GenCfgApp - {3F248C9A-C092-016C-D71B-06B95090C1A1} - (no file)
O21 - SSODL: msginfo - {1631EC19-9BF1-9456-A0D8-014A36099799} - (no file)
O21 - SSODL: endb - {0D3FEAC3-CD96-F7CD-7835-01865F6101D6} - (no file)
O21 - SSODL: SrvCfgInfo - {230AD557-423B-8A0D-7B8E-093F5702260D} - C:\Program Files\ryilgdc\SrvCfgInfo.dll

Locate the following Files/Folders and delete them if they exist (if no location given, just do a search for them):

C:\WINDOWS\system32\dghkjuze.exe
C:\Program Files\AskSBar\
C:\WINDOWS\system32\lphcv9aj0eept.exe
C:\Program Files\rhcr9aj0eept\
C:\WINDOWS\system32\fmbcjmbw.exe
C:\WINDOWS\system32\kdqpslup.exe
C:\WINDOWS\system32\bcbohupe.exe
C:\Documents and Settings\All Users\Application Data\qlijupgl\
C:\Program Files\ryilgdc\

Go to http://www.bleepingc...to-use-combofix and follow the instructions on how to install the Recovery Console and run ComboFix. Go through all the steps until posting the log part. Post the combofix log here.

[Greenlight]

Sorry for the late response, I was out of the country for a while. I did all the steps as instructed and below is the ComboFix Log.

ComboFix 08-08-17.03 - Manny Russell 2008-08-18 10:24:12.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.496 [GMT -4:00]
Running from: C:\Documents and Settings\Manny Russell\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Manny Russell\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Desktop\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\How to Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\License Agreement.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Register Antivirus XP 2008.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\Antivirus XP 2008\Uninstall.lnk
C:\Documents and Settings\LocalService\Application Data\rhcr9aj0eept
C:\Documents and Settings\Manny Russell\Application Data\macromedia\Flash Player\#SharedObjects\7KSXRKWP\interclick.com
C:\Documents and Settings\Manny Russell\Application Data\macromedia\Flash Player\#SharedObjects\7KSXRKWP\interclick.com\ud.sol
C:\Documents and Settings\Manny Russell\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Manny Russell\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Manny Russell\Application Data\rhcr9aj0eept
C:\Documents and Settings\Manny Russell\UserData
C:\Documents and Settings\Manny Russell\UserData\4HAVK9W7\oXMLStore[1].xml
C:\Documents and Settings\Manny Russell\UserData\83WHYPYB\IsOnIE6tbPromo[1].xml
C:\Documents and Settings\Manny Russell\UserData\IFCP05GB\YL[1].xml
C:\Documents and Settings\Manny Russell\UserData\index.dat
C:\Documents and Settings\Manny Russell\UserData\Y5K36J6P\userDataXmlIsland[1].xml
C:\WINDOWS\system32\blphcv9aj0eept.scr
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\WINDOWS\system32\phcv9aj0eept.bmp
C:\WINDOWS\system32\pphcv9aj0eept.exe
C:\WINDOWS\system32\setup.ini
C:\WINDOWS\trace
C:\WINDOWS\trace\trace_readme.txt
D:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2008-07-18 to 2008-08-18 )))))))))))))))))))))))))))))))
.

2008-08-18 09:39 . 2008-08-18 09:39 197 --a------ C:\WINDOWS\system32\MRT.INI
2008-08-18 09:36 . 2008-08-18 09:39 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-08-18 09:35 . 2008-08-18 09:35 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2008-08-17 22:11 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-17 22:09 . 2008-08-17 22:09 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Autodesk
2008-08-08 03:04 . 2008-08-08 03:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-08-08 02:23 . 2008-08-08 02:23 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Webroot
2008-08-07 13:21 . 2008-08-07 13:21 134,656 --a------ C:\WINDOWS\system32\upitshgv.exe
2008-08-07 12:34 . 2008-08-07 12:34 134,656 --a------ C:\WINDOWS\system32\ifclwxgp.exe
2008-08-07 11:40 . 2008-08-07 11:40 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\InstallShield
2008-08-07 09:03 . 2008-08-07 09:03 102,400 --a------ C:\WINDOWS\system32\apolatgx.exe
2008-08-06 20:55 . 2008-08-07 11:36 <DIR> d-------- C:\Program Files\yqwhhpc
2008-08-06 00:47 . 2008-08-06 00:47 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-06 00:47 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-06 00:47 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-05 12:17 . 2008-08-05 12:57 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-08-05 10:13 . 2008-08-05 15:41 <DIR> d-------- C:\Program Files\dprllae
2008-07-29 17:59 . 2008-07-29 17:59 <DIR> d-------- C:\Documents and Settings\Manny Russell\Application Data\SUPERAntiSpyware.com
2008-07-29 17:59 . 2008-07-29 17:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-26 18:22 . 2008-07-26 18:22 <DIR> d-------- C:\Documents and Settings\Manny Russell\Application Data\Lavasoft
2008-07-24 23:16 . 2008-07-24 23:16 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-07-24 18:51 . 2008-07-24 21:25 <DIR> d-------- C:\Program Files\Webroot
2008-07-24 18:51 . 2008-07-24 18:51 <DIR> d-------- C:\Documents and Settings\Manny Russell\Application Data\Webroot
2008-07-24 18:51 . 2008-07-24 18:51 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2008-07-24 18:51 . 2008-07-24 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2008-07-24 18:51 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll
2008-07-24 18:51 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2008-07-24 18:51 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2008-07-24 18:51 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2008-07-24 18:51 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2008-07-24 18:47 . 2008-07-24 21:15 164 --a------ C:\install.dat
2008-07-23 14:30 . 2008-07-23 14:29 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-07-23 14:29 . 2008-07-23 14:29 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-23 14:29 . 2008-08-08 03:08 <DIR> d-------- C:\Documents and Settings\Manny Russell\.housecall6.6
2008-07-23 14:01 . 2008-07-23 14:01 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-07-22 13:17 . 2008-07-22 13:17 <DIR> d-------- C:\Program Files\ZohoMeeting
2008-07-21 10:43 . 2008-07-24 23:12 <DIR> d-------- C:\Program Files\rywcxnc

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-08 07:05 --------- d-----w C:\Program Files\Business-in-a-Box
2008-08-08 05:02 --------- d-----w C:\Program Files\Spyware Terminator
2008-08-08 05:02 --------- d-----w C:\Documents and Settings\Manny Russell\Application Data\Spyware Terminator
2008-08-05 19:59 --------- d-----w C:\Program Files\Jasc Software Inc
2008-07-29 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-24 23:29 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-24 23:03 --------- d-----w C:\Program Files\Common Files\Real
2008-07-24 23:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-22 18:02 --------- d-----w C:\Documents and Settings\Manny Russell\Application Data\Autodesk
2008-07-22 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-07-22 01:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-07-11 05:17 --------- d-----w C:\Documents and Settings\Manny Russell\Application Data\SSH
2008-07-03 21:36 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-07-03 21:36 --------- d-----w C:\Program Files\AutoCAD 2008
2008-07-03 21:24 --------- d-----w C:\Program Files\Autodesk
2008-06-29 01:04 --------- d-----w C:\Program Files\iTunes
2008-06-29 01:03 --------- d-----w C:\Program Files\iPod
2008-06-29 01:02 --------- d-----w C:\Program Files\QuickTime
2008-06-29 00:59 --------- d-----w C:\Program Files\Apple Software Update
2008-06-27 02:46 --------- d-----w C:\Program Files\Reference Assemblies
2008-06-27 02:46 --------- d-----w C:\Program Files\MSBuild
2008-06-27 02:44 --------- d-----w C:\Program Files\MSXML 6.0
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-19 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-04-05 20:43 256 ----a-w C:\Documents and Settings\Manny Russell\pool.bin
2007-08-18 00:43 722,176 ----a-w C:\Documents and Settings\Manny Russell\gotomypc_428.exe
2007-02-08 13:47 282 ----a-w C:\Documents and Settings\Manny Russell\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-16 00:00 15360]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 00:56 64512]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 01:58 458752]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 00:03 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-24 14:40 7569408]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 01:22 794713]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40 218032]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 04:40 86960]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 15:33 163840]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-01-26 20:18 40960]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 14:23 1187840]
"DLBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2004-11-09 17:41 69632]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-04-23 11:43 228088]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]
"Webroot Desktop Firewall"="C:\Program Files\Webroot\Desktop Firewall\WDF.exe" [2007-10-20 13:20 1717592]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-12 01:55 102400]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 20:56 5367664]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 07:29 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40 218032]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-01-02 08:24:30 113664]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 12:39:30 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\dlbtcoms.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:DCOM(135)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R1 pwipf6;pwipf6;C:\WINDOWS\system32\drivers\pwipf6.sys [2007-10-18 13:41]
R2 WDFNet;Webroot Desktop Firewall network service;C:\Program Files\Webroot\Desktop Firewall\wdfsvc.exe [2007-10-20 13:20]
S3 FileObjInfo;STFileDriver;C:\Documents and Settings\All Users\Application Data\Spyware Terminator\FileObjInfo.sys [2007-12-24 23:28]
S3 GameConsoleService;GameConsoleService;C:\Program Files\WildTangent\Apps\My HP Game Console\GameConsoleService.exe [2008-05-05 18:25]
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2006-03-16 00:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66e18a7a-da19-11db-8be8-0016d317cb7d}]
\Shell\AutoRun\command - G:\LaunchU3.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-05 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 20:56]

2008-08-05 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 20:56]

2008-08-05 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job
- C:\","D:\","E:\" []
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-RealTray - C:\Program Files\Real\RealPlayer\RealPlay.exe
HKLM-Run-HostManager - C:\Program Files\Common Files\AOL\1167739833\ee\AOLSoftware.exe
HKLM-Run-ccApp - c:\Program Files\Common Files\Symantec Shared\ccApp.exe
HKLM-Run-AOLDialer - C:\Program Files\Common Files\AOL\ACS\AOLDial.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://a810-bisweb.nyc.gov/bisweb/bispi00.jsp


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 10:31:19
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\system32\msdtc.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\dlbtcoms.exe
C:\WINDOWS\ehome\ehrecvr.exe
C:\WINDOWS\ehome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\ehome\ehmsas.exe
C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\verclsid.exe
.
**************************************************************************
.
Completion time: 2008-08-18 10:46:11 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-18 14:46:05

Pre-Run: 77,426,515,968 bytes free
Post-Run: 78,607,187,968 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect /usepmtimer

254 --- E O F --- 2008-08-18 13:40:08

[greyknight17]

Open up your Notepad editor (Start->Run, type in notepad and click OK). Copy the text from the quotebox below into Notepad:

File::
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\upitshgv.exe
C:\WINDOWS\system32\ifclwxgp.exe
C:\WINDOWS\system32\apolatgx.exe
C:\install.dat
Folder::
C:\Program Files\yqwhhpc
C:\Program Files\dprllae
C:\Program Files\rywcxnc

Save this as CFScript.txt in the same location as the ComboFix.exe tool.
Drag the CFScript.txt into ComboFix.exe
Follow the prompts. When finished, it shall produce a log for you. Post that log in your next reply.

Note: Do not click on combofix's window while it's running. That may cause it to stall.

How is it running so far?

[Greenlight]

So far its running good. I can actually change my desktop background now. Thanks A LOT!!!

The new log is below:
ComboFix 08-08-17.03 - Manny Russell 2008-08-18 20:54:12.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.346 [GMT -4:00]
Running from: C:\Documents and Settings\Manny Russell\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Manny Russell\Desktop\CFScript.txt
* Created a new restore point
* Resident AV is active


FILE ::
C:\install.dat
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\apolatgx.exe
C:\WINDOWS\system32\ifclwxgp.exe
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\upitshgv.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\install.dat
C:\Program Files\dprllae
C:\Program Files\rywcxnc
C:\Program Files\yqwhhpc
C:\WINDOWS\imsins.BAK
C:\WINDOWS\system32\apolatgx.exe
C:\WINDOWS\system32\ifclwxgp.exe
C:\WINDOWS\system32\MRT.INI
C:\WINDOWS\system32\upitshgv.exe

.
((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-18 18:11 . 2008-08-18 18:12 <DIR> d-------- C:\Program Files\PlanSwift8
2008-08-17 22:11 . 2008-05-01 10:30 331,776 --------- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-17 22:09 . 2008-08-17 22:09 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Autodesk
2008-08-08 03:04 . 2008-08-08 03:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
2008-08-08 02:23 . 2008-08-08 02:23 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Webroot
2008-08-07 11:40 . 2008-08-07 11:40 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\InstallShield
2008-08-06 00:47 . 2008-08-06 00:47 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-06 00:47 . 2008-07-30 20:14 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-06 00:47 . 2008-07-30 20:14 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-05 12:17 . 2008-08-05 12:57 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
2008-07-29 17:59 . 2008-07-29 17:59 <DIR> d-------- C:\Documents and Settings\Manny Russell\Application Data\SUPERAntiSpyware.com
2008-07-29 17:59 . 2008-07-29 17:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-07-26 18:22 . 2008-07-26 18:22 <DIR> d-------- C:\Documents and Settings\Manny Russell\Application Data\Lavasoft
2008-07-24 23:16 . 2008-07-24 23:16 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot
2008-07-24 18:51 . 2008-07-24 21:25 <DIR> d-------- C:\Program Files\Webroot
2008-07-24 18:51 . 2008-07-24 18:51 <DIR> d-------- C:\Documents and Settings\Manny Russell\Application Data\Webroot
2008-07-24 18:51 . 2008-07-24 18:51 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Webroot
2008-07-24 18:51 . 2008-07-24 21:24 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Webroot
2008-07-24 18:51 . 2008-01-04 20:56 1,526,640 --a------ C:\WINDOWS\WRSetup.dll
2008-07-24 18:51 . 2008-01-04 20:34 163,696 --a------ C:\WINDOWS\system32\drivers\ssidrv.sys
2008-07-24 18:51 . 2008-01-04 20:34 23,920 --a------ C:\WINDOWS\system32\drivers\sskbfd.sys
2008-07-24 18:51 . 2008-01-04 20:34 21,872 --a------ C:\WINDOWS\system32\drivers\sshrmd.sys
2008-07-24 18:51 . 2008-01-04 20:34 20,336 --a------ C:\WINDOWS\system32\drivers\SSFS0BB9.sys
2008-07-23 14:30 . 2008-07-23 14:29 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-07-23 14:29 . 2008-07-23 14:29 <DIR> d-------- C:\Program Files\Trend Micro
2008-07-23 14:29 . 2008-08-08 03:08 <DIR> d-------- C:\Documents and Settings\Manny Russell\.housecall6.6
2008-07-23 14:01 . 2008-07-23 14:01 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Malwarebytes
2008-07-22 13:17 . 2008-07-22 13:17 <DIR> d-------- C:\Program Files\ZohoMeeting

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-08 07:05 --------- d-----w C:\Program Files\Business-in-a-Box
2008-08-08 05:02 --------- d-----w C:\Program Files\Spyware Terminator
2008-08-08 05:02 --------- d-----w C:\Documents and Settings\Manny Russell\Application Data\Spyware Terminator
2008-08-05 19:59 --------- d-----w C:\Program Files\Jasc Software Inc
2008-07-29 21:59 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-24 23:29 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-07-24 23:03 --------- d-----w C:\Program Files\Common Files\Real
2008-07-24 23:01 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-07-22 18:02 --------- d-----w C:\Documents and Settings\Manny Russell\Application Data\Autodesk
2008-07-22 18:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-07-22 01:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spyware Terminator
2008-07-11 05:17 --------- d-----w C:\Documents and Settings\Manny Russell\Application Data\SSH
2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-07 20:32 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll
2008-07-03 21:36 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-07-03 21:36 --------- d-----w C:\Program Files\AutoCAD 2008
2008-07-03 21:24 --------- d-----w C:\Program Files\Autodesk
2008-06-29 01:04 --------- d-----w C:\Program Files\iTunes
2008-06-29 01:03 --------- d-----w C:\Program Files\iPod
2008-06-29 01:02 --------- d-----w C:\Program Files\QuickTime
2008-06-29 00:59 --------- d-----w C:\Program Files\Apple Software Update
2008-06-27 02:46 --------- d-----w C:\Program Files\Reference Assemblies
2008-06-27 02:46 --------- d-----w C:\Program Files\MSBuild
2008-06-27 02:44 --------- d-----w C:\Program Files\MSXML 6.0
2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll
2008-06-24 14:57 3,592,192 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-06-23 09:20 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-06-23 09:20 625,664 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-06-23 09:20 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-06-21 05:23 161,792 ------w C:\WINDOWS\system32\dllcache\ieakui.dll
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll
2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys
2008-06-19 23:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys
2008-04-05 20:43 256 ----a-w C:\Documents and Settings\Manny Russell\pool.bin
2007-08-18 00:43 722,176 ----a-w C:\Documents and Settings\Manny Russell\gotomypc_428.exe
2007-02-08 13:47 282 ----a-w C:\Documents and Settings\Manny Russell\Application Data\wklnhst.dat
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-16 00:00 15360]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40 218032]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-08-06 00:56 64512]
"hpWirelessAssistant"="C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 01:58 458752]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-11 00:03 36975]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-08-24 14:40 7569408]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-17 01:22 794713]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40 218032]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2006-09-11 04:40 86960]
"QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 15:33 163840]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2006-01-26 20:18 40960]
"RecGuard"="C:\Windows\SMINST\RecGuard.exe" [2005-10-11 14:23 1187840]
"DLBTCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLBTtime.dll" [2004-11-09 17:41 69632]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-04-23 11:43 228088]
"Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2008-01-11 19:54 623992]
"HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 16:24 54840]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-05-27 10:50 413696]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-06-02 11:13 267048]
"Webroot Desktop Firewall"="C:\Program Files\Webroot\Desktop Firewall\WDF.exe" [2007-10-20 13:20 1717592]
"QPService"="C:\Program Files\HP\QuickPlay\QPService.exe" [2006-07-12 01:55 102400]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2008-01-04 20:56 5367664]
"High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" [2006-04-18 07:29 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ISUSPM"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2006-09-11 04:40 218032]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2007-01-02 08:24:30 113664]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 12:39:30 73728]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoResolveSearch"= 1 (0x1)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"C:\\WINDOWS\\system32\\dlbtcoms.exe"=
"C:\\WINDOWS\\network diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
"C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"135:TCP"= 135:TCP:DCOM(135)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\IcmpSettings]
"AllowInboundEchoRequest"= 1 (0x1)
"AllowInboundTimestampRequest"= 1 (0x1)
"AllowInboundMaskRequest"= 1 (0x1)
"AllowInboundRouterRequest"= 1 (0x1)
"AllowOutboundDestinationUnreachable"= 1 (0x1)
"AllowOutboundSourceQuench"= 1 (0x1)
"AllowOutboundParameterProblem"= 1 (0x1)
"AllowOutboundTimeExceeded"= 1 (0x1)
"AllowRedirect"= 1 (0x1)
"AllowOutboundPacketTooBig"= 1 (0x1)

R1 pwipf6;pwipf6;C:\WINDOWS\system32\drivers\pwipf6.sys [2007-10-18 13:41]
R2 WDFNet;Webroot Desktop Firewall network service;C:\Program Files\Webroot\Desktop Firewall\wdfsvc.exe [2007-10-20 13:20]
S3 FileObjInfo;STFileDriver;C:\Documents and Settings\All Users\Application Data\Spyware Terminator\FileObjInfo.sys [2007-12-24 23:28]
S3 GameConsoleService;GameConsoleService;C:\Program Files\WildTangent\Apps\My HP Game Console\GameConsoleService.exe [2008-05-05 18:25]
S3 USB_RNDIS_XP;Westell WireSpeed Dual Connect Modem;C:\WINDOWS\system32\DRIVERS\usb8023.sys [2006-03-16 00:00]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{66e18a7a-da19-11db-8be8-0016d317cb7d}]
\Shell\AutoRun\command - G:\LaunchU3.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-08-06 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]

2008-08-05 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 20:56]

2008-08-05 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job
- C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe [2008-01-04 20:56]

2008-08-05 C:\WINDOWS\Tasks\wrSpySweeperTrialSweep.job
- C:\","D:\","E:\" []
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-18 21:04:03
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-18 21:06:05
ComboFix-quarantined-files.txt 2008-08-19 01:05:42
ComboFix2.txt 2008-08-18 14:46:14

Pre-Run: 78,701,187,072 bytes free
Post-Run: 78,676,779,008 bytes free

212 --- E O F --- 2008-08-18 13:40:08

[Greenlight]

I got a few other questions:
C:\WINDOWS\system32\khkxefuj.exe - is this malware?
Also is there anyway to remove a program thats not through the add/remove programs? When I go to add/remove programs asksbar still shows up there and I want to remove it.
Once again thanks for your help

[greyknight17]

Yes, that file is most likely malware related. Do you see it there? If so, run the following scan also:

Perform an online scan with Internet Explorer at Panda ActiveScan http://www.pandasoft.../activescan.htm

* Click on 'Scan your PC' button. There should be a popup - if you have a pop-up blocker, make sure it's not blocking it.
* Click 'Check Now' & a pop-up window will appear.
* Enter your Country, State and E-mail Address & click 'Scan Now' - begin downloading Panda's ActiveX controls (8 MB size).
* Begin the scan by selecting My Computer.
* If it finds any malware, it will offer you a report. Ignore any entry it finds (since it wants you to buy the program for removal) as we will address this later.
* Click on see report. Then click Save report.
* Post that log in your next reply.

What happens when you try to remove it again in the Add/Remove Programs panel? If it doesn't go away still, go into HijackThis > Config > Misc Tools > and click on Open Uninstall Manager. Then look for AskSBar and click on it once. Then click on the Delete this entry button.

[Greenlight]

WOW you're good!!!I was able to delete the askbar through Hijack this. I've attached the new log below:
P.S.- I think I will learn how to remove malware, you've kinda inspired me lol
;*******************************************************************************
*********************************************************************************
*******************
ANALYSIS: 2008-08-20 00:14:11
PROTECTIONS: 1
MALWARE: 39
SUSPECTS: 1
;*******************************************************************************
*********************************************************************************
*******************
PROTECTIONS
Description Version Active Updated
;===============================================================================
=================================================================================
===================
Spy Sweeper with AntiVirus 5.5.7.124 No Yes
;===============================================================================
=================================================================================
===================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===============================================================================
=================================================================================
===================
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.trafficmp.com/]
00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.trafficmp.com/]
00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.doubleclick.net/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.atdmt.com/]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.atdmt.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.247realmedia.com/]
00145405 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.247realmedia.com/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.fastclick.net/]
00145457 Cookie/FastClick TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.fastclick.net/]
00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.tribalfusion.com/]
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.mediaplex.com/]
00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.mediaplex.com/]
00167430 Cookie/myaffiliateprogram TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[www.myaffiliateprogram.com/]
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.com.com/]
00167749 Cookie/Toplist TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.toplist.cz/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.statcounter.com/]
00167753 Cookie/Statcounter TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.statcounter.com/]
00167760 Cookie/Hitslink TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[counter.hitslink.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[ad.yieldmanager.com/]
00168056 Cookie/YieldManager TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[ad.yieldmanager.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.apmebf.com/]
00168061 Cookie/Apmebf TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.apmebf.com/]
00168076 Cookie/BurstNet TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.burstnet.com/]
00168110 Cookie/Server.iad.Liveperson TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[server.iad.liveperson.net/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.advertising.com/]
00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.advertising.com/]
00170304 Cookie/WebtrendsLive TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[statse.webtrendslive.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.ads.pointroll.com/]
00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Cookies\[email protected][1].txt
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.realmedia.com/]
00170556 Cookie/RealMedia TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.realmedia.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.questionmarket.com/]
00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.questionmarket.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.zedo.com/]
00172221 Cookie/Zedo TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.zedo.com/]
00173520 Cookie/Bluestreak TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.bluestreak.com/]
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adrevolver.com/]
00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adrevolver.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adultfriendfinder.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adultfriendfinder.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adultfriendfinder.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adultfriendfinder.com/]
00191644 Cookie/adultfriendfinder TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.adultfriendfinder.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.target.com/]
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.target.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.did-it.com/]
00207862 Cookie/did-it TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.did-it.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.atwola.com/]
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Application Data\Mozilla\Firefox\Profiles\04a4hfl5.default\cookies.txt[.atwola.com/]
00325830 Cookie/Bridgetrack TrackingCookie No 0 Yes No C:\Documents and Settings\Manny Russell\Cookies\[email protected][2].txt
00377802 Spyware/PeoplePC Spyware No 0 Yes No C:\Program Files\Online Services\PeoplePC\ISP5900\Dll\RAS.DLL
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP328\A0075314.EXE
01606636 Cookie/Adserver TrackingCookie No 0 Yes No C:\Documents and Settings\Bileysi Russell\Application Data\Mozilla\Firefox\Profiles\3zi88nkd.default\cookies.txt[.adserver.easyad.info/]
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP328\A0075298.sys
03398329 Application/XPAntivirus2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP316\A0068188.exe
03470286 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP321\A0073707.exe
03470287 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP321\A0073708.exe
03470287 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP319\A0070449.exe
03471754 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP322\A0073753.exe
03471754 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP326\A0075070.exe
03471755 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP328\A0075331.exe
03471755 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP322\A0073758.exe
03471755 Application/AntivirusXP2008 HackTools No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP326\A0075076.exe
03476345 Adware/AntivirusXP2008 Adware No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP322\A0073746.exe
03476345 Adware/AntivirusXP2008 Adware No 0 Yes No C:\System Volume Information\_restore{3A579F61-82CF-4117-919A-DB7B394CD5BC}\RP327\A0075169.exe
;===============================================================================
=================================================================================
===================
SUSPECTS
Sent Location 
;===============================================================================
=================================================================================
===================
No C:\Documents and Settings\Manny Russell\Desktop\ComboFix.exe 
;===============================================================================
=================================================================================
===================
VULNERABILITIES
Id Severity Description 
;===============================================================================
=================================================================================
===================
182048 HIGH MS07-069 
176382 HIGH MS07-057 
170906 HIGH MS07-045 
164913 HIGH MS07-033 
160623 HIGH MS07-027 
150253 HIGH MS07-016 
;===============================================================================
=================================================================================
===================

[greyknight17]

Nothing much leftover besides some cookie files and system restore points (which removing ComboFix will take care of for you ).

Go into Firefox->Tools->Clear Private Data and hit OK to delete all your cookie and temp files.

Good job. Your log is clean.

To help prevent future spyware infections, read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If none, go to Start->Run, copy/paste in combofix /u and hit OK to remove it. You should be set to go.

[greyknight17]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.