Here's the combofix log:
ComboFix 08-09-05.09 - Owner 2008-09-08 11:39:25.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.237 [GMT -5:00]
Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\NetworkService\Application Data\ptunzybl
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\profiles.ini
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\cert8.db
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\compatibility.ini
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\compreg.dat
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\cookies.sqlite
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\key3.db
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\permissions.sqlite
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\places.sqlite
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\pluginreg.dat
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\prefs.js
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\secmod.db
C:\Documents and Settings\NetworkService\Application Data\ptunzybl\Profiles\t7gbmhbx.default\xpti.dat
C:\Documents and Settings\Owner\Application Data\ptunzybl
C:\Documents and Settings\Owner\Application Data\ptunzybl\profiles.ini
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\cert8.db
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\compatibility.ini
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\compreg.dat
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\cookies.sqlite
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\key3.db
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\parent.lock
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\permissions.sqlite
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\places.sqlite
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\pluginreg.dat
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\prefs.js
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\secmod.db
C:\Documents and Settings\Owner\Application Data\ptunzybl\Profiles\7fw58l3g.default\xpti.dat
C:\WINDOWS\system32\drivers\hfpvrdvl.sys
C:\WINDOWS\system32\tmwpkzn.dll
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_HFPVRDVL
-------\Service_hfpvrdvl
((((((((((((((((((((((((( Files Created from 2008-08-08 to 2008-09-08 )))))))))))))))))))))))))))))))
.
2008-09-07 11:35 . 2008-09-07 11:35 <DIR> d-------- C:\_OTMoveIt
2008-09-06 18:55 . 2008-09-06 18:56 <DIR> d-------- C:\rsit
2008-09-05 23:25 . 2008-09-05 23:26 <DIR> d-------- C:\Program Files\ERUNT
2008-09-05 13:33 . 2008-09-06 09:42 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\ITTNord
2008-09-04 22:32 . 2008-09-04 22:32 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\iolo
2008-09-04 22:32 . 2008-09-04 22:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\iolo
2008-09-04 18:33 . 2008-09-04 18:33 2,855 --a------ C:\WINDOWS\system32\mem.PIF
2008-09-01 19:43 . 2008-09-01 19:43 2 --a------ C:\WINDOWS\msoffice.ini
2008-09-01 19:10 . 2008-09-01 19:17 2,808 --a------ C:\WINDOWS\system32\tmp.reg
2008-09-01 18:12 . 2008-09-04 21:48 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-09-01 18:12 . 2008-09-01 18:12 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
2008-09-01 18:12 . 2008-09-01 18:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-09-01 18:12 . 2008-09-02 00:16 38,528 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-09-01 18:12 . 2008-09-02 00:16 17,200 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-09-01 17:27 . 2008-04-08 20:08 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-09-01 15:45 . 2008-09-01 15:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-09-01 15:44 . 2008-09-01 19:58 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com
2008-08-31 19:15 . 2008-08-31 19:15 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\McAfee
2008-08-31 18:32 . 2008-08-31 18:32 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\McAfee
2008-08-23 16:52 . 2008-08-23 16:53 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Go-Go Gourmet Chef of the Year
2008-08-23 09:33 . 2008-09-08 11:49 20,565 --a------ C:\WINDOWS\system32\Config.MPF
2008-08-23 09:32 . 2006-03-03 08:07 143,360 --a------ C:\WINDOWS\system32\dunzip32.dll
2008-08-23 09:29 . 2007-11-22 06:44 201,320 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-08-23 09:29 . 2007-07-13 06:20 113,952 --a------ C:\WINDOWS\system32\drivers\Mpfp.sys
2008-08-23 09:29 . 2007-11-22 06:44 79,304 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-08-23 09:29 . 2007-12-02 12:51 40,488 --a------ C:\WINDOWS\system32\drivers\mfesmfk.sys
2008-08-23 09:29 . 2007-11-22 06:44 35,240 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-08-23 09:29 . 2007-11-22 06:44 33,832 --a------ C:\WINDOWS\system32\drivers\mferkdk.sys
2008-08-23 09:27 . 2008-08-23 09:28 <DIR> d-------- C:\Program Files\McAfee.com
2008-08-23 09:27 . 2008-09-05 07:29 <DIR> d-------- C:\Program Files\McAfee
2008-08-23 09:27 . 2008-08-23 09:29 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-08-23 09:19 . 2008-08-31 18:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-08-23 07:51 . 2008-08-23 07:51 <DIR> d-------- C:\WINDOWS\McAfee.com
2008-08-21 09:32 . 2008-08-22 16:31 3,350 --a------ C:\WINDOWS\COSTAR.TMP
2008-08-20 21:15 . 2008-08-23 09:07 174 --a------ C:\Documents and Settings\All Users\Application Data\ustore.dat
2008-08-20 20:45 . 2008-08-20 20:45 <DIR> d-------- C:\WINDOWS\system32\scripting
2008-08-20 20:45 . 2008-08-20 20:45 <DIR> d-------- C:\WINDOWS\system32\en
2008-08-20 20:45 . 2008-08-20 20:45 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-20 19:27 . 2008-08-20 19:27 <DIR> d-------- C:\98ef2acd623800fc40
2008-08-19 00:05 . 2008-04-13 19:12 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll
2008-08-19 00:05 . 2008-04-13 19:12 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll
2008-08-19 00:05 . 2008-04-13 19:12 276,992 --------- C:\WINDOWS\system32\wmphoto.dll
2008-08-19 00:05 . 2008-04-13 19:12 69,120 --------- C:\WINDOWS\system32\wlanapi.dll
2008-08-19 00:05 . 2008-04-13 19:12 53,248 --------- C:\WINDOWS\system32\tsgqec.dll
2008-08-19 00:05 . 2008-04-13 19:12 50,688 --------- C:\WINDOWS\system32\tspkg.dll
2008-08-19 00:03 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll
2008-08-15 18:19 . 2008-08-15 18:26 843,503,843 --a------ C:\lotrosetup-1a.bin
2008-08-14 17:00 . 2008-04-11 14:04 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
2008-08-14 17:00 . 2008-05-01 09:33 331,776 -----c--- C:\WINDOWS\system32\dllcache\msadce.dll
2008-08-10 22:02 . 2008-09-01 21:40 <DIR> d-------- C:\Program Files\Google
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-08 12:38 121,344 ----a-w C:\WINDOWS\system32\gxqwoui.dll
2008-09-08 04:10 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-09-07 22:43 --------- d-----w C:\Program Files\Trojan Remover
2008-09-07 16:27 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2008-09-06 14:45 --------- d-----w C:\Program Files\Yahoo! Games
2008-09-06 14:44 --------- d-----w C:\Documents and Settings\Owner\Application Data\PlayFirst
2008-09-06 14:44 --------- d-----w C:\Documents and Settings\All Users\Application Data\PlayFirst
2008-09-05 00:49 --------- d-----w C:\Program Files\Trend Micro
2008-09-02 00:46 --------- d-----w C:\Program Files\Pure Networks
2008-09-02 00:46 --------- d-----w C:\Program Files\Common Files\AOL
2008-09-02 00:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL
2008-09-01 21:32 --------- d-----w C:\Documents and Settings\Owner\Application Data\AOL
2008-08-24 04:49 --------- d-----w C:\Documents and Settings\Owner\Application Data\funkitron
2008-08-23 14:36 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-08-23 14:25 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-08-15 22:18 64,736 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
2008-08-13 03:32 --------- d-----w C:\Program Files\Microsoft Picture It! 9
2008-08-06 00:20 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-06 00:19 --------- d-----w C:\Program Files\StorageSync
2008-08-02 03:26 --------- d-----w C:\Documents and Settings\Owner\Application Data\HP
2008-07-20 14:40 --------- d-----w C:\Documents and Settings\Owner\Application Data\Ludia
2008-07-20 14:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Ludia
2008-07-20 14:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\PBGsavesDirectory
2008-07-20 14:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\NeoEdge Networks
2008-07-19 03:10 94,920 ----a-w C:\WINDOWS\system32\cdm.dll
2008-07-19 03:10 53,448 ----a-w C:\WINDOWS\system32\wuauclt.exe
2008-07-19 03:10 45,768 ----a-w C:\WINDOWS\system32\wups2.dll
2008-07-19 03:10 36,552 ----a-w C:\WINDOWS\system32\wups.dll
2008-07-19 03:09 563,912 ----a-w C:\WINDOWS\system32\wuapi.dll
2008-07-19 03:09 325,832 ----a-w C:\WINDOWS\system32\wucltui.dll
2008-07-19 03:09 205,000 ----a-w C:\WINDOWS\system32\wuweb.dll
2008-07-19 03:09 1,811,656 ----a-w C:\WINDOWS\system32\wuaueng.dll
2008-07-19 00:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\FreshGames
2008-07-17 01:51 --------- d-----w C:\Documents and Settings\Owner\Application Data\MysteryStudio
2008-07-08 22:40 --------- d-----w C:\Documents and Settings\Owner\Application Data\Kermit 95
2008-07-07 20:26 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-06-24 16:43 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:09 666,112 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-02-04 19:55 56,912 ----a-w C:\Documents and Settings\Owner\g2mdlhlpx.exe
2005-04-04 17:41 0 ----a-w C:\Documents and Settings\Owner\Application Data\wklnhst.dat
2001-03-26 15:13 32,768 ----a-w C:\Program Files\internet explorer\plugins\csutil.dll
.
((((((((((((((((((((((((((((( snapshot_2008-09-08_ 7.45.21.18 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-09-08 11:49:55 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-09-08 16:35:56 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-09-08 11:49:55 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-09-08 16:35:56 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-09-08 11:49:55 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-09-08 16:35:56 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((((( System Restore )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-08 11:34 1394177 C:\Program Files\Yahoo! Games\Sally's Spa\SallysSpa.exe
2008-09-07 20:58 1394177 {AB52BD40-7182-4E6D-A2D3-98415849E1A9}\RP5\A0000101.exe
C:\WINDOWS\system32\tmwpkzn.dll
2003-03-31 07:00 121344 {AB52BD40-7182-4E6D-A2D3-98415849E1A9}\RP6\A0000157.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 15360]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 50688]
"TrojanScanner"="C:\Program Files\Trojan Remover\Trjscan.exe" [2008-08-21 914512]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2004-03-03 2904064]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-11-01 582992]
"MBkLogOnHook"="C:\Program Files\McAfee\MBK\LogOnHook.exe" [2007-01-08 20480]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-02-21 155648]
"PDFPrint Tray Helper"="C:\PDFPrint\PDFPrint.exe" [2007-03-23 690176]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 155648]
"nwiz"="nwiz.exe" [2004-03-03 C:\WINDOWS\system32\nwiz.exe]
"nForce Tray Options"="sstray.exe" [2003-09-02 C:\WINDOWS\system32\sstray.exe]
"CHotkey"="zHotkey.exe" [2004-05-17 C:\WINDOWS\zHotkey.exe]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-05-15 217193]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2005-09-24 282624]
HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2005-09-24 73728]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoBandCustomize"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.DIV3"= DivXc32.dll
"vidc.DIV4"= DivXc32f.dll
"msacm.divxa32"= DivXa32.acm
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll schannel.dll digest.dll msnsspc.dll
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Yahoo! Games\\Insaniquarium Deluxe\\InsaniquariumDeluxe.exe"=
"C:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"C:\\Program Files\\Yahoo! Games\\Slingo Deluxe\\Slingo.exe"=
"C:\\Program Files\\Yahoo! Games\\JEOPARDY!\\JEOPARDY!.exe"=
"C:\\WINDOWS\\system32"=
"C:\\WINDOWS\\system32\\dpvsetup.exe"=
"c:\\PDFPrint\\PDFPrintService.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"80:TCP"= 80:TCP:@xpsp2res.dll,-22009
"58937:TCP"= 58937:TCP:@xpsp2res.dll,-22009
R2 CSLServer;Co*STAR License Server;c:\Costar32\CSLServer.exe [2001-05-14 53248]
R2 PDFPrint;PDFPrint Listener Service;C:\PDFPRINT\PDFPRINTSERVICE.EXE [2007-04-17 723968]
R3 tap0801;TAP-Win32 Adapter V8;C:\WINDOWS\system32\DRIVERS\tap0801.sys [2004-06-24 23552]
S3 WlanUIB;NETGEAR 802.11b USB Driver;C:\WINDOWS\system32\DRIVERS\MA111nd5.sys [2004-03-03 666624]
.
Contents of the 'Scheduled Tasks' folder
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-08 11:46:32
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\McAfee\MBK\MBackMonitor.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\PROGRA~1\COMMON~1\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\Mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
.
**************************************************************************
.
Completion time: 2008-09-08 11:53:25 - machine was rebooted [Owner]
ComboFix-quarantined-files.txt 2008-09-08 16:53:11
ComboFix2.txt 2008-09-08 12:46:05
Pre-Run: 143,443,783,680 bytes free
Post-Run: 143,457,968,128 bytes free
257 --- E O F --- 2008-08-21 12:07:34
Edited by cupidringmybelle, 08 September 2008 - 11:00 AM.