BleepingComputer.com: Strange infjection. Virus/malware scanners are being terminated

I have recently encountered a strange problem with my Windows XP Pro PC. Any kind of search or scan engine terminates immediately or mid-scan. Additionally, when I perform a google search, and then click on a link, often I am led to another site that is clearly not legit. Anyway, I would appreciate some help. I tried running virus scans (avira), spybot, malwarebytes, housecall, etc but all scans and searches terminate. I also tried it in safe mode to no avail.

DDS:

DDS (Ver_09-05-14.01) - NTFSx86
Run by User1 at 11:51:59.93 on Tue 06/23/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.513 [GMT -7:00]

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {804FD2B8-FFA4-00EB-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00E3-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00FC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00D2-0D24-347CA8A3377C}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Sygate\SPF\smc.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\USER1\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\opera.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\USER1\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
uInternet Connection Wizard,ShellNext = hxxp://www.utorrent.com/testport.php?port=6001
mSearchAssistant = hxxp://www.google.com
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [SansaDispatch] c:\documents and settings\USER1\application data\sandisk\sansa updater\SansaDispatch.exe
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [avgnt] "c:\program files\avira\antivir personaledition classic\avgnt.exe" /min
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
StartupFolder: c:\docume~1\USER1\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony\sony picture utility\volumewatcher\SPUVolumeWatcher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoru~1\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\program files\PartyPoker.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\USER1\applic~1\mozilla\firefox\profiles\rqqm3zfq.default\
FF - plugin: c:\documents and settings\USER1\application data\mozilla\firefox\profiles\rqqm3zfq.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-18 64160]
R1 avgio;avgio;c:\program files\avira\antivir personaledition classic\avgio.sys [2008-9-4 11608]
R2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler;c:\program files\avira\antivir personaledition classic\sched.exe [2008-9-4 68865]
R2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard;c:\program files\avira\antivir personaledition classic\avguard.exe [2008-9-4 151297]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1003344]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-8-30 24652]
R3 avgntflt;avgntflt;c:\program files\avira\antivir personaledition classic\avgntflt.sys [2008-9-4 52056]
S3 MBAMSwissArmy;MBAMSwissArmy;c:\windows\system32\drivers\mbamswissarmy.sys [2008-9-4 40160]
S3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\1.tmp [2009-6-23 5760]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2003-6-13 30336]
S4 vsdatant;vsdatant; [x]

============== File Associations ===============

regfile=regedit.exe "%1" %*
scrfile="%1" %*

=============== Created Last 30 ================

2009-06-23 11:51 <DIR> --d----- c:\windows\system32\KB905474
2009-06-23 11:07 <DIR> --d----- c:\program files\Trend Micro
2009-06-23 10:02 5,760 -------- c:\windows\system32\1.tmp
2009-06-23 09:43 552 a------- c:\windows\system32\d3d8caps.dat
2009-06-22 22:43 <DIR> --d----- c:\program files\Sophos
2009-06-22 21:29 102,664 a------- c:\windows\system32\drivers\tmcomm.sys
2009-06-22 21:28 <DIR> --d----- c:\documents and settings\USER1\.housecall6.6
2009-06-22 21:06 <DIR> --d----- c:\program files\ESET
2009-06-22 20:18 <DIR> --d----- c:\program files\CCleaner
2009-06-21 18:06 <DIR> --d----- c:\program files\AskBarDis
2009-06-21 18:06 <DIR> --d----- c:\program files\uTorrent
2009-06-20 16:04 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-20 16:04 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-19 20:51 <DIR> --dsh--- c:\documents and settings\USER1\IECompatCache
2009-06-19 17:52 <DIR> --dsh--- c:\documents and settings\USER1\PrivacIE
2009-06-19 17:51 <DIR> --dsh--- c:\documents and settings\USER1\IETldCache
2009-06-19 16:39 <DIR> -cd-h--- c:\windows\ie8
2009-06-18 12:49 15,688 a------- c:\windows\system32\lsdelete.exe
2009-06-18 11:31 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-06-18 11:29 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

==================== Find3M ====================

2009-05-26 13:20 40,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-05-26 13:19 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-07 08:44 344,064 a------- c:\windows\system32\localspl.dll
2009-04-17 02:58 1,846,656 a------- c:\windows\system32\win32k.sys
2009-04-15 08:26 583,168 a------- c:\windows\system32\rpcrt4.dll

============= FINISH: 11:53:57.93 ===============


Hijack This! Log:


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:59:48 AM, on 6/23/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\USER1\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\opera.exe
C:\Documents and Settings\USER1\Desktop\dds.scr
C:\WINDOWS\system32\cmd.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\system32\cscript.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.utorrent.com/testport.php?port=6001
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\USER1\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O20 - AppInit_DLLs:
O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7462 bytes

So I ran ComboFix and it seems to have fixed most of my problems. I'm not sure if something is still there that I cannot see, but MBAM revealed no issues after a quick scan. Here is the HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:30:06 AM, on 6/25/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Sygate\SPF\smc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Documents and Settings\USER1\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.utorrent.com/testport.php?port=6001
O2 - BHO: AskBar BHO - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: Ask Toolbar - {3041d03e-fd4b-44e0-b742-2d9b88305f98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SmcService] C:\PROGRA~1\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\USER1\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: AutorunsDisabled
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MI1933~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\Program Files\PartyPoker.exe (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - C:\Program Files\Sygate\SPF\smc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 7468 bytes

Hello peaceandlove and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
    
  • DDS.pif
  
  
• Double click on the DDS icon, allow it to run.
  
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
  
• Notepad will open with the results.
  
• Follow the instructions that pop up for posting the results.
  
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Update on problems: I ran combofix and the google redirecting and the shutting down of antispyware and antivirus softwares during scanning went away. I am still worried that residual malware could still be hidden so I would appreciate some further closure on the health of my system.

DDS log as requested:

Run by USER2 at 9:34:27.87 on Tue 06/30/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.542 [GMT -7:00]

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {804FD2B8-FFA4-00EB-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00E3-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00FC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00D2-0D24-347CA8A3377C}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Sygate\SPF\smc.exe
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Avira\AntiVir Desktop\avguard.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\windows\ld11.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\USER2\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
svchost
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AIM6\anotify.exe
C:\Documents and Settings\USER2\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.utorrent.com/testport.php?port=6001
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [SansaDispatch] c:\documents and settings\USER2\application data\sandisk\sansa updater\SansaDispatch.exe
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe"
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [avgnt] "c:\program files\avira\antivir desktop\avgnt.exe" /min
mRun: [sysldtray] c:\windows\ld11.exe
StartupFolder: c:\docume~1\USER2\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony\sony picture utility\volumewatcher\SPUVolumeWatcher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoru~1\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
uPolicies-system: EnableProfileQuota = 1 (0x1)
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\program files\PartyPoker.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\USER2\applic~1\mozilla\firefox\profiles\rqqm3zfq.default\
FF - plugin: c:\documents and settings\USER2\application data\mozilla\firefox\profiles\rqqm3zfq.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-18 64160]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-6-24 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-6-24 108289]
R2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-6-24 185089]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-6-24 55640]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1003344]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-8-30 24652]
S4 vsdatant;vsdatant; [x]

=============== Created Last 30 ================

2009-06-29 11:53 2 a------- c:\windows\010112010146118114.dat
2009-06-29 11:52 30,720 ----h--- c:\windows\ld11.exe
2009-06-24 10:47 55,640 a------- c:\windows\system32\drivers\avgntflt.sys
2009-06-24 10:47 <DIR> --d----- c:\program files\Avira
2009-06-24 10:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-06-23 16:02 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-06-23 15:47 <DIR> --d----- C:\cmdcons
2009-06-23 15:44 161,792 a------- c:\windows\SWREG.exe
2009-06-23 15:44 155,136 a------- c:\windows\PEV.exe
2009-06-23 15:44 98,816 a------- c:\windows\sed.exe
2009-06-23 11:51 <DIR> --d----- c:\windows\system32\KB905474
2009-06-23 11:07 <DIR> --d----- c:\program files\Trend Micro
2009-06-23 09:43 552 a------- c:\windows\system32\d3d8caps.dat
2009-06-22 22:43 <DIR> --d----- c:\program files\Sophos
2009-06-22 21:28 <DIR> --d----- c:\documents and settings\USER2\.housecall6.6
2009-06-22 21:06 <DIR> --d----- c:\program files\ESET
2009-06-22 20:18 <DIR> --d----- c:\program files\CCleaner
2009-06-21 18:06 <DIR> --d----- c:\program files\AskBarDis
2009-06-21 18:06 <DIR> --d----- c:\program files\uTorrent
2009-06-20 23:43 <DIR> --d----- c:\windows\ie8updates
2009-06-20 16:04 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-20 16:04 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-19 20:51 <DIR> --dsh--- c:\documents and settings\USER2\IECompatCache
2009-06-19 17:52 <DIR> --dsh--- c:\documents and settings\USER2\PrivacIE
2009-06-19 17:51 <DIR> --dsh--- c:\documents and settings\USER2\IETldCache
2009-06-19 16:39 <DIR> -cd-h--- c:\windows\ie8
2009-06-18 12:49 15,688 a------- c:\windows\system32\lsdelete.exe
2009-06-18 11:31 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-06-18 11:29 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

==================== Find3M ====================

2009-06-17 11:27 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 11:27 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-07 08:44 344,064 a------- c:\windows\system32\localspl.dll
2009-04-17 02:58 1,846,656 a------- c:\windows\system32\win32k.sys
2009-04-15 08:26 583,168 a------- c:\windows\system32\rpcrt4.dll

============= FINISH: 9:35:08.93 ===============

Hi,

The system is still infected. I want to see ComboFix log created by your earlier run (you shouldn't had run ComboFix without supervision!). Please post the ComboFix report back here.

I have attached my combo fix log.

Thanks.

Hi,

I recommend to uninstall P2P file sharing stuff like uTorrent. Those used for dubious P2P downloads put the system under risk.


Please delete old ComboFix.exe file.

After that, please follow the steps below.

1. Download combofix from any of these links and save it to Desktop:
Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log & a fresh dds.txt log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.

If you have problems with Combofix usage, see here

Combofix log:

ComboFix 09-07-05.01 - USER2 07/05/2009 16:52.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.693 [GMT -7:00]
Running from: c:\documents and settings\USER2\Desktop\ComboFix.exe
AV: AntiVir Desktop *On-access scanning enabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {804FD2B8-FFA4-00EB-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00D2-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00E3-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00FC-0D24-347CA8A3377C}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\010112010146118114.dat
c:\windows\freddy49.exe
c:\windows\Installer\197b8.msp
c:\windows\Installer\197bb.msp
c:\windows\Installer\218c95c.msp
c:\windows\Installer\218c95d.msp
c:\windows\Installer\218c95e.msp
c:\windows\Installer\218c95f.msp
c:\windows\Installer\218c960.msp
c:\windows\Installer\218c961.msp
c:\windows\Installer\218c962.msp
c:\windows\Installer\218c963.msp
c:\windows\Installer\218c964.msp
c:\windows\Installer\29e9bc.msp
c:\windows\Installer\29e9bf.msp
c:\windows\Installer\2aad4b1.msp
c:\windows\Installer\2aad4b2.msp
c:\windows\Installer\2aad4b3.msp
c:\windows\Installer\2aad4b4.msp
c:\windows\Installer\2aad4b5.msp
c:\windows\Installer\2aad4b6.msp
c:\windows\Installer\2aad4b7.msp
c:\windows\Installer\2aad4b8.msp
c:\windows\Installer\2aad4b9.msp
c:\windows\Installer\2dba4d7.msp
c:\windows\Installer\55386.msp
c:\windows\Installer\5691f7d.msp
c:\windows\Installer\658e79.msp
c:\windows\Installer\b6a6c.msi
c:\windows\Installer\b6a6d.msp
c:\windows\Installer\b6a6e.msp
c:\windows\Installer\b6a6f.msp
c:\windows\Installer\b6a70.msp
c:\windows\Installer\b6a71.msp
c:\windows\Installer\b6a72.msp
c:\windows\Installer\b6a73.msp
c:\windows\Installer\b6a74.msp
c:\windows\Installer\b6a75.msp
c:\windows\Installer\e9a589.msp

c:\windows\system32\proquota.exe . . . is missing!!

.
((((((((((((((((((((((((( Files Created from 2009-06-05 to 2009-07-05 )))))))))))))))))))))))))))))))
.

2009-07-01 20:37 . 2009-07-01 20:37 1 ---h--w- c:\windows\bf23567.dat
2009-06-24 17:47 . 2009-03-30 17:33 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2009-06-24 17:47 . 2009-02-13 19:29 22360 ----a-w- c:\windows\system32\drivers\avgntmgr.sys
2009-06-24 17:47 . 2009-03-24 23:08 55640 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2009-06-24 17:47 . 2009-02-13 19:17 45416 ----a-w- c:\windows\system32\drivers\avgntdd.sys
2009-06-24 17:47 . 2009-06-24 17:47 -------- d-----w- c:\program files\Avira
2009-06-24 17:47 . 2009-06-24 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Avira
2009-06-23 18:51 . 2009-06-23 18:51 -------- d-----w- c:\windows\system32\KB905474
2009-06-23 18:51 . 2009-03-11 05:26 1403264 ----a-w- c:\windows\system32\KB905474\wganotifypackageinner.exe
2009-06-23 18:51 . 2009-03-11 05:18 453512 ----a-w- c:\windows\system32\KB905474\wgasetup.exe
2009-06-23 18:07 . 2009-06-23 18:07 -------- d-----w- c:\program files\Trend Micro
2009-06-23 16:43 . 2009-06-23 16:43 552 ----a-w- c:\windows\system32\d3d8caps.dat
2009-06-23 05:43 . 2009-06-23 05:43 -------- d-----w- c:\program files\Sophos
2009-06-23 04:28 . 2009-06-24 00:11 -------- d-----w- c:\documents and settings\USER2\.housecall6.6
2009-06-23 04:06 . 2009-06-23 04:06 -------- d-----w- c:\program files\ESET
2009-06-23 03:18 . 2009-06-23 03:18 -------- d-----w- c:\program files\CCleaner
2009-06-22 18:31 . 2009-06-22 18:31 -------- d-sh--w- c:\documents and settings\NetworkService\IETldCache
2009-06-22 01:06 . 2009-06-22 01:06 -------- d-----w- c:\program files\AskBarDis
2009-06-22 01:06 . 2009-06-22 01:06 -------- d-----w- c:\program files\uTorrent
2009-06-21 06:43 . 2009-06-21 06:43 -------- d-----w- c:\windows\ie8updates
2009-06-20 23:04 . 2009-04-30 21:22 12800 -c----w- c:\windows\system32\dllcache\xpshims.dll
2009-06-20 23:04 . 2009-04-30 21:22 246272 -c----w- c:\windows\system32\dllcache\ieproxy.dll
2009-06-20 19:45 . 2009-06-20 19:45 -------- d-sh--w- c:\documents and settings\Family\IETldCache
2009-06-20 03:51 . 2009-06-20 03:51 -------- d-sh--w- c:\documents and settings\USER2\IECompatCache
2009-06-20 00:52 . 2009-06-20 00:52 -------- d-sh--w- c:\documents and settings\USER2\PrivacIE
2009-06-20 00:51 . 2009-06-20 00:51 -------- d-sh--w- c:\documents and settings\USER2\IETldCache
2009-06-20 00:46 . 2009-06-20 00:46 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-06-19 23:46 . 2009-06-19 23:46 -------- d-sh--w- c:\windows\system32\config\systemprofile\IETldCache
2009-06-19 23:39 . 2009-06-19 23:40 -------- dc-h--w- c:\windows\ie8
2009-06-18 19:49 . 2009-06-18 18:31 15688 ----a-w- c:\windows\system32\lsdelete.exe
2009-06-18 18:31 . 2009-06-18 18:30 64160 ----a-w- c:\windows\system32\drivers\Lbd.sys
2009-06-18 18:31 . 2009-06-29 18:59 314712 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\threatwork.exe
2009-06-18 18:31 . 2009-06-29 18:57 25440 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\savapibridge.dll
2009-06-18 18:31 . 2009-07-02 18:35 348496 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lavalicense.dll
2009-06-18 18:31 . 2009-06-29 18:57 169312 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lavamessage.dll
2009-06-18 18:31 . 2009-06-18 18:31 15688 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\lsdelete.exe
2009-06-18 18:31 . 2009-07-02 18:35 298336 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\UpdateManager.dll
2009-06-18 18:31 . 2009-07-02 18:35 84832 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\ShellExt.dll
2009-06-18 18:30 . 2009-07-02 18:35 1630560 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Resources.dll
2009-06-18 18:30 . 2009-07-02 18:35 246128 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\RPAPI.dll
2009-06-18 18:30 . 2009-07-02 18:35 40288 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\PrivacyClean.dll
2009-06-18 18:30 . 2009-06-29 18:50 85352 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Drivers\32\AAWDriverTool.exe
2009-06-18 18:30 . 2009-06-18 18:30 64160 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Drivers\32\lbd.sys
2009-06-18 18:30 . 2009-07-02 18:35 664424 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\CEAPI.dll
2009-06-18 18:30 . 2009-07-02 18:35 563064 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Ad-AwareCommand.exe
2009-06-18 18:30 . 2009-07-02 18:35 566632 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Ad-AwareAdmin.exe
2009-06-18 18:30 . 2009-07-02 18:35 2352968 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\Ad-Aware.exe
2009-06-18 18:30 . 2009-06-29 18:45 629072 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\AAWWSC.exe
2009-06-18 18:30 . 2009-07-02 18:35 520024 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\AAWTray.exe
2009-06-18 18:30 . 2009-07-02 18:35 1029456 ----a-w- c:\documents and settings\All Users\Application Data\Lavasoft\Ad-Aware\update\AAWService.exe
2009-06-18 18:29 . 2009-06-18 18:29 -------- dc-h--w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}
2009-06-18 18:29 . 2009-03-12 08:17 2902048 -c--a-w- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}\Ad-AwareAE.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-05 23:57 . 2008-12-06 20:10 -------- d-----w- c:\program files\PeerGuardian2
2009-07-05 23:54 . 2008-04-18 17:48 -------- d-----w- c:\documents and settings\USER2\Application Data\uTorrent
2009-06-24 02:54 . 2005-08-12 05:51 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-06-23 23:06 . 2008-09-04 23:50 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-06-23 23:06 . 2008-11-14 06:33 3561743 -c--a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2009-06-23 16:28 . 2006-11-27 18:14 1324 ----a-w- c:\windows\system32\d3d9caps.dat
2009-06-18 18:21 . 2005-09-05 02:47 -------- d-----w- c:\program files\Common Files\Wise Installation Wizard
2009-06-17 18:27 . 2008-09-04 23:50 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 18:27 . 2008-09-04 23:50 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-06-16 00:00 . 2005-08-12 05:51 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-06-14 21:59 . 2007-09-28 23:18 -------- d-----w- c:\documents and settings\All Users\Application Data\Microsoft Help
2009-05-27 04:33 . 2009-05-27 04:33 -------- d-----w- c:\program files\Microsoft Silverlight
2009-05-19 08:36 . 2009-07-03 06:53 2884832 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\vwpt.exe
2009-05-19 08:36 . 2009-07-03 06:53 28 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\unregister.bat
2009-05-19 08:36 . 2009-07-03 06:53 1484856 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\toolbar.exe
2009-05-19 08:36 . 2009-07-03 06:53 25 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\register.bat
2009-05-19 08:36 . 2009-07-03 06:53 97072 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\bsetutil.exe
2009-05-19 08:36 . 2009-07-03 06:53 142040 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\alsetup.exe
2009-05-19 08:36 . 2009-07-03 06:53 30512 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\Uninstaller.exe
2009-05-19 08:36 . 2009-07-03 06:53 111920 ------w- c:\documents and settings\All Users\Application Data\AOL OCP\AIM\Storage\All Users\SUDS_BBC2683C\CACHE\4426.0.4\AOLSearch.dll
2009-05-13 05:15 . 2004-08-04 04:56 915456 ----a-w- c:\windows\system32\wininet.dll
2009-05-07 15:44 . 2004-08-04 04:56 344064 ----a-w- c:\windows\system32\localspl.dll
2009-04-17 09:58 . 2004-08-04 03:17 1846656 ----a-w- c:\windows\system32\win32k.sys
2009-04-15 15:26 . 2004-08-04 04:56 583168 ----a-w- c:\windows\system32\rpcrt4.dll
.

((((((((((((((((((((((((((((( SnapShot@2009-06-23_23.01.17 )))))))))))))))))))))))))))))))))))))))))
.
+ 2007-11-07 09:19 . 2007-11-07 09:19 54272 c:\windows\WinSxS\x86_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.21022.8_x-ww_ecc42bd1\vcomp90.dll
+ 2009-06-24 17:47 . 2009-05-11 17:12 28520 c:\windows\system32\drivers\ssmdrv.sys
+ 2008-04-15 04:27 . 2008-04-15 04:27 86528 c:\windows\Installer\4eaa4.msi
+ 2009-05-27 04:33 . 2009-05-27 04:33 51712 c:\windows\Installer\43c840.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 48128 c:\windows\Installer\2c3ed1.msi
+ 2009-06-24 17:41 . 2009-06-24 17:41 228352 c:\windows\Installer\b7f51.msi
+ 2009-03-05 06:46 . 2009-03-05 06:46 140288 c:\windows\Installer\85d172.msi
+ 2007-11-07 22:07 . 2007-11-07 22:07 999936 c:\windows\Installer\4eaad.msp
+ 2007-11-07 21:56 . 2007-11-07 21:56 553472 c:\windows\Installer\4eaaa.msp
+ 2007-11-07 21:58 . 2007-11-07 21:58 908800 c:\windows\Installer\4eaa6.msp
+ 2007-11-07 21:54 . 2007-11-07 21:54 507392 c:\windows\Installer\4eaa5.msp
+ 2006-03-31 08:35 . 2006-03-31 08:35 134656 c:\windows\Installer\2cc80e6.msi
+ 2007-09-28 23:21 . 2007-09-28 23:21 501248 c:\windows\Installer\2c3f15.msi
+ 2007-09-28 23:21 . 2007-09-28 23:21 501248 c:\windows\Installer\2c3efd.msi
+ 2007-09-28 23:21 . 2007-09-28 23:21 506880 c:\windows\Installer\2c3ef7.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 516608 c:\windows\Installer\2c3ef0.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 513024 c:\windows\Installer\2c3ee9.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 501248 c:\windows\Installer\2c3edd.msi
+ 2007-09-28 23:19 . 2007-09-28 23:19 501248 c:\windows\Installer\2c3eb6.msi
+ 2007-11-30 15:59 . 2007-11-30 15:59 282624 c:\windows\Installer\293057.msi
+ 2007-07-17 04:28 . 2007-07-17 04:28 474624 c:\windows\Installer\22ab50e.msi
+ 2009-06-18 18:29 . 2009-06-18 18:29 236032 c:\windows\Installer\228492.msi
+ 2007-10-15 06:44 . 2007-10-15 06:44 324608 c:\windows\Installer\1f98bd9.msp
+ 2007-10-15 06:46 . 2007-10-15 06:46 324608 c:\windows\Installer\1f98bd2.msp
+ 2008-01-30 04:56 . 2008-01-30 04:56 124416 c:\windows\Installer\1d3b0d.msi
+ 2008-12-07 20:03 . 2008-12-07 20:03 981504 c:\windows\Installer\1ce89.msi
+ 2005-08-01 05:47 . 2005-08-01 05:47 264704 c:\windows\Installer\15ce5.msi
+ 2008-08-27 02:53 . 2008-08-27 02:53 804352 c:\windows\Installer\129bafd.msi
+ 2008-08-27 02:45 . 2008-08-27 02:45 467456 c:\windows\Installer\129baf3.msi
+ 2009-05-27 01:53 . 2009-05-27 01:53 579072 c:\windows\Installer\12220c3.msp
+ 2008-09-05 04:47 . 2008-09-05 04:47 289792 c:\windows\Installer\105ea91.msi
+ 2005-08-24 00:31 . 2005-08-24 00:31 829952 c:\windows\Downloaded Installations\DAEMON Tools 3.47\daemon.msi
+ 2006-06-14 23:41 . 2005-04-04 08:07 982016 c:\windows\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\ISScript11.Msi
+ 2004-07-17 15:35 . 2004-07-17 15:35 1326080 c:\windows\system32\webfldrs.msi
+ 2007-05-25 20:08 . 2007-05-25 20:08 9609728 c:\windows\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp
+ 2008-09-03 20:00 . 2008-09-03 20:00 2128896 c:\windows\Installer\f0a063.msi
+ 2009-02-07 06:31 . 2009-02-07 06:31 5047808 c:\windows\Installer\ecb0fa.msp
+ 2008-08-20 21:37 . 2008-08-20 21:37 5107712 c:\windows\Installer\e5c6b2.msp
+ 2008-05-21 07:45 . 2008-05-21 07:45 5246976 c:\windows\Installer\e5c66d.msp
+ 2008-02-25 22:08 . 2008-02-25 22:08 5050368 c:\windows\Installer\e5a256.msp
+ 2008-02-15 15:54 . 2008-02-15 15:54 9736192 c:\windows\Installer\c2bff8.msp
+ 2008-03-18 00:55 . 2008-03-18 00:55 5049344 c:\windows\Installer\c2bfcb.msp
+ 2007-07-22 00:15 . 2007-07-22 00:15 1067520 c:\windows\Installer\bb720d.msi
+ 2008-04-12 01:08 . 2008-04-12 01:08 6302720 c:\windows\Installer\bb341c.msp
+ 2008-04-26 03:14 . 2008-04-26 03:14 5052928 c:\windows\Installer\bb3401.msp
+ 2008-04-18 21:56 . 2008-04-18 21:56 6215680 c:\windows\Installer\bb33ea.msp
+ 2008-11-20 22:48 . 2008-11-20 22:48 5097472 c:\windows\Installer\a4fcd6.msp
+ 2008-04-12 01:48 . 2008-04-12 01:48 6774272 c:\windows\Installer\a3ff07.msp
+ 2008-07-17 02:01 . 2008-07-17 02:01 5110272 c:\windows\Installer\a3feee.msp
+ 2008-01-29 02:09 . 2008-01-29 02:09 5055488 c:\windows\Installer\8e8b89.msp
+ 2009-02-26 02:08 . 2009-02-26 02:08 8311808 c:\windows\Installer\870c8e.msp
+ 2009-03-28 16:50 . 2009-03-28 16:50 5025792 c:\windows\Installer\870c78.msp
+ 2008-09-02 18:42 . 2008-09-02 18:42 5104640 c:\windows\Installer\71732b.msp
+ 2007-04-21 02:47 . 2007-04-21 02:47 1068544 c:\windows\Installer\57632.msi
+ 2007-01-29 04:13 . 2007-01-29 04:13 3200000 c:\windows\Installer\53306a.msi
+ 2009-01-08 04:25 . 2009-01-08 04:25 5046784 c:\windows\Installer\526b53.msp
+ 2007-11-07 21:50 . 2007-11-07 21:50 6055936 c:\windows\Installer\4eaac.msp
+ 2007-11-07 22:00 . 2007-11-07 22:00 3407360 c:\windows\Installer\4eaab.msp
+ 2007-11-07 21:46 . 2007-11-07 21:46 3010560 c:\windows\Installer\4eaa9.msp
+ 2007-11-07 22:02 . 2007-11-07 22:02 6473216 c:\windows\Installer\4eaa8.msp
+ 2007-11-07 22:12 . 2007-11-07 22:12 2533376 c:\windows\Installer\4eaa7.msp
+ 2008-11-13 10:57 . 2008-11-13 10:57 5099520 c:\windows\Installer\4bf220.msp
+ 2008-10-20 18:18 . 2008-10-20 18:18 6474240 c:\windows\Installer\4bf209.msp
+ 2009-01-15 10:35 . 2009-01-15 10:35 4830720 c:\windows\Installer\43c847.msp
+ 2008-10-20 18:19 . 2008-10-20 18:19 5100032 c:\windows\Installer\41d45.msp
+ 2007-03-31 05:20 . 2007-03-31 05:20 5800960 c:\windows\Installer\3a4f4b.msp
+ 2007-05-29 05:01 . 2007-05-29 05:01 4597760 c:\windows\Installer\3a4f34.msp
+ 2007-09-01 04:58 . 2007-09-01 04:58 5054976 c:\windows\Installer\3a4f05.msp
+ 2007-03-31 05:21 . 2007-03-31 05:21 3886080 c:\windows\Installer\3a4eee.msp
+ 2007-03-27 23:14 . 2007-03-27 23:14 5566464 c:\windows\Installer\3a4ebf.msp
+ 2007-06-01 22:54 . 2007-06-01 22:54 9626624 c:\windows\Installer\3a4e90.msp
+ 2007-07-21 20:26 . 2007-07-21 20:26 7574016 c:\windows\Installer\3a4e79.msp
+ 2006-04-07 00:15 . 2006-04-07 00:15 1697792 c:\windows\Installer\397b2.msp
+ 2006-04-27 05:53 . 2006-04-27 05:53 2704896 c:\windows\Installer\3766e.msp
+ 2005-09-05 05:21 . 2005-09-05 05:21 5218816 c:\windows\Installer\367800.msi
+ 2005-09-05 05:20 . 2005-09-05 05:20 5219328 c:\windows\Installer\3677e2.msi
+ 2005-09-05 05:19 . 2005-09-05 05:19 5207040 c:\windows\Installer\3677c5.msi
+ 2005-09-05 05:19 . 2005-09-05 05:19 5595136 c:\windows\Installer\3677b8.msi
+ 2006-03-30 18:36 . 2006-03-30 18:36 2665984 c:\windows\Installer\2d766d0.msp
+ 2007-09-28 23:21 . 2007-09-28 23:21 1640960 c:\windows\Installer\2c3f1b.msi
+ 2007-09-28 23:21 . 2007-09-28 23:21 1652736 c:\windows\Installer\2c3f0f.msi
+ 2007-09-28 23:21 . 2007-09-28 23:21 1652736 c:\windows\Installer\2c3f09.msi
+ 2007-09-28 23:21 . 2007-09-28 23:21 1652736 c:\windows\Installer\2c3f03.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 2319872 c:\windows\Installer\2c3ee3.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 1647616 c:\windows\Installer\2c3ed7.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 1640960 c:\windows\Installer\2c3ec8.msi
+ 2007-09-28 23:20 . 2007-09-28 23:20 2022912 c:\windows\Installer\2c3ec2.msi
+ 2007-09-28 23:19 . 2007-09-28 23:19 1713152 c:\windows\Installer\2c3ebc.msi
+ 2007-09-28 23:18 . 2007-09-28 23:18 2397184 c:\windows\Installer\2c3eb0.msi
+ 2009-04-24 19:28 . 2009-04-24 19:28 4450816 c:\windows\Installer\2596156.msp
+ 2009-06-18 18:29 . 2009-06-18 18:29 1802240 c:\windows\Installer\228498.msi
+ 2008-06-05 20:56 . 2008-06-05 20:56 5111808 c:\windows\Installer\1ff6ce3.msp
+ 2007-10-15 06:43 . 2007-10-15 06:43 5749760 c:\windows\Installer\1f98bae.msp
+ 2007-10-28 18:53 . 2007-10-28 18:53 5047808 c:\windows\Installer\19e309.msp
+ 2006-06-16 03:12 . 2006-06-16 03:12 3443712 c:\windows\Installer\1973c7.msi
+ 2009-04-18 03:17 . 2009-04-18 03:17 1805824 c:\windows\Installer\14a66ac.msi
+ 2007-11-23 02:23 . 2007-11-23 02:23 5051904 c:\windows\Installer\13ad31.msp
+ 2009-05-04 14:46 . 2009-05-04 14:46 8299008 c:\windows\Installer\1222123.msp
+ 2009-05-04 14:47 . 2009-05-04 14:47 9124864 c:\windows\Installer\122210b.msp
+ 2009-04-24 19:30 . 2009-04-24 19:30 2583552 c:\windows\Installer\12220f3.msp
+ 2009-05-07 16:17 . 2009-05-07 16:17 5026816 c:\windows\Installer\12220da.msp
+ 2009-04-24 19:29 . 2009-04-24 19:29 9013760 c:\windows\Installer\12220ac.msp
+ 2006-05-09 19:16 . 2006-05-09 19:16 1742848 c:\windows\Installer\116b565.msp
+ 2007-10-01 04:12 . 2007-10-01 04:12 5052416 c:\windows\Installer\114ba2.msp
+ 2005-10-22 23:15 . 2005-10-22 23:15 4299264 c:\windows\Downloaded Installations\{642D6D15-DB8D-4988-A0C5-D5E79523DC1E}\Guitar Pro 4.msi
+ 2006-06-14 23:41 . 2006-02-23 23:42 9934848 c:\windows\Downloaded Installations\{59C4F14F-7590-45FC-BE9F-A67AB3590709}\iTunes.msi
+ 2008-05-21 08:30 . 2008-05-21 08:30 14308864 c:\windows\Installer\f931f6.msp
+ 2008-08-11 18:51 . 2008-08-11 18:51 15916544 c:\windows\Installer\e5c69b.msp
+ 2008-08-11 18:49 . 2008-08-11 18:49 22457344 c:\windows\Installer\e5c684.msp
+ 2008-02-25 22:07 . 2008-02-25 22:07 11772416 c:\windows\Installer\e5a2ac.msp
+ 2008-01-29 01:09 . 2008-01-29 01:09 11896320 c:\windows\Installer\e5a295.msp
+ 2008-01-29 01:10 . 2008-01-29 01:10 14201344 c:\windows\Installer\e5a27d.msp
+ 2008-01-29 01:07 . 2008-01-29 01:07 19034624 c:\windows\Installer\c2bfe2.msp
+ 2009-02-26 02:05 . 2009-02-26 02:05 11840000 c:\windows\Installer\c1735d.msp
+ 2009-02-26 02:07 . 2009-02-26 02:07 11646464 c:\windows\Installer\c17346.msp
+ 2008-04-12 01:07 . 2008-04-12 01:07 13257728 c:\windows\Installer\bb3435.msp
+ 2009-05-04 14:49 . 2009-05-04 14:49 10955776 c:\windows\Installer\adf629.msp
+ 2008-07-03 18:36 . 2008-07-03 18:36 11937792 c:\windows\Installer\a3ff35.msp
+ 2008-07-03 18:37 . 2008-07-03 18:37 11759104 c:\windows\Installer\a3ff1e.msp
+ 2008-07-30 06:20 . 2008-07-30 06:20 11767296 c:\windows\Installer\717314.msp
+ 2008-07-30 06:18 . 2008-07-30 06:18 11933184 c:\windows\Installer\7172fd.msp
+ 2008-10-20 18:22 . 2008-10-20 18:22 11758592 c:\windows\Installer\4bf266.msp
+ 2008-10-20 18:21 . 2008-10-20 18:21 11937280 c:\windows\Installer\4bf24f.msp
+ 2008-10-20 18:16 . 2008-10-20 18:16 13211648 c:\windows\Installer\4bf238.msp
+ 2008-09-24 20:05 . 2008-09-24 20:05 16381440 c:\windows\Installer\41d2e.msp
+ 2005-08-01 08:50 . 2005-08-01 08:50 13354496 c:\windows\Installer\3e411.msi
+ 2007-06-01 22:55 . 2007-06-01 22:55 10824704 c:\windows\Installer\3a4f68.msp
+ 2007-04-22 03:16 . 2007-04-22 03:16 12490752 c:\windows\Installer\3a4f1c.msp
+ 2007-03-31 05:19 . 2007-03-31 05:19 10893312 c:\windows\Installer\3a4ed6.msp
+ 2007-06-01 22:53 . 2007-06-01 22:53 10255360 c:\windows\Installer\3a4ea7.msp
+ 2007-09-28 23:25 . 2007-09-28 23:25 18181632 c:\windows\Installer\2c3f2c.msi
+ 2007-10-15 06:43 . 2007-10-15 06:43 12743168 c:\windows\Installer\1f98bc0.msp
+ 2007-10-15 06:43 . 2007-10-15 06:43 21981184 c:\windows\Installer\1f98b66.msp
+ 2007-12-01 04:00 . 2007-12-01 04:00 19210240 c:\windows\Installer\1920b6e.msp
+ 2007-12-02 04:00 . 2007-12-02 04:00 15256576 c:\windows\Installer\14e6445.msp
+ 2005-08-23 07:18 . 2005-08-23 07:18 19620352 c:\windows\Downloaded Installations\Diskeeper Professional\{D38E57CB-8842-4039-AA93-D2F6DC2244E2}\Diskeeper Professional Edition.msi
+ 2005-12-12 23:04 . 2005-12-12 23:05 21000192 c:\windows\Downloaded Installations\Diskeeper Professional\{65010B9F-3027-4882-B034-36EAE4AD1551}\Diskeeper Professional Edition.msi
+ 2007-10-15 06:43 . 2007-10-15 06:43 229852160 c:\windows\Installer\1f98b5e.msp
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}]
2009-04-02 19:47 333192 ----a-w- c:\program files\AskBarDis\bar\bin\askBar.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"Aim6"="c:\program files\AIM6\aim6.exe" [2006-11-07 50736]
"MsnMsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184]
"SansaDispatch"="c:\documents and settings\USER2\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe" [2009-03-30 79872]
"PeerGuardian"="c:\program files\PeerGuardian2\pg2.exe" [2005-09-19 1421824]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2007-06-29 8466432]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2007-06-29 81920]
"SmcService"="c:\progra~1\Sygate\SPF\smc.exe" [2004-10-16 2577632]
"Lexmark X1100 Series"="c:\program files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 57344]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2006-03-01 577536]
"nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2007-06-29 1626112]

c:\documents and settings\USER2\Start Menu\Programs\Startup\
Picture Motion Browser Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2008-7-24 344064]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

c:\documents and settings\All Users\Start Menu\Programs\Startup\AutorunsDisabled
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-9-23 29696]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0sprestrt\0lsdelete

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"6001:TCP"= 6001:TCP:*:Disabled:utorrenttcp
"6003:UDP"= 6003:UDP:*:Disabled:utorrentudp

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [6/18/2009 11:31 AM 64160]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [6/24/2009 10:47 AM 108289]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [8/30/2008 1:21 PM 24652]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [3/9/2009 12:06 PM 1003344]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - PGFILTER

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-07-02 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-03-09 18:30]

2009-07-05 c:\windows\Tasks\WGASetup.job
- c:\windows\system32\KB905474\wgasetup.exe [2009-06-23 05:18]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.utorrent.com/testport.php?port=6001
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\USER2\Application Data\Mozilla\Firefox\Profiles\rqqm3zfq.default\
FF - plugin: c:\documents and settings\USER2\Application Data\Mozilla\Firefox\Profiles\rqqm3zfq.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npmozax.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\Viewpoint\Viewpoint Media Player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-05 16:57
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath"=""
.
Completion time: 2009-07-05 16:59
ComboFix-quarantined-files.txt 2009-07-05 23:59
ComboFix2.txt 2009-06-23 23:03

Pre-Run: 653,828,096 bytes free
Post-Run: 648,024,064 bytes free

377 --- E O F --- 2009-06-23 18:51




DDS log:

DDS (Ver_09-06-26.01) - NTFSx86
Run by USER2 at 17:01:57.06 on Sun 07/05/2009
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_07
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.638 [GMT -7:00]

AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning disabled* (Updated) {804FD2B8-FFA4-00EB-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00E3-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {00000000-0000-0000-0000-000000000000}
AV: AntiVir Desktop *On-access scanning disabled* (Updated) {AD166499-45F9-482A-A743-FDD3350758C7}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00DA-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD2B8-FFA4-00FC-0D24-347CA8A3377C}
AV: Avira AntiVir PersonalEdition Classic *On-access scanning enabled* (Updated) {804FD0EC-FFA4-00D2-0D24-347CA8A3377C}
FW: Sygate Personal Firewall *enabled* {BE898FE3-CD0B-4014-85A9-03DB9923DDB6}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
C:\Program Files\Sygate\SPF\smc.exe
svchost.exe
svchost.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Avira\AntiVir Desktop\sched.exe
svchost.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Documents and Settings\USER2\Application Data\SanDisk\Sansa Updater\SansaDispatch.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Documents and Settings\USER2\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uInternet Connection Wizard,ShellNext = hxxp://www.utorrent.com/testport.php?port=6001
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6] "c:\program files\aim6\aim6.exe" /d locale=en-US ee://aol/imApp
uRun: [MsnMsgr] "c:\program files\windows live\messenger\MsnMsgr.Exe" /background
uRun: [SansaDispatch] c:\documents and settings\USER2\application data\sandisk\sansa updater\SansaDispatch.exe
uRun: [PeerGuardian] c:\program files\peerguardian2\pg2.exe
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SmcService] c:\progra~1\sygate\spf\smc.exe -startgui
mRun: [Lexmark X1100 Series] "c:\program files\lexmark x1100 series\lxbkbmgr.exe"
StartupFolder: c:\docume~1\USER2\startm~1\programs\startup\pictur~1.lnk - c:\program files\sony\sony picture utility\volumewatcher\SPUVolumeWatcher.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\autoru~1\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office12\EXCEL.EXE/3000
IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - c:\program files\aim\aim.exe
IE: {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - d:\program files\PartyPoker.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_07\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\mi1933~1\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office12\REFIEBAR.DLL
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {31435657-9980-0010-8000-00AA00389B71} - hxxp://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab
DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\USER2\applic~1\mozilla\firefox\profiles\rqqm3zfq.default\
FF - plugin: c:\documents and settings\USER2\application data\mozilla\firefox\profiles\rqqm3zfq.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071101000055.dll
FF - plugin: c:\program files\mozilla firefox\plugins\NPAdbESD.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npdjvu.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npmozax.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npunagi2.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA}

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-6-18 64160]
R1 avgio;avgio;c:\program files\avira\antivir desktop\avgio.sys [2009-6-24 11608]
R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\avira\antivir desktop\sched.exe [2009-6-24 108289]
R2 avgntflt;avgntflt;c:\windows\system32\drivers\avgntflt.sys [2009-6-24 55640]
R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2008-8-30 24652]
S2 AntiVirService;Avira AntiVir Guard;c:\program files\avira\antivir desktop\avguard.exe [2009-6-24 185089]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-3-9 1003344]
S4 vsdatant;vsdatant; [x]

=============== Created Last 30 ================

2009-07-05 16:51 <DIR> --ds---- C:\ComboFix
2009-07-01 13:37 1 ----h--- c:\windows\bf23567.dat
2009-06-24 10:47 55,640 a------- c:\windows\system32\drivers\avgntflt.sys
2009-06-24 10:47 <DIR> --d----- c:\program files\Avira
2009-06-24 10:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Avira
2009-06-23 16:02 <DIR> -cd----- c:\windows\system32\dllcache\cache
2009-06-23 15:47 <DIR> --d----- C:\cmdcons
2009-06-23 15:44 161,792 a------- c:\windows\SWREG.exe
2009-06-23 15:44 155,136 a------- c:\windows\PEV.exe
2009-06-23 15:44 98,816 a------- c:\windows\sed.exe
2009-06-23 11:51 <DIR> --d----- c:\windows\system32\KB905474
2009-06-23 11:07 <DIR> --d----- c:\program files\Trend Micro
2009-06-23 09:43 552 a------- c:\windows\system32\d3d8caps.dat
2009-06-22 22:43 <DIR> --d----- c:\program files\Sophos
2009-06-22 21:28 <DIR> --d----- c:\documents and settings\USER2\.housecall6.6
2009-06-22 21:06 <DIR> --d----- c:\program files\ESET
2009-06-22 20:18 <DIR> --d----- c:\program files\CCleaner
2009-06-21 18:06 <DIR> --d----- c:\program files\AskBarDis
2009-06-21 18:06 <DIR> --d----- c:\program files\uTorrent
2009-06-20 23:43 <DIR> --d----- c:\windows\ie8updates
2009-06-20 16:04 246,272 -c------ c:\windows\system32\dllcache\ieproxy.dll
2009-06-20 16:04 12,800 -c------ c:\windows\system32\dllcache\xpshims.dll
2009-06-19 20:51 <DIR> --dsh--- c:\documents and settings\USER2\IECompatCache
2009-06-19 17:52 <DIR> --dsh--- c:\documents and settings\USER2\PrivacIE
2009-06-19 17:51 <DIR> --dsh--- c:\documents and settings\USER2\IETldCache
2009-06-19 16:39 <DIR> -cd-h--- c:\windows\ie8
2009-06-18 12:49 15,688 a------- c:\windows\system32\lsdelete.exe
2009-06-18 11:31 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-06-18 11:29 <DIR> -cd-h--- c:\docume~1\alluse~1\applic~1\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

==================== Find3M ====================

2009-06-17 11:27 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-06-17 11:27 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-05-12 22:15 915,456 a------- c:\windows\system32\wininet.dll
2009-05-07 08:44 344,064 a------- c:\windows\system32\localspl.dll
2009-04-17 02:58 1,846,656 a------- c:\windows\system32\win32k.sys
2009-04-15 08:26 583,168 a------- c:\windows\system32\rpcrt4.dll

============= FINISH: 17:02:15.90 ===============

Hi,

Uninstall Ask Toolbar if not installed on purpose.


Go Start > Run and copy/paste the following single-line command into the Run box and click OK:

cmd /c PEV -l "%systemdrive%\proquota.exe" >location.txt&location.txt&del location.txt

A Notepad file will open. Post the contents of location.txt in your next reply.



Open notepad and copy/paste the text in the quotebox below into it:

File::
c:\windows\bf23567.dat

Save this as
CFScript

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine. This tool is not a toy and not for everyday use.



Close all browser windows and refering to the picture above, drag CFScript into ComboFix.exe
Then post the resultant log.


Combofix should never take more that 20 minutes including the reboot if malware is detected.
If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
If that happened we want to know, and also what process you had to end.


Uninstall old Adobe Reader versions and get the latest one (9.1 + update 9.1.2 for it) here or get Foxit Reader here. Make sure you don't install toolbar if choose Foxit Reader! You may also check free readers introduced here.


Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

Updating Java:

• Download the latest version of Java Runtime Environment (JRE) 6 Update 14.
  
• Click the
  Download
  button to the right.
  
• Select Windows on platform combobox and check the box that says:
  Accept License Agreement. Click continue.
  
  
• The page will refresh.
  
• Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  
• Close any programs you may have running - especially your web browser.
  
• Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  
• Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  
• Click the Remove or Change/Remove button.
  
• Repeat as many times as necessary to remove each Java versions.
  
• Reboot your computer once all Java components are removed.
  
• Then from your desktop double-click on jre-6u14-windows-i586-p.exe to install the newest version. Uncheck MSN toolbar if it's offered there.

Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.


Please run an online scan with ESET online scanner which seems to be installed on your system. Set it so that it doesn't remove any findings.


Post back its report, a fresh dds.txt log and above mentioned ComboFix resultant log.

Due to inactivity, this thread will now be closed. If you need this topic reopened, please contact a Staff member. Include the address of this thread in your request. This applies only to the original topic starter. Should you have a new issue, please start a New Topic.