PC anti-spyware 2010, bravia.exe

I have ran Malwarebytes anti-malware in both normal and safe mode, I have run smitfraudfix in Safe mode. I keep getting the red circle with white x in the bottom corner of my toolbar and pc anit-spyware 2010. between malaware bytes and smitfraudfix I think I have been able to get rid of the x twice, but as soon as the computer boots up it reboots and everything is back.

here is my DDS.txt:

DDS (Ver_09-07-30.01) - NTFSx86
Run by Stephanie Brookover at 7:50:24.90 on Fri 08/14/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2294.1836 [GMT -4:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:WINDOWSsystem32svchost -k DcomLaunch
svchost.exe
C:WINDOWSSystem32svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:WINDOWSSystem32wltrysvc.exe
C:WINDOWSSystem32bcmwltry.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSExplorer.EXE
svchost.exe
C:Program FilesIntelIntel Matrix Storage Manageriaantmon.exe
C:WINDOWSsystem32svchost.exe -k imgsvc
C:WINDOWSsystem32ctfmon.exe
C:Program FilesIntelIntel Matrix Storage Manageriaanotif.exe
C:Program FilesCommon FilesInstallShieldUpdateServiceissch.exe
C:WINDOWSSystem32DLADLACTRLW.EXE
C:Program FilesCreativeMixerCTSVolFE.exe
C:Program FilesMicrosoft ActiveSyncWcescomm.exe
C:PROGRA~1MI3AA1~1rapimgr.exe
C:Program FilesMozilla Firefoxfirefox.exe
svchost
C:WINDOWSSystem32svchost.exe
svchost.exe
C:WINDOWSSystem32svchost.exe
C:Program FilesPC_Antispyware2010PC_Antispyware2010.exe
C:WINDOWSsystem32rundll32.exe
C:Documents and SettingsStephanie BrookoverDesktopdds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com
mWinlogon: Userinit=c:windowssystem32Userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:program filesgooglegoogle toolbarGoogleToolbar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - No File
uRun: [H/PC Connection Agent] "c:program filesmicrosoft activesyncWcescomm.exe"
uRun: [swg] c:program filesgooglegoogletoolbarnotifierGoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:windowssystem32ctfmon.exe
uRun: [Google Update] "c:documents and settingsstephanie brookoverlocal settingsapplication datagoogleupdateGoogleUpdate.exe" /c
mRun: [igfxhkcmd] c:windowssystem32hkcmd.exe
mRun: [IAAnotif] c:program filesintelintel matrix storage manageriaanotif.exe
mRun: [ISUSPM Startup] "c:program filescommon filesinstallshieldupdateserviceisuspm.exe" -startup
mRun: [ISUSScheduler] "c:program filescommon filesinstallshieldupdateserviceissch.exe" -start
mRun: [DLA] c:windowssystem32dlaDLACTRLW.EXE
mRun: [QuickTime Task] "c:program filesquicktimeqttask.exe" -atboottime
mRun: [CTSVolFE] "c:program filescreativemixerCTSVolFE.exe" /r
mRun: [Regedit32] c:windowssystem32regedit.exe
dRun: [braviax]
StartupFolder: c:documents and settingsstephanie brookoverstart menuprogramsstartupikowin32.exe
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%Network Diagnosticxpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:program filesmessengermsmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:progra~1mi3aa1~1INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:progra~1mi3aa1~1INetRepl.dll
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:program filescommon filesmicrosoft sharedencarta search barENCSBAR.DLL
Trusted Zone: musicmatch.comonline
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:program filesyahoo!commonYinsthelper.dll
DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} - hxxp://asp.mathxl.com/wizmodules/testgen/installers/TestGenXInstall.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {95D88B35-A521-472B-A182-BB1A98356421} - hxxp://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} - hxxp://asp.mathxl.com/books/_Players/MathPlayer.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:program filesgooglegoogle toolbarcomponentfastsearch_A8904FB862BD9564.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:program filescommon filesmicrosoft sharedweb foldersPKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: cru629.dat
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:windowssystem32WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:docume~1stepha~1applic~1mozillafirefoxprofiles3bfsaotd.default
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:documents and settingsstephanie brookoverapplication datamozillafirefoxprofiles3bfsaotd.defaultextensionsmoveplayer@movenetworks.complatformwinnt_x86-msvcpluginsnpmnqmp071303000006.dll
FF - plugin: c:documents and settingsstephanie brookoverlocal settingsapplication datagoogleupdate1.2.183.7npGoogleOneClick8.dll
FF - plugin: c:program filesgooglegoogle updater2.4.1601.7122npCIDetect13.dll
FF - plugin: c:program filesgoogleupdate1.2.145.5npGoogleOneClick8.dll
FF - plugin: c:program filesgoogleupdate1.2.183.7npGoogleOneClick8.dll
FF - plugin: c:program filesviewpointviewpoint experience technologynpViewpoint.dll

============= SERVICES / DRIVERS ===============

R2 NwSapAgent;SAP Agent;c:windowssystem32svchost.exe -k netsvcs [2004-8-10 14336]
S2 gupdate1c9ecdee64070cc;Google Update Service (gupdate1c9ecdee64070cc);c:program filesgoogleupdateGoogleUpdate.exe [2009-6-14 133104]
S3 avgfwdx;avgfwdx;c:windowssystem32driversavgfwdx.sys [2009-8-13 29208]
S3 avgfwfd;AVG network filter service;c:windowssystem32driversavgfwdx.sys [2009-8-13 29208]

=============== Created Last 30 ================

2009-08-14 07:34 19,024 a------- c:windowsgubekog.db
2009-08-14 07:34 18,667 a------- c:docume~1alluse~1applic~1lumug.vbs
2009-08-14 07:34 18,041 a------- c:docume~1alluse~1applic~1egexi.bat
2009-08-14 07:34 17,966 a------- c:docume~1stepha~1applic~1igelezaxih.scr
2009-08-14 07:34 17,074 a------- c:program filescommon filesawoceb.dll
2009-08-14 07:34 16,772 a------- c:windowsesibywe.sys
2009-08-14 07:34 16,506 a------- c:program filescommon fileshuracurehu.sys
2009-08-14 07:34 15,568 a------- c:program filescommon filesebogufeqo.sys
2009-08-14 07:34 14,155 a------- c:windowsmapumaqudy.inf
2009-08-14 07:34 12,976 a------- c:docume~1stepha~1applic~1fibe.bat
2009-08-14 07:34 12,727 a------- c:program filescommon filesbopic.dll
2009-08-14 07:34 12,446 a------- c:docume~1alluse~1applic~1ozidy.sys
2009-08-14 07:34 12,161 a------- c:windowsuwejobyxo.com
2009-08-14 07:34 11,768 a------- c:windowssystem32wurero.pif
2009-08-14 07:27 <DIR> --d----- C:PC_Antispyware2010
2009-08-14 07:20 27,004 a------- c:windowssystem32msword98.exe
2009-08-14 07:20 27,004 a------- c:documents and settingsstephanie brookovermsword98.exe
2009-08-14 07:19 16,588 a------- c:windowssystem32ejizymidug.bin
2009-08-14 07:19 16,411 a------- c:windowssystem32carose.dl
2009-08-14 07:19 16,130 a------- c:windowsalak.com
2009-08-14 07:19 14,778 a------- c:windowsexidi.pif
2009-08-14 07:19 13,892 a------- c:windowssystem32yqapimapo.bat
2009-08-14 07:19 12,926 a------- c:windowsexij.lib
2009-08-14 07:19 12,247 a------- c:docume~1alluse~1applic~1ivigekipu.pif
2009-08-14 07:19 11,910 a------- c:docume~1alluse~1applic~1oxywuqanav.dat
2009-08-14 07:19 11,731 a------- c:windowssystem32fudax.dll
2009-08-14 07:19 11,102 a------- c:windowssystem32hapum.bat
2009-08-14 07:19 10,498 a------- c:program filescommon fileswywulyj.bat
2009-08-14 07:19 12,826 a------- c:windowsebug.vbs
2009-08-14 07:19 11,023 a------- c:windowssystem32ypat.com
2009-08-14 07:19 347,691 a------- c:windowssystem32_scui.cpl
2009-08-14 07:19 <DIR> --d----- c:program filesPC_Antispyware2010
2009-08-14 07:13 29,184 a------- c:windowssystem32dllcachefigaro.sys
2009-08-14 07:04 11,264 a------- c:windowssystem32braviax.exe
2009-08-14 07:02 11,264 a------- c:windowsbraviax.exe
2009-08-14 07:02 6,144 a------- c:windowssystem32cru629.dat
2009-08-14 07:02 6,144 a------- c:windowscru629.dat
2009-08-14 06:57 29,184 a------- c:windowssystem32driversbeep.sys
2009-08-13 21:47 50,968 a------- c:windowssystem32avgfwdx.dll
2009-08-13 21:47 29,208 a------- c:windowssystem32driversavgfwdx.sys
2009-08-13 21:47 <DIR> --d----- c:program filesAVG
2009-08-13 21:47 <DIR> --d----- c:docume~1alluse~1applic~1avg8
2009-08-13 20:51 11,264 a------- c:windowssystem32braviax.ex_
2009-08-13 20:48 <DIR> --d----- c:docume~1stepha~1applic~1AVG8
2009-08-13 20:29 19,468 a------- c:docume~1stepha~1applic~1sakaryfiq.dll
2009-08-13 20:29 19,095 a------- c:windowsrawyvo.scr
2009-08-13 20:29 18,814 a------- c:windowsibajupe.vbs
2009-08-13 20:29 17,591 a------- c:windowssystem32folodedyt.bat
2009-08-13 20:29 16,607 a------- c:windowsnicodad.dl
2009-08-13 20:29 15,531 a------- c:program filescommon filesupibo.sys
2009-08-13 20:29 14,384 a------- c:docume~1alluse~1applic~1ijyp.reg
2009-08-13 20:29 13,956 a------- c:windowsozapiw.ban
2009-08-13 20:29 13,890 a------- c:windowssystem32enus.dat
2009-08-13 20:29 12,375 a------- c:program filescommon filesogoz.pif
2009-08-13 20:29 12,294 a------- c:windowsawef.bin
2009-08-13 20:29 12,244 a------- c:windowssystem32cehyzubepo.reg
2009-08-13 20:29 11,805 a------- c:docume~1alluse~1applic~1nihimajyk.reg
2009-08-13 20:29 11,551 a------- c:windowslebe.ban
2009-08-13 20:29 11,133 a------- c:windowscidi.dat
2009-08-13 20:29 11,104 a------- c:docume~1stepha~1applic~1fevys.scr
2009-08-13 20:29 10,260 a------- c:docume~1stepha~1applic~1yxihyziqeg.pif
2009-08-13 20:25 18,748 a------- c:windowsogejar.dl
2009-08-13 20:25 15,988 a------- c:windowsezybolew.ban
2009-08-13 20:25 15,668 a------- c:windowssukeqorawy.lib
2009-08-13 20:25 15,545 a------- c:windowsvodypepa.sys
2009-08-13 20:25 14,100 a------- c:program filescommon filesuwisilil.scr
2009-08-13 20:25 13,339 a------- c:windowswedege.vbs
2009-08-13 20:25 12,946 a------- c:windowssystem32jaregi._sy
2009-08-13 20:25 12,288 a------- c:windowssystem32ewed.reg
2009-08-13 20:25 11,438 a------- c:program filescommon filesrozimyr.com
2009-08-13 20:25 10,641 a------- c:windowsisij.reg
2009-08-13 20:10 29,184 a------- c:windowssystem32dllcachebeep.sys
2009-08-13 19:38 191,131 a------- c:windowssystem32wisdstr.exe
2009-08-13 08:42 19,983 a------- c:windowsupaler._dl
2009-08-13 08:42 19,435 a------- c:windowsxifemuw.ban
2009-08-13 08:42 19,192 a------- c:windowsdigoqyb.lib
2009-08-13 08:42 18,285 a------- c:program filescommon filesgosucyveqo.vbs
2009-08-13 08:42 15,715 a------- c:windowsfocycary.dl
2009-08-13 08:42 14,288 a------- c:docume~1alluse~1applic~1ivodeko.vbs
2009-08-13 08:42 13,390 a------- c:windowsysexuze.ban
2009-08-13 08:42 11,288 a------- c:program filescommon fileshyjiveje.dat
2009-08-13 08:42 11,221 a------- c:windowssystem32bafexa.pif
2009-08-13 08:42 10,830 a------- c:windowssystem32takucuxepu.inf
2009-08-13 08:42 10,751 a------- c:windowsjomidig.com
2009-08-13 08:42 10,036 a------- c:windowsruqicyv._dl
2009-08-13 08:35 104,064 a------- c:windowssystem32driversccce7d46.sys
2009-08-13 08:34 47,744 a------- c:windowssystem32driversf1683ce2.sys
2009-08-13 07:30 18,139 a------- c:windowssystem32davifofu.reg
2009-08-13 07:30 15,008 a------- c:windowsbulymyd.lib
2009-08-13 07:30 14,556 a------- c:windowssystem32mubyhuho._sy
2009-08-13 07:30 13,326 a------- c:program filescommon filespopex.bin
2009-08-13 07:30 13,267 a------- c:windowsuviv.bin
2009-08-13 07:30 12,193 a------- c:windowsgyficykydu.exe
2009-08-13 07:30 11,804 a------- c:program filescommon fileswyzyzylodu.dat
2009-08-13 07:30 10,955 a------- c:windowstybuta.vbs
2009-08-13 07:30 10,088 a------- c:docume~1alluse~1applic~1gucemusaq.reg
2009-08-13 03:00 1,374 a------- c:windowsimsins.BAK
2009-08-12 23:00 128,512 -------- c:windowssystem32dllcachedhtmled.ocx
2009-08-12 22:00 19,580 a------- c:windowssystem32pycywo.reg
2009-08-12 22:00 18,337 a------- c:windowsjogus.inf
2009-08-12 22:00 17,437 a------- c:windowstahofupuf.ban
2009-08-12 22:00 14,340 a------- c:windowsakebyfyno.lib
2009-08-12 22:00 13,588 a------- c:windowssystem32igaxag.sys
2009-08-12 22:00 13,404 a------- c:windowsogyqidany._sy
2009-08-12 22:00 12,893 a------- c:windowssystem32qajyjukuz.bin
2009-08-12 22:00 11,763 a------- c:program filescommon filesujibuwo.pif
2009-08-12 22:00 11,413 a------- c:windowsnuguq.bat
2009-08-12 22:00 10,372 a------- c:windowssystem32ubidemexi.scr
2009-08-12 21:52 0 a------- c:windowssystem32driversOLD11.tmp
2009-08-12 21:52 47,744 a------- c:windowssystem32drivers63e5ef01.sys
2009-08-12 21:36 18,288 a------- c:windowsyjil.bat
2009-08-12 21:36 18,197 a------- c:windowssystem32vedyqyduk.dl
2009-08-12 21:36 17,934 a------- c:program filescommon filesahiku.dat
2009-08-12 21:36 17,466 a------- c:program filescommon filesjofa.vbs
2009-08-12 21:36 16,585 a------- c:docume~1alluse~1applic~1duqygazu.bat
2009-08-12 21:36 16,406 a------- c:windowsorotemimis.reg
2009-08-12 21:36 14,923 a------- c:program filescommon filesjigoceja.pif
2009-08-12 21:36 14,366 a------- c:windowsfari.scr
2009-08-12 21:36 14,245 a------- c:windowssystem32memyriku.db
2009-08-12 21:36 13,186 a------- c:windowsajyd._dl
2009-08-12 21:36 12,622 a------- c:windowseluso.exe
2009-08-12 21:36 12,123 a------- c:windowssystem32ahama.ban
2009-08-12 21:36 11,120 a------- c:program filescommon fileszewiboho.pif
2009-08-12 21:36 10,834 a------- c:docume~1alluse~1applic~1oxuzyxuha.com
2009-08-12 21:36 10,352 a------- c:windowssystem32ysatadyh._dl
2009-08-12 20:48 <DIR> --d----- c:program filesEnigma Software Group
2009-08-12 17:30 19,028 a------- c:windowssystem32evamumidot.inf
2009-08-12 17:30 17,445 a------- c:windowsibeqetumix.lib
2009-08-12 17:30 16,006 a------- c:docume~1stepha~1applic~1pukyborow.dll
2009-08-12 17:30 15,793 a------- c:windowsymuv.dat
2009-08-12 17:30 14,398 a------- c:windowssystem32ucege.bin
2009-08-12 17:30 10,568 a------- c:windowsudox.db
2009-08-12 17:30 10,498 a------- c:windowsfytoribob.inf
2009-08-12 10:27 <DIR> --d----- c:docume~1stepha~1applic~1Malwarebytes
2009-08-12 10:27 38,160 a------- c:windowssystem32driversmbamswissarmy.sys
2009-08-12 10:27 19,096 a------- c:windowssystem32driversmbam.sys
2009-08-12 10:27 <DIR> --d----- c:program filesMalwarebytes' Anti-Malware
2009-08-12 10:27 <DIR> --d----- c:docume~1alluse~1applic~1Malwarebytes
2009-08-12 10:05 <DIR> --d----- C:Lop SD
2009-08-12 09:35 2,296 a------- c:windowssystem32tmp.reg
2009-08-12 09:15 <DIR> --d----- c:program filesTrend Micro
2009-08-12 07:51 619,584 a------- c:windowssystem32dllcachentfs.sys
2009-08-05 05:01 204,800 -------- c:windowssystem32dllcachemswebdvd.dll
2009-07-21 06:49 <DIR> --d----- c:program filesCamelCasino
2009-07-17 15:01 58,880 a------- c:windowssystem32SET33.tmp
2009-07-17 15:01 58,880 -------- c:windowssystem32dllcacheatl.dll

==================== Find3M ====================

2009-08-14 07:19 12,072 a------- c:program filescommon filesujydek.dl
2009-08-14 07:19 10,702 a------- c:program filescommon filestozace.inf
2009-08-13 20:29 16,167 a------- c:program filescommon filesujavuresu.ban
2009-08-13 20:29 14,568 a------- c:program filescommon filesupabi._dl
2009-08-13 20:29 12,155 a------- c:program filescommon filesorijibu._sy
2009-08-13 08:42 16,769 a------- c:program filescommon filesvumep.lib
2009-08-13 07:30 10,772 a------- c:program filescommon fileslaguzibi._dl
2009-08-12 22:00 10,148 a------- c:program filescommon filesurowubud.dl
2009-08-12 17:30 14,235 a------- c:program filescommon filesgaraqida.ban
2009-08-12 17:30 10,744 a------- c:program filescommon filestenyla.lib
2009-08-12 08:24 156,388 a------- c:windowspchealthhelpctrconfigcachePersonal_32_1033.dat
2009-08-12 07:51 619,584 a------- c:windowssystem32driversntfs.sys
2009-08-06 23:16 27,878 a------- c:docume~1stepha~1applic~1wklnhst.dat
2009-08-05 05:01 204,800 a------- c:windowssystem32mswebdvd.dll
2009-07-19 18:48 11,067,392 a------- c:windowssystem32dllcacheieframe.dll
2009-07-19 09:18 5,937,152 a------- c:windowssystem32dllcachemshtml.dll
2009-07-13 23:43 10,841,088 a------- c:windowssystem32dllcachewmp.dll
2009-07-13 23:43 286,208 a------- c:windowssystem32wmpdxm.dll
2009-07-13 23:43 286,208 a------- c:windowssystem32dllcachewmpdxm.dll
2009-07-10 09:27 1,315,328 a------- c:windowssystem32dllcachemsoe.dll
2009-07-03 13:09 915,456 a------- c:windowssystem32wininet.dll
2009-07-03 13:09 915,456 a------- c:windowssystem32dllcachewininet.dll
2009-07-03 13:09 12,800 -------- c:windowssystem32dllcachexpshims.dll
2009-07-03 13:09 1,208,832 a------- c:windowssystem32dllcacheurlmon.dll
2009-07-03 13:09 206,848 a------- c:windowssystem32dllcacheoccache.dll
2009-07-03 13:09 594,432 a------- c:windowssystem32dllcachemsfeeds.dll
2009-07-03 13:09 55,296 a------- c:windowssystem32dllcachemsfeedsbs.dll
2009-07-03 13:09 1,985,536 a------- c:windowssystem32dllcacheiertutil.dll
2009-07-03 13:09 25,600 a------- c:windowssystem32dllcachejsproxy.dll
2009-07-03 13:09 184,320 a------- c:windowssystem32dllcacheiepeers.dll
2009-07-03 13:09 246,272 -------- c:windowssystem32dllcacheieproxy.dll
2009-07-03 13:09 386,048 a------- c:windowssystem32dllcacheiedkcs32.dll
2009-07-03 07:01 173,056 a------- c:windowssystem32dllcacheie4uinit.exe
2009-06-16 10:36 119,808 a------- c:windowssystem32t2embed.dll
2009-06-16 10:36 81,920 a------- c:windowssystem32fontsub.dll
2009-06-16 10:36 119,808 -------- c:windowssystem32dllcachet2embed.dll
2009-06-16 10:36 81,920 -------- c:windowssystem32dllcachefontsub.dll
2009-06-12 08:31 76,288 a------- c:windowssystem32telnet.exe
2009-06-12 08:31 76,288 -------- c:windowssystem32dllcachetelnet.exe
2009-06-10 10:13 84,992 a------- c:windowssystem32avifil32.dll
2009-06-10 10:13 84,992 -------- c:windowssystem32dllcacheavifil32.dll
2009-06-10 09:19 2,066,432 a------- c:windowssystem32mstscax.dll
2009-06-10 09:19 2,066,432 -------- c:windowssystem32dllcachemstscax.dll
2009-06-10 02:14 132,096 a------- c:windowssystem32wkssvc.dll
2009-06-10 02:14 132,096 -------- c:windowssystem32dllcachewkssvc.dll
2009-06-03 15:09 1,291,264 a------- c:windowssystem32quartz.dll
2009-06-03 15:09 1,291,264 -------- c:windowssystem32dllcachequartz.dll
2009-06-02 11:17 75,776 a------- c:windowssystem32WS2Fix.exe
2006-08-17 21:59 63,624 ac------ c:docume~1stepha~1applic~1GDIPFONTCACHEV1.DAT
2007-06-24 22:36 8 ---shr-- c:windowssystem3283F464E93C.sys
2006-09-09 15:59 88 ---shr-- c:windowssystem32B90F8A6C06.sys
2008-12-17 07:22 14,084 a--sh--- c:windowssystem32KGyGaAvL.sys
2008-12-17 04:08 32,768 ac-sh--- c:windowssystem32configsystemprofilelocal settingshistoryhistory.ie5mshist012008121720081218index.dat

============= FINISH: 7:50:37.96 ===============

ps girlfriends computer, my computer is right next to it, so i can read and do what u ask at the same time.

Merged posts. ~ OB

Edited by Orange Blossom, 14 August 2009 - 12:56 PM.

Hello and welcome to Bleeping Computer

We apologize for the delay in responding to your request for help. Here at Bleeping Computer we get overwhelmed at times, and we are trying our best to keep up. Please note that your topic was not intentionally overlooked. Our mission is to help everyone in need, but sometimes it takes just a little longer to get to every request for help. No one is ignored here.

If you have since resolved the original problem you were having, we would appreciate you letting us know. If not please perform the following steps below so we can have a look at the current condition of your machine.

If you have not done so, include a clear description of the problems you're having, along with any steps you may have performed so far.

Upon completing the steps below another staff member will review and take the steps necessary with you to get your machine back in working order clean and free of malware.

If you have already posted a DDS log, please do so again, as your situation may have changed.
Use the 'Add Reply' and add the new log to this thread.


Thanks and again sorry for the delay.

We need to see some information about what is happening in your machine. Please perform the following scan:

• Download DDS by sUBs from one of the following links. Save it to your desktop.
  • DDS.scr
  • DDS.pif
• Double click on the DDS icon, allow it to run.
• A small box will open, with an explaination about the tool. No input is needed, the scan is running.
• Notepad will open with the results.
• Follow the instructions that pop up for posting the results.
• Close the program window, and delete the program from your desktop.

Please note: You may have to disable any script protection running if the scan fails to run. After downloading the tool, disconnect from the internet and disable all antivirus protection. Run the scan, enable your A/V and reconnect to the internet.

Information on A/V control HERE

Topic reopened.

@ Tecle,

Please follow the instructions in the previous post.

Orange Blossom

Attach.txt:

==== Installed Programs ======================

32 bit Windows Card Reader Driver
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
AIM 6
CamelCasino
CCleaner (remove only)
Combined Community Codec Pack 2008-01-24
Compatibility Pack for the 2007 Office system
Critical Update for Windows Media Player 11 (KB959772)
DivX
Google Chrome
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
LimeWire 5.1.2
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft ActiveSync
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Mixer
Move Networks Media Player for Internet Explorer
Mozilla Firefox (3.0.13)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 8 (KB969897)
Security Update for Windows Internet Explorer 8 (KB972260)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 10 (KB936782)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973869)
SigmaTel Audio
Sound Blaster Audigy ADVANCED MB Demo
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB973815)
Winamp
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3

==== Event Viewer Messages From Past Week ========

9/3/2009 9:12:27 PM, error: Service Control Manager [7000] - The Background Intelligent Transfer Service service failed to start due to the following error: The system cannot find the file specified.
9/3/2009 9:12:27 PM, error: Service Control Manager [7000] - The Automatic Updates service failed to start due to the following error: The system cannot find the file specified.
9/3/2009 9:11:17 PM, error: DCOM [10005] - DCOM got error "%2" attempting to start the service BITS with arguments "" in order to run the server: {4991D34B-80A1-4291-83B6-3328366B9097}

==== End Of File ===========================


and my dds.txt:


DDS (Ver_09-07-30.01) - NTFSx86
Run by Stephanie Brookover at 21:12:33.17 on Thu 09/03/2009
Internet Explorer: 8.0.6001.18702
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2294.1924 [GMT -4:00]

AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\System32\wltrysvc.exe
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Creative\Mixer\CTSVolFE.exe
C:\Program Files\Microsoft ActiveSync\Wcescomm.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Documents and Settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
svchost
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\system32\rundll32.exe
c:\program files\common files\installshield\updateservice\isuspm.exe
C:\Documents and Settings\Stephanie Brookover\Desktop\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com
uSearch Page = hxxp://www.google.com
uSearch Bar = hxxp://www.google.com/ie
mDefault_Search_URL = hxxp://www.google.com/ie
mSearch Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
mSearchAssistant = hxxp://www.google.com
mWinlogon: Userinit=c:\windows\system32\Userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
TB: {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - No File
TB: {4E7BD74F-2B8D-469E-8CBD-FD60BB9AAE2E} - No File
TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File
TB: {5CBE2611-C31B-401F-89BC-4CBB25E853D7} - No File
uRun: [H/PC Connection Agent] "c:\program files\microsoft activesync\Wcescomm.exe"
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Google Update] "c:\documents and settings\stephanie brookover\local settings\application data\google\update\GoogleUpdate.exe" /c
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [ISUSPM Startup] "c:\program files\common files\installshield\updateservice\isuspm.exe" -startup
mRun: [ISUSScheduler] "c:\program files\common files\installshield\updateservice\issch.exe" -start
mRun: [DLA] c:\windows\system32\dla\DLACTRLW.EXE
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [CTSVolFE] "c:\program files\creative\mixer\CTSVolFE.exe" /r
mRun: [Regedit32] c:\windows\system32\regedit.exe
mRun: [braviax] braviax.exe
dRun: [braviax]
StartupFolder: c:\documents and settings\stephanie brookover\start menu\programs\startup\ikowin32.exe
dPolicies-explorer: ForceClassicControlPanel = 1 (0x1)
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - {2EAF5BB0-070F-11D3-9307-00C04FAE2D4F} - c:\progra~1\mi3aa1~1\INetRepl.dll
IE: {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - {552781AF-37E4-4FEE-920A-CED9E648EADD} - c:\program files\common files\microsoft shared\encarta search bar\ENCSBAR.DLL
Trusted Zone: musicmatch.com\online
DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} - c:\program files\yahoo!\common\Yinsthelper.dll
DPF: {37A273C2-5129-11D5-BF37-00A0CCE8754B} - hxxp://asp.mathxl.com/wizmodules/testgen/installers/TestGenXInstall.cab
DPF: {48DD0448-9209-4F81-9F6D-D83562940134} - hxxp://lads.myspace.com/upload/MySpaceUploader1006.cab
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - hxxp://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab
DPF: {95D88B35-A521-472B-A182-BB1A98356421} - hxxp://asp.mathxl.com/books/_Players/PearsonInstallAsst2.cab
DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} - hxxp://www.crucial.com/controls/cpcScanner.cab
DPF: {E6D23284-0E9B-417D-A782-03E4487FC947} - hxxp://asp.mathxl.com/books/_Players/MathPlayer.cab
Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - c:\program files\google\google toolbar\component\fastsearch_A8904FB862BD9564.dll
Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} -
Notify: igfxcui - igfxdev.dll
AppInit_DLLs: cru629.dat
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
LSA: Notification Packages = scecli msnfxwmc.dll

================= FIREFOX ===================

FF - ProfilePath -

============= SERVICES / DRIVERS ===============

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [2004-8-10 14336]
S2 gupdate1c9ecdee64070cc;Google Update Service (gupdate1c9ecdee64070cc);c:\program files\google\update\GoogleUpdate.exe [2009-6-14 133104]
S3 avgfwdx;avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [2009-8-13 29208]
S3 avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [2009-8-13 29208]

=============== Created Last 30 ================

2009-08-14 07:34 19,024 a------- c:\windows\gubekog.db
2009-08-14 07:34 18,667 a------- c:\docume~1\alluse~1\applic~1\lumug.vbs
2009-08-14 07:34 18,041 a------- c:\docume~1\alluse~1\applic~1\egexi.bat
2009-08-14 07:34 17,966 a------- c:\docume~1\stepha~1\applic~1\igelezaxih.scr
2009-08-14 07:34 17,074 a------- c:\program files\common files\awoceb.dll
2009-08-14 07:34 16,772 a------- c:\windows\esibywe.sys
2009-08-14 07:34 16,506 a------- c:\program files\common files\huracurehu.sys
2009-08-14 07:34 15,568 a------- c:\program files\common files\ebogufeqo.sys
2009-08-14 07:34 14,155 a------- c:\windows\mapumaqudy.inf
2009-08-14 07:34 12,976 a------- c:\docume~1\stepha~1\applic~1\fibe.bat
2009-08-14 07:34 12,727 a------- c:\program files\common files\bopic.dll
2009-08-14 07:34 12,446 a------- c:\docume~1\alluse~1\applic~1\ozidy.sys
2009-08-14 07:34 12,161 a------- c:\windows\uwejobyxo.com
2009-08-14 07:34 11,768 a------- c:\windows\system32\wurero.pif
2009-08-14 07:27 <DIR> --d----- C:\PC_Antispyware2010
2009-08-14 07:20 27,004 a------- c:\windows\system32\msword98.exe
2009-08-14 07:20 27,004 a------- c:\documents and settings\stephanie brookover\msword98.exe
2009-08-14 07:19 16,588 a------- c:\windows\system32\ejizymidug.bin
2009-08-14 07:19 16,411 a------- c:\windows\system32\carose.dl
2009-08-14 07:19 16,130 a------- c:\windows\alak.com
2009-08-14 07:19 14,778 a------- c:\windows\exidi.pif
2009-08-14 07:19 13,892 a------- c:\windows\system32\yqapimapo.bat
2009-08-14 07:19 12,926 a------- c:\windows\exij.lib
2009-08-14 07:19 12,247 a------- c:\docume~1\alluse~1\applic~1\ivigekipu.pif
2009-08-14 07:19 11,910 a------- c:\docume~1\alluse~1\applic~1\oxywuqanav.dat
2009-08-14 07:19 11,731 a------- c:\windows\system32\fudax.dll
2009-08-14 07:19 11,102 a------- c:\windows\system32\hapum.bat
2009-08-14 07:19 10,498 a------- c:\program files\common files\wywulyj.bat
2009-08-14 07:19 12,826 a------- c:\windows\ebug.vbs
2009-08-14 07:19 11,023 a------- c:\windows\system32\ypat.com
2009-08-14 07:19 347,691 a------- c:\windows\system32\_scui.cpl
2009-08-14 07:19 <DIR> --d----- c:\program files\PC_Antispyware2010
2009-08-14 07:04 11,264 a------- c:\windows\system32\braviax.exe
2009-08-14 07:02 11,264 a------- c:\windows\braviax.exe
2009-08-14 07:02 6,144 a------- c:\windows\system32\cru629.dat
2009-08-14 07:02 6,144 a------- c:\windows\cru629.dat
2009-08-14 06:57 29,184 a------- c:\windows\system32\drivers\beep.sys
2009-08-13 21:47 50,968 a------- c:\windows\system32\avgfwdx.dll
2009-08-13 21:47 29,208 a------- c:\windows\system32\drivers\avgfwdx.sys
2009-08-13 21:47 <DIR> --d----- c:\program files\AVG
2009-08-13 21:47 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
2009-08-13 20:51 11,264 a------- c:\windows\system32\braviax.ex_
2009-08-13 20:48 <DIR> --d----- c:\docume~1\stepha~1\applic~1\AVG8
2009-08-13 20:29 19,468 a------- c:\docume~1\stepha~1\applic~1\sakaryfiq.dll
2009-08-13 20:29 19,095 a------- c:\windows\rawyvo.scr
2009-08-13 20:29 18,814 a------- c:\windows\ibajupe.vbs
2009-08-13 20:29 17,591 a------- c:\windows\system32\folodedyt.bat
2009-08-13 20:29 16,607 a------- c:\windows\nicodad.dl
2009-08-13 20:29 15,531 a------- c:\program files\common files\upibo.sys
2009-08-13 20:29 14,384 a------- c:\docume~1\alluse~1\applic~1\ijyp.reg
2009-08-13 20:29 13,956 a------- c:\windows\ozapiw.ban
2009-08-13 20:29 13,890 a------- c:\windows\system32\enus.dat
2009-08-13 20:29 12,375 a------- c:\program files\common files\ogoz.pif
2009-08-13 20:29 12,294 a------- c:\windows\awef.bin
2009-08-13 20:29 12,244 a------- c:\windows\system32\cehyzubepo.reg
2009-08-13 20:29 11,805 a------- c:\docume~1\alluse~1\applic~1\nihimajyk.reg
2009-08-13 20:29 11,551 a------- c:\windows\lebe.ban
2009-08-13 20:29 11,133 a------- c:\windows\cidi.dat
2009-08-13 20:29 11,104 a------- c:\docume~1\stepha~1\applic~1\fevys.scr
2009-08-13 20:29 10,260 a------- c:\docume~1\stepha~1\applic~1\yxihyziqeg.pif
2009-08-13 20:25 18,748 a------- c:\windows\ogejar.dl
2009-08-13 20:25 15,988 a------- c:\windows\ezybolew.ban
2009-08-13 20:25 15,668 a------- c:\windows\sukeqorawy.lib
2009-08-13 20:25 15,545 a------- c:\windows\vodypepa.sys
2009-08-13 20:25 14,100 a------- c:\program files\common files\uwisilil.scr
2009-08-13 20:25 13,339 a------- c:\windows\wedege.vbs
2009-08-13 20:25 12,946 a------- c:\windows\system32\jaregi._sy
2009-08-13 20:25 12,288 a------- c:\windows\system32\ewed.reg
2009-08-13 20:25 11,438 a------- c:\program files\common files\rozimyr.com
2009-08-13 20:25 10,641 a------- c:\windows\isij.reg
2009-08-13 20:10 29,184 a------- c:\windows\system32\dllcache\beep.sys
2009-08-13 19:38 191,131 a------- c:\windows\system32\wisdstr.exe
2009-08-13 08:42 19,983 a------- c:\windows\upaler._dl
2009-08-13 08:42 19,435 a------- c:\windows\xifemuw.ban
2009-08-13 08:42 19,192 a------- c:\windows\digoqyb.lib
2009-08-13 08:42 18,285 a------- c:\program files\common files\gosucyveqo.vbs
2009-08-13 08:42 15,715 a------- c:\windows\focycary.dl
2009-08-13 08:42 14,288 a------- c:\docume~1\alluse~1\applic~1\ivodeko.vbs
2009-08-13 08:42 13,390 a------- c:\windows\ysexuze.ban
2009-08-13 08:42 11,288 a------- c:\program files\common files\hyjiveje.dat
2009-08-13 08:42 11,221 a------- c:\windows\system32\bafexa.pif
2009-08-13 08:42 10,830 a------- c:\windows\system32\takucuxepu.inf
2009-08-13 08:42 10,751 a------- c:\windows\jomidig.com
2009-08-13 08:42 10,036 a------- c:\windows\ruqicyv._dl
2009-08-13 08:35 104,064 a------- c:\windows\system32\drivers\ccce7d46.sys
2009-08-13 08:34 47,744 a------- c:\windows\system32\drivers\f1683ce2.sys
2009-08-13 07:30 18,139 a------- c:\windows\system32\davifofu.reg
2009-08-13 07:30 15,008 a------- c:\windows\bulymyd.lib
2009-08-13 07:30 14,556 a------- c:\windows\system32\mubyhuho._sy
2009-08-13 07:30 13,326 a------- c:\program files\common files\popex.bin
2009-08-13 07:30 13,267 a------- c:\windows\uviv.bin
2009-08-13 07:30 12,193 a------- c:\windows\gyficykydu.exe
2009-08-13 07:30 11,804 a------- c:\program files\common files\wyzyzylodu.dat
2009-08-13 07:30 10,955 a------- c:\windows\tybuta.vbs
2009-08-13 07:30 10,088 a------- c:\docume~1\alluse~1\applic~1\gucemusaq.reg
2009-08-13 03:00 1,374 a------- c:\windows\imsins.BAK
2009-08-12 23:00 128,512 -------- c:\windows\system32\dllcache\dhtmled.ocx
2009-08-12 22:00 19,580 a------- c:\windows\system32\pycywo.reg
2009-08-12 22:00 18,337 a------- c:\windows\jogus.inf
2009-08-12 22:00 17,437 a------- c:\windows\tahofupuf.ban
2009-08-12 22:00 14,340 a------- c:\windows\akebyfyno.lib
2009-08-12 22:00 13,588 a------- c:\windows\system32\igaxag.sys
2009-08-12 22:00 13,404 a------- c:\windows\ogyqidany._sy
2009-08-12 22:00 12,893 a------- c:\windows\system32\qajyjukuz.bin
2009-08-12 22:00 11,763 a------- c:\program files\common files\ujibuwo.pif
2009-08-12 22:00 11,413 a------- c:\windows\nuguq.bat
2009-08-12 22:00 10,372 a------- c:\windows\system32\ubidemexi.scr
2009-08-12 21:52 0 a------- c:\windows\system32\drivers\OLD11.tmp
2009-08-12 21:52 47,744 a------- c:\windows\system32\drivers\63e5ef01.sys
2009-08-12 21:36 18,288 a------- c:\windows\yjil.bat
2009-08-12 21:36 18,197 a------- c:\windows\system32\vedyqyduk.dl
2009-08-12 21:36 17,934 a------- c:\program files\common files\ahiku.dat
2009-08-12 21:36 17,466 a------- c:\program files\common files\jofa.vbs
2009-08-12 21:36 16,585 a------- c:\docume~1\alluse~1\applic~1\duqygazu.bat
2009-08-12 21:36 16,406 a------- c:\windows\orotemimis.reg
2009-08-12 21:36 14,923 a------- c:\program files\common files\jigoceja.pif
2009-08-12 21:36 14,366 a------- c:\windows\fari.scr
2009-08-12 21:36 14,245 a------- c:\windows\system32\memyriku.db
2009-08-12 21:36 13,186 a------- c:\windows\ajyd._dl
2009-08-12 21:36 12,622 a------- c:\windows\eluso.exe
2009-08-12 21:36 12,123 a------- c:\windows\system32\ahama.ban
2009-08-12 21:36 11,120 a------- c:\program files\common files\zewiboho.pif
2009-08-12 21:36 10,834 a------- c:\docume~1\alluse~1\applic~1\oxuzyxuha.com
2009-08-12 21:36 10,352 a------- c:\windows\system32\ysatadyh._dl
2009-08-12 20:48 <DIR> --d----- c:\program files\Enigma Software Group
2009-08-12 17:30 19,028 a------- c:\windows\system32\evamumidot.inf
2009-08-12 17:30 17,445 a------- c:\windows\ibeqetumix.lib
2009-08-12 17:30 16,006 a------- c:\docume~1\stepha~1\applic~1\pukyborow.dll
2009-08-12 17:30 15,793 a------- c:\windows\ymuv.dat
2009-08-12 17:30 14,398 a------- c:\windows\system32\ucege.bin
2009-08-12 17:30 10,568 a------- c:\windows\udox.db
2009-08-12 17:30 10,498 a------- c:\windows\fytoribob.inf
2009-08-12 10:27 <DIR> --d----- c:\docume~1\stepha~1\applic~1\Malwarebytes
2009-08-12 10:27 38,160 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 10:27 19,096 a------- c:\windows\system32\drivers\mbam.sys
2009-08-12 10:27 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 10:27 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-08-12 10:05 <DIR> --d----- C:\Lop SD
2009-08-12 09:35 2,296 a------- c:\windows\system32\tmp.reg
2009-08-12 09:15 <DIR> --d----- c:\program files\Trend Micro
2009-08-12 07:51 619,584 a------- c:\windows\system32\dllcache\ntfs.sys
2009-08-05 05:01 204,800 -------- c:\windows\system32\dllcache\mswebdvd.dll

==================== Find3M ====================

2009-08-14 07:19 12,072 a------- c:\program files\common files\ujydek.dl
2009-08-14 07:19 10,702 a------- c:\program files\common files\tozace.inf
2009-08-13 20:29 16,167 a------- c:\program files\common files\ujavuresu.ban
2009-08-13 20:29 14,568 a------- c:\program files\common files\upabi._dl
2009-08-13 20:29 12,155 a------- c:\program files\common files\orijibu._sy
2009-08-13 08:42 16,769 a------- c:\program files\common files\vumep.lib
2009-08-13 07:30 10,772 a------- c:\program files\common files\laguzibi._dl
2009-08-12 22:00 10,148 a------- c:\program files\common files\urowubud.dl
2009-08-12 17:30 14,235 a------- c:\program files\common files\garaqida.ban
2009-08-12 17:30 10,744 a------- c:\program files\common files\tenyla.lib
2009-08-12 08:24 156,388 a------- c:\windows\pchealth\helpctr\config\cache\Personal_32_1033.dat
2009-08-12 07:51 619,584 a------- c:\windows\system32\drivers\ntfs.sys
2009-08-06 23:16 27,878 a------- c:\docume~1\stepha~1\applic~1\wklnhst.dat
2009-08-05 05:01 204,800 a------- c:\windows\system32\mswebdvd.dll
2009-07-19 18:48 11,067,392 a------- c:\windows\system32\dllcache\ieframe.dll
2009-07-19 09:18 5,937,152 a------- c:\windows\system32\dllcache\mshtml.dll
2009-07-17 15:01 58,880 a------- c:\windows\system32\SET33.tmp
2009-07-17 15:01 58,880 -------- c:\windows\system32\dllcache\atl.dll
2009-07-13 23:43 10,841,088 a------- c:\windows\system32\dllcache\wmp.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\wmpdxm.dll
2009-07-13 23:43 286,208 a------- c:\windows\system32\dllcache\wmpdxm.dll
2009-07-10 09:27 1,315,328 a------- c:\windows\system32\dllcache\msoe.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\wininet.dll
2009-07-03 13:09 915,456 a------- c:\windows\system32\dllcache\wininet.dll
2009-07-03 13:09 12,800 -------- c:\windows\system32\dllcache\xpshims.dll
2009-07-03 13:09 1,208,832 a------- c:\windows\system32\dllcache\urlmon.dll
2009-07-03 13:09 206,848 a------- c:\windows\system32\dllcache\occache.dll
2009-07-03 13:09 594,432 a------- c:\windows\system32\dllcache\msfeeds.dll
2009-07-03 13:09 55,296 a------- c:\windows\system32\dllcache\msfeedsbs.dll
2009-07-03 13:09 1,985,536 a------- c:\windows\system32\dllcache\iertutil.dll
2009-07-03 13:09 25,600 a------- c:\windows\system32\dllcache\jsproxy.dll
2009-07-03 13:09 184,320 a------- c:\windows\system32\dllcache\iepeers.dll
2009-07-03 13:09 246,272 -------- c:\windows\system32\dllcache\ieproxy.dll
2009-07-03 13:09 386,048 a------- c:\windows\system32\dllcache\iedkcs32.dll
2009-07-03 07:01 173,056 a------- c:\windows\system32\dllcache\ie4uinit.exe
2009-06-16 10:36 119,808 a------- c:\windows\system32\t2embed.dll
2009-06-16 10:36 81,920 a------- c:\windows\system32\fontsub.dll
2009-06-16 10:36 119,808 -------- c:\windows\system32\dllcache\t2embed.dll
2009-06-16 10:36 81,920 -------- c:\windows\system32\dllcache\fontsub.dll
2009-06-12 08:31 76,288 a------- c:\windows\system32\telnet.exe
2009-06-12 08:31 76,288 -------- c:\windows\system32\dllcache\telnet.exe
2009-06-10 10:13 84,992 a------- c:\windows\system32\avifil32.dll
2009-06-10 10:13 84,992 -------- c:\windows\system32\dllcache\avifil32.dll
2009-06-10 09:19 2,066,432 a------- c:\windows\system32\mstscax.dll
2009-06-10 09:19 2,066,432 -------- c:\windows\system32\dllcache\mstscax.dll
2009-06-10 02:14 132,096 a------- c:\windows\system32\wkssvc.dll
2009-06-10 02:14 132,096 -------- c:\windows\system32\dllcache\wkssvc.dll
2006-08-17 21:59 63,624 ac------ c:\docume~1\stepha~1\applic~1\GDIPFONTCACHEV1.DAT
2007-06-24 22:36 8 ---shr-- c:\windows\system32\83F464E93C.sys
2006-09-09 15:59 88 ---shr-- c:\windows\system32\B90F8A6C06.sys
2008-12-17 07:22 14,084 a--sh--- c:\windows\system32\KGyGaAvL.sys
2008-12-17 04:08 32,768 ac-sh--- c:\windows\system32\config\systemprofile\local settings\history\history.ie5\mshist012008121720081218\index.dat

============= FINISH: 21:12:44.54 ===============

Hi Tecle,

Welcome to BC HijackThis forum and sorry for the delay. I am farbar. I am going to assist you with your problem.

Please refrain from making any changes to your system (updating Windows, installing applications, removing files, etc.) from now on as it might prolong handling your log and make the job for both of us more difficult.

Download RootRepeal.exe from one of these download locations and save it to your desktop:
http://download.bleepingcomputer.com/rootr.../RootRepeal.exe
http://ad13.geekstogo.com/RootRepeal.exe
http://rootrepeal.psikotick.com/RootRepeal.exe

• Open on your desktop.
• Click the tab.
• Click the button.
• Check all seven boxes:
• Click Ok.
• Check the box for your main system drive (Usually C:), and press Ok.
• Allow RootRepeal to run a scan of your system. This may take some time.
• Once the scan completes, push the button. Save the log to your desktop, using a distinctive name, such as RootRepeal.txt. Include this report in your next reply, please.

No problem on the delay, thanx for your time and help. here is the rootrepeal :







ROOTREPEAL © AD, 2007-2009
==================================================
Scan Start Time: 2009/09/10 07:07
Program Version: Version 1.3.5.0
Windows Version: Windows XP SP3
==================================================

Drivers
-------------------
Name: ccce7d46.sys
Image Path: C:\WINDOWS\System32\drivers\ccce7d46.sys
Address: 0xA5964000 Size: 104064 File Visible: No Signed: -
Status: -

Name: dump_iastor.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_iastor.sys
Address: 0xA0D8E000 Size: 872448 File Visible: No Signed: -
Status: -

Name: f1683ce2.sys
Image Path: C:\WINDOWS\System32\drivers\f1683ce2.sys
Address: 0xA6BC9000 Size: 47744 File Visible: No Signed: -
Status: -

Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xA7834000 Size: 49152 File Visible: No Signed: -
Status: -

Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\drivers\ccce7d46.sys
Status: Locked to the Windows API!

Path: C:\WINDOWS\system32\drivers\f1683ce2.sys
Status: Locked to the Windows API!

Path: c:\documents and settings\stephanie brookover\local settings\temp\perflib_perfdata_770.dat
Status: Allocation size mismatch (API: 16384, Raw: 0)

Processes
-------------------
Path: C:\WINDOWS\system32\braviax.exe
PID: 1336 Status: Hidden from the Windows API!

SSDT
-------------------
#: 035 Function Name: NtCreateEvent
Status: Hooked by "C:\WINDOWS\System32\drivers\ccce7d46.sys" at address 0xa59764fd

#: 041 Function Name: NtCreateKey
Status: Hooked by "C:\WINDOWS\System32\drivers\ccce7d46.sys" at address 0xa5974505

#: 119 Function Name: NtOpenKey
Status: Hooked by "C:\WINDOWS\System32\drivers\ccce7d46.sys" at address 0xa59745c5

#: 173 Function Name: NtQuerySystemInformation
Status: Hooked by "C:\WINDOWS\System32\Drivers\Beep.SYS" at address 0xa6f921a0

Stealth Objects
-------------------
Object: Hidden Module [Name: svchost.exe]
Process: svchost.exe (PID: 1032) Address: 0x01000000 Size: 20480

Object: Hidden Module [Name: svchost.exe]
Process: svchost.exe (PID: 1232) Address: 0x01000000 Size: 20480

Object: Hidden Module [Name: svchost.exe]
Process: svchost.exe (PID: 1668) Address: 0x01000000 Size: 20480

Hidden Services
-------------------
Service Name: ccce7d46
Image Path: C:\WINDOWS\System32\drivers\ccce7d46.sys

Service Name: f1683ce2
Image Path: C:\WINDOWS\System32\drivers\f1683ce2.sys

==EOF==

This time we want to run ComboFix. This is a major step. Please be precise and make sure rename before saving and save it on your desktop and let it download install the Recovery Console.


Download Combofix from any of the links below. You must rename it before saving it. Save it to your desktop.

Link 1
Link 2
Link 3





--------------------------------------------------------------------
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. (Information on A/V control HERE)

Double click on Combo-Fix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

combo fix log:


ComboFix 09-09-10.03 - Stephanie Brookover 09/11/2009 7:03.1.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2294.1851 [GMT -4:00]
Running from: c:\documents and settings\Stephanie Brookover\Desktop\Combo-Fix.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\10390004
c:\documents and settings\All Users\Application Data\10390004\10390004
c:\documents and settings\All Users\Application Data\10390004\10390004.exe
c:\documents and settings\All Users\Application Data\10390004\pc10390004ins
c:\documents and settings\All Users\Application Data\duqygazu.bat
c:\documents and settings\All Users\Application Data\duxymiroj.lib
c:\documents and settings\All Users\Application Data\egexi.bat
c:\documents and settings\All Users\Application Data\enyxiz._sy
c:\documents and settings\All Users\Application Data\gucemusaq.reg
c:\documents and settings\All Users\Application Data\ijyp.reg
c:\documents and settings\All Users\Application Data\iqyxiviv.inf
c:\documents and settings\All Users\Application Data\ivigekipu.pif
c:\documents and settings\All Users\Application Data\ivodeko.vbs
c:\documents and settings\All Users\Application Data\koxyha.scr
c:\documents and settings\All Users\Application Data\lumug.vbs
c:\documents and settings\All Users\Application Data\nihimajyk.reg
c:\documents and settings\All Users\Application Data\onehysofyq._dl
c:\documents and settings\All Users\Application Data\oxuzyxuha.com
c:\documents and settings\All Users\Application Data\ozidy.sys
c:\documents and settings\All Users\Application Data\powafame.ban
c:\documents and settings\All Users\Application Data\pukoh.lib
c:\documents and settings\All Users\Application Data\qoho.inf
c:\documents and settings\All Users\Application Data\segot.dl
c:\documents and settings\All Users\Application Data\woba._sy
c:\documents and settings\All Users\Application Data\ynol.lib
c:\documents and settings\All Users\Documents\akukirek.ban
c:\documents and settings\All Users\Documents\cozowixe.exe
c:\documents and settings\All Users\Documents\cyce.bat
c:\documents and settings\All Users\Documents\egibyd.dll
c:\documents and settings\All Users\Documents\gowywugyf._dl
c:\documents and settings\All Users\Documents\iqimyqo.inf
c:\documents and settings\All Users\Documents\irigojyjip.dl
c:\documents and settings\All Users\Documents\oziwigami.exe
c:\documents and settings\All Users\Documents\sigiqalexi.com
c:\documents and settings\All Users\Documents\siqep.bat
c:\documents and settings\All Users\Documents\urybyjaxu.bin
c:\documents and settings\All Users\Documents\yxobu.dl
c:\documents and settings\LocalService\Application Data\apomuby.bin
c:\documents and settings\LocalService\Application Data\bacelydy.reg
c:\documents and settings\LocalService\Application Data\ibadabe.dl
c:\documents and settings\LocalService\Application Data\ipomumapoj.dll
c:\documents and settings\LocalService\Application Data\iwedepigoj.pif
c:\documents and settings\LocalService\Application Data\jacewizy.sys
c:\documents and settings\LocalService\Application Data\lipuv.ban
c:\documents and settings\LocalService\Application Data\odadu.reg
c:\documents and settings\LocalService\Application Data\otaqutu.vbs
c:\documents and settings\LocalService\Application Data\ozaperu._sy
c:\documents and settings\LocalService\Application Data\qumo.bin
c:\documents and settings\LocalService\Application Data\rulo.com
c:\documents and settings\LocalService\Application Data\verojowobi.bat
c:\documents and settings\LocalService\Application Data\vulyfytu.scr
c:\documents and settings\LocalService\Application Data\xivodamoli.pif
c:\documents and settings\LocalService\Application Data\xucezafyz.reg
c:\documents and settings\LocalService\Cookies\avujux.scr
c:\documents and settings\LocalService\Cookies\awoxif.scr
c:\documents and settings\LocalService\Cookies\eqym.dl
c:\documents and settings\LocalService\Cookies\evilaf.scr
c:\documents and settings\LocalService\Cookies\gysajo.vbs
c:\documents and settings\LocalService\Cookies\opyvynu.ban
c:\documents and settings\LocalService\Cookies\qafazala.inf
c:\documents and settings\LocalService\Cookies\sifoset.dl
c:\documents and settings\LocalService\Cookies\ufivej.dat
c:\documents and settings\LocalService\Cookies\ulyfed.dll
c:\documents and settings\LocalService\Cookies\zexugaji.pif
c:\documents and settings\LocalService\Cookies\zubyn.inf
c:\documents and settings\LocalService\Cookies\zyjap.sys
c:\documents and settings\LocalService\Local Settings\Application Data\bocuz.com
c:\documents and settings\LocalService\Local Settings\Application Data\bopylif.bin
c:\documents and settings\LocalService\Local Settings\Application Data\cuxico.dl
c:\documents and settings\LocalService\Local Settings\Application Data\gybikyvuq.exe
c:\documents and settings\LocalService\Local Settings\Application Data\jygipuhi.bat
c:\documents and settings\LocalService\Local Settings\Application Data\mofimupehi.dl
c:\documents and settings\LocalService\Local Settings\Application Data\myhewib.sys
c:\documents and settings\LocalService\Local Settings\Application Data\ovafog.bat
c:\documents and settings\LocalService\Local Settings\Application Data\ucapab._dl
c:\documents and settings\LocalService\Local Settings\Application Data\uhuwuxa.scr
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\adefuhogab._sy
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\aqovyxeluk.reg
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\epivusy.db
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\laxobysuca._dl
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\luxi.com
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\oqimofaxe.pif
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\puzidyfora.scr
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\qozakire.inf
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\syfojolif.db
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\toreda.sys
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\unaq.bin
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\zewibifosa.inf
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\zifujuhyna.reg
c:\documents and settings\LocalService\oashdihasidhasuidhiasdhiashdiuasdhasd
c:\documents and settings\Stephanie Brookover\Application Data\fevys.scr
c:\documents and settings\Stephanie Brookover\Application Data\fibe.bat
c:\documents and settings\Stephanie Brookover\Application Data\igelezaxih.scr
c:\documents and settings\Stephanie Brookover\Application Data\jidob.lib
c:\documents and settings\Stephanie Brookover\Application Data\kefupa.inf
c:\documents and settings\Stephanie Brookover\Application Data\pukyborow.dll
c:\documents and settings\Stephanie Brookover\Application Data\sakaryfiq.dll
c:\documents and settings\Stephanie Brookover\Application Data\wiaserva.log
c:\documents and settings\Stephanie Brookover\Application Data\ytomeviqo._dl
c:\documents and settings\Stephanie Brookover\Application Data\yxihyziqeg.pif
c:\documents and settings\Stephanie Brookover\Cookies\dycyr.bin
c:\documents and settings\Stephanie Brookover\Cookies\igoceba.scr
c:\documents and settings\Stephanie Brookover\Cookies\lejawyh.com
c:\documents and settings\Stephanie Brookover\Cookies\zaqosi.scr
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\dumiq.ban
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\efevujikam.scr
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\evitikuna.reg
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\hodusoji.inf
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\itimoqixo.pif
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\ozicyjaxat.vbs
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\wopojocog.scr
c:\documents and settings\Stephanie Brookover\Local Settings\Temporary Internet Files\akehywi.inf
c:\documents and settings\Stephanie Brookover\Local Settings\Temporary Internet Files\dexan.dat
c:\documents and settings\Stephanie Brookover\Local Settings\Temporary Internet Files\joryfukeb.lib
c:\documents and settings\Stephanie Brookover\Local Settings\Temporary Internet Files\ynukiny.lib
c:\documents and settings\Stephanie Brookover\msword98.exe
c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\ikowin32.exe
c:\program files\Common Files\awoceb.dll
c:\program files\Common Files\bopic.dll
c:\program files\Common Files\ebogufeqo.sys
c:\program files\Common Files\garaqida.ban
c:\program files\Common Files\gosucyveqo.vbs
c:\program files\Common Files\huracurehu.sys
c:\program files\Common Files\jigoceja.pif
c:\program files\Common Files\jofa.vbs
c:\program files\Common Files\laguzibi._dl
c:\program files\Common Files\ogoz.pif
c:\program files\Common Files\popex.bin
c:\program files\Common Files\rozimyr.com
c:\program files\Common Files\tozace.inf
c:\program files\Common Files\ujavuresu.ban
c:\program files\Common Files\ujibuwo.pif
c:\program files\Common Files\ujydek.dl
c:\program files\Common Files\upabi._dl
c:\program files\Common Files\upibo.sys
c:\program files\Common Files\urowubud.dl
c:\program files\Common Files\uwisilil.scr
c:\program files\Common Files\wywulyj.bat
c:\program files\Common Files\zewiboho.pif
c:\program files\PC_Antispyware2010
c:\program files\PC_Antispyware2010\AVEngn.dll
c:\program files\PC_Antispyware2010\data\daily.cvd
c:\program files\PC_Antispyware2010\htmlayout.dll
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcm80.dll
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcp80.dll
c:\program files\PC_Antispyware2010\Microsoft.VC80.CRT\msvcr80.dll
c:\program files\PC_Antispyware2010\PC_Antispyware2010.cfg
c:\program files\PC_Antispyware2010\PC_Antispyware2010.exe
c:\program files\PC_Antispyware2010\pthreadVC2.dll
c:\program files\PC_Antispyware2010\Uninstall.exe
c:\program files\PC_Antispyware2010\wscui.cpl
c:\windows\ajyd._dl
c:\windows\awef.bin
c:\windows\braviax.exe
c:\windows\cru629.dat
c:\windows\ebug.vbs
c:\windows\eluso.exe
c:\windows\esibywe.sys
c:\windows\exidi.pif
c:\windows\ezybolew.ban
c:\windows\fari.scr
c:\windows\focycary.dl
c:\windows\fytoribob.inf
c:\windows\gyficykydu.exe
c:\windows\ibajupe.vbs
c:\windows\isij.reg
c:\windows\jogus.inf
c:\windows\lebe.ban
c:\windows\mapumaqudy.inf
c:\windows\nicodad.dl
c:\windows\nuguq.bat
c:\windows\ogejar.dl
c:\windows\orotemimis.reg
c:\windows\ozapiw.ban
c:\windows\rawyvo.scr
c:\windows\ruqicyv._dl
c:\windows\ShellNew
c:\windows\ShellNew\WINWORD8.DOC
c:\windows\system32\_000005_.tmp.dll
c:\windows\system32\_scui.cpl
c:\windows\system32\404Fix.exe
c:\windows\system32\Agent.OMZ.Fix.exe
c:\windows\system32\ahama.ban
c:\windows\system32\bafexa.pif
c:\windows\system32\bcmwl5.inf
c:\windows\system32\braviax.exe
c:\windows\system32\carose.dl
c:\windows\system32\cehyzubepo.reg
c:\windows\system32\cru629.dat
c:\windows\system32\davifofu.reg
c:\windows\system32\dllcache\figaro.sys
c:\windows\system32\drivers\ccce7d46.sys
c:\windows\system32\drivers\f1683ce2.sys
c:\windows\system32\dumphive.exe
c:\windows\system32\ejizymidug.bin
c:\windows\system32\evamumidot.inf
c:\windows\system32\ewed.reg
c:\windows\system32\folodedyt.bat
c:\windows\system32\fudax.dll
c:\windows\system32\hapum.bat
c:\windows\system32\IEDFix.C.exe
c:\windows\system32\IEDFix.exe
c:\windows\system32\igaxag.sys
c:\windows\system32\o4Patch.exe
c:\windows\system32\Process.exe
c:\windows\system32\pycywo.reg
c:\windows\system32\qajyjukuz.bin
c:\windows\system32\SrchSTS.exe
c:\windows\system32\takucuxepu.inf
c:\windows\system32\tmp.reg
c:\windows\system32\ubidemexi.scr
c:\windows\system32\ucege.bin
c:\windows\system32\VACFix.exe
c:\windows\system32\VCCLSID.exe
c:\windows\system32\vedyqyduk.dl
c:\windows\system32\wisdstr.exe
c:\windows\system32\WS2Fix.exe
c:\windows\system32\wurero.pif
c:\windows\system32\yqapimapo.bat
c:\windows\system32\ysatadyh._dl
c:\windows\tahofupuf.ban
c:\windows\tybuta.vbs
c:\windows\upaler._dl
c:\windows\uviv.bin
c:\windows\vodypepa.sys
c:\windows\wedege.vbs
c:\windows\xifemuw.ban
c:\windows\yjil.bat
c:\windows\ysexuze.ban

Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected
Restored copy from - c:\windows\system32\beep.sys

Infected copy of c:\windows\system32\drivers\AGP440.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\agp440.sys

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NPF
-------\Service_ccce7d46
-------\Service_f1683ce2


((((((((((((((((((((((((( Files Created from 2009-08-11 to 2009-09-11 )))))))))))))))))))))))))))))))
.

2009-09-04 01:14 . 2009-09-04 01:14 -------- d-----w- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
2009-08-14 11:34 . 2009-08-14 11:34 12161 ----a-w- c:\windows\uwejobyxo.com
2009-08-14 11:27 . 2009-08-14 11:27 -------- d-----w- C:\PC_Antispyware2010
2009-08-14 11:20 . 2009-08-14 11:20 27004 ----a-w- c:\windows\system32\msword98.exe
2009-08-14 11:19 . 2009-08-14 11:19 16130 ----a-w- c:\windows\alak.com
2009-08-14 11:19 . 2009-08-14 11:19 11023 ----a-w- c:\windows\system32\ypat.com
2009-08-14 10:57 . 2004-08-04 09:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys
2009-08-14 01:47 . 2009-08-14 01:47 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-08-14 01:47 . 2009-08-14 01:47 29208 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-08-14 01:47 . 2009-08-14 01:47 -------- d-----w- c:\program files\AVG
2009-08-14 01:47 . 2009-08-14 01:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-14 00:48 . 2009-08-14 00:48 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\AVG8
2009-08-14 00:29 . 2009-08-14 00:29 13890 ----a-w- c:\windows\system32\enus.dat
2009-08-14 00:29 . 2009-08-14 00:29 11133 ----a-w- c:\windows\cidi.dat
2009-08-14 00:10 . 2009-09-11 11:02 27648 ----a-w- c:\windows\system32\dllcache\beep.sys
2009-08-13 12:42 . 2009-08-13 12:42 11288 ----a-w- c:\program files\Common Files\hyjiveje.dat
2009-08-13 12:42 . 2009-08-13 12:42 10751 ----a-w- c:\windows\jomidig.com
2009-08-13 11:30 . 2009-08-13 11:30 11804 ----a-w- c:\program files\Common Files\wyzyzylodu.dat
2009-08-13 01:52 . 2009-08-13 07:07 47744 ----a-w- c:\windows\system32\drivers\63e5ef01.sys
2009-08-13 01:36 . 2009-08-13 01:36 17934 ----a-w- c:\program files\Common Files\ahiku.dat
2009-08-13 01:36 . 2009-08-13 01:36 10627 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\vimitijan.dat
2009-08-13 00:48 . 2009-08-13 00:58 -------- d-----w- c:\program files\Enigma Software Group
2009-08-13 00:25 . 2009-08-13 00:41 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-12 21:30 . 2009-08-12 21:30 15793 ----a-w- c:\windows\ymuv.dat
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\Malwarebytes
2009-08-12 14:27 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-12 14:27 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-12 14:05 . 2009-08-12 14:07 -------- d-----w- C:\Lop SD
2009-08-12 13:15 . 2009-08-12 13:15 -------- d-----w- c:\program files\Trend Micro
2009-08-12 12:27 . 2009-08-12 12:27 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache
2009-08-12 11:51 . 2009-08-12 11:51 619584 ----a-w- c:\windows\system32\dllcache\ntfs.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-14 11:49 . 2006-07-27 02:08 68288 ----a-w- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 11:19 . 2009-08-14 11:19 11910 ----a-w- c:\documents and settings\All Users\Application Data\oxywuqanav.dat
2009-08-14 01:46 . 2009-05-14 09:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg7
2009-08-14 00:29 . 2009-08-14 00:29 12155 ----a-w- c:\program files\Common Files\orijibu._sy
2009-08-13 12:42 . 2009-08-13 12:42 16769 ----a-w- c:\program files\Common Files\vumep.lib
2009-08-13 01:52 . 2009-08-13 01:52 0 ----a-w- c:\windows\system32\drivers\OLD11.tmp
2009-08-13 01:15 . 2009-05-14 08:58 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\GetRightToGo
2009-08-12 21:30 . 2009-08-12 21:30 10744 ----a-w- c:\program files\Common Files\tenyla.lib
2009-08-12 14:11 . 2006-07-20 23:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-08-12 14:11 . 2006-07-20 22:55 -------- d-----w- c:\program files\Java
2009-08-12 11:51 . 2004-08-10 16:51 619584 ----a-w- c:\windows\system32\drivers\ntfs.sys
2009-08-07 03:16 . 2006-07-25 23:23 27878 ----a-w- c:\documents and settings\Stephanie Brookover\Application Data\wklnhst.dat
2009-08-05 09:01 . 2004-08-10 16:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-21 11:20 . 2009-07-21 10:49 -------- d-----w- c:\program files\CamelCasino
2009-07-17 19:01 . 2009-07-17 19:01 58880 ----a-w- c:\windows\system32\SET33.tmp
2009-07-14 03:43 . 2004-08-10 16:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-10 16:51 915456 ----a-w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2004-08-10 16:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 16:51 81920 ----a-w- c:\windows\system32\fontsub.dll
2007-06-25 02:36 . 2007-06-25 02:36 8 --sh--r- c:\windows\system32\83F464E93C.sys
2006-09-09 19:59 . 2006-07-26 21:26 88 --sh--r- c:\windows\system32\B90F8A6C06.sys
2008-12-17 11:22 . 2007-06-25 02:36 14084 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

------- Sigcheck -------

[-] 2009-08-12 11:51 . 4DFB45D14330ACE7FD32EE8DBCF50C97 . 619584 . . [------] . . c:\windows\system32\dllcache\ntfs.sys
[-] 2009-08-12 11:51 . 4DFB45D14330ACE7FD32EE8DBCF50C97 . 619584 . . [------] . . c:\windows\system32\drivers\ntfs.sys
[7] 2008-04-13 . 78A08DD6A8D65E697C18E1DB01C5CDCA . 574976 . . [5.1.2600.5512] . . c:\windows\ServicePackFiles\i386\ntfs.sys
[-] 2007-02-09 . 05AB81909514BFD69CBB1F2C147CF6B9 . 574976 . . [5.1.2600.3081] . . c:\windows\$hf_mig$\KB930916\SP2QFE\ntfs.sys
[-] 2007-02-09 . 19A811EF5F1ED5C926A028CE107FF1AF . 574464 . . [5.1.2600.3081] . . c:\windows\$NtServicePackUninstall$\ntfs.sys
[7] 2004-08-04 . B78BE402C3F63DD55521F73876951CDD . 574592 . . [5.1.2600.2180] . . c:\windows\$NtUninstallKB930916$\ntfs.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 68856]
"Google Update"="c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-14 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-20 98304]
"CTSVolFE"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"Rbekupiyec"="c:\windows\ariguheyekitenim.dll" [2008-04-14 173568]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli msnfxwmc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Utility.lnk
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^ikowin32.exe]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\ikowin32.exe
backup=c:\windows\pss\ikowin32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^Shareaza Turbo Accelerator.lnk]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\Shareaza Turbo Accelerator.lnk
backup=c:\windows\pss\Shareaza Turbo Accelerator.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 12:51 PM 14336]
S2 gupdate1c9ecdee64070cc;Google Update Service (gupdate1c9ecdee64070cc);c:\program files\Google\Update\GoogleUpdate.exe [6/14/2009 6:57 AM 133104]
S3 avgfwdx;avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [8/13/2009 9:47 PM 29208]
S3 avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [8/13/2009 9:47 PM 29208]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-05 10:57]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 10:57]

2009-09-10 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 10:57]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2871299663-1425001378-2023338215-1006Core.job
- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-14 10:48]

2009-09-10 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2871299663-1425001378-2023338215-1006UA.job
- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-14 10:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
Trusted Zone: musicmatch.com\online
FF - ProfilePath - c:\documents and settings\Stephanie Brookover\Application Data\Mozilla\Firefox\Profiles\3bfsaotd.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\Stephanie Brookover\Application Data\Mozilla\Firefox\Profiles\3bfsaotd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: XUL Cache: {6BC2A287-0778-4E4D-AC74-99208ED6DC13} - c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
.
- - - - ORPHANS REMOVED - - - -

Toolbar-{CCC7A320-B3CA-4199-B1A6-9F516DD69829} - (no file)
HKLM-Run-10390004 - c:\documents and settings\All Users\Application Data\10390004\10390004.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-11 07:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(760)
c:\windows\msnfxwmc.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(3792)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\msnfxwmc.dll
c:\windows\ariguheyekitenim.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\bcmwltry.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-11 7:12 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-11 11:12

Pre-Run: 31,193,124,864 bytes free
Post-Run: 31,334,719,488 bytes free

447 --- E O F --- 2009-08-13 07:02

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

Looks the recovery console is not installed. Combofix removed a lot but the system is not clean yet.

With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


Go to Microsoft's website => http://support.microsoft.com/kb/310994

Scroll down to Step 1, and select the download that's appropriate for your Operating System. Download the file & save it as it's originally named.

Note: If you have SP3, use the SP2 package.


---------------------------------------------------------------------

Transfer all files you just downloaded, to the desktop of the infected computer.

--------------------------------------------------------------------


Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

• Drag the setup package onto ComboFix.exe and drop it.
  
  
• Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.
  
  
  
  
  
  
• At the next prompt, click 'Yes' to run the full ComboFix scan.
  
  
• When the tool is finished, it will produce a report for you.

Please post the C:\ComboFix.txt in your next reply.

combo fix it report 2, also now antivirus pro 2010 is now running in the task bar:


ComboFix 09-09-10.03 - Stephanie Brookover 09/11/2009 8:10.2.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2294.1827 [GMT -4:00]
Running from: c:\documents and settings\Stephanie Brookover\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Stephanie Brookover\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\hoqefedaf.com
c:\documents and settings\All Users\Application Data\ijixa.lib
c:\documents and settings\All Users\Application Data\myqyvylula.pif
c:\documents and settings\All Users\Application Data\vega.exe
c:\documents and settings\All Users\Application Data\ypocew.inf
c:\documents and settings\All Users\Documents\anaxulin.dll
c:\documents and settings\All Users\Documents\utodu.dl
c:\documents and settings\LocalService\Application Data\bujosunety.inf
c:\documents and settings\LocalService\Application Data\itutehyp._dl
c:\documents and settings\LocalService\Application Data\uralo.ban
c:\documents and settings\LocalService\Application Data\vyraco.dll
c:\documents and settings\LocalService\Application Data\xicegypup._sy
c:\documents and settings\LocalService\Cookies\timyf._dl
c:\documents and settings\LocalService\Local Settings\Application Data\corovuf.com
c:\documents and settings\LocalService\Local Settings\Application Data\iwugito.sys
c:\documents and settings\LocalService\Local Settings\Application Data\qivewaf.bin
c:\documents and settings\LocalService\Local Settings\Application Data\rexahywa.scr
c:\documents and settings\LocalService\Local Settings\Temporary Internet Files\gykenefo._dl
c:\windows\gubo.vbs
c:\windows\hovaqijodi.dll
c:\windows\locutyji.sys
c:\windows\repoxyn.dl
c:\windows\system32\_scui.cpl
c:\windows\system32\braviax.exe
c:\windows\system32\dllcache\figaro.sys
c:\windows\system32\wisdstr.exe
c:\windows\xilezo.exe

Infected copy of c:\windows\system32\drivers\ntfs.sys was found and disinfected
Restored copy from - c:\windows\ServicePackFiles\i386\ntfs.sys

Infected copy of c:\windows\system32\drivers\beep.sys was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\beep.sys

Infected copy of c:\windows\system32\drivers\AGP440.sys was found and disinfected
Restored copy from - c:\windows\ERDNT\cache\AGP440.sys

.
((((((((((((((((((((((((( Files Created from 2009-08-11 to 2009-09-11 )))))))))))))))))))))))))))))))
.

2009-09-11 12:07 . 2009-09-11 12:07 16166 ----a-w- c:\program files\Common Files\zucepe.dat
2009-09-11 12:07 . 2009-09-11 12:07 -------- d-----w- C:\AntivirusPro_2010
2009-09-11 12:07 . 2009-09-11 12:09 -------- d-----w- c:\program files\AntivirusPro_2010
2009-09-04 01:14 . 2009-09-04 01:14 -------- d-----w- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
2009-08-14 11:34 . 2009-08-14 11:34 12161 ----a-w- c:\windows\uwejobyxo.com
2009-08-14 11:27 . 2009-08-14 11:27 -------- d-----w- C:\PC_Antispyware2010
2009-08-14 11:20 . 2009-08-14 11:20 27004 ----a-w- c:\windows\system32\msword98.exe
2009-08-14 11:19 . 2009-08-14 11:19 16130 ----a-w- c:\windows\alak.com
2009-08-14 11:19 . 2009-08-14 11:19 11023 ----a-w- c:\windows\system32\ypat.com
2009-08-14 10:57 . 2004-08-04 09:00 4224 ----a-w- c:\windows\system32\drivers\beep.sys
2009-08-14 01:47 . 2009-08-14 01:47 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-08-14 01:47 . 2009-08-14 01:47 29208 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-08-14 01:47 . 2009-08-14 01:47 -------- d-----w- c:\program files\AVG
2009-08-14 01:47 . 2009-08-14 01:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-14 00:48 . 2009-08-14 00:48 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\AVG8
2009-08-14 00:29 . 2009-08-14 00:29 13890 ----a-w- c:\windows\system32\enus.dat
2009-08-14 00:29 . 2009-08-14 00:29 11133 ----a-w- c:\windows\cidi.dat
2009-08-14 00:10 . 2009-09-11 11:15 27648 ----a-w- c:\windows\system32\dllcache\beep.sys
2009-08-13 12:42 . 2009-08-13 12:42 11288 ----a-w- c:\program files\Common Files\hyjiveje.dat
2009-08-13 12:42 . 2009-08-13 12:42 10751 ----a-w- c:\windows\jomidig.com
2009-08-13 11:30 . 2009-08-13 11:30 11804 ----a-w- c:\program files\Common Files\wyzyzylodu.dat
2009-08-13 01:52 . 2009-08-13 07:07 47744 ----a-w- c:\windows\system32\drivers\63e5ef01.sys
2009-08-13 01:36 . 2009-08-13 01:36 17934 ----a-w- c:\program files\Common Files\ahiku.dat
2009-08-13 01:36 . 2009-08-13 01:36 10627 ----a-w- c:\documents and settings\LocalService\Local Settings\Application Data\vimitijan.dat
2009-08-13 00:48 . 2009-08-13 00:58 -------- d-----w- c:\program files\Enigma Software Group
2009-08-13 00:25 . 2009-08-13 00:41 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP
2009-08-12 21:30 . 2009-08-12 21:30 15793 ----a-w- c:\windows\ymuv.dat
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\Malwarebytes
2009-08-12 14:27 . 2009-08-03 17:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-12 14:27 . 2009-08-03 17:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-08-12 14:05 . 2009-08-12 14:07 -------- d-----w- C:\Lop SD
2009-08-12 13:15 . 2009-08-12 13:15 -------- d-----w- c:\program files\Trend Micro
2009-08-12 12:27 . 2009-08-12 12:27 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-14 11:49 . 2006-07-27 02:08 68288 ----a-w- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 11:19 . 2009-08-14 11:19 11910 ----a-w- c:\documents and settings\All Users\Application Data\oxywuqanav.dat
2009-08-14 01:46 . 2009-05-14 09:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg7
2009-08-14 00:29 . 2009-08-14 00:29 12155 ----a-w- c:\program files\Common Files\orijibu._sy
2009-08-13 12:42 . 2009-08-13 12:42 16769 ----a-w- c:\program files\Common Files\vumep.lib
2009-08-13 01:52 . 2009-08-13 01:52 0 ----a-w- c:\windows\system32\drivers\OLD11.tmp
2009-08-13 01:15 . 2009-05-14 08:58 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\GetRightToGo
2009-08-12 21:30 . 2009-08-12 21:30 10744 ----a-w- c:\program files\Common Files\tenyla.lib
2009-08-12 14:11 . 2006-07-20 23:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-08-12 14:11 . 2006-07-20 22:55 -------- d-----w- c:\program files\Java
2009-08-07 03:16 . 2006-07-25 23:23 27878 ----a-w- c:\documents and settings\Stephanie Brookover\Application Data\wklnhst.dat
2009-08-05 09:01 . 2004-08-10 16:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-07-21 11:20 . 2009-07-21 10:49 -------- d-----w- c:\program files\CamelCasino
2009-07-17 19:01 . 2009-07-17 19:01 58880 ----a-w- c:\windows\system32\SET33.tmp
2009-07-14 03:43 . 2004-08-10 16:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-10 16:51 915456 ------w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2004-08-10 16:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 16:51 81920 ----a-w- c:\windows\system32\fontsub.dll
2007-06-25 02:36 . 2007-06-25 02:36 8 --sh--r- c:\windows\system32\83F464E93C.sys
2006-09-09 19:59 . 2006-07-26 21:26 88 --sh--r- c:\windows\system32\B90F8A6C06.sys
2008-12-17 11:22 . 2007-06-25 02:36 14084 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-09-11_11.10.48 )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-09-11 12:07 . 2009-09-11 12:07 16384 c:\windows\temp\Perflib_Perfdata_dd4.dat
+ 2004-08-10 16:51 . 2008-04-13 19:15 574976 c:\windows\system32\drivers\ntfs.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 68856]
"Google Update"="c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-14 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-20 98304]
"CTSVolFE"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]
"Rbekupiyec"="c:\windows\ariguheyekitenim.dll" [2008-04-14 173568]
"Antivirus Pro 2010"="c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe" [2009-09-11 595456]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"ForceClassicControlPanel"= 1 (0x1)

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli msnfxwmc.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Utility.lnk
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^ikowin32.exe]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\ikowin32.exe
backup=c:\windows\pss\ikowin32.exeStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^Shareaza Turbo Accelerator.lnk]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\Shareaza Turbo Accelerator.lnk
backup=c:\windows\pss\Shareaza Turbo Accelerator.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 12:51 PM 14336]
S2 gupdate1c9ecdee64070cc;Google Update Service (gupdate1c9ecdee64070cc);c:\program files\Google\Update\GoogleUpdate.exe [6/14/2009 6:57 AM 133104]
S3 avgfwdx;avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [8/13/2009 9:47 PM 29208]
S3 avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [8/13/2009 9:47 PM 29208]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-05 10:57]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 10:57]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 10:57]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2871299663-1425001378-2023338215-1006Core.job
- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-14 10:48]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2871299663-1425001378-2023338215-1006UA.job
- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-14 10:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
Trusted Zone: musicmatch.com\online
FF - ProfilePath - c:\documents and settings\Stephanie Brookover\Application Data\Mozilla\Firefox\Profiles\3bfsaotd.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\Stephanie Brookover\Application Data\Mozilla\Firefox\Profiles\3bfsaotd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - HiddenExtension: XUL Cache: {6BC2A287-0778-4E4D-AC74-99208ED6DC13} - c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-11 08:17
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(756)
c:\windows\msnfxwmc.dll
c:\windows\system32\WININET.dll

- - - - - - - > 'explorer.exe'(2964)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\msnfxwmc.dll
c:\windows\ariguheyekitenim.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\wltrysvc.exe
c:\windows\system32\bcmwltry.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-09-11 8:20 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-11 12:20
ComboFix2.txt 2009-09-11 11:12

Pre-Run: 32,130,322,432 bytes free
Post-Run: 32,084,369,408 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

245 --- E O F --- 2009-09-11 12:18

Your log(s) show that you are using so called peer-to-peer or file-sharing programs. These programs allow to share files between users as the name(s) suggest. In today's world the cyber crime has come to an enormous dimension and any means is used to infect personal computers to make use of their stored data or machine power for further propagation of the malware files. A popular means is the use of file-sharing tools as a tremendous amount of prospective victims can be reached through it.

It is therefore possible to be infected by downloading manipulated files via peer-to-peer tools and thus suggested to be used with intense care. Some further readings on this subject, along the included links, are as follows: "File-Sharing, otherwise known as Peer To Peer" and "Risks of File-Sharing Technology."


Removal Instructions

• Empty all p2p (like LimeWire) active download folders. They might contain infected files. Please avoid using these p2p applications until the system is clean. Using these applications at this stage might lead to reinfection or infecting other users.
  
  
• Open notepad and copy/paste the text in the code box below into it:
  
  

  http://www.bleepingcomputer.com/forums/t/249507/pc-anti-spyware-2010-braviaexe/
  Collect::
  c:\program files\Common Files\zucepe.dat
  c:\windows\uwejobyxo.com
  c:\windows\system32\msword98.exe
  c:\windows\alak.com
  c:\windows\system32\ypat.com
  c:\windows\system32\enus.dat
  c:\windows\cidi.dat
  c:\program files\Common Files\hyjiveje.dat
  c:\windows\jomidig.com
  c:\program files\Common Files\wyzyzylodu.dat
  c:\windows\system32\drivers\63e5ef01.sys
  c:\program files\Common Files\ahiku.dat
  c:\documents and settings\LocalService\Local Settings\Application Data\vimitijan.dat
  c:\windows\ymuv.dat
  c:\documents and settings\All Users\Application Data\oxywuqanav.dat
  c:\program files\Common Files\orijibu._sy
  c:\program files\Common Files\vumep.lib
  c:\program files\Common Files\tenyla.lib
  c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\ikowin32.exe
  c:\windows\msnfxwmc.dll
  c:\windows\ariguheyekitenim.dll
  File::
  c:\windows\pss\ikowin32.exeStartup
  Folder::
  C:\AntivirusPro_2010
  c:\program files\AntivirusPro_2010
  C:\PC_Antispyware2010
  c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
  Firefox::
  FF - HiddenExtension: XUL Cache: {6BC2A287-0778-4E4D-AC74-99208ED6DC13} - c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
  Registry::
  [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "Antivirus Pro 2010"=-
  [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
  "Notification Packages"=hex(7):73,63,65,63,6C,69,00,00
  [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
  "ForceClassicControlPanel"=-
  [-HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^ikowin32.exe]

  
  Save this as CFScript.txt
  
  
  
  
  
  Referring to the picture above, drag CFScript.txt into ComboFix.exe
  
  When finished, it shall produce a log for you. Please copy and paste that log in your next reply.
  
  **Important Note**
  
  When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
  • Ensure you are connected to the internet and click OK on the message box.
• Open your Malwarebytes' Anti-Malware.
  • First update it, to do that under the Update tab press "Check for Updates".
  • Under Scanner tab select "Perform Quick Scan", then click Scan.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the MBAM log.
  Extra Note:
  If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.

Edited by farbar, 11 September 2009 - 08:07 AM.

malawarebytes mbam log:

Malwarebytes' Anti-Malware 1.41
Database version: 2780
Windows 5.1.2600 Service Pack 3

9/11/2009 11:53:31 AM
mbam-log-2009-09-11 (11-53-31).txt

Scan type: Quick Scan
Objects scanned: 101480
Time elapsed: 2 minute(s), 54 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 2
Folders Infected: 0
Files Infected: 2

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\AntivirusPro_2010 (Rogue.AntiVirusPro2010) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\braviax.ex_ (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dllcache\beep.sys (Fake.Beep.sys) -> Quarantined and deleted successfully.

Please post the Combofix log too.

The log is here:

Please go to start -> Run. Copy and paste the bold line in the run-box and click OK:

C:\ComboFix.txt

If a text file opens up, copy and paste the content to your reply.

Sorry:

ComboFix 09-09-10.03 - Stephanie Brookover 09/11/2009 9:50.3.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.2294.1815 [GMT -4:00]
Running from: c:\documents and settings\Stephanie Brookover\Desktop\Combo-Fix.exe
Command switches used :: c:\documents and settings\Stephanie Brookover\Desktop\CFScript.txt
AV: AVG Internet Security *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

FILE ::
"c:\windows\pss\ikowin32.exeStartup"

file zipped: c:\documents and settings\All Users\Application Data\oxywuqanav.dat
file zipped: c:\documents and settings\LocalService\Local Settings\Application Data\vimitijan.dat
file zipped: c:\program files\Common Files\ahiku.dat
file zipped: c:\program files\Common Files\hyjiveje.dat
file zipped: c:\program files\Common Files\orijibu._sy
file zipped: c:\program files\Common Files\tenyla.lib
file zipped: c:\program files\Common Files\vumep.lib
file zipped: c:\program files\Common Files\wyzyzylodu.dat
file zipped: c:\program files\Common Files\zucepe.dat
file zipped: c:\windows\alak.com
file zipped: c:\windows\ariguheyekitenim.dll
file zipped: c:\windows\cidi.dat
file zipped: c:\windows\jomidig.com
file zipped: c:\windows\msnfxwmc.dll
file zipped: c:\windows\system32\drivers\63e5ef01.sys
file zipped: c:\windows\system32\enus.dat
file zipped: c:\windows\system32\msword98.exe
file zipped: c:\windows\system32\ypat.com
file zipped: c:\windows\uwejobyxo.com
file zipped: c:\windows\ymuv.dat
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\AntivirusPro_2010
c:\antiviruspro_2010\AntivirusPro_2010.lnk
c:\antiviruspro_2010\Uninstall.lnk
c:\documents and settings\All Users\Application Data\oxywuqanav.dat
c:\documents and settings\LocalService\Local Settings\Application Data\vimitijan.dat
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}\chrome.manifest
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}\chrome\content\_cfg.js
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}\chrome\content\overlay.xul
c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\{6BC2A287-0778-4E4D-AC74-99208ED6DC13}\install.rdf
C:\PC_Antispyware2010
c:\pc_antispyware2010\PC_Antispyware2010.lnk
c:\pc_antispyware2010\Uninstall.lnk
c:\program files\AntivirusPro_2010
c:\program files\AntivirusPro_2010\AntivirusPro_2010.cfg
c:\program files\AntivirusPro_2010\AntivirusPro_2010.exe
c:\program files\AntivirusPro_2010\AVEngn.dll
c:\program files\AntivirusPro_2010\data\daily.cvd
c:\program files\AntivirusPro_2010\htmlayout.dll
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcm80.dll
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcp80.dll
c:\program files\AntivirusPro_2010\Microsoft.VC80.CRT\msvcr80.dll
c:\program files\AntivirusPro_2010\pthreadVC2.dll
c:\program files\AntivirusPro_2010\Uninstall.exe
c:\program files\AntivirusPro_2010\wscui.cpl
c:\program files\Common Files\ahiku.dat
c:\program files\Common Files\hyjiveje.dat
c:\program files\Common Files\orijibu._sy
c:\program files\Common Files\tenyla.lib
c:\program files\Common Files\vumep.lib
c:\program files\Common Files\wyzyzylodu.dat
c:\program files\Common Files\zucepe.dat
c:\windows\alak.com
c:\windows\ariguheyekitenim.dll
c:\windows\cidi.dat
c:\windows\jomidig.com
c:\windows\msnfxwmc.dll
c:\windows\pss\ikowin32.exeStartup
c:\windows\system32\drivers\63e5ef01.sys
c:\windows\system32\enus.dat
c:\windows\system32\msword98.exe
c:\windows\system32\ypat.com
c:\windows\uwejobyxo.com
c:\windows\ymuv.dat

.
((((((((((((((((((((((((( Files Created from 2009-08-11 to 2009-09-11 )))))))))))))))))))))))))))))))
.

2009-08-14 10:57 . 2004-08-04 09:00 4224 ------w- c:\windows\system32\drivers\beep.sys
2009-08-14 01:47 . 2009-08-14 01:47 50968 ----a-w- c:\windows\system32\avgfwdx.dll
2009-08-14 01:47 . 2009-08-14 01:47 29208 ----a-w- c:\windows\system32\drivers\avgfwdx.sys
2009-08-14 01:47 . 2009-08-14 01:47 -------- d-----w- c:\program files\AVG
2009-08-14 01:47 . 2009-08-14 01:48 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
2009-08-14 00:48 . 2009-08-14 00:48 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\AVG8
2009-08-14 00:10 . 2009-09-11 11:15 27648 ----a-w- c:\windows\system32\dllcache\beep.sys
2009-08-13 00:48 . 2009-08-13 00:58 -------- d-----w- c:\program files\Enigma Software Group
2009-08-13 00:25 . 2009-08-13 00:41 -------- d---a-w- c:\documents and settings\All Users\Application Data\TEMP

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-08-14 11:49 . 2006-07-27 02:08 68288 ----a-w- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-08-14 01:46 . 2009-05-14 09:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Avg7
2009-08-13 01:52 . 2009-08-13 01:52 0 ----a-w- c:\windows\system32\drivers\OLD11.tmp
2009-08-13 01:15 . 2009-05-14 08:58 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\GetRightToGo
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\documents and settings\Stephanie Brookover\Application Data\Malwarebytes
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-08-12 14:27 . 2009-08-12 14:27 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-08-12 14:11 . 2006-07-20 23:02 -------- d-----w- c:\documents and settings\All Users\Application Data\Viewpoint
2009-08-12 14:11 . 2006-07-20 22:55 -------- d-----w- c:\program files\Java
2009-08-12 13:15 . 2009-08-12 13:15 -------- d-----w- c:\program files\Trend Micro
2009-08-07 03:16 . 2006-07-25 23:23 27878 ----a-w- c:\documents and settings\Stephanie Brookover\Application Data\wklnhst.dat
2009-08-05 09:01 . 2004-08-10 16:51 204800 ----a-w- c:\windows\system32\mswebdvd.dll
2009-08-03 17:36 . 2009-08-12 14:27 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-08-03 17:36 . 2009-08-12 14:27 19096 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-07-21 11:20 . 2009-07-21 10:49 -------- d-----w- c:\program files\CamelCasino
2009-07-17 19:01 . 2009-07-17 19:01 58880 ----a-w- c:\windows\system32\SET33.tmp
2009-07-14 03:43 . 2004-08-10 16:51 286208 ----a-w- c:\windows\system32\wmpdxm.dll
2009-07-03 17:09 . 2004-08-10 16:51 915456 ------w- c:\windows\system32\wininet.dll
2009-06-16 14:36 . 2004-08-10 16:51 119808 ----a-w- c:\windows\system32\t2embed.dll
2009-06-16 14:36 . 2004-08-10 16:51 81920 ----a-w- c:\windows\system32\fontsub.dll
2007-06-25 02:36 . 2007-06-25 02:36 8 --sh--r- c:\windows\system32\83F464E93C.sys
2006-09-09 19:59 . 2006-07-26 21:26 88 --sh--r- c:\windows\system32\B90F8A6C06.sys
2008-12-17 11:22 . 2007-06-25 02:36 14084 --sha-w- c:\windows\system32\KGyGaAvL.sys
.

((((((((((((((((((((((((((((( SnapShot@2009-09-11_11.10.48 )))))))))))))))))))))))))))))))))))))))))
.
- 2009-08-13 03:00 . 2009-05-26 11:40 26488 c:\windows\SoftwareDistribution\Download\b7f0b2892b21211a5630518d058f48d9\update\spcustom.dll
- 2009-08-13 03:00 . 2009-05-26 11:40 17272 c:\windows\SoftwareDistribution\Download\b7f0b2892b21211a5630518d058f48d9\spmsg.dll
- 2009-07-17 19:01 . 2009-07-17 19:01 58880 c:\windows\SoftwareDistribution\Download\b7f0b2892b21211a5630518d058f48d9\sp3gdr\atl.dll
+ 2009-09-11 12:18 . 2009-09-11 12:19 5908 c:\windows\SoftwareDistribution\EventCache\{D9CEB902-8E98-4EA0-A3A0-095BD5295E14}.bin
+ 2004-08-10 16:51 . 2008-04-13 19:15 574976 c:\windows\system32\drivers\ntfs.sys
- 2009-08-13 03:00 . 2009-05-26 11:40 382840 c:\windows\SoftwareDistribution\Download\b7f0b2892b21211a5630518d058f48d9\update\updspapi.dll
- 2009-08-13 03:00 . 2009-05-26 11:40 755576 c:\windows\SoftwareDistribution\Download\b7f0b2892b21211a5630518d058f48d9\update\update.exe
- 2009-08-13 03:00 . 2009-05-26 11:40 231288 c:\windows\SoftwareDistribution\Download\b7f0b2892b21211a5630518d058f48d9\spuninst.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\Wcescomm.exe" [2006-11-13 1289000]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-27 68856]
"Google Update"="c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-06-14 133104]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-10-14 77824]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 139264]
"ISUSPM Startup"="c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 249856]
"ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 81920]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-09-08 122940]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-07-20 98304]
"CTSVolFE"="c:\program files\Creative\Mixer\CTSVolFE.exe" [2005-02-23 57344]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Belkin Wireless Utility.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Belkin Wireless Utility.lnk
backup=c:\windows\pss\Belkin Wireless Utility.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=c:\windows\pss\Microsoft Office.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^LimeWire On Startup.lnk]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\LimeWire On Startup.lnk
backup=c:\windows\pss\LimeWire On Startup.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^Stephanie Brookover^Start Menu^Programs^Startup^Shareaza Turbo Accelerator.lnk]
path=c:\documents and settings\Stephanie Brookover\Start Menu\Programs\Startup\Shareaza Turbo Accelerator.lnk
backup=c:\windows\pss\Shareaza Turbo Accelerator.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=
"c:\program files\Microsoft ActiveSync\rapimgr.exe"= c:\program files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"c:\program files\Microsoft ActiveSync\wcescomm.exe"= c:\program files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"c:\\Program Files\\AIM6\\aim6.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\program files\Microsoft ActiveSync\WCESMgr.exe"= c:\program files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R2 NwSapAgent;SAP Agent;c:\windows\system32\svchost.exe -k netsvcs [8/10/2004 12:51 PM 14336]
S2 gupdate1c9ecdee64070cc;Google Update Service (gupdate1c9ecdee64070cc);c:\program files\Google\Update\GoogleUpdate.exe [6/14/2009 6:57 AM 133104]
S3 avgfwdx;avgfwdx;c:\windows\system32\drivers\avgfwdx.sys [8/13/2009 9:47 PM 29208]
S3 avgfwfd;AVG network filter service;c:\windows\system32\drivers\avgfwdx.sys [8/13/2009 9:47 PM 29208]

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-09-11 c:\windows\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-03-05 10:57]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 10:57]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-06-14 10:57]

2009-08-15 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2871299663-1425001378-2023338215-1006Core.job
- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-14 10:48]

2009-09-11 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-2871299663-1425001378-2023338215-1006UA.job
- c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-06-14 10:48]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com
mStart Page = hxxp://www.google.com
Trusted Zone: musicmatch.com\online
FF - ProfilePath - c:\documents and settings\Stephanie Brookover\Application Data\Mozilla\Firefox\Profiles\3bfsaotd.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - plugin: c:\documents and settings\Stephanie Brookover\Application Data\Mozilla\Firefox\Profiles\3bfsaotd.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp071303000006.dll
FF - plugin: c:\documents and settings\Stephanie Brookover\Local Settings\Application Data\Google\Update\1.2.183.7\npGoogleOneClick8.dll
FF - plugin: c:\program files\Google\Google Updater\2.4.1601.7122\npCIDetect13.dll
FF - plugin: c:\program files\Google\Update\1.2.183.7\npGoogleOneClick8.dll
.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-Rbekupiyec - c:\windows\ariguheyekitenim.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-11 11:42
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3864)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\bcmwltry.exe
c:\program files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\MI3AA1~1\rapimgr.exe
.
**************************************************************************
.
Completion time: 2009-09-11 11:44 - machine was rebooted
ComboFix-quarantined-files.txt 2009-09-11 15:44
ComboFix2.txt 2009-09-11 12:20
ComboFix3.txt 2009-09-11 11:12

Pre-Run: 32,116,432,896 bytes free
Post-Run: 32,058,310,656 bytes free

241 --- E O F --- 2009-09-11 12:18