Redirecting virus

Have vituamonde? and now my appraisal software is not responding correctly.

Please help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:54:21 PM, on 12/31/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\System32\wltrysvc.exe
C:\WINNT\System32\bcmwltry.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\iWin Games\iWinGamesInstaller.exe
C:\Program Files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe
C:\WINNT\system32\slserv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\fxssvc.exe
C:\WINNT\system32\slrundll.exe
C:\WINNT\system32\wscntfy.exe
C:\WINNT\System32\svchost.exe
C:\Program Files\Outlook Express\msimn.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll (file missing)
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.3000.1001\en-us\msntb.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [The Assistant] "C:\Program Files\a la mode\Sched\eSched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NIC Monitor] VNICMon.exe
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\System32\NeroCheck.exe
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [ERS_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\ers_startupmon.exe"
O4 - HKLM\..\Run: [DC6_check] "C:\Program Files\Common Files\WinAntiVirus Pro 2006\dc6_startupmon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Belkin Wireless Utility.lnk = ?
O4 - Global Startup: Enable Belkin Wireless Keyboard Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe
O4 - Global Startup: Enable Belkin Wireless Mouse Driver.lnk = C:\Program Files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe
O4 - Global Startup: hp psc 2000 Series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NETGEAR WG111T Smart Wizard.lnk = ?
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINNT\system32\GPhotos.scr/200
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINNT\system32\msjava.dll
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyPoker\PartyPoker.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\System32\shdocvw.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\WINNT\System32\shdocvw.dll
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab46479.cab
O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Monopoly Here and Now\Images\stg_drm.ocx
O16 - DPF: {15589FA1-C456-11CE-BF01-00AA0055595A} - http://w4s2.work4sure.com/c/ge/w4sgeen10.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} (alaWeb.clsGetStats) - file://C:\Win2000\Content\cabs\alaWeb.CAB
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (ZoneBuddy Class) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab32846.cab
O16 - DPF: {474F00F5-3853-492C-AC3A-476512BBC336} (UploadListView Class) - http://picasaweb.google.com/s/v/54.16/uploader2.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://rdfr1.spaces.live.com//PhotoUpload/MsnPUpld.cab
O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab32846.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase8942.cab
O16 - DPF: {75565ED2-1560-4F15-B841-20358DE6A0D1} (ImageControl Class) - http://content.ancestry.com/asfiles/files/...ll/MFImgVwr.cab
O16 - DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} (GeacRevw Control) - http://sav.mlxchange.com/5.0.05.46/Control/IRCSharc.cab
O16 - DPF: {9191F686-7F0A-441D-8A98-2FE3AC1BD913} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab
O16 - DPF: {A30FBBDC-FA29-4606-8565-14AADCCA6708} (Rite Aid One Hour Photo Online Control) - https://photos.riteaid.com/control/RiteAidO...PhotoOnline.cab
O16 - DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} (alaGrid.TechDocSearch) - file://C:\Win2000\Content\cabs\alaGrid.CAB
O16 - DPF: {B198A72B-B4C3-42B5-B8DA-B364E76429AA} (Cerebus Class) - http://sav.mlxchange.com/3.0.08.72/Control/WebDog.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab
O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab42858.cab
O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Monopoly Here and Now\Images\armhelper.ocx
O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (StadiumProxy Class) - http://zone.msn.com/binframework/v10/StProxy.cab41227.cab
O16 - DPF: {E7DBFB6C-113A-47CF-B278-F5C6AF4DE1BD} - http://download.abacast.com/download/files/abasetup161.cab
O23 - Service: GameConsoleService - WildTangent, Inc. - C:\Program Files\WildGames\Game Console - WildGames\GameConsoleService.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iWinGamesInstaller - iWin Inc. - C:\Program Files\iWin Games\iWinGamesInstaller.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\System32\HPZipm12.exe
O23 - Service: SmartLinkService (SLService) - - C:\WINNT\SYSTEM32\slserv.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINNT\System32\wltrysvc.exe
O24 - Desktop Component 0: (no name) - C:\Documents and Settings\Owner\My Documents\My Pictures\Katie and China rug valentines 2007.jpg

--
End of file - 10049 bytes

Edited by knew1, 31 December 2009 - 01:55 PM.

Hello!
My name is Sam and I will be helping you.

In order to see what's going on with your computer I will ask for you to post various logs from the tools that we will use to resolve your issue. Please also share with me any information about how your computer is reacting and behaving each step of the way as we work through this process.


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

• Make sure you are connected to the Internet.
• Double-click on Download_mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.
• MBAM will automatically start and you will be asked to update the program before performing a scan. If an update is found, the program will automatically update itself. Press the OK button to close that box and continue. If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install.
• On the Scanner tab:
  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.
• Back at the main Scanner screen, click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad and you may be prompted to restart your computer. (see Note below)
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.




We need to create an OTL Report

• Please download OTL from here
• Save it to your desktop.
• Double click on the icon on your desktop.
• Click the "Scan All Users" checkbox.
• Under the Custom Scan box paste this in
  
  netsvcs
  %SYSTEMDRIVE%\*.exe
  /md5start
  eventlog.dll
  scecli.dll
  netlogon.dll
  cngaudit.dll
  sceclt.dll
  ntelogon.dll
  logevent.dll
  iaStor.sys
  nvstor.sys
  atapi.sys
  IdeChnDr.sys
  viasraid.sys
  AGP440.sys
  vaxscsi.sys
  nvatabus.sys
  viamraid.sys
  nvata.sys
  nvgts.sys
  iastorv.sys
  ViPrt.sys
  eNetHook.dll
  ahcix86.sys
  KR10N.sys
  /md5stop
  %systemroot%\*. /mp /s
  %systemroot%\system32\*.dll /lockedfiles
  CREATERESTOREPOINT
  
  
  
  
• Click the "Quick Scan" button.
• The scan should take just a few minutes.
• Please copy and paste both logs back here in your next reply.

I did the malware quick scan. It came back with no problems found. I am still redirected. There has got to be something. My app software still is not operating correctly either.

The OTL scan hangs up at NetSvcs settings and won't go any farther.

Remove this line from the custom scan in OTL.

netsvcs

Keep everything else and click Run Scan.

Now it is hanging up at 'AppCertDlls key'

Please download RKill by Grinler

Link #1
Link #2
Link #3
Link #4

• Before we begin, you should disable your anti-malware softwares you have installed so they do not interfere RKill running as some anti-malware softwares detect RKill as malicious. Please refer to this page if you are not sure how.
• Download Link #1.
• Save it to your Desktop.
• Double click the RKill desktop icon.
  If you are using Vista please right click and run as Admin!
• A black screen will briefly flash indicating a successful run.
• If this does not occur please delete that application and download Link #2.
• Continue process until the tool runs.
• If the tool does not run from any of the links tell me about it.

After RKill runs, try OTL again.

Still hangs up doing quick scan and run scan. Same places as before.

Please download ComboFix from one of these locations:

Link 1
Link 2
Link 3

Important!
You should NOT use Combofix unless you have been instructed to do so by a Malware Removal Expert.
It is intended by its creator to be used under the guidance and supervision of an Malware Removal Expert, not for private use.
Using this tool incorrectly could lead to disastrous problems with your operating system such as preventing it from ever starting again.


Make sure that you save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.





Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:




Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please copy and paste the contents of C:\ComboFix.txt in your next reply.

ComboFix 10-01-03.05 - Owner 01/04/2010 9:44.1.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1271.946 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\fix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Documents\cigu.inf
c:\documents and settings\All Users\Documents\etegufo.reg
c:\documents and settings\All Users\Documents\gupexypu.bat
c:\documents and settings\All Users\Documents\oveqysog.reg
c:\documents and settings\All Users\Documents\peloju.inf
c:\documents and settings\All Users\Documents\vyniheqagi.vbs
c:\documents and settings\All Users\Documents\wyty.inf
c:\documents and settings\NetworkService\Application Data\Install.dat
c:\documents and settings\Owner\Application Data\Install.dat
c:\documents and settings\Owner\Application Data\ricy.inf
c:\documents and settings\Owner\Application Data\tagop.bat
c:\documents and settings\Owner\err.log
c:\documents and settings\Owner\Local Settings\Application Data\pojusirih.vbs
c:\documents and settings\Owner\Local Settings\Application Data\wezasuze.vbs
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\apupaw._sy
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\daho.bat
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\ecipyr.dll
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\elyvigywoz.reg
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\guvefyvume.inf
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\ixezynezu.dl
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\kirebiku.inf
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\macafe.vbs
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\mafobug.bin
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\ohonohufud.dl
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\qikih.com
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\usibyhezum.com
c:\documents and settings\Owner\Local Settings\Temporary Internet Files\uzyn._dl
c:\program files\Common Files\azinoqa.reg
c:\program files\Common Files\Companion Wizard
c:\program files\Common Files\companion wizard\log.txt
c:\program files\Common Files\fipatom.vbs
c:\program files\Common Files\oxycoz.bat
c:\program files\Common Files\ybocaruc.bat
c:\recycler\S-1-5-21-1233308376-2944640564-1361533672-1003
C:\Thumbs.db
c:\winnt\acom.exe
c:\winnt\apipovas.vbs
c:\winnt\bubonek.reg
c:\winnt\dasepe.vbs
c:\winnt\niluzibaf.dll
c:\winnt\sefawe.scr
c:\winnt\system32\bcmwl5.inf
c:\winnt\system32\cetaraj.vbs
c:\winnt\system32\cuqerisu.inf
c:\winnt\system32\ivoxuqune.reg
c:\winnt\system32\lulace.reg
c:\winnt\system32\reboot.txt
c:\winnt\tinaxysa.inf
c:\winnt\umetymy.scr
c:\winnt\urex.reg
c:\winnt\vyvyh._sy

Infected copy of c:\winnt\system32\DRIVERS\atapi.sys was found and disinfected
Restored copy from - Kitty ate it
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_FOPN
-------\Legacy_VSPF
-------\Legacy_VSPF_HK


((((((((((((((((((((((((( Files Created from 2009-12-04 to 2010-01-04 )))))))))))))))))))))))))))))))
.

2010-01-01 19:13 . 2006-01-30 14:32 5632 ----a-w- c:\winnt\system32\pxc25pm.dll
2010-01-01 19:13 . 2004-12-07 12:11 258352 ----a-w- c:\winnt\system32\unicows.dll
2010-01-01 19:13 . 2010-01-01 19:13 -------- d-----w- c:\program files\Tracker Software
2009-12-31 17:53 . 2009-12-31 17:53 -------- d-----w- c:\program files\Trend Micro
2009-12-28 13:44 . 2010-01-01 18:09 -------- d-----w- c:\program files\Panda Security
2009-12-23 13:36 . 2009-12-23 13:38 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\bapxdd
2009-12-18 20:27 . 2009-12-18 20:27 -------- d-----w- c:\documents and settings\Owner\Application Data\AVG8
2009-12-18 15:38 . 2009-12-18 15:38 -------- d-sh--w- c:\winnt\system32\config\systemprofile\IETldCache
2009-12-18 13:50 . 2009-12-18 13:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-04 15:04 . 2009-11-02 18:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2010-01-02 18:50 . 2008-04-30 21:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-02 17:17 . 2004-10-21 08:47 -------- d-----w- c:\program files\MSN Games
2010-01-02 17:13 . 2006-09-19 15:35 -------- d-----w- c:\program files\Windows Live Safety Center
2010-01-01 18:25 . 2003-11-06 03:02 -------- d-----w- c:\program files\WildTangent
2010-01-01 18:25 . 2008-10-29 12:10 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2010-01-01 18:24 . 2005-03-31 04:50 -------- d-----w- c:\program files\Yahoo! Games
2010-01-01 18:21 . 2003-11-06 03:02 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-01 18:18 . 2008-10-30 12:21 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games
2010-01-01 18:16 . 2005-04-27 15:37 -------- d-----w- c:\program files\CTI Navigator
2010-01-01 18:16 . 2008-05-09 12:26 -------- d-----w- c:\program files\Coupons
2010-01-01 18:12 . 2003-11-06 02:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 18:12 . 2005-03-18 03:23 -------- d-----w- c:\program files\a la mode
2010-01-01 18:09 . 2006-05-15 17:16 -------- d-----w- c:\program files\Google
2009-12-31 16:02 . 2008-06-12 11:57 -------- d-----w- c:\program files\amerix2314
2009-12-30 17:57 . 2004-01-27 15:29 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM
2009-12-23 14:04 . 2009-06-19 17:47 -------- d-----w- c:\program files\Lavasoft
2009-12-23 14:04 . 2009-06-19 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-12-22 22:17 . 2004-01-23 16:28 -------- d-----w- c:\program files\BDE
2009-12-20 17:21 . 2009-09-03 17:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-20 16:23 . 2009-09-03 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-15 15:51 . 2007-01-22 19:36 3695944 ----a-w- c:\winnt\system32\filecabinet5.dll
2009-12-11 21:27 . 2008-02-05 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\alamode
2009-11-23 18:05 . 2009-11-23 18:05 243016 ----a-w- c:\winnt\system32\alaiphone.dll
2009-11-23 14:46 . 2007-01-22 19:36 1041736 ----a-w- c:\winnt\system32\auroraupgrade.dll
2009-11-09 20:04 . 2004-01-27 21:48 73064 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-09 18:30 . 2009-11-09 18:30 -------- d-----w- c:\program files\MSECache
2009-11-05 18:41 . 2009-11-05 18:41 -------- d-----w- c:\program files\ReflexiveArcade
2009-11-05 14:03 . 2003-08-22 14:12 595272 ----a-w- c:\winnt\system32\alatrans.dll
2009-11-03 01:42 . 2009-10-05 12:58 195456 ------w- c:\winnt\system32\MpSigStub.exe
2009-10-29 07:45 . 2004-02-06 22:05 916480 ----a-w- c:\winnt\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 ----a-w- c:\winnt\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 ----a-w- c:\winnt\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ------w- c:\winnt\system32\drivers\http.sys
2009-10-15 14:15 . 2007-01-22 19:36 2303304 ----a-w- c:\winnt\system32\xsitenet.dll
2009-10-13 13:14 . 2007-01-22 19:36 1353032 ----a-w- c:\winnt\system32\wtfiles.dll
2009-10-13 10:30 . 1980-01-01 06:00 270336 ----a-w- c:\winnt\system32\oakley.dll
2009-10-12 13:38 . 1980-01-01 06:00 149504 ----a-w- c:\winnt\system32\rastls.dll
2009-10-12 13:38 . 1980-01-01 06:00 79872 ----a-w- c:\winnt\system32\raschap.dll
2009-10-07 21:17 . 2006-12-20 20:37 3925440 ----a-w- c:\winnt\system32\adbilling.dll
2009-09-03 17:20 . 2009-09-03 17:20 15931 ----a-w- c:\program files\Common Files\jagigo.dl
2009-09-03 17:20 . 2009-09-03 17:20 13551 ----a-w- c:\program files\Common Files\gosapoz.dat
2009-08-29 12:59 . 2009-08-29 12:59 13072 ----a-w- c:\program files\Common Files\adyhed.pif
2009-08-29 12:59 . 2009-08-29 12:59 14226 ----a-w- c:\program files\Common Files\fafana.com
2009-08-29 12:59 . 2009-08-29 12:59 12626 ----a-w- c:\program files\Common Files\vadugarig.bin
2009-08-28 21:20 . 2009-08-28 21:20 19743 ----a-w- c:\program files\Common Files\ikugyk.dat
2009-08-28 21:20 . 2009-08-28 21:20 19170 ----a-w- c:\program files\Common Files\uxafalyqoq._sy
2009-08-28 21:20 . 2009-08-28 21:20 13132 ----a-w- c:\program files\Common Files\uwuko.dat
2009-08-28 17:50 . 2009-08-28 17:50 11181 ----a-w- c:\program files\Common Files\ulitiv.bin
2009-08-28 12:34 . 2009-08-28 12:34 12221 ----a-w- c:\program files\Common Files\viduhe.dll
2008-02-25 13:14 . 2008-02-25 13:14 29298460 ----a-w- c:\program files\staNav.exe
2007-10-03 15:31 . 2007-10-03 15:31 27024112 ----a-w- c:\program files\PowerPointViewer.exe
2004-11-12 14:58 . 2004-11-12 14:57 18944 --sha-w- c:\program files\Thumbs.db
.

------- Sigcheck -------

[7] 2003-03-31 . DA1F27D85E0D1525F6621372E7B685E9 . 4224 . . [5.1.2600.0] . . c:\winnt\system32\dllcache\beep.sys

c:\winnt\System32\drivers\beep.sys ... is missing !!
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-30 68856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25626408]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 200767]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"The Assistant"="c:\program files\a la mode\Sched\eSched.exe" [2007-04-16 99840]
"NIC Monitor"="VNICMon.exe" [2002-09-05 40960]
"NeroCheck"="c:\winnt\System32\NeroCheck.exe" [2001-07-09 155648]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-17 28672]
"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2005-02-16 155648]
"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2003-07-10 114688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Belkin Wireless Utility.lnk - c:\program files\Belkin\F5D7001v2000\Belkinwcui.exe [2006-11-20 1572864]
Enable Belkin Wireless Keyboard Driver.lnk - c:\program files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe [2004-1-16 192512]
Enable Belkin Wireless Mouse Driver.lnk - c:\program files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe [2004-1-16 212992]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-14 111376]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [2005-9-29 483412]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-14 51984]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= c:\documents and settings\Owner\My Documents\My Pictures\Katie and China rug valentines 2007.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2004-12-19 18:44 98304 ----a-w- c:\program files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINNT\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINNT\\ServicePackFiles\\i386\\iexplore.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Gateway\\HPA\\GWMenu.exe"=
"c:\\Program Files\\Microsoft SQL Server\\MSSQL$ALAMODE\\Binn\\sqlservr.exe"=
"c:\\Program Files\\a la mode\\Sched\\eSched.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 kbfilter;Keyboard Filter Driver;c:\winnt\system32\drivers\kbfilter.sys [1/16/2004 1:41 PM 11886]
R2 MSSQL$ALAMODE;MSSQL$ALAMODE;c:\program files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe [5/4/2005 12:04 AM 9158656]
S3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\winnt\system32\drivers\Athfmwdl.sys [9/29/2005 8:35 PM 43392]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\winnt\system32\DNINDIS5.sys [9/29/2005 8:35 PM 17149]
S3 L2XPSR;L2XPSR;\??\c:\progra~1\EFFICI~1\TANGOM~1\app\L2XPSR.SYS --> c:\progra~1\EFFICI~1\TANGOM~1\app\L2XPSR.SYS [?]
S3 SQLAgent$ALAMODE;SQLAgent$ALAMODE;c:\program files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlagent.EXE [5/3/2005 9:42 PM 323584]
S3 VNICPKT5;VNICPKT5 Protocol Driver;c:\winnt\system32\VNICPKT5.sys [1/24/2004 6:29 PM 16202]
.
Contents of the 'Scheduled Tasks' folder

2004-08-04 c:\winnt\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8074861580.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52]

2010-01-01 c:\winnt\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8083780329.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52]

2010-01-04 c:\winnt\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-30 17:13]

2004-01-16 c:\winnt\Tasks\ISP signup reminder 1.job
- c:\winnt\System32\OOBE\oobebaln.exe [2003-10-06 00:12]

2004-01-27 c:\winnt\Tasks\ISP signup reminder 2.job
- c:\winnt\System32\OOBE\oobebaln.exe [2003-10-06 00:12]

2004-02-01 c:\winnt\Tasks\ISP signup reminder 3.job
- c:\winnt\System32\OOBE\oobebaln.exe [2003-10-06 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: alamode.com\www
Trusted Zone: mappoint.net\www
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} - file://c:\win2000\Content\cabs\alaWeb.CAB
DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} - hxxp://sav.mlxchange.com/5.0.05.46/Control/IRCSharc.cab
DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} - file://c:\win2000\Content\cabs\alaGrid.CAB
.
- - - - ORPHANS REMOVED - - - -

HKU-Default-Run-ALUAlert - c:\program files\Symantec\LiveUpdate\ALUNotify.exe
AddRemove-Praetorians - c:\progra~1\EIDOSI~1\PYROST~1\PRAETO~1\UNWISE.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-04 10:02
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3759976718-407013637-3259503129-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(3800)
c:\winnt\system32\WININET.dll
c:\winnt\system32\ieframe.dll
c:\winnt\system32\mshtml.dll
c:\winnt\system32\msls31.dll
c:\winnt\system32\webcheck.dll
c:\winnt\system32\WPDShServiceObj.dll
c:\winnt\system32\PortableDeviceTypes.dll
c:\winnt\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\winnt\System32\wltrysvc.exe
c:\winnt\System32\bcmwltry.exe
c:\winnt\system32\fxssvc.exe
c:\winnt\system32\wscntfy.exe
c:\winnt\system32\slrundll.exe
c:\winnt\system32\VNICMon.exe
c:\progra~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
c:\program files\Belkin Wireless\Belkin Wireless Keyboard\OSD.EXE
c:\program files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\winnt\System32\HPZipm12.exe
c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
.
**************************************************************************
.
Completion time: 2010-01-04 10:15:00 - machine was rebooted
ComboFix-quarantined-files.txt 2010-01-04 15:14

Pre-Run: 17,118,605,312 bytes free
Post-Run: 17,662,304,256 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINNT="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

- - End Of File - - 7281F326BA2B8BC1F53A4851C028BA95

Computer is now working as it should. Appraisal software working as it should. You are a lifesaver.

All icons on desktop are highlighted now when they weren't before. Is this something to be concerned with?

We're not quite done yet.

Copy and paste ALL the following text in the Quote box below into Notepad.
Click on File(in the menu at the top)>Save as../Save as Type: 'All Files' /File name: CFScript to your desktop.

Mia::
c:\winnt\System32\drivers\beep.sys

File::
c:\program files\Common Files\jagigo.dl
c:\program files\Common Files\gosapoz.dat
c:\program files\Common Files\adyhed.pif
c:\program files\Common Files\fafana.com
c:\program files\Common Files\vadugarig.bin
c:\program files\Common Files\ikugyk.dat
c:\program files\Common Files\uxafalyqoq._sy
c:\program files\Common Files\uwuko.dat
c:\program files\Common Files\ulitiv.bin
c:\program files\Common Files\viduhe.dll

Prior to running Combofix.exe you should disable your antivirus program.

Now drag then drop the CFScript file onto ComboFix.exe as seen in the image below.



This will start ComboFix again.
After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.


======================


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2
If you have a previous version of MBAM, remove it via Add/Remove Programs and download a fresh copy.

• Make sure you are connected to the Internet.
• Double-click on mbam-setup.exe to install the application.
• When the installation begins, follow the prompts and do not make any changes to default settings.
• When installation has finished, make sure you leave both of these checked:
  • Update Malwarebytes' Anti-Malware
  • Launch Malwarebytes' Anti-Malware
• Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

• If an update is found, the program will automatically update itself.
• Press the OK button to close that box and continue.
• If you encounter any problems while downloading the updates, manually download them from here and just double-click on mbam-rules.exe to install. Alternatively, you can update through MBAM's interface from a clean computer, copy the definitions (rules.ref) located in C:\Documents and Settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware from that system to a usb stick or CD and then copy it to the infected machine.

On the Scanner tab:

• Make sure the "Perform Quick Scan" option is selected.
• Then click on the Scan button.
• If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
• The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
• When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
• Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

• Click on the Show Results button to see a list of any malware that was found.
• Make sure that everything is checked, and click Remove Selected.
• When removal is completed, a log report will open in Notepad.
• The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
• Copy and paste the contents of that report in your next reply and exit MBAM.

Note: If MBAM encounters a file that is difficult to remove, you may be asked to reboot your computer so it can proceed with the disinfection process. Regardless if prompted to restart the computer or not, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware. MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you after scanning with MBAM. Please temporarily disable such programs or permit them to allow the changes.

ComboFix 10-01-04.01 - Owner 01/05/2010 16:09:55.2.1 - x86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1271.630 [GMT -5:00]
Running from: c:\documents and settings\Owner\Desktop\fix.exe
Command switches used :: c:\documents and settings\Owner\Desktop\CFScript.txt

FILE ::
"c:\program files\Common Files\adyhed.pif"
"c:\program files\Common Files\fafana.com"
"c:\program files\Common Files\gosapoz.dat"
"c:\program files\Common Files\ikugyk.dat"
"c:\program files\Common Files\jagigo.dl"
"c:\program files\Common Files\ulitiv.bin"
"c:\program files\Common Files\uwuko.dat"
"c:\program files\Common Files\uxafalyqoq._sy"
"c:\program files\Common Files\vadugarig.bin"
"c:\program files\Common Files\viduhe.dll"
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\Common Files\adyhed.pif
c:\program files\Common Files\fafana.com
c:\program files\Common Files\gosapoz.dat
c:\program files\Common Files\ikugyk.dat
c:\program files\Common Files\jagigo.dl
c:\program files\Common Files\ulitiv.bin
c:\program files\Common Files\uwuko.dat
c:\program files\Common Files\uxafalyqoq._sy
c:\program files\Common Files\vadugarig.bin
c:\program files\Common Files\viduhe.dll

c:\winnt\System32\drivers\beep.sys was missing
Restored copy from - c:\winnt\system32\dllcache\beep.sys

.
((((((((((((((((((((((((( Files Created from 2009-12-05 to 2010-01-05 )))))))))))))))))))))))))))))))
.

2010-01-05 21:19 . 2003-03-31 12:00 4224 ----a-w- c:\winnt\system32\drivers\beep.sys
2010-01-05 21:19 . 2003-03-31 12:00 4224 ----a-w- c:\winnt\system32\dllcache\beep.sys
2010-01-01 19:13 . 2006-01-30 14:32 5632 ----a-w- c:\winnt\system32\pxc25pm.dll
2010-01-01 19:13 . 2004-12-07 12:11 258352 ----a-w- c:\winnt\system32\unicows.dll
2010-01-01 19:13 . 2010-01-01 19:13 -------- d-----w- c:\program files\Tracker Software
2009-12-31 17:53 . 2009-12-31 17:53 -------- d-----w- c:\program files\Trend Micro
2009-12-28 13:44 . 2010-01-01 18:09 -------- d-----w- c:\program files\Panda Security
2009-12-23 13:36 . 2009-12-23 13:38 -------- d-----w- c:\documents and settings\Owner\Local Settings\Application Data\bapxdd
2009-12-18 20:27 . 2009-12-18 20:27 -------- d-----w- c:\documents and settings\Owner\Application Data\AVG8
2009-12-18 15:38 . 2009-12-18 15:38 -------- d-sh--w- c:\winnt\system32\config\systemprofile\IETldCache
2009-12-18 13:50 . 2009-12-18 13:50 -------- d-sh--w- c:\documents and settings\LocalService\IETldCache

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-01-05 21:20 . 2009-11-02 18:36 -------- d-----w- c:\documents and settings\Owner\Application Data\Skype
2010-01-05 14:41 . 2004-01-27 15:29 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-01-05 12:47 . 2008-04-30 21:00 -------- d-----w- c:\documents and settings\All Users\Application Data\Google Updater
2010-01-04 19:00 . 2008-02-05 19:23 -------- d-----w- c:\documents and settings\All Users\Application Data\alamode
2010-01-02 17:17 . 2004-10-21 08:47 -------- d-----w- c:\program files\MSN Games
2010-01-02 17:13 . 2006-09-19 15:35 -------- d-----w- c:\program files\Windows Live Safety Center
2010-01-01 18:25 . 2003-11-06 03:02 -------- d-----w- c:\program files\WildTangent
2010-01-01 18:25 . 2008-10-29 12:10 -------- d-----w- c:\documents and settings\All Users\Application Data\WildTangent
2010-01-01 18:24 . 2005-03-31 04:50 -------- d-----w- c:\program files\Yahoo! Games
2010-01-01 18:21 . 2003-11-06 03:02 -------- d-----w- c:\program files\Common Files\Symantec Shared
2010-01-01 18:18 . 2008-10-30 12:21 -------- d-----w- c:\documents and settings\All Users\Application Data\iWin Games
2010-01-01 18:16 . 2005-04-27 15:37 -------- d-----w- c:\program files\CTI Navigator
2010-01-01 18:16 . 2008-05-09 12:26 -------- d-----w- c:\program files\Coupons
2010-01-01 18:12 . 2003-11-06 02:59 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-01-01 18:12 . 2005-03-18 03:23 -------- d-----w- c:\program files\a la mode
2010-01-01 18:09 . 2006-05-15 17:16 -------- d-----w- c:\program files\Google
2009-12-31 16:02 . 2008-06-12 11:57 -------- d-----w- c:\program files\amerix2314
2009-12-23 14:04 . 2009-06-19 17:47 -------- d-----w- c:\program files\Lavasoft
2009-12-23 14:04 . 2009-06-19 17:47 -------- d-----w- c:\documents and settings\All Users\Application Data\Lavasoft
2009-12-22 22:17 . 2004-01-23 16:28 -------- d-----w- c:\program files\BDE
2009-12-20 17:21 . 2009-09-03 17:31 -------- d-----w- c:\program files\Spybot - Search & Destroy
2009-12-20 16:23 . 2009-09-03 17:31 -------- d-----w- c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-12-15 15:51 . 2007-01-22 19:36 3695944 ----a-w- c:\winnt\system32\filecabinet5.dll
2009-11-23 18:05 . 2009-11-23 18:05 243016 ----a-w- c:\winnt\system32\alaiphone.dll
2009-11-23 14:46 . 2007-01-22 19:36 1041736 ----a-w- c:\winnt\system32\auroraupgrade.dll
2009-11-09 20:04 . 2004-01-27 21:48 73064 ----a-w- c:\documents and settings\Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-11-09 18:30 . 2009-11-09 18:30 -------- d-----w- c:\program files\MSECache
2009-11-05 14:03 . 2003-08-22 14:12 595272 ----a-w- c:\winnt\system32\alatrans.dll
2009-11-03 01:42 . 2009-10-05 12:58 195456 ------w- c:\winnt\system32\MpSigStub.exe
2009-10-29 07:45 . 2004-02-06 22:05 916480 ------w- c:\winnt\system32\wininet.dll
2009-10-21 05:38 . 2004-08-04 07:56 75776 ----a-w- c:\winnt\system32\strmfilt.dll
2009-10-21 05:38 . 2004-08-04 07:56 25088 ----a-w- c:\winnt\system32\httpapi.dll
2009-10-20 16:20 . 2004-08-04 06:00 265728 ------w- c:\winnt\system32\drivers\http.sys
2009-10-15 14:15 . 2007-01-22 19:36 2303304 ----a-w- c:\winnt\system32\xsitenet.dll
2009-10-13 13:14 . 2007-01-22 19:36 1353032 ----a-w- c:\winnt\system32\wtfiles.dll
2009-10-13 10:30 . 1980-01-01 06:00 270336 ----a-w- c:\winnt\system32\oakley.dll
2009-10-12 13:38 . 1980-01-01 06:00 149504 ----a-w- c:\winnt\system32\rastls.dll
2009-10-12 13:38 . 1980-01-01 06:00 79872 ----a-w- c:\winnt\system32\raschap.dll
2008-02-25 13:14 . 2008-02-25 13:14 29298460 ----a-w- c:\program files\staNav.exe
2007-10-03 15:31 . 2007-10-03 15:31 27024112 ----a-w- c:\program files\PowerPointViewer.exe
2004-11-12 14:58 . 2004-11-12 14:57 18944 --sha-w- c:\program files\Thumbs.db
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-04-30 68856]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2009-10-09 25626408]
"MoneyAgent"="c:\program files\Microsoft Money\System\mnyexpr.exe" [2002-07-17 200767]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"The Assistant"="c:\program files\a la mode\Sched\eSched.exe" [2007-04-16 99840]
"NIC Monitor"="VNICMon.exe" [2002-09-05 40960]
"NeroCheck"="c:\winnt\System32\NeroCheck.exe" [2001-07-09 155648]
"Microsoft Works Update Detection"="c:\program files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2002-07-17 28672]
"IgfxTray"="c:\winnt\system32\igfxtray.exe" [2005-02-16 155648]
"HotKeysCmds"="c:\winnt\system32\hkcmd.exe" [2003-07-10 114688]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-03-13 39264]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Acrobat Assistant.lnk - c:\program files\Adobe\Acrobat 6.0\Distillr\acrotray.exe [2003-10-23 217194]
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
Belkin Wireless Utility.lnk - c:\program files\Belkin\F5D7001v2000\Belkinwcui.exe [2006-11-20 1572864]
Enable Belkin Wireless Keyboard Driver.lnk - c:\program files\Belkin Wireless\Belkin Wireless Keyboard\MagicKey.exe [2004-1-16 192512]
Enable Belkin Wireless Mouse Driver.lnk - c:\program files\Belkin Wireless\Belkin Wireless Mouse\MouseAp.exe [2004-1-16 212992]
hp psc 2000 Series.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpobnz08.exe [2003-4-6 323646]
hpoddt01.exe.lnk - c:\program files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe [2003-4-6 28672]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-8-14 111376]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
NETGEAR WG111T Smart Wizard.lnk - c:\program files\NETGEAR\WG111T Configuration Utility\wlan111t.exe [2005-9-29 483412]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-8-14 51984]

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
Source= c:\documents and settings\Owner\My Documents\My Pictures\Katie and China rug valentines 2007.jpg
FriendlyName=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, ntoskrnl.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
2004-12-19 18:44 98304 ----a-w- c:\program files\QuickTime\qttask.exe

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\WINNT\\system32\\fxsclnt.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"c:\\WINNT\\ServicePackFiles\\i386\\iexplore.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Gateway\\HPA\\GWMenu.exe"=
"c:\\Program Files\\Microsoft SQL Server\\MSSQL$ALAMODE\\Binn\\sqlservr.exe"=
"c:\\Program Files\\a la mode\\Sched\\eSched.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 kbfilter;Keyboard Filter Driver;c:\winnt\system32\drivers\kbfilter.sys [1/16/2004 1:41 PM 11886]
R2 MSSQL$ALAMODE;MSSQL$ALAMODE;c:\program files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlservr.exe [5/4/2005 12:04 AM 9158656]
S3 ATHFMWDL;NETGEAR WG111T bootloader driver;c:\winnt\system32\drivers\Athfmwdl.sys [9/29/2005 8:35 PM 43392]
S3 DNINDIS5;DNINDIS5 NDIS Protocol Driver;c:\winnt\system32\DNINDIS5.sys [9/29/2005 8:35 PM 17149]
S3 L2XPSR;L2XPSR;\??\c:\progra~1\EFFICI~1\TANGOM~1\app\L2XPSR.SYS --> c:\progra~1\EFFICI~1\TANGOM~1\app\L2XPSR.SYS [?]
S3 SQLAgent$ALAMODE;SQLAgent$ALAMODE;c:\program files\Microsoft SQL Server\MSSQL$ALAMODE\Binn\sqlagent.EXE [5/3/2005 9:42 PM 323584]
S3 VNICPKT5;VNICPKT5 Protocol Driver;c:\winnt\system32\VNICPKT5.sys [1/24/2004 6:29 PM 16202]
.
Contents of the 'Scheduled Tasks' folder

2004-08-04 c:\winnt\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8074861580.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52]

2010-01-05 c:\winnt\Tasks\FRU Task 2003-04-06 08:52ewlett-Packard2003-04-06 08:52p psc 2170 series5E771253C1676EBED677BF361FDFC537825E15B8083780329.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2003-04-06 05:52]

2010-01-05 c:\winnt\Tasks\Google Software Updater.job
- c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-04-30 17:13]

2004-01-16 c:\winnt\Tasks\ISP signup reminder 1.job
- c:\winnt\System32\OOBE\oobebaln.exe [2003-10-06 00:12]

2004-01-27 c:\winnt\Tasks\ISP signup reminder 2.job
- c:\winnt\System32\OOBE\oobebaln.exe [2003-10-06 00:12]

2004-02-01 c:\winnt\Tasks\ISP signup reminder 3.job
- c:\winnt\System32\OOBE\oobebaln.exe [2003-10-06 00:12]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
mStart Page = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
Trusted Zone: alamode.com\www
Trusted Zone: mappoint.net\www
DPF: Microsoft XML Parser for Java - file://c:\winnt\Java\classes\xmldso.cab
DPF: {2C15848B-21C0-406A-9902-56C8D90684F3} - file://c:\win2000\Content\cabs\alaWeb.CAB
DPF: {83AB6E4D-CDD7-11D3-B5E7-00104B9AFF6E} - hxxp://sav.mlxchange.com/5.0.05.46/Control/IRCSharc.cab
DPF: {AED6797A-D608-11D4-89D2-00105AA3C57F} - file://c:\win2000\Content\cabs\alaGrid.CAB
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-01-05 16:20
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-3759976718-407013637-3259503129-1003\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(868)
c:\winnt\system32\igfxsrvc.dll
c:\winnt\system32\hccutils.DLL
.
Completion time: 2010-01-05 16:25:08
ComboFix-quarantined-files.txt 2010-01-05 21:24
ComboFix2.txt 2010-01-04 15:15

Pre-Run: 17,530,494,976 bytes free
Post-Run: 17,563,176,960 bytes free

- - End Of File - - 408108AF73F717AF3988AC1A73990F52

New Malware quick scan found no problems. No log to post.

Looks good to me!


We need to remove Combofix now that we're done with it.

• Click Start -> Run
• Now type Combofix /uninstall in the runbox and click OK

==================



Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

• Disable and Enable System Restore. - You should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.
  
  You can find instructions on how to enable and reenable system restore here:
  
  Windows XP System Restore Guide
  
  Renable system restore with instructions from tutorial above
  
  
• Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
  
  See this link for a listing of some online & their stand-alone antivirus programs:
  
  Virus, Spyware, and Malware Protection and Removal Resources
  
  
• Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
  
  
• Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
  
  For a tutorial on Firewalls and a listing of some available ones see the link below:
  
  Understanding and Using Firewalls
  
  
• Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
  
  
• Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.
  
  A tutorial on installing & using this product can be found here:
  
  Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers
  
  
• Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
  
  A tutorial on installing & using this product can be found here:
  
  Using SpywareBlaster to protect your computer from Spyware and Malware
  
  
• Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

Follow this list and your potential for being infected again will reduce dramatically.