Here is my HijackThis log



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:01:02 PM, on 8/17/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16705)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\cisvc.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamtrayctrl.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\cidaemon.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: (no name) - {FBA3115F-C38B-4926-83DC-00C2C48A32D3} - (no file)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O18 - Filter hijack: text/html - {77806e44-e790-4edb-aecb-f8640304392d} - (no file)
O20 - AppInit_DLLs: wttxwu.dll eajprf.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

--
End of file - 8219 bytes

Hi, my name is Victor and I will be helping you.

Please take your time to read thru my instructions and follow them carefully. I am not going to be able to reply immediately so please wait patiently for my reply.

Please download Combofix from one of these locations:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe
http://www.forospyware.com/sUBs/ComboFix.exe
http://subs.geekstogo.com/ComboFix.exe

Take note that the links are case sensitive
Save ComboFix to the desktop.
Note: It is important that it is saved directly to, and run from your desktop.

In the event you already have Combofix, please delete it as this is a new version.

Close any open browsers.
Close/disable all anti-virus and anti-malware programs so they do not interfere with the running of ComboFix.
1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.
Note: Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang. Do not proceed with the rest of the fix if you fail to run combofix

Hi Victor, thanks for such a quick response.




ComboFix Log



ComboFix 08-08-18.04 - Scott 2008-08-19 5:34:33.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.630 [GMT -4:00]
Running from: C:\Documents and Settings\Scott\Desktop\ComboFix.exe
* Resident AV is active


WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\Documents and Settings\Scott\Application Data\macromedia\Flash Player\#SharedObjects\NKFTTZEX\interclick.com
C:\Documents and Settings\Scott\Application Data\macromedia\Flash Player\#SharedObjects\NKFTTZEX\interclick.com\ud.sol
C:\Documents and Settings\Scott\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Scott\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\Scott\UserData
C:\Documents and Settings\Scott\UserData\index.dat
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\fse
C:\Temp\fse\tmpZTF.log
C:\WINDOWS\system\oeminfo.ini
C:\WINDOWS\system32\MSINET.oca
C:\WINDOWS\system32\qbrubqsi.dll
C:\WINDOWS\system32\uttss.bak1
C:\WINDOWS\system32\wttxwu.dll
C:\WINDOWS\system32\ydriospx.ini

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_TDSSSERV
-------\Legacy_TDSSSERV


((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-18 17:43 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\Leisure Suit Larry(TM) - Magna Cum Laude
2008-08-18 03:02 . 2005-10-14 20:45 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-18 03:01 . 2008-08-18 03:01 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-08-18 02:48 . 2004-08-04 06:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-08-18 02:47 . 2004-08-04 06:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-08-18 02:46 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-08-17 22:14 . 2008-08-17 22:14 <DIR> d-------- C:\WINDOWS\dell
2008-08-16 22:26 . 2008-08-16 22:27 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-16 21:43 . 2008-08-16 21:43 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-16 21:40 . 2008-08-16 21:40 <DIR> d-------- C:\Program Files\CCleaner
2008-08-16 20:46 . 2008-08-16 20:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-16 19:28 . 2008-08-16 19:29 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-16 19:28 . 2008-08-16 19:28 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Malwarebytes
2008-08-16 19:28 . 2008-08-16 19:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-16 19:28 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-16 19:28 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-16 18:24 . 2008-08-16 23:10 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-08-16 02:21 . 2008-08-16 02:21 <DIR> d-------- C:\Documents and Settings\Administrator.MAIN
2008-08-16 00:29 . 2008-08-16 00:29 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-08-13 18:06 . 2008-08-15 15:09 <DIR> d-------- C:\Program Files\Wild West Quest
2008-08-13 13:57 . 2008-08-13 14:03 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Ancient Quest of Saqqarah__reflexive
2008-08-12 15:24 . 2008-08-12 16:39 <DIR> d-------- C:\GUILTY
2008-08-12 15:07 . 2008-08-12 15:07 <DIR> d-------- C:\DIG
2008-08-11 21:44 . 2008-08-17 14:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-11 21:44 . 2008-08-11 21:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-11 19:25 . 2008-08-11 19:25 <DIR> d-------- C:\WINDOWS\Build in Time
2008-08-11 08:14 . 2008-08-11 08:14 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Big Fish Games
2008-08-08 05:52 . 2008-08-08 05:52 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Gaijin Ent
2008-08-06 08:02 . 2008-08-06 08:02 <DIR> d-------- C:\WINDOWS\Cooking Dash
2008-08-05 00:34 . 2008-08-05 00:34 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\UNOUndercover
2008-08-05 00:32 . 2008-08-15 19:38 <DIR> d-------- C:\Program Files\UNO Undercover
2008-08-04 23:55 . 2008-08-04 23:55 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Amaranth Games
2008-08-02 11:06 . 2008-08-02 11:07 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\BeachPartyCraze
2008-08-02 11:04 . 2008-08-02 11:04 <DIR> d-------- C:\WINDOWS\Beach Party Craze
2008-07-25 21:18 . 2008-08-16 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 19:55 . 2008-07-25 19:55 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Jasc
2008-07-25 19:47 . 2008-07-25 19:48 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-07-25 19:46 . 2008-08-16 20:35 <DIR> d-------- C:\Program Files\Unlocker
2008-07-25 19:46 . 2008-07-25 19:46 <DIR> d-------- C:\Program Files\DVDFab 5
2008-07-25 19:46 . 2008-07-25 19:46 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Vso
2008-07-25 15:35 . 2008-07-25 15:35 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\FUJIFILM
2008-07-24 16:39 . 2008-07-24 16:43 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-24 16:39 . 2008-07-24 16:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-07-23 19:49 . 2008-07-23 19:49 <DIR> d-------- C:\Program Files\uTorrent
2008-07-23 19:49 . 2008-08-16 19:29 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-18 23:29 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-16 07:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-15 22:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-15 03:54 --------- d-----w C:\Program Files\McAfee
2008-08-07 21:36 --------- d-----w C:\Documents and Settings\Scott\Application Data\COREL
2008-08-06 12:03 --------- d-----w C:\Documents and Settings\Scott\Application Data\PlayFirst
2008-07-26 02:17 --------- d-----w C:\Program Files\Google
2008-07-26 00:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-26 00:04 --------- d-----w C:\Program Files\Lavasoft
2008-07-17 16:19 --------- d-----w C:\Program Files\vixy.net
2008-07-13 02:03 --------- d-----w C:\Documents and Settings\Scott\Application Data\SoundSpectrum
2008-07-13 00:07 --------- d-----w C:\Program Files\SoundSpectrum
2008-07-12 06:11 --------- d-----w C:\Documents and Settings\Scott\Application Data\Apple Computer
2008-07-11 23:23 --------- d-----w C:\Documents and Settings\Scott\Application Data\Move Networks
2008-07-05 18:53 0 ----a-w C:\Documents and Settings\Scott\jagex_runescape_preferences.dat
2008-07-05 05:13 --------- d-----w C:\Documents and Settings\Scott\Application Data\LimeWire
2008-07-04 00:24 --------- d-----w C:\Program Files\LimeWire
2008-06-29 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
2008-06-24 07:17 --------- d-----w C:\Documents and Settings\Scott\Application Data\Pogo Games
2008-06-24 07:14 --------- d-----w C:\Program Files\Oberon Media
2007-12-24 06:58 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-10-06 18:30 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2007-09-17 16:51 88 --sha-r C:\WINDOWS\system32\EE23474822.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-19_ 5.03.31.60 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-19 09:22:54 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-19 09:22:54 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
+ 2008-08-19 09:22:54 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50 114688]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-04 02:33 582992]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44 249856]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 09:47 57344]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-01 07:51:29 24576]
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2008-01-14 14:12:01 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wttxwu.dll eajprf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= lvfwwdmt.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 04:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--a------ 2004-12-02 18:23 102400 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellTransferAgent]
--a------ 2007-11-13 17:46 135168 C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
--a------ 2005-09-08 05:20 122940 C:\WINDOWS\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2005-11-01 03:12 94208 C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
--a------ 2001-09-06 18:10 94208 C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2006-08-01 07:58 26112 C:\Program Files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--a------ 2000-05-11 01:00 90112 C:\WINDOWS\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
--a------ 2005-09-19 07:42 1159168 C:\Program Files\Creative\VoiceCenter\AndreaVC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
--a------ 2005-05-19 08:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
--a------ 2004-12-22 17:40 24576 C:\WINDOWS\MIDIDEF.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RSVP"=3 (0x3)
"NMIndexingService"=3 (0x3)
"NBService"=3 (0x3)
"gusvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\patchget.dat"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 lusbaudio;Logitech USB Microphone;C:\WINDOWS\system32\drivers\lvsound2.sys [2001-09-06 18:09]
R3 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 12:43]
R3 QCEmerald;Logitech QuickCam Web(PID_0850);C:\WINDOWS\system32\DRIVERS\LVCE.sys [2001-09-06 18:09]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 18:53]
S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-07-30 20:07]
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 09:57]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setup.exe
.
Contents of the 'Scheduled Tasks' folder

2008-08-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2008-07-15 C:\WINDOWS\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-08-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
- - - - ORPHANS REMOVED - - - -

MSConfigStartUp-304bfe1e - C:\WINDOWS\system32\daolafcy.dll
MSConfigStartUp-REGSHAVE - C:\Program Files\REGSHAVE\REGSHAVE.EXE
MSConfigStartUp-Skype - C:\Program Files\Skype\Phone\Skype.exe


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Scott\Application Data\Mozilla\Firefox\Profiles\flgkn949.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
FF -: plugin - C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - C:\Program Files\Download Manager\npfpdlm.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1229.1533\npCIDetect11.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 05:39:44
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTSVCCDA.EXE
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\PROGRA~1\COMMON~1\McAfee\McProxy\McProxy.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\MPF\MpfSrv.exe
C:\Program Files\McAfee\MSK\msksrver.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
.
**************************************************************************
.
Completion time: 2008-08-19 5:45:17 - machine was rebooted [Scott]
ComboFix-quarantined-files.txt 2008-08-19 09:45:12

Pre-Run: 55,826,153,472 bytes free
Post-Run: 55,812,890,624 bytes free

271 --- E O F --- 2008-08-15 03:24:26




HijackThis Log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:06:58 AM, on 8/19/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\Program Files\McAfee\VirusScan\McShield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\Program Files\McAfee\MSK\MskSrver.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = /
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk&channel=us
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: WG111v2 Smart Wizard Wireless Setting.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {3107C2A8-9F0B-4404-A58B-21BD85268FBC} (PogoWebLauncher Control) - http://www.pogo.com/cdl/launcher/PogoWebLauncherInstaller.CAB
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
O16 - DPF: {3DCEC959-378A-4922-AD7E-FD5C925D927F} (Disney Online Games ActiveX Control) - http://disney.go.com/pirates/online/testActiveX/built/signed/DisneyOnlineGames.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
O20 - AppInit_DLLs: wttxwu.dll eajprf.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\AOLacsd.exe
O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\McShield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

--
End of file - 8741 bytes

Hi

Go to Microsoft's website => http://support.microsoft.com/kb/310994
Select the download that's appropriate for your Operating System




Download the file & save it as it's originally named, next to ComboFix.exe.






Now close all open windows and programs, then drag the setup package onto ComboFix.exe and drop it. Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console. When complete, a log named CF_RC.txt will open. Please post the contents of that log than reboot your computer.

Here is the log file that popped up once ComboFix finished



ComboFix 08-08-18.05 - Scott 2008-08-19 17:58:07.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.577 [GMT -4:00]
Running from: C:\Documents and Settings\Scott\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Scott\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
* Created a new restore point
* Resident AV is active

.

((((((((((((((((((((((((( Files Created from 2008-07-19 to 2008-08-19 )))))))))))))))))))))))))))))))
.

2008-08-18 17:43 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\Leisure Suit Larry(TM) - Magna Cum Laude
2008-08-18 03:02 . 2005-10-14 20:45 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-18 03:01 . 2008-08-18 03:01 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-08-18 02:48 . 2004-08-04 06:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-08-18 02:47 . 2004-08-04 06:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-08-18 02:46 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-08-17 22:14 . 2008-08-17 22:14 <DIR> d-------- C:\WINDOWS\dell
2008-08-16 22:26 . 2008-08-16 22:27 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-16 21:43 . 2008-08-16 21:43 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-16 21:40 . 2008-08-16 21:40 <DIR> d-------- C:\Program Files\CCleaner
2008-08-16 20:46 . 2008-08-16 20:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-16 19:28 . 2008-08-16 19:29 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-16 19:28 . 2008-08-16 19:28 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Malwarebytes
2008-08-16 19:28 . 2008-08-16 19:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-16 19:28 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-16 19:28 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-16 18:24 . 2008-08-16 23:10 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-08-16 02:21 . 2008-08-16 02:21 <DIR> d-------- C:\Documents and Settings\Administrator.MAIN
2008-08-16 00:29 . 2008-08-16 00:29 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-08-13 18:06 . 2008-08-15 15:09 <DIR> d-------- C:\Program Files\Wild West Quest
2008-08-13 13:57 . 2008-08-13 14:03 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Ancient Quest of Saqqarah__reflexive
2008-08-12 15:24 . 2008-08-12 16:39 <DIR> d-------- C:\GUILTY
2008-08-12 15:07 . 2008-08-12 15:07 <DIR> d-------- C:\DIG
2008-08-11 21:44 . 2008-08-17 14:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-11 21:44 . 2008-08-11 21:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-11 19:25 . 2008-08-11 19:25 <DIR> d-------- C:\WINDOWS\Build in Time
2008-08-11 08:14 . 2008-08-11 08:14 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Big Fish Games
2008-08-08 05:52 . 2008-08-08 05:52 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Gaijin Ent
2008-08-06 08:02 . 2008-08-06 08:02 <DIR> d-------- C:\WINDOWS\Cooking Dash
2008-08-05 00:34 . 2008-08-05 00:34 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\UNOUndercover
2008-08-05 00:32 . 2008-08-15 19:38 <DIR> d-------- C:\Program Files\UNO Undercover
2008-08-04 23:55 . 2008-08-04 23:55 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Amaranth Games
2008-08-02 11:06 . 2008-08-02 11:07 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\BeachPartyCraze
2008-08-02 11:04 . 2008-08-02 11:04 <DIR> d-------- C:\WINDOWS\Beach Party Craze
2008-07-25 21:18 . 2008-08-16 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 19:55 . 2008-07-25 19:55 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Jasc
2008-07-25 19:47 . 2008-07-25 19:48 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-07-25 19:46 . 2008-08-16 20:35 <DIR> d-------- C:\Program Files\Unlocker
2008-07-25 19:46 . 2008-07-25 19:46 <DIR> d-------- C:\Program Files\DVDFab 5
2008-07-25 19:46 . 2008-07-25 19:46 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Vso
2008-07-25 15:35 . 2008-07-25 15:35 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\FUJIFILM
2008-07-24 16:39 . 2008-07-24 16:43 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-24 16:39 . 2008-07-24 16:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-07-23 19:49 . 2008-07-23 19:49 <DIR> d-------- C:\Program Files\uTorrent
2008-07-23 19:49 . 2008-08-16 19:29 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-19 20:59 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 19:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-19 19:01 --------- d-----w C:\Program Files\EA Games
2008-08-15 22:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-15 03:54 --------- d-----w C:\Program Files\McAfee
2008-08-07 22:06 4,288 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-08-07 21:36 --------- d-----w C:\Documents and Settings\Scott\Application Data\COREL
2008-08-06 12:03 --------- d-----w C:\Documents and Settings\Scott\Application Data\PlayFirst
2008-07-26 02:17 --------- d-----w C:\Program Files\Google
2008-07-26 00:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-26 00:04 --------- d-----w C:\Program Files\Lavasoft
2008-07-13 02:03 --------- d-----w C:\Documents and Settings\Scott\Application Data\SoundSpectrum
2008-07-13 00:07 --------- d-----w C:\Program Files\SoundSpectrum
2008-07-12 06:11 --------- d-----w C:\Documents and Settings\Scott\Application Data\Apple Computer
2008-07-11 23:23 --------- d-----w C:\Documents and Settings\Scott\Application Data\Move Networks
2008-07-05 18:53 0 ----a-w C:\Documents and Settings\Scott\jagex_runescape_preferences.dat
2008-07-05 05:13 --------- d-----w C:\Documents and Settings\Scott\Application Data\LimeWire
2008-07-04 00:24 --------- d-----w C:\Program Files\LimeWire
2008-06-29 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
2008-06-24 07:17 --------- d-----w C:\Documents and Settings\Scott\Application Data\Pogo Games
2008-06-24 07:14 --------- d-----w C:\Program Files\Oberon Media
2007-12-24 06:58 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-10-06 18:30 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2001-05-21 18:18 147,456 ----a-w C:\Program Files\mozilla firefox\plugins\WMDownload.dll
2007-09-17 16:51 88 --sha-r C:\WINDOWS\system32\EE23474822.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-19_ 5.03.31.60 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-19 17:53:44 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-19 17:53:44 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50 114688]
"mcagent_exe"="C:\Program Files\McAfee.com\Agent\mcagent.exe" [2007-08-04 02:33 582992]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44 249856]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 09:47 57344]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-01 07:51:29 24576]
WG111v2 Smart Wizard Wireless Setting.lnk - C:\Program Files\NETGEAR\WG111v2 Configuration Utility\RtlWake.exe [2008-01-14 14:12:01 745472]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wttxwu.dll eajprf.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSVideo"= lvfwwdmt.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Gamma Loader.lnk
backup=C:\WINDOWS\pss\Adobe Gamma Loader.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
--a------ 2007-05-11 04:06 40048 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
--a------ 2006-11-16 19:04 139264 C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative Detector]
--a------ 2004-12-02 18:23 102400 C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 06:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]
--a------ 2007-03-15 11:09 460784 C:\Program Files\DellSupport\DSAgnt.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellTransferAgent]
--a------ 2007-11-13 17:46 135168 C:\Documents and Settings\All Users\Application Data\Dell\TransferAgent\TransferAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLA]
--a------ 2005-09-08 05:20 122940 C:\WINDOWS\system32\DLA\DLACTRLW.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
--a------ 2005-11-01 03:12 94208 C:\Program Files\Dell\Media Experience\DMXLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LVCOMS]
--a------ 2001-09-06 18:10 94208 C:\Program Files\Common Files\Logitech\QCDriver\LVComS.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
--------- 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 15:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\QTTask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
--a------ 2006-08-01 07:58 26112 C:\Program Files\Real\RealPlayer\realplay.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2008-02-22 05:25 144784 C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdReg]
--a------ 2000-05-11 01:00 90112 C:\WINDOWS\Updreg.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
--a------ 2005-09-19 07:42 1159168 C:\Program Files\Creative\VoiceCenter\AndreaVC.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
--a------ 2005-05-19 08:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefaultMIDI]
--a------ 2004-12-22 17:40 24576 C:\WINDOWS\MIDIDEF.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"RSVP"=3 (0x3)
"NMIndexingService"=3 (0x3)
"NBService"=3 (0x3)
"gusvc"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"=
"C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"=
"C:\\Program Files\\America Online 9.0\\waol.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\EA Games\\Command & Conquer Generals Zero Hour\\patchget.dat"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"C:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"C:\\Program Files\\uTorrent\\uTorrent.exe"=

R1 lusbaudio;Logitech USB Microphone;C:\WINDOWS\system32\drivers\lvsound2.sys [2001-09-06 18:09]
R3 EAPPkt;Realtek EAPPkt Protocol;C:\WINDOWS\system32\DRIVERS\EAPPkt.sys [2005-04-01 12:43]
R3 QCEmerald;Logitech QuickCam Web(PID_0850);C:\WINDOWS\system32\DRIVERS\LVCE.sys [2001-09-06 18:09]
R3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [2006-03-27 18:53]
S2 MBAMService;MBAMService;C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe [2008-07-30 20:07]
S3 SjyPkt;SjyPkt;C:\WINDOWS\System32\Drivers\SjyPkt.sys [2002-10-02 09:57]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\setup.exe

*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder

2008-08-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-06-03 13:42]

2008-07-15 C:\WINDOWS\Tasks\McDefragTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]

2008-08-01 C:\WINDOWS\Tasks\McQcTask.job
- c:\program files\mcafee\mqc\QcConsol.exe [2007-12-04 13:32]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\Scott\Application Data\Mozilla\Firefox\Profiles\flgkn949.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.yahoo.com/
FF -: plugin - C:\PROGRA~1\Yahoo!\Common\npyaxmpb.dll
FF -: plugin - C:\Program Files\Download Manager\npfpdlm.dll
FF -: plugin - C:\Program Files\Google\Google Updater\2.2.1229.1533\npCIDetect11.dll
FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-19 18:01:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-08-19 18:03:08
ComboFix-quarantined-files.txt 2008-08-19 22:02:43
ComboFix2.txt 2008-08-19 09:45:19

Pre-Run: 55,753,723,904 bytes free
Post-Run: 55,728,771,072 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect

234 --- E O F --- 2008-08-15 03:24:26



I'm gone to reboot now.

Hi,
Open notepad and copy/paste the text in the quote box below into it:

Save this as "CFScript"


Referring to the picture above, drag CFScript into ComboFix.exe

You will be prompted to run Combofix again. Follow the same instructions you did before for running ComboFix.
CAUTION: Do not mouse-click ComboFix while it is running. It may cause it to stall.
When finished, it will produce a log for you at C:ComboFix.txt which I will need in your next reply.

Note: Do not mouseclick combofix's window while it's running. That may cause it to stall

Download and scan with SUPERAntiSpyware Free for Home Users

• Double-click SUPERAntiSpyware.exe and use the default settings for installation.
• An icon will be created on your desktop. Double-click that icon to launch the program.
• If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
• Under "Configuration and Preferences", click the Preferences button.
• Click the Scanning Control tab.
• Under Scanner Options make sure the following are checked (leave all others unchecked):
  • Close browsers before scanning.
  • Scan for tracking cookies.
  • Terminate memory threats before quarantining.
• Click the "Close" button to leave the control center screen.
• Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
• On the left, make sure you check C:\Fixed Drive.
• On the right, under "Complete Scan", choose Perform Complete Scan.
• Click "Next" to start the scan. Please be patient while it scans your computer.
• After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
• Make sure everything has a checkmark next to it and click "Next".
• A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
• If asked if you want to reboot, click "Yes".
• To retrieve the removal information after reboot, launch SUPERAntispyware again.
  • Click Preferences, then click the Statistics/Logs tab.
  • Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
  • If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
  • Please copy and paste the Scan Log results in your next reply.
• Click Close to exit the program.

_________________
IT Stuff

Here is the ComboFix log



ComboFix 08-08-18.05 - Scott 2008-08-20 5:12:48.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.701 [GMT -4:00]
Running from: C:\Documents and Settings\Scott\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Scott\Desktop\CFScript.txt
* Created a new restore point

FILE ::
C:\WINDOWS\system32\eajprf.dll
C:\WINDOWS\system32\wttxwu.dll
.

((((((((((((((((((((((((( Files Created from 2008-07-20 to 2008-08-20 )))))))))))))))))))))))))))))))
.

2008-08-18 17:43 . 2008-08-18 17:52 <DIR> d-------- C:\Program Files\Leisure Suit Larry(TM) - Magna Cum Laude
2008-08-18 03:02 . 2005-10-14 20:45 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2008-08-18 03:01 . 2008-08-18 03:01 13,646 --a------ C:\WINDOWS\system32\wpa.bak
2008-08-18 02:48 . 2004-08-04 06:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-08-18 02:47 . 2004-08-04 06:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-08-18 02:46 . 2004-05-13 00:39 876,653 --a--c--- C:\WINDOWS\system32\dllcache\fp4awel.dll
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-08-18 02:44 . 2008-08-18 02:44 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-08-18 02:27 . 2008-08-19 19:08 1,374 --a------ C:\WINDOWS\imsins.BAK
2008-08-17 22:14 . 2008-08-17 22:14 <DIR> d-------- C:\WINDOWS\dell
2008-08-16 22:26 . 2008-08-16 22:27 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-08-16 21:43 . 2008-08-16 21:43 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-16 21:40 . 2008-08-16 21:40 <DIR> d-------- C:\Program Files\CCleaner
2008-08-16 20:46 . 2008-08-16 20:46 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-16 19:28 . 2008-08-16 19:29 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-08-16 19:28 . 2008-08-16 19:28 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Malwarebytes
2008-08-16 19:28 . 2008-08-16 19:28 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-08-16 19:28 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-08-16 19:28 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-08-16 18:24 . 2008-08-16 23:10 <DIR> d-------- C:\Program Files\Enigma Software Group
2008-08-16 02:21 . 2008-08-16 02:21 <DIR> d-------- C:\Documents and Settings\Administrator.MAIN
2008-08-16 00:29 . 2008-08-16 00:29 552 --a------ C:\WINDOWS\system32\d3d8caps.dat
2008-08-13 18:06 . 2008-08-15 15:09 <DIR> d-------- C:\Program Files\Wild West Quest
2008-08-13 13:57 . 2008-08-13 14:03 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Ancient Quest of Saqqarah__reflexive
2008-08-12 15:24 . 2008-08-12 16:39 <DIR> d-------- C:\GUILTY
2008-08-12 15:07 . 2008-08-12 15:07 <DIR> d-------- C:\DIG
2008-08-11 21:44 . 2008-08-17 14:57 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-08-11 21:44 . 2008-08-11 21:44 1,409 --a------ C:\WINDOWS\QTFont.for
2008-08-11 19:25 . 2008-08-11 19:25 <DIR> d-------- C:\WINDOWS\Build in Time
2008-08-11 08:14 . 2008-08-11 08:14 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Big Fish Games
2008-08-08 05:52 . 2008-08-08 05:52 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Gaijin Ent
2008-08-06 08:02 . 2008-08-06 08:02 <DIR> d-------- C:\WINDOWS\Cooking Dash
2008-08-05 00:34 . 2008-08-05 00:34 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\UNOUndercover
2008-08-05 00:32 . 2008-08-15 19:38 <DIR> d-------- C:\Program Files\UNO Undercover
2008-08-04 23:55 . 2008-08-04 23:55 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Amaranth Games
2008-08-02 11:06 . 2008-08-02 11:07 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\BeachPartyCraze
2008-08-02 11:04 . 2008-08-02 11:04 <DIR> d-------- C:\WINDOWS\Beach Party Craze
2008-07-25 21:18 . 2008-08-16 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-07-25 19:55 . 2008-07-25 19:55 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Jasc
2008-07-25 19:47 . 2008-07-25 19:48 <DIR> d-------- C:\Program Files\Jasc Software Inc
2008-07-25 19:46 . 2008-08-16 20:35 <DIR> d-------- C:\Program Files\Unlocker
2008-07-25 19:46 . 2008-07-25 19:46 <DIR> d-------- C:\Program Files\DVDFab 5
2008-07-25 19:46 . 2008-07-25 19:46 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\Vso
2008-07-25 15:35 . 2008-07-25 15:35 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\FUJIFILM
2008-07-24 16:39 . 2008-07-24 16:43 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-24 16:39 . 2008-07-24 16:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2008-07-23 19:49 . 2008-07-23 19:49 <DIR> d-------- C:\Program Files\uTorrent
2008-07-23 19:49 . 2008-08-19 20:43 <DIR> d-------- C:\Documents and Settings\Scott\Application Data\uTorrent

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-20 01:55 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-08-19 19:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-08-19 19:01 --------- d-----w C:\Program Files\EA Games
2008-08-15 22:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2008-08-15 03:54 --------- d-----w C:\Program Files\McAfee
2008-08-07 21:36 --------- d-----w C:\Documents and Settings\Scott\Application Data\COREL
2008-08-06 12:03 --------- d-----w C:\Documents and Settings\Scott\Application Data\PlayFirst
2008-07-26 02:17 --------- d-----w C:\Program Files\Google
2008-07-26 00:05 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-07-26 00:04 --------- d-----w C:\Program Files\Lavasoft
2008-07-13 02:03 --------- d-----w C:\Documents and Settings\Scott\Application Data\SoundSpectrum
2008-07-13 00:07 --------- d-----w C:\Program Files\SoundSpectrum
2008-07-12 06:11 --------- d-----w C:\Documents and Settings\Scott\Application Data\Apple Computer
2008-07-11 23:23 --------- d-----w C:\Documents and Settings\Scott\Application Data\Move Networks
2008-07-05 18:53 0 ----a-w C:\Documents and Settings\Scott\jagex_runescape_preferences.dat
2008-07-05 05:13 --------- d-----w C:\Documents and Settings\Scott\Application Data\LimeWire
2008-07-04 00:24 --------- d-----w C:\Program Files\LimeWire
2008-06-29 13:45 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sandlot Games
2008-06-24 07:17 --------- d-----w C:\Documents and Settings\Scott\Application Data\Pogo Games
2008-06-24 07:14 --------- d-----w C:\Program Files\Oberon Media
2007-12-24 06:58 32 ----a-w C:\Documents and Settings\All Users\Application Data\ezsid.dat
2007-10-06 18:30 32 ----a-r C:\Documents and Settings\All Users\hash.dat
2001-05-21 18:18 147,456 ----a-w C:\Program Files\mozilla firefox\plugins\WMDownload.dll
2007-09-17 16:51 88 --sha-r C:\WINDOWS\system32\EE23474822.sys
.

((((((((((((((((((((((((((((( snapshot@2008-08-19_ 5.03.31.60 )))))))))))))))))))))))))))))))))))))))))
.
- 2006-05-25 15:29:04 213,216 -c--a-w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe
+ 2006-05-25 14:29:04 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe
- 2006-05-25 15:29:04 371,424 -c--a-w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll
+ 2006-05-25 14:29:04 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\updspapi.dll
- 2006-05-24 17:32:48 213,216 -c--a-w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe
+ 2006-05-24 16:32:48 213,216 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe
- 2006-05-24 17:32:48 371,424 -c--a-w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll
+ 2006-05-24 16:32:48 371,424 -c----w C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\updspapi.dll
- 2004-08-04 09:00:00 61,440 -c--a-w C:\WINDOWS\ie7\admparse.dll
+ 2004-08-04 10:00:00 61,440 -c--a-w C:\WINDOWS\ie7\admparse.dll
- 2004-08-04 09:00:00 99,840 -c--a-w C:\WINDOWS\ie7\advpack.dll
+ 2004-08-04 10:00:00 99,840 -c--a-w C:\WINDOWS\ie7\advpack.dll
+ 2006-03-04 03:33:40 1,022,976 -c--a-w C:\WINDOWS\ie7\browseui.dll
- 2004-08-04 09:00:00 35,328 -c--a-w C:\WINDOWS\ie7\corpol.dll
+ 2004-08-04 10:00:00 35,328 -c--a-w C:\WINDOWS\ie7\corpol.dll
- 2006-06-03 11:40:49 33,792 -c--a-w C:\WINDOWS\ie7\custsat.dll
+ 2004-09-15 16:28:08 28,672 -c--a-w C:\WINDOWS\ie7\custsat.dll
- 2006-10-23 15:34:20 357,888 -c--a-w C:\WINDOWS\ie7\dxtmsft.dll
+ 2004-08-04 10:00:00 357,888 -c--a-w C:\WINDOWS\ie7\dxtmsft.dll
- 2006-10-23 15:34:20 205,312 -c--a-w C:\WINDOWS\ie7\dxtrans.dll
+ 2006-03-04 03:33:42 205,312 -c--a-w C:\WINDOWS\ie7\dxtrans.dll
- 2006-10-23 15:34:20 55,808 -c--a-w C:\WINDOWS\ie7\extmgr.dll
+ 2006-03-04 03:33:42 55,808 -c--a-w C:\WINDOWS\ie7\extmgr.dll
- 2004-08-04 09:00:00 38,912 -c--a-w C:\WINDOWS\ie7\hmmapi.dll
+ 2004-08-04 10:00:00 38,912 -c--a-w C:\WINDOWS\ie7\hmmapi.dll
- 2004-08-04 09:00:00 34,304 -c--a-w C:\WINDOWS\ie7\ie4uinit.exe
+ 2004-08-04 10:00:00 34,304 -c--a-w C:\WINDOWS\ie7\ie4uinit.exe
- 2004-08-04 09:00:00 139,264 -c--a-w C:\WINDOWS\ie7\ieakeng.dll
+ 2004-08-04 10:00:00 139,264 -c--a-w C:\WINDOWS\ie7\ieakeng.dll
- 2004-08-04 09:00:00 216,576 -c--a-w C:\WINDOWS\ie7\ieaksie.dll
+ 2004-08-04 10:00:00 216,576 -c--a-w C:\WINDOWS\ie7\ieaksie.dll
- 2004-08-04 09:00:00 221,184 -c--a-w C:\WINDOWS\ie7\ieakui.dll
+ 2004-08-04 10:00:00 221,184 -c--a-w C:\WINDOWS\ie7\ieakui.dll
- 2004-08-04 09:00:00 323,584 -c--a-w C:\WINDOWS\ie7\iedkcs32.dll
+ 2004-08-04 10:00:00 323,584 -c--a-w C:\WINDOWS\ie7\iedkcs32.dll
- 2006-10-23 11:02:37 18,432 -c--a-w C:\WINDOWS\ie7\iedw.exe
+ 2006-03-04 00:39:06 18,432 -c--a-w C:\WINDOWS\ie7\iedw.exe
- 2004-08-04 09:00:00 81,920 -c--a-w C:\WINDOWS\ie7\ieencode.dll
+ 2004-08-04 10:00:00 81,920 -c--a-w C:\WINDOWS\ie7\ieencode.dll
- 2006-10-23 15:34:20 251,904 -c--a-w C:\WINDOWS\ie7\iepeers.dll
+ 2006-03-04 03:33:42 251,392 -c--a-w C:\WINDOWS\ie7\iepeers.dll
+ 2006-11-08 02:03:36 287,744 -c--a-w C:\WINDOWS\ie7\ieproxy.dll
- 2004-08-04 09:00:00 48,640 -c--a-w C:\WINDOWS\ie7\iernonce.dll
+ 2004-08-04 10:00:00 48,640 -c--a-w C:\WINDOWS\ie7\iernonce.dll
- 2004-08-04 09:00:00 62,976 -c--a-w C:\WINDOWS\ie7\iesetup.dll
+ 2004-08-04 10:00:00 62,976 -c--a-w C:\WINDOWS\ie7\iesetup.dll
+ 2006-11-08 02:03:36 180,736 -c--a-w C:\WINDOWS\ie7\ieui.dll
- 2004-08-04 09:00:00 93,184 -c--a-w C:\WINDOWS\ie7\iexplore.exe
+ 2004-08-04 10:00:00 93,184 -c--a-w C:\WINDOWS\ie7\iexplore.exe
- 2004-08-04 09:00:00 35,840 -c--a-w C:\WINDOWS\ie7\imgutil.dll
+ 2004-08-04 10:00:00 35,840 -c--a-w C:\WINDOWS\ie7\imgutil.dll
- 2006-10-23 15:34:20 96,256 -c--a-w C:\WINDOWS\ie7\inseng.dll
+ 2006-03-04 03:33:42 96,256 -c--a-w C:\WINDOWS\ie7\inseng.dll
- 2006-05-18 05:24:25 450,560 -c--a-w C:\WINDOWS\ie7\jscript.dll
+ 2004-08-04 10:00:00 450,560 -c--a-w C:\WINDOWS\ie7\jscript.dll
- 2006-10-23 15:34:20 15,872 -c--a-w C:\WINDOWS\ie7\jsproxy.dll
+ 2004-08-04 10:00:00 15,872 -c--a-w C:\WINDOWS\ie7\jsproxy.dll
- 2004-08-04 09:00:00 22,016 -c--a-w C:\WINDOWS\ie7\licmgr10.dll
+ 2004-08-04 10:00:00 22,016 -c--a-w C:\WINDOWS\ie7\licmgr10.dll
+ 2006-10-17 16:58:32 12,288 -c--a-w C:\WINDOWS\ie7\msfeedssync.exe
- 2004-08-04 09:00:00 29,184 -c--a-w C:\WINDOWS\ie7\mshta.exe
+ 2004-08-04 10:00:00 29,184 -c--a-w C:\WINDOWS\ie7\mshta.exe
- 2006-10-23 15:34:22 3,061,248 -c--a-w C:\WINDOWS\ie7\mshtml.dll
+ 2006-03-23 17:32:42 3,053,568 -c--a-w C:\WINDOWS\ie7\mshtml.dll
- 2006-10-23 15:34:21 448,512 -c--a-w C:\WINDOWS\ie7\mshtmled.dll
+ 2006-03-04 03:33:44 448,512 -c--a-w C:\WINDOWS\ie7\mshtmled.dll
- 2004-08-04 09:00:00 56,832 -c--a-w C:\WINDOWS\ie7\mshtmler.dll
+ 2004-08-04 10:00:00 56,832 -c--a-w C:\WINDOWS\ie7\mshtmler.dll
- 2004-08-04 09:00:00 146,432 -c--a-w C:\WINDOWS\ie7\msls31.dll
+ 2004-08-04 10:00:00 146,432 -c--a-w C:\WINDOWS\ie7\msls31.dll
- 2006-10-23 15:34:21 146,432 -c--a-w C:\WINDOWS\ie7\msrating.dll
+ 2006-03-04 03:33:44 146,432 -c--a-w C:\WINDOWS\ie7\msrating.dll
- 2006-10-23 15:34:21 532,480 -c--a-w C:\WINDOWS\ie7\mstime.dll
+ 2006-03-04 03:33:44 532,480 -c--a-w C:\WINDOWS\ie7\mstime.dll
- 2004-08-04 09:00:00 96,256 -c--a-w C:\WINDOWS\ie7\occache.dll
+ 2004-08-04 10:00:00 96,256 -c--a-w C:\WINDOWS\ie7\occache.dll
- 2006-10-23 15:34:21 39,424 -c--a-w C:\WINDOWS\ie7\pngfilt.dll
+ 2006-03-04 03:33:44 39,424 -c--a-w C:\WINDOWS\ie7\pngfilt.dll
+ 2006-03-30 09:16:04 1,492,480 -c--a-w C:\WINDOWS\ie7\shdocvw.dll
+ 2006-03-04 03:33:44 474,112 -c--a-w C:\WINDOWS\ie7\shlwapi.dll
- 2006-11-08 02:04:18 31,856 -c--a-w C:\WINDOWS\ie7\spuninst\iecustom.dll
+ 2007-08-13 22:54:42 32,960 -c--a-w C:\WINDOWS\ie7\spuninst\iecustom.dll
- 2006-11-08 02:01:06 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
+ 2007-08-13 22:52:06 66,048 -c--a-w C:\WINDOWS\ie7\spuninst\ieResetIcons.exe
- 2004-08-04 09:00:00 37,888 -c--a-w C:\WINDOWS\ie7\url.dll
+ 2004-08-04 10:00:00 37,888 -c--a-w C:\WINDOWS\ie7\url.dll
- 2006-10-23 15:34:22 615,936 -c--a-w C:\WINDOWS\ie7\urlmon.dll
+ 2006-03-18 11:09:38 613,376 -c--a-w C:\WINDOWS\ie7\urlmon.dll
- 2004-08-04 09:00:00 417,792 -c--a-w C:\WINDOWS\ie7\vbscript.dll
+ 2004-08-04 10:00:00 417,792 -c--a-w C:\WINDOWS\ie7\vbscript.dll
- 2006-09-18 14:15:52 851,968 -c--a-w C:\WINDOWS\ie7\vgx.dll
+ 2004-08-04 10:00:00 848,384 -c--a-w C:\WINDOWS\ie7\vgx.dll
- 2004-08-04 09:00:00 276,480 -c--a-w C:\WINDOWS\ie7\webcheck.dll
+ 2004-08-04 10:00:00 276,480 -c--a-w C:\WINDOWS\ie7\webcheck.dll
+ 2006-10-17 17:05:58 206,336 -c--a-w C:\WINDOWS\ie7\winfxdocobj.exe
- 2006-10-23 15:34:22 664,576 -c--a-w C:\WINDOWS\ie7\wininet.dll
+ 2006-03-04 03:33:46 658,432 -c--a-w C:\WINDOWS\ie7\wininet.dll
- 2004-08-04 10:00:00 61,440 ----a-w C:\WINDOWS\system32\admparse.dll
+ 2007-08-13 22:39:20 71,680 ----a-w C:\WINDOWS\system32\admparse.dll
- 2004-08-04 10:00:00 99,840 ----a-w C:\WINDOWS\system32\advpack.dll
+ 2007-08-13 22:39:00 123,904 ----a-w C:\WINDOWS\system32\advpack.dll
- 2006-03-04 03:33:40 1,022,976 ----a-w C:\WINDOWS\system32\browseui.dll
+ 2006-09-23 17:12:50 1,022,976 ----a-w C:\WINDOWS\system32\browseui.dll
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
+ 2008-08-20 04:09:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat
- 2008-08-19 04:20:12 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
+ 2008-08-20 04:09:52 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2004-08-04 10:00:00 35,328 ----a-w C:\WINDOWS\system32\corpol.dll
+ 2007-08-13 22:42:54 17,408 ----a-w C:\WINDOWS\system32\corpol.dll
- 2004-08-04 10:00:00 61,440 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll
+ 2007-08-13 22:39:20 71,680 -c--a-w C:\WINDOWS\system32\dllcache\admparse.dll
- 2004-08-04 10:00:00 99,840 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll
+ 2007-08-13 22:39:00 123,904 -c--a-w C:\WINDOWS\system32\dllcache\advpack.dll
- 2006-03-04 03:33:40 1,022,976 -c-