Hello Screen317
I did what you asked and the following is the log that was produced. Thank you again for your time and assistance.
_____________________________________________________________
ComboFix 08-05-19.4 - Jeremy 2008-05-21 0:37:04.4 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.471 [GMT -7:00]
Running from: C:\Documents and Settings\Jeremy\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\Jeremy\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
* Resident AV is active
.
((((((((((((((((((((((((( Files Created from 2008-04-21 to 2008-05-21 )))))))))))))))))))))))))))))))
.
2008-05-20 01:51 . 2008-05-20 01:51 127 --a------ C:\WINDOWS\system32\MRT.INI
2008-05-20 01:12 . 2008-05-20 01:12 2,624 --a------ C:\WINDOWS\system32\vcqxwjiw.exe
2008-05-19 00:31 . 2008-05-19 03:06 <DIR> d-------- C:\Program Files\CA Yahoo! Anti-Spy
2008-05-16 19:42 . 2008-05-16 19:42 32,989 --a------ C:\VETlog.dmp
2008-05-16 17:46 . 2008-05-16 17:46 4,128 --a------ C:\INFCACHE.1
2008-05-14 03:45 . 2008-05-18 23:43 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-14 03:45 . 2008-05-14 03:45 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-13 21:11 . 2008-05-13 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Program Files\Apple Software Update
2008-05-13 21:10 . 2008-05-13 21:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
2008-05-13 20:32 . 2003-12-04 05:33 873,984 --a------ C:\WINDOWS\system32\AvidAVdvCodec.qtx
2008-05-13 20:32 . 2000-10-17 11:16 289,280 --a------ C:\WINDOWS\system32\AvidQTCodec.qtx
2008-05-13 20:32 . 2003-07-02 10:31 241,664 --a------ C:\WINDOWS\system32\AvidStartup.exe
2008-05-13 20:32 . 2003-12-04 05:24 208,384 --a------ C:\WINDOWS\system32\AvidQTAVJICodec.qtx
2008-05-13 20:32 . 2003-10-27 11:23 184,320 --a------ C:\WINDOWS\system32\AvidSDM.dll
2008-05-13 20:32 . 2003-12-04 05:24 100,352 --a------ C:\WINDOWS\system32\AvidQTAVUICodec.qtx
2008-05-13 20:32 . 2003-05-08 19:06 61,440 --a------ C:\WINDOWS\system32\AvidQTUpdater.dll
2008-05-13 20:32 . 2003-12-04 05:27 54,272 --a------ C:\WINDOWS\system32\drivers\AvidXPSerial.sys
2008-05-13 20:31 . 2008-05-13 20:32 <DIR> d-------- C:\Program Files\Avid
2008-05-13 13:56 . 2008-05-13 20:39 474 --ahs---- C:\WINDOWS\system32\bpjhlmps.ini
2008-05-12 18:41 . 2008-05-12 18:41 <DIR> d-------- C:\Documents and Settings\Jeremy\Application Data\McAfee
2008-05-12 17:40 . 2008-05-13 12:34 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-12 17:40 . 2008-05-13 21:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-12 12:53 . 2008-05-12 12:53 <DIR> d-------- C:\Program Files\Lavasoft
2008-05-11 22:58 . 2008-05-11 22:58 294 --ahs---- C:\WINDOWS\system32\acrmaspb.ini
2008-05-09 12:23 . 2008-05-09 12:23 70 --ah----- C:\aaw7boot.cmd
2008-05-08 23:16 . 2008-05-08 23:16 <DIR> d-------- C:\Program Files\Rainbow Technologies
2008-05-08 19:58 . 2008-05-08 19:58 <DIR> d-------- C:\Program Files\Common Files\Digidesign
2008-05-08 19:57 . 2001-02-01 15:10 45,056 --a------ C:\WINDOWS\system32\wnaspi32.dll
2008-05-08 19:57 . 2001-02-01 15:10 25,244 --a------ C:\WINDOWS\system32\drivers\aspi32.sys
2008-05-08 19:57 . 2001-02-01 15:10 5,600 --a------ C:\WINDOWS\system\winaspi.dll
2008-05-08 19:57 . 2001-02-01 15:10 4,672 --a------ C:\WINDOWS\system\wowpost.exe
2008-05-05 16:38 . 2008-05-05 16:47 <DIR> d-------- C:\Program Files\SopCast
2008-05-05 16:33 . 2008-04-30 17:09 3,187,458 --a------ C:\Program Files\Setup-SopCast-3.0.3-2008-4-30.exe
2008-04-24 22:42 . 2008-04-24 22:42 <DIR> d-------- C:\Program Files\Trend Micro
2008-04-23 01:59 . 2008-04-23 01:59 <DIR> d-------- C:\Program Files\PrevxCSI
2008-04-23 01:59 . 2008-05-20 03:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
2008-04-23 01:59 . 2008-05-14 10:13 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-21 06:18 --------- d-----w C:\Program Files\Warcraft III
2008-05-19 07:31 --------- d-----w C:\Program Files\Yahoo!
2008-05-19 07:31 --------- d-----w C:\Program Files\Common Files\Scanner
2008-05-14 04:12 --------- d-----w C:\Program Files\QuickTime
2008-05-14 03:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-13 11:03 4,392 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
2008-05-13 01:58 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-13 01:54 --------- d-----w C:\Documents and Settings\All Users\Application Data\GTek
2008-05-01 00:07 3,813 ----a-w C:\Program Files\changeLog.txt
2008-04-18 22:17 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-04-18 22:17 --------- d-----w C:\Documents and Settings\Jeremy\Application Data\SUPERAntiSpyware.com
2008-04-18 21:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-04-18 21:48 --------- d-----w C:\Documents and Settings\Jeremy\Application Data\Move Networks
2008-04-18 21:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-18 20:09 --------- d-----w C:\Program Files\Windows Defender
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\dllcache\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\dllcache\win32k.sys
2008-03-02 01:36 3,591,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2008-02-29 08:55 70,656 ----a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2008-02-29 08:55 625,664 ----a-w C:\WINDOWS\system32\dllcache\iexplore.exe
2008-02-22 10:00 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-01-09 08:38 73,759 ----a-w C:\Program Files\UninstallMM.exe
2006-08-01 23:15 4,608 ----a-w C:\Program Files\idlemon.dll.bak
2005-09-23 10:56 479,232 ----a-w C:\Program Files\msvcm80.dll
2005-09-23 03:22 522 ----a-w C:\Program Files\Microsoft.VC80.CRT.manifest
2005-09-23 03:05 626,688 ----a-w C:\Program Files\msvcr80.dll
2005-09-23 03:05 548,864 ----a-w C:\Program Files\msvcp80.dll
2005-07-07 18:13 2,152 ----a-w C:\Program Files\mm_readme.txt
2005-07-04 15:20 165,376 ----a-w C:\Program Files\middle_man.ocm
2005-03-22 23:51 53,248 ----a-w C:\Program Files\idlemon.dll
2001-09-28 21:00 164,864 ----a-w C:\Program Files\unwise32.exe
2007-03-27 06:06 56 --sh--r C:\WINDOWS\system32\C9DC4ACB29.sys
.
((((((((((((((((((((((((((((( snapshot_2008-05-20_ 1.58.34.57 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-20 08:43:04 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-21 07:25:45 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{98B1E64C-DC93-4633-8547-CF144E9BC92B}]
C:\WINDOWS\system32\yaywvusr.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A03AB7B4-62D1-45D4-9AB1-23BF8254F491}]
C:\WINDOWS\system32\fccabbxw.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F15F14C6-C3E1-486B-98B9-446274ED05E2}]
C:\WINDOWS\system32\fccbawvu.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SetDefaultMIDI"="MIDIDef.exe" [2004-12-22 08:40 24576 C:\WINDOWS\MIDIDEF.EXE]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54 5674352]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-10 03:00 15360]
"Creative Detector"="C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 16:23 102400]
"Active Desktop Calendar"="C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe" [2005-12-21 13:56 2109440]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"YSearchProtection"="C:\Program Files\Yahoo!\Search Protection\SearchProtection.exe" [2007-06-08 07:59 224248]
"VSOCheckTask"="C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe" [2005-07-08 18:18 151552]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [2006-09-27 20:33 125168]
"VirusScan Online"="C:\Program Files\McAfee.com\VSO\mcvsshld.exe" [2005-08-10 10:49 163840]
"UpdReg"="C:\WINDOWS\UpdReg.EXE" [2000-05-10 23:00 90112]
"SigmatelSysTrayApp"="stsystra.exe" [2005-03-22 15:20 339968 C:\WINDOWS\stsystra.exe]
"OASClnt"="C:\Program Files\McAfee.com\VSO\oasclnt.exe" [2005-08-11 20:02 53248]
"MSKDetectorExe"="C:\PROGRA~1\McAfee\SPAMKI~1\MSKDetct.exe" [2005-08-12 16:16 1121792]
"MSKAGENTEXE"="C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe" [2005-09-26 10:26 110592]
"MPSExe"="c:\PROGRA~1\mcafee.com\mps\mscifapp.exe" [2006-03-30 14:31 296488]
"MPFExe"="C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe" [2005-11-11 17:00 1005096]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [2006-01-11 12:05 212992]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29 303104]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 08:44 81920]
"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 08:44 249856]
"IAAnotif"="C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2005-06-17 05:56 139264]
"ehTray"="C:\WINDOWS\ehome\ehtray.exe" [2005-09-29 12:01 67584]
"dscactivate"="C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe" [2007-11-15 10:24 16384]
"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-10-05 01:12 94208]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 03:20 122940]
"CTSysVol"="C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-09-15 07:47 57344]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2006-09-03 00:04 84640]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 19:05 344064]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06 40048]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"VoiceCenter"="C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2005-09-19 05:42 1159168]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-01-31 23:13 385024]
"DellSupportCenter"="C:\Program Files\Dell Support Center\bin\sprtcmd.exe" [2007-11-15 10:23 202544]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [2000-01-21 01:15:54 65588]
NETGEAR WG311v3 Wireless Assistant.lnk - C:\WINDOWS\Installer\{70014586-7BBA-4A92-A610-CDC896C48F8F}\NewShortcut1_1.exe [2006-07-29 15:22:33 2238]
Post-itr Software Notes Lite.lnk - C:\Program Files\3M\PSNLite\PsnLite.exe [2004-06-02 13:04:58 1622016]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\khfdabyy]
khfdabyy.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^LCDPlayer.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\LCDPlayer.lnk
backup=C:\WINDOWS\pss\LCDPlayer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
--a------ 2006-11-07 08:29 50736 C:\Program Files\AIM6\aim6.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BMefc6a1ad]
C:\WINDOWS\system32\gtufuies.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
--a------ 2005-12-10 07:57 133016 C:\Program Files\DAEMON Tools\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ecf59231]
C:\WINDOWS\system32\dmeihavq.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MBMon]
--a------ 2005-05-18 23:54 1345520 C:\WINDOWS\system32\CTMBHA.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
--------- 2008-01-28 11:43 2097488 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyHunter Security Suite]
C:\Program Files\Enigma Software Group\SpyHunter\SpyHunter3.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VoiceCenter]
--------- 2005-09-19 05:42 1159168 C:\Program Files\Creative\VoiceCenter\AndreaVC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"
"BMefc6a1ad"=Rundll32.exe "C:\WINDOWS\system32\tqyahvyk.dll",s
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\AIM\\aim.exe"=
"C:\\Program Files\\Internet Explorer\\iexplore.exe"=
"C:\\Program Files\\Warcraft III\\Warcraft III.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
"C:\\Program Files\\SopCast\\adv\\SopAdver.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7384:TCP"= 7384:TCP:BitComet 7384 TCP
"7384:UDP"= 7384:UDP:BitComet 7384 UDP
R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-05-14 10:13]
R1 LIKECDN2;LIKECDN2;C:\WINDOWS\system32\DRIVERS\LIKECDN2.sys [2002-02-15 13:33]
R1 XSPACEWG;XSPACEWG;C:\WINDOWS\system32\drivers\XSpaceWg.sys [2001-12-11 10:46]
R2 CSIScanner;CSIScanner;"C:\Program Files\PrevxCSI\\PrevxCSI.exe" /service []
R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter);C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2007-11-15 10:23]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 14:38]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\Autorun.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H]
\Shell\AutoRun\command - H:\autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\I]
\Shell\AutoRun\command - I:\autoplay.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
\Shell\AutoRun\command - E:\setup.exe
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8338942e-c00b-11dc-9839-001372da1478}]
\Shell\AutoRun\command - J:\wd_windows_tools\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-05-21 07:26:30 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (D4VW9HB1-Jeremy).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2008-05-20 09:05:01 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-05-21 00:39:06
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\explorer.exe
-> C:\Program Files\XemiComputers\Active Desktop Calendar\MouseHook.dll
.
Completion time: 2008-05-21 0:40:18
ComboFix-quarantined-files.txt 2008-05-21 07:40:06
ComboFix2.txt 2008-05-20 08:59:18
ComboFix3.txt 2008-05-20 08:12:27
Pre-Run: 16,047,079,424 bytes free
Post-Run: 16,027,144,192 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
248 --- E O F --- 2008-05-20 08:52:32