Aloha TheBruce1! Thank you for your help!
I've done everything requested and am attaching the 3 log files.
One quick concern - my clock seems to be displaying in military time now and I'd like to switch it back to am/pm. However, the annoying pop-ups in the system tray seem to have disappeared finally!
SmitFraudFix v2.333
Scan done at 19:19:49.55, Mon 08/04/2008
Run from C:\Documents and Settings\elaine.ELAINE-VAIO\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{c96395b8-ab09-46a4-b539-7ddf6e061808}"="ceroxylon"
[HKEY_CLASSES_ROOT\CLSID\{c96395b8-ab09-46a4-b539-7ddf6e061808}\InProcServer32]
@="C:\WINDOWS\system32\jkqvjzl.dll"
[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{c96395b8-ab09-46a4-b539-7ddf6e061808}\InProcServer32]
@="C:\WINDOWS\system32\jkqvjzl.dll"
»»»»»»»»»»»»»»»»»»»»»»»» Killing process
»»»»»»»»»»»»»»»»»»»»»»»» hosts
127.0.0.1 localhost
»»»»»»»»»»»»»»»»»»»»»»»» VACFix
VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix
S!Ri's WS2Fix: LSP not Found.
»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix
GenericRenosFix by S!Ri
C:\WINDOWS\system32\jkqvjzl.dll -> Hoax.Win32.Renos.gen.p
C:\WINDOWS\system32\jkqvjzl.dll -> Deleted
»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files
C:\Program Files\Applications\ Deleted
»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» 404Fix
404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri
»»»»»»»»»»»»»»»»»»»»»»»» DNS
HKLM\SYSTEM\CCS\Services\Tcpip\..\{E37FDF7F-9F19-4BAE-BADD-7AD2ECC81321}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{E37FDF7F-9F19-4BAE-BADD-7AD2ECC81321}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\..\{E37FDF7F-9F19-4BAE-BADD-7AD2ECC81321}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files
»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""
»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning
Registry Cleaning done.
»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!
SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll
»»»»»»»»»»»»»»»»»»»»»»»» End
========
ComboFix 08-08-04.09 - elaine 2008-08-05 23:12:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.210 [GMT -10:00]
Running from: C:\Documents and Settings\elaine.ELAINE-VAIO\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\elaine.ELAINE-VAIO\Desktop\WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr0.dat
C:\Documents and Settings\All Users.WINDOWS\Application Data\Microsoft\Network\Downloader\qmgr1.dat
C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\macromedia\Flash Player\#SharedObjects\E2B5E73F\interclick.com
C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\macromedia\Flash Player\#SharedObjects\E2B5E73F\interclick.com\ud.sol
C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\Documents and Settings\elaine.ELAINE-VAIO\My Documents\My Documents.url
C:\Documents and Settings\elaine.ELAINE-VAIO\My Documents\My Music\My Music.url
C:\Documents and Settings\elaine.ELAINE-VAIO\My Documents\My Pictures\My Pictures.url
C:\Documents and Settings\elaine.ELAINE-VAIO\My Documents\My Videos\My Video.url
----- BITS: Possible infected sites -----
http://updates.swarmcast.net
.
((((((((((((((((((((((((( Files Created from 2008-07-06 to 2008-08-06 )))))))))))))))))))))))))))))))
.
2008-08-05 23:01 . 2008-08-05 23:01 <DIR> d--h----- C:\WINDOWS\PIF
2008-08-04 19:34 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-08-04 19:34 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-08-04 19:34 . 2008-05-29 09:35 86,528 --a------ C:\WINDOWS\system32\VACFix.exe
2008-08-04 19:34 . 2008-05-18 21:40 82,944 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-08-04 19:34 . 2008-07-02 13:33 82,432 --a------ C:\WINDOWS\system32\IEDFix.C.exe
2008-08-04 19:34 . 2008-05-23 18:21 81,920 --a------ C:\WINDOWS\system32\404Fix.exe
2008-08-04 19:34 . 2003-06-05 21:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-08-04 19:34 . 2004-07-31 18:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-08-04 19:34 . 2007-10-04 00:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-08-04 19:19 . 2008-08-04 19:19 3,248 --a------ C:\WINDOWS\system32\tmp.reg
2008-08-01 00:49 . 2008-08-01 00:49 <DIR> d-------- C:\Program Files\Trend Micro
2008-08-01 00:34 . 2008-08-01 00:34 <DIR> d-------- C:\Deckard
2008-07-31 23:28 . 2007-08-13 18:54 33,792 --a--c--- C:\WINDOWS\system32\dllcache\custsat.dll
2008-07-31 23:00 . 2008-07-31 23:01 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\WinZip
2008-07-31 22:25 . 2008-07-31 22:25 <DIR> d-------- C:\ie-spyad_zo
2008-07-31 22:14 . 2008-08-05 22:53 <DIR> d-a------ C:\Documents and Settings\All Users.WINDOWS\Application Data\TEMP
2008-07-31 22:11 . 2008-08-04 19:40 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-07-31 20:01 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys
2008-07-31 19:59 . 2008-08-05 17:18 <DIR> d-------- C:\Program Files\Panda Security
2008-07-30 14:44 . 2008-07-30 14:44 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-07-30 14:44 . 2008-07-30 15:51 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Spybot - Search & Destroy
2008-07-17 11:25 . 2008-07-17 11:25 <DIR> d-------- C:\Program Files\Sun
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-06 08:50 --------- d-----w C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\Skype
2008-08-06 02:01 --------- d-----w C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\skypePM
2008-08-04 22:06 --------- d-----w C:\Program Files\Java
2008-07-14 00:29 --------- d-----w C:\Program Files\iTunes
2008-07-11 02:40 --------- d-----w C:\Program Files\iPod
2008-06-29 10:24 --------- d-----w C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\LimeWire
2008-06-26 08:22 --------- d-----w C:\Program Files\QuickTime
2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
2008-06-20 01:51 --------- d-----w C:\Program Files\Safari
2008-06-18 12:07 --------- d-----w C:\Program Files\LimeWire
2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-12 23:46 --------- d-----w C:\Program Files\Microsoft Silverlight
2008-06-12 23:45 --------- d-----w C:\Program Files\The Weather Channel FW
2008-06-10 03:14 --------- d-----w C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\Apple Computer
2008-05-07 05:18 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2008-03-15 02:56 60,968 ----a-w C:\Documents and Settings\elaine.ELAINE-VAIO\GoToAssistDownloadHelper.exe
2008-02-17 07:42 32 ----a-w C:\Documents and Settings\All Users.WINDOWS\Application Data\ezsid.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="C:\Program Files\Skype\Phone\Skype.exe" [2008-02-01 17:22 21898024]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 21:56 15360]
"DW6"="C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe" [2008-06-10 16:18 785520]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HKSERV.EXE"="C:\Program Files\Sony\HotKey Utility\HKserv.exe" [2004-06-29 14:49 122880]
"Switcher.exe"="C:\Program Files\Sony\Wireless Switch Setting Utility\Switcher.exe" [2004-08-03 16:56 294912]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-03-25 21:00 335872]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2003-11-07 17:21 114688]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 11:09 63712]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2008-07-19 04:38 78008]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-05-08 12:07 185632]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-05-27 10:50 413696]
"AppleSyncNotifier"="C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-10 09:47 116040]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-07-10 10:51 289064]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-04 17:24 28672 C:\WINDOWS\system32\Ati2mdxx.exe]
C:\Documents and Settings\All Users.WINDOWS\Start Menu\Programs\Startup\
MLB.TV NexDef Plug-in.lnk - C:\Program Files\Autobahn\mlb-nexdef-autobahn.exe [2008-03-30 13:52:34 799496]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Autobahn\\mlb-nexdef-autobahn.exe"=
"C:\\Program Files\\QuickTime\\QuickTimePlayer.exe"=
"C:\\Program Files\\LimeWire\\LimeWire.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
"C:\\WINDOWS\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24]
R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 04:35]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 04:37]
R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\system32\DRIVERS\SonyPI.sys [2003-06-18 16:12]
*Newly Created Service* - CATCHME
*Newly Created Service* - HTTPFILTER
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-08-01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
.
- - - - ORPHANS REMOVED - - - -
WebBrowser-{604BC32A-9680-40D1-9AC6-E06B23A1BA4C} - (no file)
HKLM-Run-Mouse Suite 98 Daemon - ICO.EXE
.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Documents and Settings\elaine.ELAINE-VAIO\Application Data\Mozilla\Firefox\Profiles\5c6nn2yp.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - dogpile.com
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-08-05 23:15:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-08-05 23:17:16
ComboFix-quarantined-files.txt 2008-08-06 09:16:42
Pre-Run: 44,018,720,768 bytes free
Post-Run: 44,378,656,768 bytes free
WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition"=optin /fastdetect
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
153 --- E O F --- 2008-07-10 01:34:52