Machine running much better, thank you. No unsolicited pop-ups since running combofix. Here's the logs, as requested:
ComboFix 08-11-14.01 - Kevin 2008-11-16 13:37:37.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.467 [GMT -5:00]
Running from: c:\documents and settings\Kevin\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Kevin\Desktop\CFScript.txt
* Created a new restore point
FILE ::
c:\documents and settings\All Users\Application Data\omizamit.com
c:\documents and settings\Kevin\Application Data\osivyq.dll
c:\documents and settings\Kevin\Application Data\pumyzarete.dat
c:\documents and settings\Kevin\Application Data\pypibu.scr
c:\documents and settings\Kevin\Application Data\zydejoma.pif
c:\program files\Common Files\baloqufyw.bin
c:\program files\Common Files\lopylama.pif
c:\program files\Common Files\xarec.vbs
c:\windows\ecoxa.com
c:\windows\edoxyd._dl
c:\windows\raqamite.reg
c:\windows\system32\feda.db
c:\windows\uhapazecu.scr
c:\windows\wyjil.scr
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\All Users\Application Data\omizamit.com
c:\documents and settings\Kevin\Application Data\osivyq.dll
c:\documents and settings\Kevin\Application Data\pumyzarete.dat
c:\documents and settings\Kevin\Application Data\pypibu.scr
c:\documents and settings\Kevin\Application Data\Twain
c:\documents and settings\Kevin\Application Data\Twain\Twain.exe
c:\documents and settings\Kevin\Application Data\zydejoma.pif
c:\program files\Common Files\baloqufyw.bin
c:\program files\Common Files\lopylama.pif
c:\program files\Common Files\oqmm
c:\program files\Common Files\oqmm\oqmma.lck
c:\program files\Common Files\oqmm\oqmmd\class-barrel
c:\program files\Common Files\oqmm\oqmmd\vocabulary
c:\program files\Common Files\oqmm\oqmmh
c:\program files\Common Files\oqmm\oqmml.lck
c:\program files\Common Files\oqmm\oqmmm.lck
c:\program files\Common Files\xarec.vbs
c:\windows\ecoxa.com
c:\windows\edoxyd._dl
c:\windows\oqmm
c:\windows\oqmm\oqmm.dat
c:\windows\oqmm\wu
c:\windows\raqamite.reg
c:\windows\S2V2aW4gQmF1bQ
c:\windows\system32\feda.db
c:\windows\uhapazecu.scr
c:\windows\wyjil.scr
.
((((((((((((((((((((((((( Files Created from 2008-10-16 to 2008-11-16 )))))))))))))))))))))))))))))))
.
2008-11-13 18:12 . 2008-11-13 18:13 250 --a------ c:\windows\gmer.ini
2008-11-12 21:28 . 2008-06-10 02:32 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-12 21:02 . 2008-11-12 21:04 <DIR> d-------- c:\documents and settings\All Users\Application Data\Lavasoft
2008-11-12 20:22 . 2008-11-12 20:22 <DIR> d-------- c:\program files\Trend Micro
2008-11-08 19:55 . 2008-11-14 18:06 54,156 --ah----- c:\windows\QTFont.qfn
2008-11-08 19:55 . 2008-11-08 19:55 1,409 --a------ c:\windows\QTFont.for
2008-10-17 20:01 . 2008-10-17 20:01 <DIR> d-------- c:\documents and settings\Kevin\Application Data\Malwarebytes
2008-10-17 20:01 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-10-17 20:01 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-10-17 20:00 . 2008-11-12 18:06 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-10-17 20:00 . 2008-10-17 20:00 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-10-17 19:21 . 2008-10-17 19:21 <DIR> d-------- c:\program files\Enigma Software Group
2008-10-17 08:29 . 2008-11-16 08:59 <DIR> d-------- c:\program files\Common
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-16 14:06 --------- d-----w c:\program files\MP3 Rocket
2008-11-13 23:08 --------- d-----w c:\program files\Norton AntiVirus
2008-11-13 16:50 --------- d-----w c:\documents and settings\All Users\Application Data\DVD Shrink
2008-11-13 03:28 --------- d-----w c:\program files\Java
2008-11-13 02:03 --------- d-----w c:\program files\Lavasoft
2008-11-13 02:03 --------- d-----w c:\documents and settings\Kevin\Application Data\Lavasoft
2008-11-13 02:01 --------- d-----w c:\program files\Common Files\Wise Installation Wizard
2008-10-02 11:24 --------- d-----w c:\program files\Google
2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys
2008-08-20 05:38 659,456 ----a-w c:\windows\system32\wininet.dll
2001-11-23 04:08 712,704 ----a-w c:\windows\inf\OTHER\AUDIO3D.DLL
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
---- Directory of c:\program files\Common ----
2008-11-11 20:37 60928 --a------ c:\program files\Common\_helper.sig
((((((((((((((((((((((((((((( snapshot@2008-11-16_ 9.10.04.56 )))))))))))))))))))))))))))))))))))))))))
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PhotoShow Deluxe Media Manager"="c:\progra~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-05-12 196608]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-10-13 1694208]
"H/PC Connection Agent"="c:\program files\Microsoft ActiveSync\WCESCOMM.EXE" [2004-02-03 401491]
"NBJ"="c:\program files\Ahead\Nero BackItUp\NBJ.exe" [2004-11-30 1945600]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SiSUSBRG"="c:\windows\SiSUSBrg.exe" [2002-07-12 106496]
"Gainward"="c:\windows\TBPanel.exe" [2004-12-29 2043904]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-08-02 7110656]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"WinFast Schedule"="c:\program files\WinFast\WFTVFM\WFWIZ.exe" [2004-10-06 176128]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2005-02-28 68768]
"Symantec NetDriver Monitor"="c:\progra~1\SYMNET~1\SNDMon.exe" [2005-09-03 95960]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2005-08-02 86016]
"CloneCDTray"="c:\program files\SlySoft\CloneCD\CloneCDTray.exe" [2005-05-19 57344]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-03-04 155648]
"SansaDispatch"="c:\program files\SanDisk\Sansa Updater\SansaDispatch.exe" [2007-10-22 75584]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"C-Media Mixer"="Mixer.exe" [2002-06-12 c:\windows\mixer.exe]
"nwiz"="nwiz.exe" [2005-08-02 c:\windows\system32\nwiz.exe]
c:\documents and settings\Kevin\Start Menu\Programs\Startup\
MP3 Rocket (silent).lnk - c:\program files\MP3 Rocket\MP3Rocket_on_startup.exe [2006-12-13 66168]
c:\documents and settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696]
EPSON SMART PANEL for Scanner.lnk - c:\program files\EPSON\EPSON SMART PANEL for Scanner\ESPMAIN.EXE [2005-01-08 180224]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-07-10 111376]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-07-10 51984]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"MSACM.CEGSM"= mobilev.acm
"VIDC.MJPG"= jl_mjpg2.drv
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Papyrus\\NASCAR Racing 2003 Season\\NR2003.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe"=
"c:\\Program Files\\Microsoft ActiveSync\\WCESMgr.exe"=
"c:\\Program Files\\Ahead\\Nero ShowTime\\ShowTime.exe"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"c:\\Program Files\\Microsoft Office\\Office\\WINWORD.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"1911:UDP"= 1911:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"1910:UDP"= 1910:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"1915:UDP"= 1915:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"2899:UDP"= 2899:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"2898:UDP"= 2898:UDP:Windows Media Format SDK (IEXPLORE.EXE)
"2903:UDP"= 2903:UDP:Windows Media Format SDK (IEXPLORE.EXE)
R1 amdtools;AMD Special Tools Driver;c:\windows\system32\DRIVERS\amdtools.sys [2006-01-14 21632]
R2 BT848;WinFast TV2000 XP WDM Video Capture;c:\windows\system32\drivers\wf2kvcap.sys [2004-10-04 75925]
R2 tv2ktunr;WinFast TV2000 XP WDM TVTuner;c:\windows\system32\drivers\wf2ktunr.sys [2004-10-04 36423]
R2 Tv2kXbar;WinFast TV2000 XP WDM Crossbar;c:\windows\system32\drivers\wf2kxbar.sys [2004-10-04 10005]
R3 WFIOCTL;WFIOCTL;\??\c:\program files\WinFast\WFTVFM\WFIOCTL.SYS [2004-12-30 9510]
S3 JL2005;JL2005A Camera;c:\windows\system32\Drivers\toywdm.sys [2005-10-08 71512]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{39b2b980-7727-11da-971e-000d875484b4}]
\Shell\AutoRun\command - J:\setupSNK.exe
.
Contents of the 'Scheduled Tasks' folder
2008-11-15 c:\windows\Tasks\Norton AntiVirus - Scan my computer.job
- c:\progra~1\NORTON~1\Navw32.exe [2003-12-04 18:22]
2008-11-16 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-12-14 12:24]
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2008-11-16 13:39:35
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-16 13:41:37
ComboFix-quarantined-files.txt 2008-11-16 18:40:40
ComboFix2.txt 2008-11-16 14:11:30
Pre-Run: 47,469,867,008 bytes free
Post-Run: 47,513,976,832 bytes free
176 --- E O F --- 2008-10-25 02:40:09
--------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Sunday, November 16, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Sunday, November 16, 2008 13:43:47
Records in database: 1387799
--------------------------------------------------------------------------------
Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes
Scan area - My Computer:
A:\
C:\
G:\
H:\
Scan statistics:
Files scanned: 64157
Threat name: 6
Infected objects: 8
Suspicious objects: 0
Duration of the scan: 01:46:49
File name / Threat name / Threats count
C:\Documents and Settings\Kevin\Application Data\Sun\Java\Deployment\cache\6.0\22\10453ed6-3138a844 Infected: Exploit.Java.Gimsh.b 1
C:\Documents and Settings\Kevin\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-3b070a2d-6700d78c.zip Infected: Exploit.Java.Gimsh.b 1
C:\My Shared Folder\Harry Potter and The Deathly Hallows [Full Book].zip Infected: P2P-Worm.Win32.VB.dw 1
C:\Program Files\Eyetide Media\Eyetide Viewer\mgsSetp.EyeTide.exe Infected: not-a-virus:WebToolbar.Win32.MyWebSearch.dr 1
C:\Program Files\Norton AntiVirus\Quarantine\345F471A Infected: Trojan-Downloader.JS.IstBar.j 1
C:\Program Files\Norton AntiVirus\Quarantine\46574E46 Infected: Trojan-Downloader.JS.IstBar.e 1
C:\Program Files\Norton AntiVirus\Quarantine\5B070414 Infected: Trojan-Downloader.JS.IstBar.e 1
C:\Qoobox\Quarantine\C\Documents and Settings\Kevin\Application Data\Twain\Twain.exe.vir Infected: Trojan.Win32.Agent.amwr 1
The selected area was scanned.