Win32.trojan.agent Help- Can't Delete

[Afronaut]

While scanning my computer with McAfee Security System I found a win32.trojan.agent... I then downloaded Ad-Aware and found that I had quite a few infected files, 0ver 200. I first quarantined and then deleted them. I scanned only a couple of hours later and there were more. I read through and followed the 5 steps to use this Thread. I get pop-ups from IE , even though i use Mozilla. Here is my main.txt from the DSS and I'll attach the extra as well. I've also used Hijackthis and gotten a log from that if you need it. Any help would be greatly appreciated. Thanks in advance..

Andrew

Dss:

Deckard's System Scanner v20071014.68
Run by F.Radical on 2007-12-16 14:37:28
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------



-- Last 5 Restore Point(s) --
70: 2007-12-16 17:13:30 UTC - RP70 - Deckard's System Scanner Restore Point
69: 2007-12-16 16:10:25 UTC - RP69 - Software Distribution Service 3.0
68: 2007-12-16 14:34:50 UTC - RP68 - Software Distribution Service 3.0
67: 2007-12-15 23:20:34 UTC - RP67 - Software Distribution Service 3.0
66: 2007-12-15 16:30:26 UTC - RP66 - Software Distribution Service 3.0


-- First Restore Point --
1: 2007-12-13 19:41:00 UTC - RP1 - System Checkpoint


Backed up registry hives.
Performed disk cleanup.



-- HijackThis Clone ------------------------------------------------------------


Emulating logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2007-12-16 14:38:06
Platform: Windows XP Service Pack 2 (5.01.2600)
MSIE: Internet Explorer (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\system32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\Program Files\McAfee\MSC\mcmscsvc.exe
C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
C:\Program Files\McAfee\VirusScan\mcods.exe
C:\Program Files\McAfee\MSC\mcpromgr.exe
C:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe
C:\Program Files\McAfee\VirusScan\Mcshield.exe
C:\Program Files\McAfee\VirusScan\mcsysmon.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\xnohqder.exe
C:\Documents and Settings\F.Radical\Desktop\dss.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {73F24B2F-4F7A-4BC2-A685-0333C49D1042} - C:\WINDOWS\system32\urqrrqq.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptcl.dll
O2 - BHO: {9921cdaa-f0c4-128b-4974-eca3115016a9} - {9a610511-3ace-4794-b821-4c0faadc1299} - C:\WINDOWS\system32\xwopqdhx.dll
O2 - BHO: (no name) - {EDF11262-C7A6-44B3-82F0-1F54E8F07830} - C:\WINDOWS\system32\pmnlm.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -noicon
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlackICE PC Protection.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\network diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\SYSTEM\CCS\Services\Tcpip\..\{274E2CF4-7AF7-4959-90C9-5243B000CCD4}: NameServer = 192.168.2.1
O18 - Protocol: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - C:\Program Files\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL
O18 - Protocol: mso-offdap - {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL
O20 - Winlogon Notify: urqrrqq - C:\WINDOWS\system32\urqrrqq.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\EmProxy\emproxy.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\MNA\McNASvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\Program Files\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - C:\Program Files\Common Files\McAfee\RedirSvc\RedirSvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\Mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan\mcsysmon.exe
O23 - Service: NBService - Unknown owner - C:\Program Files\Nero\Nero 7\Nero
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\RapApp.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe


--
End of file - 7661 bytes

-- File Associations -----------------------------------------------------------

All associations okay.


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 cdrbsdrv - c:\windows\system32\drivers\cdrbsdrv.sys <Not Verified; B.H.A Corporation; B's Recorder GOLD>

S0 black - c:\windows\system32\drivers\blackdrv.sys <Not Verified; Internet Security Systems, Inc.; ICEpac>
S3 RapDrv - c:\windows\system32\drivers\rapdrv.sys <Not Verified; Internet Security Systems, Inc.; Rap Protection System>
S3 RapFile - c:\windows\system32\drivers\rapfile.sys <Not Verified; Internet Security Systems, Inc.; Rap Protection System>
S3 RapNet - c:\windows\system32\drivers\rapnet.sys <Not Verified; Internet Security Systems, Inc.; Rap Protection System>


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R? DomainService -
R2 bgsvcgen (B's Recorder GOLD Library General Service) - "c:\windows\system32\bgsvcgen.exe" <Not Verified; B.H.A Corporation; B's Recorder GOLD9>

S2 BlackICE - "c:\program files\iss\blackice\blackd.exe" <Not Verified; Internet Security Systems, Inc.; Network ICE Corporation blackd>
S3 NBService - c:\program files\nero\nero 7\nero backitup\nbservice.exe
S3 RapApp - "c:\program files\iss\blackice\rapapp.exe" <Not Verified; Internet Security Systems, Inc.; Rap Protection System>


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2007-12-15 01:15:44 358 --a------ C:\WINDOWS\Tasks\McDefragTask.job
2007-11-01 00:00:05 360 --a------ C:\WINDOWS\Tasks\McQcTask.job


-- Files created between 2007-11-16 and 2007-12-16 -----------------------------

2007-12-16 11:18:56 71 --a------ C:\WINDOWS\system32\pfdnnt_actions.sys
2007-12-16 11:18:55 8704 --a------ C:\WINDOWS\system32\pfdnnt.exe <Not Verified; Panda Software International; Panda Anti-malware>
2007-12-16 11:04:58 0 d-------- C:\Program Files\SpywareBlaster
2007-12-16 11:00:33 0 d-------- C:\WINDOWS\system32\ActiveScan
2007-12-16 10:30:21 70 --ah----- C:\aaw7boot.cmd
2007-12-16 09:34:55 0 d-------- C:\WINDOWS\LastGood
2007-12-15 17:33:50 85568 --a------ C:\WINDOWS\system32\vapygoot.dll
2007-12-15 17:30:50 80448 --a------ C:\WINDOWS\system32\xwopqdhx.dll
2007-12-15 17:25:12 74304 -----n--- C:\WINDOWS\system32\xnohqder.exe <Not Verified; ; DDC>
2007-12-15 11:33:41 0 d-------- C:\Program Files\Windows Media Connect 2
2007-12-15 11:30:59 0 d-------- C:\WINDOWS\system32\LogFiles
2007-12-15 11:30:59 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2007-12-15 07:55:57 0 d-------- C:\Program Files\Ad-Aware 2007
2007-12-15 07:55:56 0 d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-15 07:54:57 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-15 00:13:22 0 d-------- C:\Program Files\Common Files\Adobe
2007-12-15 00:13:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Adobe
2007-12-14 21:30:39 0 d-------- C:\Program Files\Alcohol Soft
2007-12-14 14:57:36 0 d-------- C:\Program Files\QdrPack
2007-12-14 14:57:35 0 d-------- C:\Program Files\QdrDrive
2007-12-14 14:57:34 0 d-------- C:\Program Files\ISM
2007-12-14 14:54:53 85568 --a------ C:\WINDOWS\system32\okjjlabx.dll
2007-12-14 14:52:11 80448 --a------ C:\WINDOWS\system32\hrvtykhh.dll
2007-12-13 14:40:49 460715 --ahs---- C:\WINDOWS\system32\mlnmp.ini2
2007-12-13 14:40:36 337920 --a------ C:\WINDOWS\system32\pmnlm.dll
2007-12-13 14:38:11 39936 --a------ C:\WINDOWS\17PHolmes922.exe
2007-12-13 14:35:32 39936 -----n--- C:\WINDOWS\system32\urqrrqq.dll
2007-12-13 14:35:27 39936 --a------ C:\WINDOWS\mrofinu922.exe
2007-12-12 21:33:03 52736 --a------ C:\WINDOWS\ipuninst.exe <Not Verified; Interplay Productions; Interplay Uninstaller for Windows 95>
2007-12-12 21:32:34 0 d-------- C:\Program Files\Fallout2
2007-12-12 21:29:17 0 d-------- C:\Program Files\DAEMON Tools
2007-12-11 23:59:33 0 d-------- C:\Program Files\MSXML 4.0
2007-12-11 10:12:22 0 d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2007-12-11 10:10:49 0 d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-12-10 07:26:05 0 d--h----- C:\WINDOWS\PIF
2007-12-09 18:19:11 0 d-------- C:\Program Files\WinSCP
2007-12-07 11:09:00 0 d-------- C:\Documents and Settings\F.Radical\Application Data\LEAPS
2007-12-07 11:03:33 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Pegasys Inc
2007-12-07 10:58:06 56976 --a------ C:\WINDOWS\system32\GenSvcInst.exe <Not Verified; B.H.A Corporation; B's Recorder GOLD9>
2007-12-07 10:58:06 33408 --a------ C:\WINDOWS\system32\drivers\CDRBSDRV.SYS <Not Verified; B.H.A Corporation; B's Recorder GOLD>
2007-12-07 10:58:06 122512 --a------ C:\WINDOWS\system32\bgsvcgen.exe <Not Verified; B.H.A Corporation; B's Recorder GOLD9>
2007-12-07 10:57:33 0 d-------- C:\Program Files\Pegasys Inc
2007-12-06 22:43:13 54272 --a------ C:\WINDOWS\system32\DrvTrNTm.dll <Not Verified; High Criteria inc.; Total Recorder (Professional Edition)>
2007-12-06 22:43:13 106496 --a------ C:\WINDOWS\system32\DrvTrNTl.dll <Not Verified; High Criteria inc.; Total Recorder (Professional Edition)>
2007-12-06 22:43:13 0 d-------- C:\Program Files\TotalRecorder
2007-12-04 09:42:40 299008 --a------ C:\WINDOWS\b148.exe
2007-12-03 17:43:52 0 d-------- C:\8c43d9d7bfb4f8be100e285073
2007-11-28 17:21:36 0 d-------- C:\Program Files\VirtualDJ
2007-11-28 16:21:53 0 d-------- C:\Program Files\mIRC
2007-11-28 16:21:53 0 d-------- C:\Documents and Settings\F.Radical\Application Data\mIRC
2007-11-20 02:52:50 0 d-------- C:\WINDOWS\Sun
2007-11-20 02:52:50 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Sun


-- Find3M Report ---------------------------------------------------------------

2007-12-16 11:31:11 0 d-------- C:\Program Files\Winamp
2007-12-16 11:30:49 0 d-------- C:\Program Files\SmartFTP Client 2.0
2007-12-16 11:27:42 0 d-------- C:\Program Files\Common Files\LightScribe
2007-12-15 18:20:53 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Azureus
2007-12-15 18:20:24 0 d-------- C:\Documents and Settings\F.Radical\Application Data\.purple
2007-12-15 08:19:54 0 d-------- C:\Program Files\Common Files
2007-12-15 00:11:36 0 d-------- C:\Documents and Settings\F.Radical\Application Data\AdobeUM
2007-12-14 22:37:40 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Adobe
2007-12-11 10:11:49 0 d-------- C:\Program Files\Common Files\Ahead
2007-12-10 19:04:58 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Real
2007-12-07 10:57:09 0 d-------- C:\Program Files\Common Files\InstallShield
2007-11-06 09:57:21 0 d-------- C:\Program Files\Postal 2 Special Edition
2007-11-06 09:57:21 0 d-------- C:\Program Files\Online Services
2007-11-05 16:23:49 0 d-------- C:\Documents and Settings\F.Radical\Application Data\gtk-2.0
2007-11-03 20:03:31 0 d-------- C:\Program Files\McAfee
2007-11-03 04:01:52 192 --a------ C:\WINDOWS\system32\tbhi.dat
2007-11-03 04:01:51 0 d-------- C:\Program Files\ISS
2007-11-03 04:01:50 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-11-03 02:18:09 0 d-------- C:\Program Files\Microsoft ActiveSync
2007-11-03 02:09:48 61440 --a------ C:\WINDOWS\keygen.dll
2007-11-03 02:03:19 0 d-------- C:\Program Files\DVD Shrink
2007-11-02 01:05:54 1467 --a------ C:\WINDOWS\mozver.dat
2007-11-01 05:13:18 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Ahead
2007-11-01 04:05:31 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Sony Corporation
2007-11-01 01:18:20 0 d-------- C:\Program Files\Common Files\Sony Shared
2007-11-01 01:18:09 0 d-------- C:\Program Files\Azureus
2007-11-01 01:17:56 0 d-------- C:\Program Files\Sony
2007-11-01 01:14:38 0 d-------- C:\Program Files\directx
2007-11-01 00:57:12 12558 --a------ C:\WINDOWS\gstcore.dll
2007-11-01 00:57:11 38982 --a------ C:\WINDOWS\rsczsys.dll
2007-11-01 00:57:11 6017 --a------ C:\WINDOWS\assys.dll
2007-11-01 00:57:09 13277 --a------ C:\WINDOWS\snsys.dll
2007-11-01 00:57:08 40177 --a------ C:\WINDOWS\ffnsys.dll
2007-11-01 00:57:07 30559 --a------ C:\WINDOWS\mfnsys.dll
2007-11-01 00:57:00 227851 --a------ C:\WINDOWS\uawin.dll
2007-11-01 00:50:56 0 d-------- C:\Program Files\Nero
2007-10-31 23:43:37 0 d-------- C:\Program Files\Realtek
2007-10-31 20:52:30 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Macromedia
2007-10-31 20:39:30 0 d-------- C:\Program Files\Pidgin
2007-10-31 20:39:12 0 d-------- C:\Program Files\Common Files\GTK
2007-10-31 15:51:40 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Media Player Classic
2007-10-31 15:43:14 0 d-------- C:\Program Files\Java
2007-10-31 15:41:06 0 d-------- C:\Program Files\Common Files\Java
2007-10-31 15:00:04 0 d-------- C:\Documents and Settings\F.Radical\Application Data\SmartFTP
2007-10-31 14:57:09 0 d-------- C:\Program Files\K-Lite Codec Pack
2007-10-31 14:54:11 0 d-------- C:\Documents and Settings\F.Radical\Application Data\WinRAR
2007-10-31 14:18:44 0 --a------ C:\WINDOWS\nsreg.dat
2007-10-31 14:18:42 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Mozilla
2007-10-31 1419 0 d-------- C:\Program Files\Intel
2007-10-31 13:56:58 0 d-------- C:\Program Files\Common Files\McAfee
2007-10-31 13:56:16 0 d-------- C:\Program Files\McAfee.com
2007-10-31 13:36:01 0 d-------- C:\Documents and Settings\F.Radical\Application Data\Identities
2007-10-31 13:28:11 0 d-------- C:\Program Files\microsoft frontpage
2007-10-31 13:27:52 0 -rahs---- C:\MSDOS.SYS
2007-10-31 13:27:52 0 -rahs---- C:\IO.SYS
2007-10-31 13:27:52 0 --a------ C:\CONFIG.SYS
2007-10-31 13:27:52 0 --a------ C:\AUTOEXEC.BAT
2007-10-31 13:26:57 0 d--h----- C:\Program Files\WindowsUpdate
2007-10-31 13:26:12 0 d-------- C:\Program Files\Common Files\MSSoap
2007-10-31 13:26:04 0 d-------- C:\Program Files\Movie Maker
2007-10-31 13:25:24 21640 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-10-31 13:24:58 0 d-------- C:\Program Files\MSN Gaming Zone
2007-10-31 13:24:50 0 d-------- C:\Program Files\Windows NT
2007-10-31 08:13:35 0 d-------- C:\Program Files\Common Files\ODBC
2007-10-31 08:13:32 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-10-31 08:13:09 62 --ahs---- C:\Documents and Settings\F.Radical\Application Data\desktop.ini


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{73F24B2F-4F7A-4BC2-A685-0333C49D1042}]
12/13/2007 02:35 PM 39936 --------- C:\WINDOWS\system32\urqrrqq.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9a610511-3ace-4794-b821-4c0faadc1299}]
12/15/2007 05:30 PM 80448 --a------ C:\WINDOWS\system32\xwopqdhx.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EDF11262-C7A6-44B3-82F0-1F54E8F07830}]
12/13/2007 02:40 PM 337920 --a------ C:\WINDOWS\system32\pmnlm.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [01/12/2007 08:47 PM]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [01/12/2007 08:47 PM]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [01/12/2007 08:46 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [09/25/2007 01:11 AM]
"SkyTel"="SkyTel.EXE" [05/16/2006 05:04 AM C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [09/12/2006 03:58 AM C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [05/03/2005 05:43 AM C:\WINDOWS\Alcmtr.exe]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [04/26/2002 12:53 PM]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"TotalRecorderScheduler"="C:\Program Files\TotalRecorder\TotRecSched.exe" [05/12/2006 01:32 AM]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [03/01/2007 03:57 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 07:00 AM]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [06/27/2007 07:03 PM]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [12/12/2007 08:09 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 10:05:26 PM]
BlackICE PC Protection.lnk - C:\Program Files\ISS\BlackICE\blackice.exe [11/3/2007 4:01:51 AM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 12:01:04 AM]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{73F24B2F-4F7A-4BC2-A685-0333C49D1042}"= C:\WINDOWS\system32\urqrrqq.dll [12/13/2007 02:35 PM 39936]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrrqq]
urqrrqq.dll 12/13/2007 02:35 PM 39936 C:\WINDOWS\system32\urqrrqq.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnlm.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

*Newly Created Service* - RKPAVPROC



-- End of Deckard's System Scanner: finished at 2007-12-16 14:38:57 ------------

[Afronaut]

Here is the Panda Scan, as well..



Incident Status Location

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\xnohqder.exe
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\xwopqdhx.dll
Virus:Trj/Downloader.ROO Disinfected Operating system
Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.tribalfusion.com/]
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.doubleclick.net/]
Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.com.com/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.atdmt.com/]
Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[statse.webtrendslive.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[www.burstbeacon.com/]
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.burstnet.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Yadro Not disinfected C:\Documents and Settings\F.Radical\Application Data\Mozilla\Firefox\Profiles\1c6x5pgo.default\cookies.txt[.yadro.ru/]
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\F.Radical\Cookies\f.radical@atdmt[1].txt
Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\F.Radical\Cookies\f.radical@burstnet[2].txt
Spyware:Cookie/Enhance Not disinfected C:\Documents and Settings\F.Radical\Cookies\f.radical@enhance[2].txt
Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\F.Radical\Cookies\f.radical@www.burstbeacon[1].txt
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\F.Radical\Local Settings\Temporary Internet Files\Content.IE5\03UIOH72\gamadril20071203[1]
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\F.Radical\Local Settings\Temporary Internet Files\Content.IE5\EQKXCCF2\ptch[1]
Adware:Adware/Borlander Not disinfected C:\Documents and Settings\F.Radical\Local Settings\Temporary Internet Files\Content.IE5\RTDBOKSW\17PHolmes[1].cmt
Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\F.Radical\Local Settings\Temporary Internet Files\Content.IE5\RTDBOKSW\hctp[1]
Virus:Trj/Agent.GBF Not disinfected C:\Documents and Settings\F.Radical\My Documents\Azureus Downloads\Smart FTP 2.5.1006.8 + Patch [SerialNagCracker]\SmartFTP.v2.5.1006.8.exe[_SFTPNSI.exe]
Virus:Trj/Banker.JER Not disinfected C:\Program Files\InstallShield Installation Information\{76542EE3-5849-11D2-9C18-00609707C0FF}\data1.cab[wget.exe]
Possible Virus. Not disinfected C:\Program Files\QdrDrive\qdrloader.exe
Adware:Adware/Amera Not disinfected C:\Program Files\QdrPack\QdrPack9.exe
Adware:Adware/Borlander Not disinfected C:\WINDOWS\17PHolmes922.exe
Virus:Trj/Agent.GBF Disinfected C:\WINDOWS\EditIPWzrd.exe
Adware:Adware/Borlander Not disinfected C:\WINDOWS\mrofinu922.exe
Adware:Adware/Borlander Not disinfected C:\WINDOWS\mrofinu922.exe.tmp
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\awttspq.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\cbxxyaw.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\fccyvwx.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\hggfdab.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\hrvtykhh.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\jkkihhi.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\okjjlabx.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\tuvwvsq.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\urqrrqq.dll
Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\vapygoot.dll
Virus:Trj/Downloader.ROO Disinfected C:\WINDOWS\system32\xxyxyyv.dll

[TheBruce1]

Hello Afronaut and welcome to TSF.

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

====================

Please follow all instructions and in which order they come,if you have any questions,please ask before proceeding.Its important that you follow this through until i give you the all clear,a lack of symptoms does not mean that you are clean.

=============================

P2P

P2P - I see you have P2P software Azureus installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

==============================

Download ComboFix from Here or here

**Save it to your desktop**

===============================

Disconnect from the internet

================================




Go to → Run → paste in the single line command & click OK

"%userprofile%\desktop\combofix.exe" /killall

When finished, it shall produce a log for you. Post that log & a fresh HJT log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

===============================

Reconnect to the internet and follow instructions

===============================

Please download HijackThis to your desktop

Alternate link

This program will help us determine if there are any spyware/malware on your computer. Double-click on the file you just downloaded.
Click on the "Unzip" button to install. It will by default install to the directory - C:\Program Files\Trend Micro\HijackThis

Upon install, HijackThis should open for you.

Should it not open, navigate to C:\Program Files\Trend Micro\HijackThis and double click on HijackThis.exe

1. If it gives you an intro screen, just choose 'Do a system scan and save a logfile'.
2. If you don't get the intro screen, just hit Scan and then click on Save log.
3. Post the hijackthis.log file here. Do not fix anything in HijackThis since they may be harmless.

=================================
Logs Required
C:\Combofix.txt
Hijackthis log

[Afronaut]

I was not able to run combofix due to an error saying 'it is not valid Win32 application' I did in fact download combofix to my desktop as well.

[TheBruce1]

What is the exact error message you received.Have you tried both links, did you receive any warnings from Mcafee when downloading, if so please allow Combofix.

[Afronaut]

C:\Documents and Settings\F. Radical\desktop\combofix.exe is not a valid Win32 application is the exact message. I have tried both links and both give me the same message.

[Afronaut]

Scratch that, was able to run it right off the desktop this time. The first time i was unable. Here is the combofix and hijackthis log. Ill attach as well.

ComboFix 07-12-21.4 - F.Radical 2007-12-22 17:47:53.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.616 [GMT -5:00]
Running from: C:\Documents and Settings\F.Radical\Desktop\ComboFix(2).exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\F.Radical\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\F.Radical\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\F.Radical\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\QdrDrive
C:\Program Files\QdrDrive\QdrDrive8.dll
C:\Program Files\QdrDrive\qdrloader.exe
C:\Program Files\QdrPack
C:\Program Files\QdrPack\QdrPack9.exe
C:\WINDOWS\b148.exe
C:\WINDOWS\system32\apjcmasw.dll
C:\WINDOWS\system32\bjlqqodk.dll
C:\WINDOWS\system32\caodmdew.ini
C:\WINDOWS\system32\cqnxkgjj.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\dsdtgitj.ini
C:\WINDOWS\system32\jjgkxnqc.ini
C:\WINDOWS\system32\jtigtdsd.dll
C:\WINDOWS\system32\kdoqqljb.ini
C:\WINDOWS\system32\mlnmp.ini
C:\WINDOWS\system32\mlnmp.ini2
C:\WINDOWS\system32\okjjlabx.dll
C:\WINDOWS\system32\otpvuxvr.dll
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\pmnlm.dll
C:\WINDOWS\system32\rvxuvpto.ini
C:\WINDOWS\system32\simoanjt.ini
C:\WINDOWS\system32\tjnaomis.dll
C:\WINDOWS\system32\toogypav.ini
C:\WINDOWS\system32\vapygoot.dll
C:\WINDOWS\system32\wedmdoac.dll
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\system32\xbaljjko.ini
G:\Autorun.inf

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
-------\NPF


((((((((((((((((((((((((( Files Created from 2007-11-22 to 2007-12-22 )))))))))))))))))))))))))))))))
.

2007-12-16 11:54 . 2007-12-16 11:54 <DIR> d-------- C:\Deckard
2007-12-16 11:04 . 2007-12-16 11:08 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-12-16 11:04 . 2005-08-25 18:19 115,920 --a------ C:\WINDOWS\system32\MSINET.OCX
2007-12-16 11:00 . 2007-12-16 11:34 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-12-16 11:00 . 2007-12-16 11:00 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2007-12-16 11:00 . 2007-12-16 11:00 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2007-12-16 11:00 . 2007-12-16 11:00 1,406 --a------ C:\WINDOWS\system32\Help.ico
2007-12-15 11:33 . 2007-12-15 11:33 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-12-15 11:30 . 2007-12-15 11:30 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2007-12-15 11:30 . 2007-12-15 11:32 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-12-15 07:55 . 2007-12-16 11:26 <DIR> d-------- C:\Program Files\Ad-Aware 2007
2007-12-15 07:55 . 2007-12-15 07:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-15 07:54 . 2007-12-15 07:54 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-15 00:13 . 2007-12-15 00:13 <DIR> d-------- C:\Program Files\Common Files\Adobe
2007-12-14 21:30 . 2007-12-14 21:30 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-12-12 21:33 . 2007-12-13 15:13 52,736 --a------ C:\WINDOWS\ipuninst.exe
2007-12-12 21:32 . 2007-12-13 15:13 <DIR> d-------- C:\Program Files\Fallout2
2007-12-12 21:29 . 2007-12-13 15:09 <DIR> d-------- C:\Program Files\DAEMON Tools
2007-12-11 23:59 . 2007-12-11 23:59 <DIR> d-------- C:\Program Files\MSXML 4.0
2007-12-11 10:12 . 2007-12-11 10:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Ahead
2007-12-11 10:10 . 2007-12-11 10:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Nero
2007-12-10 07:26 . 2007-12-10 07:26 <DIR> d--h----- C:\WINDOWS\PIF
2007-12-09 18:19 . 2007-12-16 11:31 <DIR> d-------- C:\Program Files\WinSCP
2007-12-07 11:09 . 2007-12-07 11:09 <DIR> d-------- C:\Documents and Settings\F.Radical\Application Data\LEAPS
2007-12-07 11:03 . 2007-12-07 12:53 <DIR> d-------- C:\Documents and Settings\F.Radical\Application Data\Pegasys Inc
2007-12-07 10:58 . 2007-12-07 10:57 122,512 --a------ C:\WINDOWS\system32\bgsvcgen.exe
2007-12-07 10:58 . 2007-12-07 10:57 56,976 --a------ C:\WINDOWS\system32\GenSvcInst.exe
2007-12-07 10:58 . 2007-12-07 10:57 33,408 --a------ C:\WINDOWS\system32\drivers\CDRBSDRV.SYS
2007-12-07 10:57 . 2007-12-07 12:52 <DIR> d-------- C:\Program Files\Pegasys Inc
2007-12-06 22:43 . 2007-12-16 11:31 <DIR> d-------- C:\Program Files\TotalRecorder
2007-12-06 22:43 . 2006-05-11 10:48 106,496 --a------ C:\WINDOWS\system32\DrvTrNTl.dll
2007-12-06 22:43 . 2006-05-17 21:53 54,272 --a------ C:\WINDOWS\system32\DrvTrNTm.dll
2007-11-28 17:21 . 2007-11-28 17:21 <DIR> d-------- C:\Program Files\VirtualDJ
2007-11-28 16:21 . 2007-11-29 02:37 <DIR> d-------- C:\Program Files\mIRC
2007-11-28 16:21 . 2007-11-29 02:43 <DIR> d-------- C:\Documents and Settings\F.Radical\Application Data\mIRC

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-21 00:05 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\Azureus
2007-12-18 18:45 --------- d-----w C:\Program Files\McAfee
2007-12-16 16:31 --------- d-----w C:\Program Files\Winamp
2007-12-16 16:30 --------- d-----w C:\Program Files\SmartFTP Client 2.0
2007-12-16 16:27 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-12-15 23:20 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\.purple
2007-12-15 05:11 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\AdobeUM
2007-12-11 15:11 --------- d-----w C:\Program Files\Common Files\Ahead
2007-12-07 15:57 --------- d-----w C:\Program Files\Common Files\InstallShield
2007-11-20 22:12 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-06 14:57 --------- d-----w C:\Program Files\Postal 2 Special Edition
2007-11-05 21:23 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\gtk-2.0
2007-11-04 01:06 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-03 09:01 10 ----a-w C:\WINDOWS\system32\drivers\tmbi.sys
2007-11-03 09:01 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-11-03 09:01 --------- d-----w C:\Program Files\ISS
2007-11-03 07:18 --------- d-----w C:\Program Files\Microsoft ActiveSync
2007-11-03 07:09 61,440 ----a-w C:\WINDOWS\keygen.dll
2007-11-03 07:03 --------- d-----w C:\Program Files\DVD Shrink
2007-11-03 07:03 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2007-11-01 10:13 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\Ahead
2007-11-01 10:13 --------- d-----w C:\Documents and Settings\All Users\Application Data\LightScribe
2007-11-01 09:05 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\Sony Corporation
2007-11-01 06:18 --------- d-----w C:\Program Files\Common Files\Sony Shared
2007-11-01 06:18 --------- d-----w C:\Program Files\Azureus
2007-11-01 06:17 --------- d-----w C:\Program Files\Sony
2007-11-01 06:16 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Corporation
2007-11-01 06:14 --------- d-----w C:\Program Files\directx
2007-11-01 05:57 6,017 ----a-w C:\WINDOWS\assys.dll
2007-11-01 05:57 40,177 ----a-w C:\WINDOWS\ffnsys.dll
2007-11-01 05:57 38,982 ----a-w C:\WINDOWS\rsczsys.dll
2007-11-01 05:57 30,559 ----a-w C:\WINDOWS\mfnsys.dll
2007-11-01 05:57 227,851 ----a-w C:\WINDOWS\uawin.dll
2007-11-01 05:57 13,277 ----a-w C:\WINDOWS\snsys.dll
2007-11-01 05:57 12,558 ----a-w C:\WINDOWS\gstcore.dll
2007-11-01 05:50 --------- d-----w C:\Program Files\Nero
2007-11-01 04:43 --------- d-----w C:\Program Files\Realtek
2007-11-01 01:39 --------- d-----w C:\Program Files\Pidgin
2007-11-01 01:39 --------- d-----w C:\Program Files\Common Files\GTK
2007-10-31 20:51 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\Media Player Classic
2007-10-31 20:43 --------- d-----w C:\Program Files\Java
2007-10-31 20:41 --------- d-----w C:\Program Files\Common Files\Java
2007-10-31 20:26 --------- d-----w C:\Documents and Settings\All Users\Application Data\Azureus
2007-10-31 20:00 --------- d-----w C:\Documents and Settings\F.Radical\Application Data\SmartFTP
2007-10-31 19:57 --------- d-----w C:\Program Files\K-Lite Codec Pack
2007-10-31 19:06 --------- d-----w C:\Program Files\Intel
2007-10-31 19:00 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee
2007-10-31 18:56 --------- d-----w C:\Program Files\McAfee.com
2007-10-31 18:56 --------- d-----w C:\Program Files\Common Files\McAfee
2007-10-31 18:28 --------- d-----w C:\Program Files\microsoft frontpage
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11009846-ffb2-4dee-bbad-731683a4421c}]
C:\WINDOWS\system32\apjcmasw.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11AD2BFD-B688-4C92-9EA6-9A192EE98DDE}]
C:\WINDOWS\system32\pmnlm.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\SmartFTP Drop]
@={EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}

[HKEY_CLASSES_ROOT\CLSID\{EA5A76F7-8138-4B53-B0F5-ADCC730CAFBD}]
2007-10-01 22:33 406840 --a------ C:\Program Files\SmartFTP Client 2.0\sfShellTools.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 19:03]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-12-12 08:09]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2007-01-12 20:47]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2007-01-12 20:47]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2007-01-12 20:46]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]
"SkyTel"="SkyTel.EXE" [2006-05-16 05:04 C:\WINDOWS\SkyTel.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 03:58 C:\WINDOWS\RTHDCPL.exe]
"Alcmtr"="ALCMTR.EXE" [2005-05-03 05:43 C:\WINDOWS\Alcmtr.exe]
"WinampAgent"="C:\Program Files\Winamp\Winampa.exe" [2002-04-26 12:53]
"UserFaultCheck"="C:\WINDOWS\system32\dumprep 0 -u" []
"TotalRecorderScheduler"="C:\Program Files\TotalRecorder\TotRecSched.exe" [2006-05-12 01:32]
"NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 15:57]
"combofix"="C:\WINDOWS\system32\cmd.exe" [2004-08-04 07:00]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
BlackICE PC Protection.lnk - C:\Program Files\ISS\BlackICE\blackice.exe [2007-11-03 04:01:51]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 00:01:04]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"SFCDisable"=dword:00000004

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrrqq]
urqrrqq.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

R4 black;black;C:\WINDOWS\system32\drivers\BlackDrv.sys [2005-03-30 08:40]
S3 RapDrv;RapDrv;C:\WINDOWS\system32\drivers\RapDrv.sys [2003-10-24 14:57]
S3 RapFile;RapFile;C:\WINDOWS\system32\drivers\RapFile.sys [2003-02-25 17:26]
S3 RapNet;RapNet;C:\WINDOWS\system32\drivers\RapNet.sys [2003-02-25 17:26]

.
Contents of the 'Scheduled Tasks' folder
"2007-12-15 06:15:44 C:\WINDOWS\Tasks\McDefragTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe'
"2007-11-01 05:00:05 C:\WINDOWS\Tasks\McQcTask.job"
- c:\program files\mcafee\mqc\QcConsol.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-22 18:02:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-22 18:03:23 - machine was rebooted
.
2007-12-16 14:35:46 --- E O F ---

Hijack This

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:10:03 PM, on 12/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\bgsvcgen.exe
C:\Program Files\ISS\BlackICE\blackd.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Winamp\Winampa.exe
C:\Program Files\TotalRecorder\TotRecSched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\ISS\BlackICE\blackice.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\F.Radical\Desktop\F.Radicals\Pragues\HiJackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptcl.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [TotalRecorderScheduler] "C:\Program Files\TotalRecorder\TotRecSched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 -noicon
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: BlackICE PC Protection.lnk = C:\Program Files\ISS\BlackICE\blackice.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{274E2CF4-7AF7-4959-90C9-5243B000CCD4}: NameServer = 192.168.2.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{274E2CF4-7AF7-4959-90C9-5243B000CCD4}: NameServer = 192.168.2.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{274E2CF4-7AF7-4959-90C9-5243B000CCD4}: NameServer = 192.168.2.1
O20 - Winlogon Notify: urqrrqq - urqrrqq.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Ad-Aware 2007\aawservice.exe
O23 - Service: B's Recorder GOLD Library General Service (bgsvcgen) - B.H.A Corporation - C:\WINDOWS\system32\bgsvcgen.exe
O23 - Service: BlackICE - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\blackd.exe
O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe
O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe
O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: RapApp - Internet Security Systems, Inc. - C:\Program Files\ISS\BlackICE\rapapp.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\PROGRA~1\COMMON~1\SONYSH~1\AVLib\Sptisrv.exe

--
End of file - 7246 bytes

[TheBruce1]

Good job on getting Combofix to run.

--------------------

Open notepad and copy/paste the text in the quotebox below into it:

KillAll::

File::
:\WINDOWS\assys.dll
C:\WINDOWS\ffnsys.dll
C:\WINDOWS\rsczsys.dll
C:\WINDOWS\mfnsys.dll
C:\WINDOWS\uawin.dll
C:\WINDOWS\snsys.dll
C:\WINDOWS\gstcore.dll
C:\WINDOWS\system32\xnohqder.exe
C:\WINDOWS\system32\xwopqdhx.dll
C:\WINDOWS\mrofinu922.exe
C:\WINDOWS\mrofinu922.exe.tmp
C:\WINDOWS\17PHolmes922.exe
C:\WINDOWS\system32\hrvtykhh.dll
C:\WINDOWS\system32\okjjlabx.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{11009846-ffb2-4dee-bbad-731683a4421c}]