Pop-ups in Firefox/Minor system slowdown

[Everblue221]

Hello. I've been having problems with Firefox (and occasionally IE when Firefox is closed) spawning pop-ups in the last few days, after I had visited a forum which I hadn't been to since I got this computer; most of them are "anti-virus" or search engine ads which appear in a new window, though I have had a few appear in a new tab apparently listing the contents of my C:\Windows folder. They mainly trigger when navigating pages or opening/closing tabs in Firefox, but I did have one spawn almost immediately after a reboot.

As per the New Instructions thread, I am posting the DDS log and attaching the second log and GMER scan report.


DDS (Ver_09-01-07.01) - NTFSx86
Run by Compaq_Owner at 11:49:09.42 on Sat 01/17/2009
Internet Explorer: 7.0.5730.11 BrowserJavaVersion: 1.6.0_11
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.647 [GMT -6:00]

AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated)

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\windows\system\hpsysdrv.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\WINDOWS\AGRSMMSG.exe
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Common Files\AOL\1158377764\ee\aolsoftware.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\system32\ZuneBusEnum.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
K:\Doodie\SendTo\dds.com

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.com/
uDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q105&bd=presario&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
BHO: {327a5e53-b5fa-4b87-8211-821db2f91f9d} - c:\windows\system32\mlJDvTKa.dll
BHO: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\jkkKdbBq.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
BHO: Viewpoint Toolbar BHO: {a7327c09-b521-4edb-8509-7d2660c9ec98} - c:\program files\viewpoint\viewpoint toolbar\3.8.0\ViewBarBHO.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
BHO: {5b612dd6-f82b-ed69-b654-88c65792b6af}: {fa6b2975-6c88-456b-96de-b28f6dd216b5} - c:\windows\system32\zncnuz.dll
TB: Viewpoint Toolbar: {f8ad5aa5-d966-4667-9daf-2561d68b2012} - c:\program files\common files\viewpoint\toolbar runtime\3.8.0\IEViewBar.dll
TB: AVG Security Toolbar: {a057a204-bacc-4d26-9990-79a187e2698e} - c:\progra~1\avg\avg8\AVGTOO~1.DLL
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [Aim6]
uRun: [MsnMsgr] "c:\program files\msn messenger\MsnMsgr.Exe" /background
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [UpdateManager] "c:\program files\common files\sonic\update manager\sgtray.exe" /r
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [SiSPower] Rundll32.exe SiSPower.dll,ModeAgent
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe
mRun: [AGRSMMSG] AGRSMMSG.exe
mRun: [ISUSPM Startup] c:\progra~1\common~1\instal~1\update~1\ISUSPM.exe -startup
mRun: [VTTimer] VTTimer.exe
mRun: [IPHSend] c:\program files\common files\aol\iphsend\IPHSend.exe
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot
mRun: [AlcxMonitor] ALCXMNTR.EXE
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [nwiz] nwiz.exe /install
mRun: [NvMediaCenter] RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
mRun: [Zune Launcher] "c:\program files\zune\ZuneLauncher.exe"
mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
mRun: [prunnet] "c:\windows\system32\prunnet.exe"
mRun: [5478dcec] rundll32.exe "c:\windows\system32\tykkpivg.dll",b
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\dropbox.lnk - k:\doodie\program files\dropbox\Dropbox.exe
StartupFolder: c:\docume~1\compaq~1\startm~1\programs\startup\imvu.lnk - c:\program files\imvu\IMVUClient.exe
StartupFolder: c:\documents and settings\compaq_owner\start menu\programs\startup\PowerReg Scheduler V3.exe
IE: Download &Flash Movies - j:\doodie\flash\flash hunter\save.htm
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {CF819DA3-9882-4944-ADF5-6EF17ECF3C6E} - "c:\program files\fiddler2\Fiddler.exe"
IE: {d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\compaq_owner\start menu\programs\imvu\Run IMVU.lnk
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
Trusted Zone: att.net
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com\clientapps
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
Notify: igfxcui - igfxsrvc.dll
Notify: jkkKdbBq - jkkKdbBq.dll
AppInit_DLLs: avgrsstx.dll zncnuz.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: {6d794cb4-c7cd-4c6f-bfdc-9b77afbdc02c} - c:\windows\system32\jkkKdbBq.dll
LSA: Authentication Packages = msv1_0 c:\windows\system32\mlJDvTKa

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\compaq~1\applic~1\mozilla\firefox\profiles\3wsbbpwy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - component: c:\program files\avg\avg8\firefox\components\avgssff.dll
FF - component: c:\program files\avg\avg8\toolbarff\components\vmAVGConnector.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npViewpoint.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npvirtools.dll
FF - plugin: c:\program files\viewpoint\viewpoint media player\npViewpoint.dll

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-11-25 97928]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2008-11-25 26824]
R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\avg\avg8\avgemc.exe [2008-11-25 875288]
R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2008-11-25 231704]
R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-11-25 76040]
R4 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\viewpoint\common\ViewpointService.exe [2007-1-11 24652]
S3 samhid;samhid;c:\windows\system32\drivers\Samhid.sys [2008-9-23 7548]

============== File Associations ===============

regfile="regedit.exe" "%1"

=============== Created Last 30 ================

2009-01-17 11:44 410,984 a------- c:\windows\system32\deploytk.dll
2009-01-16 11:54 1,402,103 ---sh--- c:\windows\system32\gvipkkyt.ini
2009-01-16 11:54 68,096 a------- c:\windows\system32\tykkpivg.dll
2009-01-16 11:51 102,912 a------- c:\windows\system32\zncnuz.dll
2009-01-16 11:51 102,912 a------- c:\windows\system32\xtakcaww.dll
2009-01-15 11:57 1,375,226 ---sh--- c:\windows\system32\nglkcvqt.ini
2009-01-15 11:51 40,960 a------- c:\windows\system32\smhpaftd.dll
2009-01-15 07:42 <DIR> --d----- c:\docume~1\compaq~1\applic~1\Dropbox
2009-01-14 11:48 1,369,259 ---sh--- c:\windows\system32\lhlbgedv.ini
2009-01-13 11:51 1,348,813 ---sh--- c:\windows\system32\pdimqqwc.ini
2009-01-13 09:15 1,331,931 ---sh--- c:\windows\system32\xeahykyd.ini
2009-01-12 14:58 143 a------- c:\windows\system32\mcrh.tmp
2009-01-12 09:14 1,265,179 ---sh--- c:\windows\system32\kowkqmll.ini
2009-01-12 09:10 1,703,456 a--sh--- c:\windows\system32\aKTvDJlm.ini2
2009-01-12 09:10 1,703,424 a--sh--- c:\windows\system32\aKTvDJlm.ini
2009-01-12 09:10 235,008 a------- c:\windows\system32\mlJDvTKa.dll
2009-01-12 08:53 46,080 a------- c:\windows\system32\pmnKcCTm.dll
2008-12-25 13:13 <DIR> --d----- c:\program files\Audacity

==================== Find3M ====================

2008-11-25 13:11 10,520 a------- c:\windows\system32\avgrsstx.dll
2008-11-25 13:11 76,040 a------- c:\windows\system32\drivers\avgtdix.sys
2008-11-25 13:11 97,928 a------- c:\windows\system32\drivers\avgldx86.sys
2008-11-10 12:23 243,840 a------- c:\windows\system32\ZuneWlanCfgSvc.exe
2008-11-10 12:23 60,032 a------- c:\windows\system32\ZuneBusEnum.exe
2008-11-10 12:09 73,728 a------- c:\windows\system32\ZuneUsbTransport.dll
2008-11-10 12:09 18,944 a------- c:\windows\system32\ZuneTcp2Udp.dll
2008-11-10 12:09 57,344 a------- c:\windows\system32\ZuneRegUtil.dll
2008-11-10 12:09 12,800 a------- c:\windows\system32\ZunePTDNS.dll
2008-11-10 12:09 310,272 a------- c:\windows\system32\ZuneNetProxy.dll
2008-11-10 12:09 145,920 a------- c:\windows\system32\ZuneMTPZ.dll
2008-10-29 07:30 2,678 a------- c:\windows\java\packages\data\IQNTVJBD.DAT
2008-10-29 07:30 2,678 a------- c:\windows\java\packages\data\M0T313Z5.DAT
2008-10-29 07:30 2,678 a------- c:\windows\java\packages\data\AJDJJ31F.DAT
2008-10-29 07:30 2,678 a------- c:\windows\java\packages\data\5VT79NNF.DAT
2008-10-29 07:30 2,678 a------- c:\windows\java\packages\data\9RLFT337.DAT
2008-10-23 07:01 283,648 a------- c:\windows\system32\gdi32.dll
2008-08-20 14:05 2,076 a------- c:\docume~1\compaq~1\applic~1\wklnhst.dat
2007-09-25 10:26 32 a----r-- c:\documents and settings\all users\hash.dat
2007-01-31 03:20 4,270,800 a------- c:\program files\CI.EXE
2006-11-21 23:49 537,600 a------- c:\program files\ventrilo_srv-2.3.1-Windows.exe

============= FINISH: 11:51:07.92 ===============

[TheBruce1]

Hello and welcome to TSF

Please subscribe to this thread to get immediate notification of replies as soon as they are posted. To do this click Thread Tools, then click Subscribe to this Thread. Make sure it is set to Instant Notification, then click Subscribe.

========

Please follow all instructions and in which order they come, if you have any questions, please ask before proceeding. Its important that you follow this through until i give you the all clear.

Please DO NOT Attach logs to your posts unless you are advised to do so.

=========

Click > Start > Control Panel > Add / Remove Programs and uninstall the following programs:

Advertisement Service
Java(TM) 6 Update 3
Leave Java(TM) 6 Update 11 installed
Viewpoint Media Player<---Viewpoint is considered as foistware instead of malware since it is installed without users approval but doesn't spy or do anything "bad". This will change from what we know in 2006 read this article: http://www.clickz.com/news/article.php/3561546

Additional InformationHere
Viewpoint Manager<---This program is used to update the Viewpoint Media Player. This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.
Viewpoint Toolbar<---The Viewpoint Toolbar is a browser toolbar that allows you to manage your photos, search the web using the viewpoint site, make bookmarks, and block popups. This program does not do anything bad such as deliver ads or spy on you, but it is considered foistware as it is installed without your consent through programs like AOl, AIM, Compuserve, etc.

============

Please visit this webpage for download links, and instructions for running combofix:

http://www.bleepingcomputer.com/comb...o-use-combofix

* Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Please include the C:\ComboFix.txt in your next reply for further review.

Please note that the forum is very busy and if I don't hear from you within three days this thread will be closed.

[Everblue221]

Here's the file, although I had to uninstall AVG for ComboFix to work; shutting it down still left an unclosable operation running.

ComboFix 09-01-19.05 - Compaq_Owner 2009-01-20 19:18:54.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.772 [GMT -6:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
c:\documents and settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
c:\windows\Downloaded Program Files\setup.inf
c:\windows\IE4 Error Log.txt
c:\windows\system32\aKTvDJlm.ini
c:\windows\system32\aKTvDJlm.ini2
c:\windows\system32\dakppq.dll
c:\windows\system32\dcqixxmw.ini
c:\windows\system32\drivers\seneka.sys
c:\windows\system32\drivers\senekahatjvqqx.sys
c:\windows\system32\grecorder.dll
c:\windows\system32\gvipkkyt.ini
c:\windows\system32\ixnvanop.dll
c:\windows\system32\kowkqmll.ini
c:\windows\system32\lhlbgedv.ini
c:\windows\system32\mcrh.tmp
c:\windows\system32\mlJDvTKa.dll
c:\windows\system32\nglkcvqt.ini
c:\windows\system32\pdimqqwc.ini
c:\windows\system32\ponavnxi.ini
c:\windows\system32\senekajenhirwn.dll
c:\windows\system32\senekakbmyufrr.dat
c:\windows\system32\senekalog.dat
c:\windows\system32\xeahykyd.ini
c:\windows\system32\xslhvcir.dll
c:\windows\system32\xybttxxd.ini
c:\windows\Tasks\elgaadyk.job
c:\windows\Temp\tmp3.tmp
D:\Autorun.inf

----- BITS: Possible infected sites -----

hxxp://childhe.com
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_SENEKA


((((((((((((((((((((((((( Files Created from 2008-12-21 to 2009-01-21 )))))))))))))))))))))))))))))))
.

2009-01-20 18:58 . 2009-01-20 18:58 134,144 --a------ c:\windows\iwutefedahemofi.dll
2009-01-20 18:45 . 2009-01-20 18:45 41,984 --a------ c:\windows\system32\chert5-998.exe
2009-01-20 18:45 . 2009-01-20 18:45 41,984 --a------ c:\windows\Opitabu.dll
2009-01-17 12:05 . 2009-01-17 12:05 250 --a------ c:\windows\gmer.ini
2009-01-17 11:44 . 2009-01-17 11:43 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-15 11:51 . 2009-01-15 11:51 40,960 --a------ c:\windows\system32\smhpaftd.dll
2009-01-15 07:42 . 2009-01-18 11:08 <DIR> d-------- c:\documents and settings\Compaq_Owner\Application Data\Dropbox
2009-01-12 10:00 . 2009-01-12 10:00 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR
2008-12-25 13:13 . 2008-12-25 15:05 <DIR> d-------- c:\program files\Audacity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 00:58 --------- d-----w c:\documents and settings\Compaq_Owner\Application Data\AVGTOOLBAR
2009-01-21 00:27 --------- d-----w c:\program files\Viewpoint
2009-01-21 00:27 --------- d-----w c:\program files\Java
2009-01-21 00:27 --------- d-----w c:\documents and settings\Compaq_Owner\Application Data\Viewpoint
2009-01-21 00:27 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2009-01-17 17:46 --------- d-----w c:\program files\Creative
2009-01-17 17:19 --------- d-----w c:\program files\Diablo II
2009-01-17 17:18 --------- d-----w c:\program files\Image-Line
2009-01-10 15:36 --------- d-----w c:\documents and settings\Compaq_Owner\Application Data\uTorrent
2008-12-28 19:02 --------- d-----w c:\program files\Zune
2008-12-27 19:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-12 21:03 --------- d-----w c:\program files\Common Files\DirectX
2008-11-25 19:11 --------- d-----w c:\program files\AVG
2008-11-24 23:48 --------- d-----w c:\program files\Symantec
2008-11-24 23:48 --------- d-----w c:\program files\Norton Internet Security
2008-11-22 22:35 --------- d-----w c:\documents and settings\All Users\Application Data\Norton
2008-11-22 22:34 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-08-20 20:05 2,076 ----a-w c:\documents and settings\Compaq_Owner\Application Data\wklnhst.dat
2007-09-25 16:26 32 ----a-r c:\documents and settings\All Users\hash.dat
2007-01-31 09:20 4,270,800 ----a-w c:\program files\CI.EXE
2006-11-22 05:49 537,600 ----a-w c:\program files\ventrilo_srv-2.3.1-Windows.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-10-20 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-03-17 185784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 136600]
"Vhadey"="c:\windows\Opitabu.dll" [2009-01-20 41984]
"Sxogedabenudajug"="c:\windows\iwutefedahemofi.dll" [2009-01-20 134144]
"SiSPower"="SiSPower.dll" [2004-09-24 c:\windows\system32\SiSPower.dll]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"VTTimer"="VTTimer.exe" [2004-10-22 c:\windows\system32\VTTimer.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.CSCD"= camcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158377764\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158377764\\ee\\aim6.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S3 samhid;samhid;c:\windows\system32\drivers\Samhid.sys [2008-09-23 7548]
.
Contents of the 'Scheduled Tasks' folder

2008-11-09 c:\windows\Tasks\Alarm.job
- k:\doodie\My Music\Techno\Inside an Infinite Realm\02 New World.mp3 []

2009-01-10 c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Compaq_Owner.job
- c:\progra~1\NORTON~2\NORTON~1\Navw32.exe []

2009-01-20 c:\windows\Tasks\SpywareBot Scheduled Scan.job
- c:\program files\SpywareBot\SpywareBot.exe []

2009-01-20 c:\windows\Tasks\SpywareBot Scheduled Scan.job
- c:\program files\SpywareBot [2007-09-12 10:41]
.
- - - - ORPHANS REMOVED - - - -

BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\jkkKdbBq.dll
BHO-{77AB5974-55A3-4737-9FD5-B93C64307F78} - c:\windows\system32\ssevuytr.dll
BHO-{F8902447-A60E-4246-8F23-7D54411EB042} - c:\windows\system32\mlJDvTKa.dll
ShellIconOverlayIdentifiers-{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} - k:\doodie\Program Files\Dropbox\DropboxExt.dll
ShellIconOverlayIdentifiers-{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} - k:\doodie\Program Files\Dropbox\DropboxExt.dll
ShellIconOverlayIdentifiers-{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} - k:\doodie\Program Files\Dropbox\DropboxExt.dll
HKCU-Run-MsnMsgr - c:\program files\MSN Messenger\MsnMsgr.Exe
HKCU-Run-Aim6 - (no file)
HKLM-Run-PS2 - c:\windows\system32\ps2.exe
HKLM-Run-prunnet - c:\windows\system32\prunnet.exe
ShellExecuteHooks-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - c:\windows\system32\jkkKdbBq.dll
Notify-jkkKdbBq - jkkKdbBq.dll


.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
IE: Download &Flash Movies - j:\doodie\Flash\Flash Hunter\save.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Compaq_Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: *.att.net
Trusted Zone: *.sbcglobal.net
Trusted Zone: clientapps.yahoo.com
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\3wsbbpwy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-20 19:28:55
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\ZuneBusEnum.exe
c:\windows\system32\rundll32.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\AOL\1158377764\ee\aolsoftware.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Completion time: 2009-01-20 19:35:21 - machine was rebooted [Compaq_Owner]
ComboFix-quarantined-files.txt 2009-01-21 01:34:03

Pre-Run: 12,186,038,272 bytes free
Post-Run: 13,006,192,640 bytes free

197 --- E O F --- 2008-12-18 09:01:36

[TheBruce1]

Hello again

Download ATF-Cleaner by Atribune to your desktop. Do not run just yet, we will shortly

========

Open notepad and copy/paste the text in the codebox below into it:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/335831-pop-ups-firefox-minor-system-slowdown.html

Collect::
c:\windows\iwutefedahemofi.dll
c:\windows\system32\chert5-998.exe
c:\windows\Opitabu.dll
c:\windows\system32\smhpaftd.dll

File::
c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Compaq_Owner.job
c:\windows\Tasks\SpywareBot Scheduled Scan.job

Folder::
c:\program files\Viewpoint
c:\documents and settings\Compaq_Owner\Application Data\Viewpoint
c:\documents and settings\All Users\Application Data\Viewpoint
c:\documents and settings\Compaq_Owner\Application Data\uTorrent
c:\program files\Symantec
c:\program files\Norton Internet Security
c:\documents and settings\All Users\Application Data\Norton
c:\program files\Common Files\Symantec Shared

Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Vhadey"=-
"Sxogedabenudajug"=-
Trusted Zone: *.att.net
Trusted Zone: *.sbcglobal.net
Trusted Zone: clientapps.yahoo.com

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall


When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture a file to submit for analysis.

Ensure you are connected to the internet and click OK. A browser will open. Simply follow the instructions to copy/paste/send the requested file(s).


========

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you have Firefox installed:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you have Opera installed:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.
=========

Establish an internet connection & perform an online scan with Internet Explorer at Kaspersky Online Scanner

Click Accept, when prompted to download and install the program files and database of malware definitions.

• Click Run at the Security prompt.
• The program will then begin downloading and installing and will also update the database.
• Please be patient as this can take several minutes.
• Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View scan report at the bottom.
• Click the Save Report As... button.
• Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.

**Note**

This animation will guide you through the process:




To optimize scanning time and produce a more sensible report for review:

• Close any open programs.
• Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

============

Please run GMER again and post the ark.txt in your reply for further review.

============
Logs Required
C:\Combofix.txt
Kaspersky Scan Report
ark.txt

How is your system running.

[Everblue221]

Things seem to be running smoothly at the moment, for what little browsing I've been doing lately. I'm not sure if I need to post the files in the reply field, so I'm attaching them.

ComboFix 09-01-20.05 - Compaq_Owner 2009-01-21 6:41:01.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.679 [GMT -6:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point

FILE ::
c:\windows\Tasks\Norton Internet Security - Run Full System Scan - Compaq_Owner.job
c:\windows\Tasks\SpywareBot Scheduled Scan.job
.

((((((((((((((((((((((((( Files Created from 2008-12-21 to 2009-01-21 )))))))))))))))))))))))))))))))
.

2009-01-17 12:05 . 2009-01-17 12:05 250 --a------ c:\windows\gmer.ini
2009-01-17 11:44 . 2009-01-17 11:43 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-15 07:42 . 2009-01-21 06:28 <DIR> d-------- c:\documents and settings\Compaq_Owner\Application Data\Dropbox
2009-01-12 10:00 . 2009-01-12 10:00 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR
2008-12-25 13:13 . 2008-12-25 15:05 <DIR> d-------- c:\program files\Audacity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 00:58 --------- d-----w c:\documents and settings\Compaq_Owner\Application Data\AVGTOOLBAR
2009-01-21 00:27 --------- d-----w c:\program files\Java
2009-01-17 17:46 --------- d-----w c:\program files\Creative
2009-01-17 17:19 --------- d-----w c:\program files\Diablo II
2009-01-17 17:18 --------- d-----w c:\program files\Image-Line
2008-12-28 19:02 --------- d-----w c:\program files\Zune
2008-12-27 19:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-12 21:03 --------- d-----w c:\program files\Common Files\DirectX
2008-11-25 19:11 --------- d-----w c:\program files\AVG
2008-11-10 18:23 60,032 ----a-w c:\windows\system32\ZuneBusEnum.exe
2008-11-10 18:23 243,840 ----a-w c:\windows\system32\ZuneWlanCfgSvc.exe
2008-11-10 18:09 73,728 ----a-w c:\windows\system32\ZuneUsbTransport.dll
2008-11-10 18:09 57,344 ----a-w c:\windows\system32\ZuneRegUtil.dll
2008-11-10 18:09 310,272 ----a-w c:\windows\system32\ZuneNetProxy.dll
2008-11-10 18:09 18,944 ----a-w c:\windows\system32\ZuneTcp2Udp.dll
2008-11-10 18:09 145,920 ----a-w c:\windows\system32\ZuneMTPZ.dll
2008-11-10 18:09 12,800 ----a-w c:\windows\system32\ZunePTDNS.dll
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-08-20 20:05 2,076 ----a-w c:\documents and settings\Compaq_Owner\Application Data\wklnhst.dat
2007-09-25 16:26 32 ----a-r c:\documents and settings\All Users\hash.dat
2007-01-31 09:20 4,270,800 ----a-w c:\program files\CI.EXE
2006-11-22 05:49 537,600 ----a-w c:\program files\ventrilo_srv-2.3.1-Windows.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-20_19.33.06.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-12-02 21:26:30 17,593,280 ----a-w c:\windows\system32\MRT.exe
+ 2009-01-09 23:35:30 20,853,704 ----a-w c:\windows\system32\MRT.exe
+ 2009-01-21 12:28:09 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_dc.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-10-20 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-03-17 185784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 136600]
"SiSPower"="SiSPower.dll" [2004-09-24 c:\windows\system32\SiSPower.dll]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"VTTimer"="VTTimer.exe" [2004-10-22 c:\windows\system32\VTTimer.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Dropbox.lnk - k:\doodie\Program Files\Dropbox\Dropbox.exe [2008-09-26 24096981]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.CSCD"= camcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158377764\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158377764\\ee\\aim6.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S3 samhid;samhid;c:\windows\system32\drivers\Samhid.sys [2008-09-23 7548]
.
Contents of the 'Scheduled Tasks' folder

2008-11-09 c:\windows\Tasks\Alarm.job
- k:\doodie\My Music\Techno\Inside an Infinite Realm\02 New World.mp3 [2009-01-16 08:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
IE: Download &Flash Movies - j:\doodie\Flash\Flash Hunter\save.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Compaq_Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
Trusted Zone: att.net
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com\clientapps
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\3wsbbpwy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-21 06:42:31
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2009-01-21 6:45:27
ComboFix-quarantined-files.txt 2009-01-21 12:44:10
ComboFix2.txt 2009-01-21 12:35:55
ComboFix3.txt 2009-01-21 01:35:22

Pre-Run: 12,788,383,744 bytes free
Post-Run: 12,774,948,864 bytes free

138 --- E O F --- 2009-01-21 12:08:23

[TheBruce1]

Hello again

Please do not attach logs to your post unless you are advised to do so, otherwise just copy/paste the logs into your post, thanks.

=======

Locate this file:

C:\Qoobox\Quarantine\[4]-Submit_2009-01-21@6.23.zip

Upload to this website:

http://www.bleepingcomputer.com/subm....php?channel=4

Include this link into your submission:

http://www.techsupportforum.com/security-center/virus-trojan-spyware-help/335831-pop-ups-firefox-minor-system-slowdown.html

========

Open notepad and copy/paste the text in the quotebox below into it:

SkipFix::

DDS::
Trusted Zone: att.net
Trusted Zone: sbcglobal.net
Trusted Zone: yahoo.com\clientapps

Save this as CFscript







Refering to the picture above, drag CFscript into ComboFix.exe

Follow the prompts, and post the resulting log, C:\ComboFix.txt

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.


Warning:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

===========

You said that you uninstalled AVG, if this is the case you`ll need to reinstall AVG.

==========

You don't seem to have a firewall program installed. Using a firewall will allow you to give/deny access for applications that want to go online. Select one of these, or another of your choice:

• Comodo Personal Firewall
• ZoneAlarm

.


Note: If installing Comodo Firewall, be sure to uncheck/tick the box that allows Comodo antivirus to be installed.

=========

Post the Combofix.txt in your reply for further review.

[Everblue221]

Sorry about the misunderstanding. Here's the log:

ComboFix 09-01-21.02 - Compaq_Owner 2009-01-22 7:33:00.4 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1023.687 [GMT -6:00]
Running from: c:\documents and settings\Compaq_Owner\Desktop\ComboFix.exe
Command switches used :: c:\documents and settings\Compaq_Owner\Desktop\CFscript.txt
AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
* Created a new restore point
.
- REDUCED FUNCTIONALITY MODE -
.

((((((((((((((((((((((((( Files Created from 2008-12-22 to 2009-01-22 )))))))))))))))))))))))))))))))
.

2009-01-17 12:05 . 2009-01-21 15:35 250 --a------ c:\windows\gmer.ini
2009-01-17 11:44 . 2009-01-17 11:43 410,984 --a------ c:\windows\system32\deploytk.dll
2009-01-15 07:42 . 2009-01-22 07:28 <DIR> d-------- c:\documents and settings\Compaq_Owner\Application Data\Dropbox
2009-01-12 10:00 . 2009-01-12 10:00 <DIR> d-------- c:\windows\system32\config\systemprofile\Application Data\AVGTOOLBAR
2008-12-25 13:13 . 2009-01-21 16:23 <DIR> d-------- c:\program files\Audacity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-01-21 00:58 --------- d-----w c:\documents and settings\Compaq_Owner\Application Data\AVGTOOLBAR
2009-01-21 00:27 --------- d-----w c:\program files\Java
2009-01-17 17:46 --------- d-----w c:\program files\Creative
2009-01-17 17:19 --------- d-----w c:\program files\Diablo II
2009-01-17 17:18 --------- d-----w c:\program files\Image-Line
2008-12-28 19:02 --------- d-----w c:\program files\Zune
2008-12-27 19:42 --------- d--h--w c:\program files\InstallShield Installation Information
2008-12-12 21:03 --------- d-----w c:\program files\Common Files\DirectX
2008-12-11 11:57 333,184 ----a-w c:\windows\system32\drivers\srv.sys
2008-11-25 19:11 --------- d-----w c:\program files\AVG
2008-11-10 18:23 60,032 ----a-w c:\windows\system32\ZuneBusEnum.exe
2008-11-10 18:23 243,840 ----a-w c:\windows\system32\ZuneWlanCfgSvc.exe
2008-11-10 18:09 73,728 ----a-w c:\windows\system32\ZuneUsbTransport.dll
2008-11-10 18:09 57,344 ----a-w c:\windows\system32\ZuneRegUtil.dll
2008-11-10 18:09 310,272 ----a-w c:\windows\system32\ZuneNetProxy.dll
2008-11-10 18:09 18,944 ----a-w c:\windows\system32\ZuneTcp2Udp.dll
2008-11-10 18:09 145,920 ----a-w c:\windows\system32\ZuneMTPZ.dll
2008-11-10 18:09 12,800 ----a-w c:\windows\system32\ZunePTDNS.dll
2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
2008-08-20 20:05 2,076 ----a-w c:\documents and settings\Compaq_Owner\Application Data\wklnhst.dat
2007-09-25 16:26 32 ----a-r c:\documents and settings\All Users\hash.dat
2007-01-31 09:20 4,270,800 ----a-w c:\program files\CI.EXE
2006-11-22 05:49 537,600 ----a-w c:\program files\ventrilo_srv-2.3.1-Windows.exe
.

((((((((((((((((((((((((((((( snapshot@2009-01-20_19.33.06.50 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-08-28 10:04:17 333,056 -c--a-w c:\windows\system32\dllcache\srv.sys
+ 2008-12-11 11:57:21 333,184 -c--a-w c:\windows\system32\dllcache\srv.sys
- 2008-12-02 21:26:30 17,593,280 ----a-w c:\windows\system32\MRT.exe
+ 2009-01-09 23:35:30 20,853,704 ----a-w c:\windows\system32\MRT.exe
- 2007-07-27 15:41:40 16,760 ----a-w c:\windows\system32\spmsg.dll
+ 2007-11-30 12:39:22 17,272 ------w c:\windows\system32\spmsg.dll
+ 2009-01-22 09:08:21 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_6a0.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"UpdateManager"="c:\program files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 110592]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-14 233472]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2004-08-20 155648]
"LSBWatcher"="c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe" [2004-10-14 253952]
"ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-04-17 196608]
"IPHSend"="c:\program files\Common Files\AOL\IPHSend\IPHSend.exe" [2006-02-17 124520]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2004-10-20 98304]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-03-17 185784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-10-22 86016]
"Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe" [2008-11-10 157312]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-01-17 136600]
"SiSPower"="SiSPower.dll" [2004-09-24 c:\windows\system32\SiSPower.dll]
"AGRSMMSG"="AGRSMMSG.exe" [2004-06-29 c:\windows\AGRSMMSG.exe]
"VTTimer"="VTTimer.exe" [2004-10-22 c:\windows\system32\VTTimer.exe]
"AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 c:\windows\ALCXMNTR.EXE]
"nwiz"="nwiz.exe" [2006-10-22 c:\windows\system32\nwiz.exe]

c:\documents and settings\Compaq_Owner\Start Menu\Programs\Startup\
Dropbox.lnk - k:\doodie\Program Files\Dropbox\Dropbox.exe [2008-09-26 24096981]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.CSCD"= camcodec.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158377764\\ee\\aolsoftware.exe"=
"c:\\Program Files\\Common Files\\AOL\\1158377764\\ee\\aim6.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

S3 samhid;samhid;c:\windows\system32\drivers\Samhid.sys [2008-09-23 7548]
.
Contents of the 'Scheduled Tasks' folder

2008-11-09 c:\windows\Tasks\Alarm.job
- k:\doodie\My Music\Techno\Inside an Infinite Realm\02 New World.mp3 [2009-01-16 08:54]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.google.com/
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
mStart Page = hxxp://securityresponse.symantec.com/avcenter/fix_homepage
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q105&bd=presario&pf=desktop
IE: Download &Flash Movies - j:\doodie\Flash\Flash Hunter\save.htm
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{d9288080-1baa-4bc4-9cf8-a92d743db949} - c:\documents and settings\Compaq_Owner\Start Menu\Programs\IMVU\Run IMVU.lnk
DPF: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\3wsbbpwy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\program files\Mozilla Firefox\plugins\npvirtools.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-01-22 07:33:51
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************
.
Completion time: 2009-01-22 7:37:12
ComboFix-quarantined-files.txt 2009-01-22 13:35:55
ComboFix2.txt 2009-01-21 12:45:28
ComboFix3.txt 2009-01-21 12:35:55
ComboFix4.txt 2009-01-21 01:35:22

Pre-Run: 12,660,539,392 bytes free
Post-Run: 12,705,640,448 bytes free

140 --- E O F --- 2009-01-22 09:01:32

[TheBruce1]

Hello again

File uploaded successfully, thank you.

Did you install a firewall, i see no evidence of one from the Combofix log. Be aware that windows firewall Only offers inbound protection... so any malicious programme that wants to use your system for illegal activity(or send you`re personal information back to their servers), will not be stopped.

========

If there are no further issues, continue below.

========

Delete DDS from your desktop.

Click Start>Run and type or copy/paste the following command then hit enter to uninstall gmer.

%systemroot%\gmer_uninstall.cmd

You can keep ATF-Cleaner if you wish, otherwise delete from desktop.

=========

Well done, your logs are clean.

Click start>run>type(or copy/paste command into run box):

ComboFix /u

Click ok.

=========

Clear IE7 cookies

*On the Internet Explorer 7 Tools menu, click Internet Options. The Internet Options box should open to the General tab.
*On the General tab, in the Browsing History, click the Delete button. This will delete all the files that are currently stored in your cache [that includes cookies too].
*Click OK, and then click OK again.


Clear Firefox cookies/cache

• Select "Tools"
• Select "Options".
• Select "Privacy".
• In "Settings" window put the check mark for Cookies,Cache,Browsing history and any others you want.
• Click OK.
• In Private area click "Clear Now".

-------------------------------------------------------------------------------------------

MICROSOFT UPDATES

1.Click Start,Run, type sysdm.cpl, and then press OK.
2.Click the Automatic Updates tab, and then click to select one of the following options. We recommend that you select the Automatic (recommended).

Microsoft updates are released every second Tuesday of each month,what is called "Patch Tuesday".

------------------------------------------------------------------------------------------

Useful Information and Programs to keep you safe.

TrendProtect is a FREE browser plug-in that helps you avoid Web pages with unwanted content and hidden threats. TrendProtect rates the current page and pages listed in Google, MSN, and Yahoo search results. You can use the rating to decide if you want to visit or avoid a given Web page. To rate Web pages, TrendProtect refers to an extensive database that covers the following information for billions of Web pages:

* Content category
* Phishing scam detection
* Site reputation
* Page reputation

WOT Free helps you avoid disingenuous Internet content by allowing you to learn from others' experiences. WOT shows you website reputations on your browser, telling you how much other users trust a website. This helps you make better decisions while browsing and avoid phishing, malware, and other types of fraud. Reputations can also be added to web search results, Gmail, Wikipedia, and other selected sites.

WOT reputations are computed mainly from user testimonies. Sharing your knowledge with others is just a click away, without ever having to leave the site. We also collect data from hundreds of other sources (including PhishTank) to quickly warn you of emerging threats. Currently, WOT knows over 12 million websites.
Note:Only compatible with Firefox 1.5 and higher.

--------------------------------------------------------------------------------------

Alternate Browsers
Try the following free alternate browsers rather than Internet Explorer
Avant
Firefox
Opera
K-Meleon

------------------------------------------------------------------------------------------

Free Antispyware Products
SuperAntiSpyware
Malwarebytes ' Anti-Malware

SpywareBlaster to help prevent spyware from installing in the first place.

• Install & update SpywareBlaster with the latest definitions.
  After you have updated, click the button - enable protection for all unprotected items

------------------------------------------------------------------

The MVPS Hosts file replaces your current HOSTS file with one that will restrict known ad sites from serving you unsolicited advertisements. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is the IP of your local computer. Note that if you use a company provided HOSTS file you should not use the MVPS HOSTS file.

If your having trouble downloading & extracting,see link below for guidance:
http://www.mvps.org/winhelp2002/hosts2.htm

Once you have extracted the host file,double click on it and a new window will open.

Double-click on mvps.batand follow the prompts

---------------------------------------------------------------

Winpatrol - Download and install the free version of Winpatrol. A tutorial for this product is located here:
Using Winpatrol to protect your computer.

----------------------------------------

SnoopFree is a programme that informs you when another programme is wanting to log your keystrokes or read your screen.Only for XP users.

Update all these programs regularly. Without regular updates you will not be protected when new malicious programs are released.

==============================================

Secunia PSI is a programme that will alert you to vulnerabilities and outdated programs you have installed, such as Java, Flash Player and many more.

It can also alert you if you have not installed the latest patches from Microsoft.

==============================================

Also, please take a look at this well written article:

PC Safety and Security--What Do I Need?

**Be very wary with any security software that is advertised in popups or in other ways. They are not only usually of no use, but often have malware in them.

Please reply to this thread once more, as we may mark this as resolved, thanks.

[Everblue221]

Done and done, reinstalled AVG and put in ZoneAlarm, added in the suggested progams. Everything seems to be back in full working order. Thank you very much!

[TheBruce1]

You`re welcome, surf safely