Infected with Virtumonde; keeps coming back

[heavyjavadrinker]

My computer became infected with Virtumonde, Virtumonde.generic, and Virtumonde.ddc about a week ago. Everytime i scan with spybot, one are all of them shows up again. I have updated my Java to the most current version.

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2007-12-01 16:43
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 1/12/2007
Kaspersky Anti-Virus database records: 469906
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
A:\
C:\
D:\
E:\

Scan Statistics:
Total number of scanned objects: 60014
Number of viruses found: 15
Number of infected objects: 35
Number of suspicious objects: 2
Duration of the scan process: 00:49:39

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip/v1.8.6/wbuninst.exe Suspicious: Password-protected-EXE skipped
C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\WebBuyingAssistant.zip ZIP: suspicious - 1 skipped
C:\Documents and Settings\All Users\Application Data\SupportSoft\ddoctorv2\SYSTEM\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\coffee trader\Application Data\Sun\Java\Deployment\cache\6.0\57\364044f9-290163c0/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\coffee trader\Application Data\Sun\Java\Deployment\cache\6.0\57\364044f9-290163c0 ZIP: infected - 1 skipped
C:\Documents and Settings\coffee trader\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0d96-22e147e9.zip/vlocal.class Infected: Trojan-Downloader.Java.Agent.f skipped
C:\Documents and Settings\coffee trader\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmsecman.jar-69ee0d96-22e147e9.zip ZIP: infected - 1 skipped
C:\Documents and Settings\coffee trader\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\coffee trader\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\coffee trader\Desktop\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\coffee trader\Desktop\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\coffee trader\Desktop\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\coffee trader\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\Application Data\SupportSoft\ddoctorv2\coffee trader\state\logs\sprtcmd.log Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\History\History.IE5\MSHist012007120120071202\index.dat Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\Temporary Internet Files\Content.IE5\007MO15T\hctp[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\Documents and Settings\coffee trader\Local Settings\Temporary Internet Files\Content.IE5\2JD8LRY9\poiu[1] Infected: Trojan-Downloader.Win32.Tiny.id skipped
C:\Documents and Settings\coffee trader\Local Settings\Temporary Internet Files\Content.IE5\2JD8LRY9\upd32_v14[1] Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\Documents and Settings\coffee trader\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\coffee trader\Local Settings\Temporary Internet Files\Content.IE5\TZD08V97\pochki20071106[1] Infected: Trojan.Win32.Obfuscated.kp skipped
C:\Documents and Settings\coffee trader\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\coffee trader\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\INDEX.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\qoobox\Quarantine\catchme2007-11-30_ 40337.03.zip/pmnll.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aza skipped
C:\qoobox\Quarantine\catchme2007-11-30_ 40337.03.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\A0089996.exe Infected: not-a-virus:AdWare.Win32.Agent.co skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\A0090020.dll Infected: Trojan-Downloader.Win32.Small.gkh skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\A0090023.dll Infected: Trojan-Downloader.Win32.Small.gkh skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\A0090089.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.a skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP322\A0090089.exe NSIS: infected - 1 skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP324\A0094444.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP324\A0094543.exe Infected: Trojan-Downloader.Win32.VB.bvj skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP325\A0094743.exe Infected: Trojan.Win32.Obfuscated.kp skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP327\A0094892.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP329\A0094924.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aza skipped
C:\System Volume Information\_restore{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP332\change.log Object is locked skipped
C:\VundoFix Backups\ovjtqddm.dll.bad Infected: not-a-virus:AdWare.Win32.SecToolBar.k skipped
C:\VundoFix Backups\qomjggd.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.apx skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\df87173.exe Infected: Trojan-Clicker.Win32.VB.vx skipped
C:\WINDOWS\hg173.exe Infected: Trojan-Clicker.Win32.VB.vx skipped
C:\WINDOWS\io43mvuiw4kj.exe Infected: Trojan-Clicker.Win32.VB.vx skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\SYSTEM32\asacpqfu.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\CONFIG\Antivirus.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\kyhjkney.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\pmnll.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aza skipped
C:\WINDOWS\SYSTEM32\qomjggd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.apx skipped
C:\WINDOWS\SYSTEM32\rMa02yy\rMa02yy1099.exe Infected: Trojan-Downloader.Win32.VB.bto skipped
C:\WINDOWS\SYSTEM32\vnstaxpm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_5b8.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\WIADEBUG.LOG Object is locked skipped
C:\WINDOWS\WIASERVC.LOG Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[heavyjavadrinker]

here are the hijackthis results:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:19, on 2007-12-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
O3 - Toolbar: ZeroBar - {F0F8ECBE-D460-4B34-B007-56A92E8F84A7} - C:\Program Files\NetZero\Toolbar.dll
O4 - HKLM\..\Run: [ddoctorv2] "C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe" /P ddoctorv2
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Display All Images with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/228
O8 - Extra context menu item: Display Image with Full Quality - res://C:\Program Files\NetZero\qsacc\appres.dll/227
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\coffee trader\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra 'Tools' menuitem: Absolute Poker - {13C1DBF6-7535-495c-91F6-8C13714ED485} - C:\Documents and Settings\coffee trader\Start Menu\Programs\Absolute Poker\Absolute Poker.lnk
O9 - Extra button: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: EmpirePoker - {77E68763-4284-41d6-B7E7-B6E1F053A9E7} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - C:\Program Files\UltimateBet\UltimateBet.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {4C39376E-FA9D-4349-BACC-D305C1750EF3} (EPUImageControl Class) - http://tools.ebayimg.com/eps/wl/activex/EPUWALControl_v1-0-3-18.cab
O18 - Protocol: bw+0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw+0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw-0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw-0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw00 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw00s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw10 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw10s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw20 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw20s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw30 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw30s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw40 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw40s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw50 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw50s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw60 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw60s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw70 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw70s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw80 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw80s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw90 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bw90s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwa0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwa0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwb0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwb0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwc0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwc0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwd0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwd0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwe0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwe0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwf0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwf0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - (no file)
O18 - Protocol: bwg0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwg0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwh0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwh0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwi0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwi0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwj0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwj0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwk0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwk0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwl0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwl0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwm0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwm0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwn0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwn0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwo0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwo0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwp0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwp0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwq0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwq0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwr0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwr0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bws0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bws0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwt0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwt0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwu0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwu0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwv0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwv0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bww0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bww0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwx0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwx0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwy0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwy0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwz0 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: bwz0s - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: offline-8876480 - {2BC4DC2D-7643-4FEE-9183-69FB3CE4922B} - (no file)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Logitech Process Monitor (LVPrcSrv) - Logitech Inc. - c:\program files\common files\logitech\lvmvfm\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\Logitech\SrvLnch\SrvLnch.exe
O23 - Service: Macromedia Licensing Service - Unknown owner - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: SupportSoft Sprocket Service (ddoctorv2) (sprtsvc_ddoctorv2) - SupportSoft, Inc. - C:\Program Files\Comcast\Desktop Doctor\bin\sprtsvc.exe

--
End of file - 11929 bytes

[heavyjavadrinker]

i tried running superantispyware following the instructions in another thread, but i could not run the complete scan. After 3 tries it kept freezing on the same file and using all of my virtual memory. I did a quick scan instead. Here are the log results:

SUPERAntiSpyware Scan Log
http://www.superantispyware.com

Generated 12/02/2007 at 02:58 AM

Application Version : 3.9.1008

Core Rules Database Version : 3353
Trace Rules Database Version: 1352

Scan type : Quick Scan
Total Scan Time : 00:44:05

Memory items scanned : 360
Memory threats detected : 1
Registry items scanned : 1067
Registry threats detected : 13
File items scanned : 25589
File threats detected : 19

Trojan.WinFixer
C:\WINDOWS\SYSTEM32\PMNLL.DLL
C:\WINDOWS\SYSTEM32\PMNLL.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8AA5D78F-5ECD-451E-B53C-C3B41F5CBD8F}
HKCR\CLSID\{8AA5D78F-5ECD-451E-B53C-C3B41F5CBD8F}
HKCR\CLSID\{8AA5D78F-5ECD-451E-B53C-C3B41F5CBD8F}\InprocServer32
HKCR\CLSID\{8AA5D78F-5ECD-451E-B53C-C3B41F5CBD8F}\InprocServer32#ThreadingModel

Unclassified.Unknown Origin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{081c8549-24f7-406c-874d-6431f09cdc93}
HKCR\CLSID\{081C8549-24F7-406C-874D-6431F09CDC93}
HKCR\CLSID\{081C8549-24F7-406C-874D-6431F09CDC93}\InprocServer32
HKCR\CLSID\{081C8549-24F7-406C-874D-6431F09CDC93}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\QFAFGJR.DLL
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\QFAFGJR.DLL.VIR

Adware.Vundo-Variant/Small-A
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{807c1a33-9111-4f57-902f-7ca2979dcba6}
HKCR\CLSID\{807C1A33-9111-4F57-902F-7CA2979DCBA6}
HKCR\CLSID\{807C1A33-9111-4F57-902F-7CA2979DCBA6}\InprocServer32
HKCR\CLSID\{807C1A33-9111-4F57-902F-7CA2979DCBA6}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\EVWEUSXB.DLL
C:\WINDOWS\SYSTEM32\ASACPQFU.DLL
C:\WINDOWS\SYSTEM32\KYHJKNEY.DLL
C:\WINDOWS\SYSTEM32\MVSUOBSK.DLL
C:\WINDOWS\SYSTEM32\OPWNIIXP.DLL
C:\WINDOWS\SYSTEM32\VNSTAXPM.DLL
C:\WINDOWS\SYSTEM32\YIEHRBGN.DLL

Adware.Tracking Cookie
C:\Documents and Settings\coffee trader\Cookies\coffee_trader@atwola[2].txt

Adware.Web Buying
HKU\S-1-5-21-2745935024-4284577030-3385992209-1006\Software\WebBuying

Trojan.Downloader-Gen/TaLDrv
C:\QOOBOX\QUARANTINE\C\WINDOWS\SYSTEM32\M8\NSTS2DLL1.EXE.VIR
C:\WINDOWS\SYSTEM32\M8\NSTS2DLL1.EXE

Adware.Vundo Variant
C:\VUNDOFIX BACKUPS\QOMJGGD.DLL.BAD
C:\WINDOWS\SYSTEM32\QOMJGGD.DLL

Adware.AdHost/DR
C:\WINDOWS\DF87173.EXE
C:\WINDOWS\IO43MVUIW4KJ.EXE

Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\LLNMP.INI

Trojan.Downloader-Gen/BundleBase
C:\WINDOWS\SYSTEM32\RMA02YY\RMA02YY1099.EXE

[heavyjavadrinker]

and finally i have run the combofix and produced this log.

i appreciate any help anyone can give. i think it would just be easier to reformat this computer. ive never seen a virus this bad. and it seemed to have happened after i downloaded spybot from cnet/download.com. :sad: thanks again.

ComboFix 07-11-19.4C - coffee trader 2007-12-02 3:31:50.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.97 [GMT -5:00]
Running from: C:\Documents and Settings\coffee trader\Desktop\ComboFix.exe
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\c1
C:\WINDOWS\system32\d1
C:\WINDOWS\system32\j2
C:\WINDOWS\system32\llnmp.ini
C:\WINDOWS\SYSTEM32\llnmp.ini2
C:\WINDOWS\system32\m8
C:\WINDOWS\system32\pmnll.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_CORE
-------\LEGACY_DOMAINSERVICE


((((((((((((((((((((((((( Files Created from 2007-11-02 to 2007-12-02 )))))))))))))))))))))))))))))))
.

2007-12-01 21:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-12-01 21:05 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-12-01 21:05 <DIR> d-------- C:\Documents and Settings\coffee trader\Application Data\SUPERAntiSpyware.com
2007-12-01 20:21 <DIR> d-------- C:\Program Files\Paint.NET
2007-12-01 19:55 <DIR> d-------- C:\Program Files\Lavasoft
2007-12-01 19:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-01 19:53 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-12-01 19:40 <DIR> d-------- C:\Program Files\MSXML 6.0
2007-12-01 19:28 <DIR> d-------- C:\Program Files\MSBuild
2007-12-01 19:18 <DIR> d-------- C:\Program Files\Reference Assemblies
2007-12-01 18:18 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-01 15:13 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sonic
2007-12-01 15:13 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Jasc Software Inc
2007-12-01 14:14 <DIR> d-------- C:\WINDOWS\SYSTEM32\Kaspersky Lab
2007-12-01 14:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-12-01 06:58 354 --ahs---- C:\WINDOWS\SYSTEM32\ufqpcasa.ini
2007-11-30 03:47 <DIR> d-------- C:\Program Files\Java
2007-11-30 03:47 <DIR> d-------- C:\Program Files\Common Files\Java
2007-11-30 02:29 594 --ahs---- C:\WINDOWS\SYSTEM32\yenkjhyk.ini
2007-11-28 13:33 <DIR> d-------- C:\Documents and Settings\coffee trader\Application Data\Brother
2007-11-28 12:52 <DIR> d-------- C:\Program Files\Safer Networking
2007-11-28 01:55 24,576 --a------ C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
2007-11-28 01:40 <DIR> d-------- C:\VundoFix Backups
2007-11-27 01:09 4,318 --a------ C:\WINDOWS\SYSTEM32\tmp.reg
2007-11-27 01:08 289,144 --a------ C:\WINDOWS\SYSTEM32\VCCLSID.exe
2007-11-27 01:08 25,600 --a------ C:\WINDOWS\SYSTEM32\WS2Fix.exe
2007-11-26 15:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-26 14:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2007-11-26 14:31 <DIR> d-------- C:\Temp\abW9
2007-11-18 17:45 <DIR> d-------- C:\Program Files\DellSupport
2007-11-05 18:44 <DIR> d-------- C:\Program Files\iPod
2007-11-05 18:34 30,464 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbaapl.sys
2007-11-05 18:13 <DIR> d-------- C:\Program Files\Apple Software Update
2007-11-04 00:35 23,152 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswRdr.sys
2007-11-04 00:34 <DIR> d-------- C:\Program Files\Alwil Software
2007-11-04 00:34 815,480 --a------ C:\WINDOWS\SYSTEM32\aswBoot.exe
2007-11-04 00:34 380,928 --a------ C:\WINDOWS\SYSTEM32\actskin4.ocx
2007-11-04 00:34 95,608 --a------ C:\WINDOWS\SYSTEM32\AvastSS.scr
2007-11-04 00:34 94,416 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon2.sys
2007-11-04 00:34 93,264 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswmon.sys
2007-11-04 00:34 42,912 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aswTdi.sys
2007-11-04 00:34 26,624 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\aavmker4.sys

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-02 01:20 --------- d-----w C:\Program Files\SpywareBlaster
2007-11-28 06:23 --------- d-----w C:\Documents and Settings\coffee trader\Application Data\Skype
2007-11-27 03:13 --------- d-----w C:\Program Files\PokerStars
2007-11-27 03:13 --------- d-----w C:\Program Files\Absolute Poker
2007-11-26 19:00 --------- d-----w C:\Program Files\iTunes
2007-11-18 22:56 --------- d--h--w C:\Documents and Settings\coffee trader\Application Data\Gtek
2007-11-18 22:40 --------- d--h--r C:\Documents and Settings\coffee trader\Application Data\yahoo!
2007-11-14 10:22 --------- d-----w C:\Program Files\Full Tilt Poker
2007-11-08 01:21 --------- d-----w C:\Documents and Settings\coffee trader\Application Data\Apple Computer
2007-11-05 23:37 --------- d-----w C:\Program Files\QuickTime
2007-11-04 05:37 --------- d-----w C:\Program Files\Dell
2007-10-31 05:05 --------- d-----w C:\Program Files\McAfee.com
2007-10-31 04:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\McAfee.com
2007-10-27 04:06 --------- d-----w C:\Program Files\Common Files\Apple
2007-10-27 04:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple
2007-10-17 05:22 --------- d-----w C:\Documents and Settings\coffee trader\Application Data\McAfee.com Personal Firewall
2007-09-12 18:52 53,248 ----a-w C:\WINDOWS\hg173.exe
2005-05-24 04:45 38,728 -c--a-w C:\Documents and Settings\coffee trader\Application Data\GDIPFONTCACHEV1.DAT
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{28BF5BFB-0950-4C53-A39F-532B73EE7C59}]
C:\Program Files\Internet Explorer\hokeqoC:\WINDOWS\system32\j2\ppjup83122.exe.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8355017-E96C-4264-A7AD-38F897D7D96F}]
C:\Program Files\Internet Explorer\hokeqoC:\DOCUME~1\COFFEE~1\LOCALS~1\Temp\CEMG555077.exe.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-10-25 11:20]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 01:11]

[hklm\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dmycwmig]
dmycwmig.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
"Authentication Packages"= msv1_0 C:\WINDOWS\system32\pmnll.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk]
backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^coffee trader^Start Menu^Programs^Startup^Cool - Auto Update.lnk]
backup=C:\WINDOWS\pss\Cool - Auto Update.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^coffee trader^Start Menu^Programs^Startup^TA_Start.lnk]
backup=C:\WINDOWS\pss\TA_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\a8b0c565]
rundll32.exe C:\WINDOWS\system32\asacpqfu.dll,b

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
2004-08-04 06:00 15360 --a--c--- C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ddoctorv2]
C:\Program Files\Comcast\Desktop Doctor\bin\sprtcmd.exe /P ddoctorv2

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla]
2004-08-13 02:05 122939 --a------ C:\WINDOWS\system32\dla\tfswctrl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher]
2004-08-23 19:19 57344 -----c--- C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
2005-09-20 08:32 77824 --a------ C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxhkcmd]
2005-09-20 08:32 77824 --a------ C:\WINDOWS\system32\hkcmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\igfxpers]
2005-09-20 08:36 114688 --a------ C:\WINDOWS\system32\igfxpers.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
2005-09-20 08:35 94208 --a------ C:\WINDOWS\system32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelMeM]
2003-09-03 21:12 221184 --a------ C:\Program Files\Intel\Modem Event Monitor\IntelMEM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\io43mvuiw4kj]
C:\WINDOWS\io43mvuiw4kj.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
2007-11-02 18:36 267048 --a------ C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\McAgent.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
C:\PROGRA~1\mcafee.com\agent\McUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\mmtask]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ModemOnHold]
2003-11-17 11:10 86016 --a------ C:\PROGRA~1\MODEMO~1\moh.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCMService]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe /nosplash /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
2007-08-31 16:46 1460560 --a------ C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
2007-06-21 14:06 1318912 --a------ C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe /r

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VirusScan Online]
c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VSOCheckTask]
c:\PROGRA~1\mcafee.com\vso\mcmnhdlr.exe /checktask

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WebBuying]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\{0C-C5-5C-CA-ZN}]

S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-11-29 04:38:08 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-02 03:39:28
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-02 3:41:37 - machine was rebooted
C:\ComboFix2.txt ... 2007-11-30 04:06
.
--- E O F ---


Edit: http://forums.spybot.info/showthread.php?t=20985