Can Only Access Internet In Safe Mode

[BlackBike]

On my son's computer, we are no longer able to access the Internet through either IE7, IE8, or FireFox. However, we can access the internet in Windows XP Safe Mode with Networking.
I have gone through all the steps in the Microsoft Support article KB 926431 and KB 811259.
The Linksys wireless connection we have works just fine. In fact, before I went through all the steps in KB 926431, I was able to use the Restore function to go back to a point where I could access the browser normally. The problem seems to be centered on the most recent Microsoft Updates. Unfortunately, all my old Restore points are gone, and I have been unable to delete the Windows XP Service Pack 3 and then IE7.
My research suggested that MalWare may be the problem. Therefore, I have used HijackThis and provide this log in hopes that someone will be able to help me resolve this issue. Thanks in advance for any help you can provide.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:07:59 AM, on 2/22/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Safe mode with network support

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.yahoo.com/search/ie.html
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - C:\PROGRA~1\AVG\AVG8\AVGTOO~1.DLL
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: Microsoft Outlook.lnk = C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Startup: YPOPs.lnk = ?
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/actives.../as2stubie.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

--
End of file - 6372 bytes

[Blade81]

Hi

Download DDS and save it to your desktop from here or here or here.
Disable any script blocker, and then double click dds.scr to run the tool.

• When done, DDS will open two (2) logs:
  1. DDS.txt
  2. Attach.txt
• Save both reports to your desktop. Post them back to your topic.

[BlackBike]

Thank You Blade,
Sorry for the late response. I was away for a couple of days. I also have to appoligize if I changed something important. I don't know what script blockers are, so to be sure, I uninstalled my son's AntiVirus protection (AVG Free) and the two spyware protections (Spybot and AdAware). I figured it can't do any harm since we can't access the internet on his computer (except when the computer is in Safe Mode).

Anyway, as instructed I have posted the DDS text file and the Attach file. I realize the instructions said to attach a zipped version of the "Attach" file, but I don't see how to do that. Anyway, it is a very short file, so I hope it is OK if I just include it with my post.

Thank you for your help and attention to this problem. I look forward to your reply.

DDS File Results:

DDS (Ver_09-02-01.01) - NTFSx86
Run by Dillon at 18:03:17.50 on Thu 02/26/2009
Internet Explorer: 8.0.6001.18372
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.253 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
G:\dds.com

============== Pseudo HJT Report ===============

uSearch Bar = hxxp://www.yahoo.com/search/ie.html
mWinlogon: Userinit=c:\windows\system32\userinit.exe
BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {430DDB4F-38CC-4E91-AF33-4157334EC937} - No File
TB: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
uRun: [DriverMax]
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [OneTouch Monitor] c:\program files\visioneer onetouch\OneTouchMon.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\dillon\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OUTLOOK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\callwave.lnk - c:\program files\callwave\IAM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\MSOFFICE.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} - hxxp://usfulfillment.puretracks.com/onager.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-3 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-5-27 17376]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]

=============== Created Last 30 ================

2009-02-25 19:31 8,074 a------- c:\windows\extend.dat
2009-02-25 19:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avg8
2009-02-25 18:47 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 <DIR> --d----- c:\program files\Trend Micro
2009-02-21 23:52 <DIR> --d----- c:\program files\Innovative Solutions
2009-02-21 23:15 <DIR> --d----- c:\program files\Eusing Free Registry Cleaner
2009-02-21 22:59 16,384 a------t c:\temp\Perflib_Perfdata_344.dat
2009-02-21 17:29 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-21 17:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-21 17:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:26 <DIR> --d----- c:\temp\WPDNSE
2009-02-21 16:59 <DIR> -cdsh--- c:\documents and settings\dillon\IECompatCache
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\PrivacIE
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\IETldCache
2009-02-21 16:50 <DIR> --d----- c:\windows\ie8updates
2009-02-21 16:45 <DIR> -cd-h--- c:\windows\ie8
2009-02-21 16:41 79,360 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-21 13:26 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-20 22:31 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-20 20:10 <DIR> --d----- c:\program files\Mozilla Firefox(2)

==================== Find3M ====================

2009-01-15 02:05 911,872 a------- c:\windows\system32\wininet.dll
2009-01-15 02:05 43,008 a------- c:\windows\system32\licmgr10.dll
2009-01-15 02:04 18,944 a------- c:\windows\system32\corpol.dll
2009-01-15 02:03 420,352 a------- c:\windows\system32\vbscript.dll
2009-01-15 02:03 72,704 a------- c:\windows\system32\admparse.dll
2009-01-15 02:03 71,680 a------- c:\windows\system32\iesetup.dll
2009-01-15 02:01 34,304 a------- c:\windows\system32\imgutil.dll
2009-01-15 02:00 48,128 a------- c:\windows\system32\mshtmler.dll
2009-01-15 02:00 45,568 a------- c:\windows\system32\mshta.exe
2009-01-15 01:50 156,160 a------- c:\windows\system32\msls31.dll
2009-01-05 21:39 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-01-02 11:38 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2007-09-11 21:33 5,471,581 ac------ c:\program files\acstudio.exe
2007-08-17 20:16 3,580 ac------ c:\program files\INSTALL.LOG
2003-08-29 13:12 61,440 ac------ c:\windows\inf\i386\Viz7300.dll
2003-08-29 13:12 17,376 ac------ c:\windows\inf\i386\Gt680x.sys
2001-09-28 17:00 164,864 a------- c:\program files\UNWISE.EXE

============= FINISH: 18:03:59.29 ===============


Attach File Results:

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/22/2005 9:29:24 PM
System Uptime: 2/26/2009 6:00:18 PM (0 hours ago)

Motherboard: | | K7VT4APro
Processor: AMD Athlon(tm) XP 2200+ | Socket-A | 1798/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 8.266 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 97.644 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is FIXED (FAT32) - 4 GiB total, 0.76 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 2/21/2009 9:23:54 PM - System Checkpoint
RP2: 2/21/2009 9:55:07 PM - Software Distribution Service 3.0
RP3: 2/25/2009 6:59:49 PM - Software Distribution Service 3.0
RP4: 2/25/2009 7:20:33 PM - Removed AVG Free 8.0
RP5: 2/25/2009 7:28:31 PM - Removed AVG Free 8.0
RP6: 2/25/2009 7:29:36 PM - Installed AVG Free 8.0

==== Installed Programs ======================

Acoustica Effects Pack
Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
Before You Know It 3.6 Lite
Berlitz
C-Media WDM Audio Driver
CallWave
DriverMax 4
Eusing Free Registry Cleaner
Free DVD Decrypter version 1.2
GrammarPro
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Intel(R) 536EP Modem
InterActual Player
IrfanView (remove only)
LanguageNow!
LimeWire 4.16.6
Linksys Wireless-G PCI Network Adapter with SpeedBooster
MAGIX music maker 11 demo (US)
Malwarebytes' Anti-Malware
MaxSplitter v1.53 Free Edition
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 97, Professional Edition
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
Musicmatch® Jukebox
MySpaceIM
Nero Suite
NVIDIA Drivers
PaperPort 8.0 SE
PowerDVD
Quicken 2007
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
Simple File Shredder 2.4
Starcraft
Text-To-Speech-Runtime
Text Thru Time Screensaver
TrustWatch Toolbar
Uninstall 1.0.0.0
Update for Windows Internet Explorer 8 (KB961813)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB958752)
Update for Windows XP (KB967715)
URGE
VC 9.0 Runtime
Visioneer OneTouch 7300
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Warcraft III: All Products
WD Diagnostics
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8 Release Candidate 1
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
World of Warcraft
Yahoo! Music Jukebox

==== Event Viewer Messages From Past Week ========

2/21/2009 2:21:30 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/21/2009 2:19:52 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 AvgLdx86 AvgMfx86 eeCtrl Fips pavboot SYMTDI
2/19/2009 8:50:04 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.101. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.
2/21/2009 5:05:35 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/21/2009 9:04:35 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.
2/21/2009 9:24:02 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
2/22/2009 12:08:09 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/25/2009 7:18:08 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
2/26/2009 6:01:16 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 0012179DD8F8 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
2/26/2009 6:02:25 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.102. The machine with the IP address 192.168.1.101 did not allow the name to be claimed by this machine.

==== End Of File ===========================

[Blade81]

Hi again,

IMPORTANT I notice there are signs of one or more P2P (Peer to Peer) File Sharing Programs on your computer.

Limewire


I'd like you to read this thread.

Please go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red).

Delete these folders afterwards:

C:\Program Files\LimeWire

Empty Recycle Bin.

After that:


Please visit this webpage for download links, and instructions for running ComboFix tool:

http://www.bleepingcomputer.com/comb...o-use-combofix

Please ensure you read this guide carefully and install the Recovery Console first.

The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

Once installed, you should see a blue screen prompt that says:

The Recovery Console was successfully installed.

Please continue as follows:

1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix, link
   Remember to re-enable them afterwards.
   
   
2. Click Yes to allow ComboFix to continue scanning for malware.

When the tool is finished, it will produce a report for you.

Please include the following reports for further review, and so we may continue cleansing the system:

C:\ComboFix.txt
New dds.txt log.

A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix. This tool is not a toy and not for everyday use.

[BlackBike]

Thanks For Continuing To Help,

Here is what I've done:
Attempted to delete Limewire, but it was not present in Control Panel nor in the C:\Program Files.
Ran ComboFix once, only to discover that I had to have an internet connection to install the Recovery Console. I saved the reports.
Downloaded the Windows XP Home Edition with Service Pack 2 Utility and moved that icon over the ComboFix icon, as directed. ComboFix started on its own. I saved the reports after it was finished.
I wasn't sure if you wanted me to run DDS again, so I did. I noticed that Limeware was still showing as being on the computer.
After searching a bit, I found a site (http://www.spywaredb.com/remove-limewire/) that showed me how to find the two entries in my Registry where LimeWare was located. I deleted both of those entries, and rebooted the computer.
I ran ComboFix for the third time, and saved those reports. I have included both of them below.
I wanted to make sure that LimeWare was gone, so I ran DDS again. There is no mention of LimeWire anymore.

I have saved all the reports from each time I ran a program. So, if you need me to send something else, I can. However, I think you just wanted the results of ComboFix after it completed without any LimeWire. That is what is below. Thanks again for your help. I look forward to your reply.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
ComboFix 09-02-28.01 - Dillon 2009-02-28 18:20:17.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.285 [GMT -7:00]
Running from: c:\documents and settings\Dillon\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 )))))))))))))))))))))))))))))))
.

2009-02-25 19:31 . 2009-02-25 19:31 8,074 --a------ c:\windows\extend.dat
2009-02-25 19:29 . 2009-02-25 19:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Avg8
2009-02-25 18:47 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 . 2009-02-21 23:58 <DIR> d-------- c:\program files\Trend Micro
2009-02-21 23:52 . 2009-02-21 23:52 <DIR> d-------- c:\program files\Innovative Solutions
2009-02-21 23:15 . 2009-02-21 23:15 <DIR> d-------- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:30 . 2009-02-21 17:30 <DIR> d----c--- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-21 17:30 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:29 . 2009-02-21 17:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-21 17:28 . 2009-02-21 17:28 <DIR> d--hsc--- c:\documents and settings\Mike\PrivacIE
2009-02-21 17:27 . 2009-02-21 17:27 <DIR> d--hsc--- c:\documents and settings\Mike\IETldCache
2009-02-21 17:26 . 2009-02-21 17:26 <DIR> d-------- c:\temp\WPDNSE
2009-02-21 16:59 . 2009-02-21 16:59 <DIR> d--hsc--- c:\documents and settings\Dillon\IECompatCache
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\PrivacIE
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\IETldCache
2009-02-21 16:50 . 2009-02-21 16:50 <DIR> d-------- c:\windows\ie8updates
2009-02-21 16:45 . 2009-02-21 16:46 <DIR> d--h-c--- c:\windows\ie8
2009-02-21 16:41 . 2009-01-10 22:00 79,360 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-20 22:31 . 2009-02-21 13:29 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\MSBuild
2009-02-20 21:25 . 2009-02-25 19:53 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-02-20 20:10 . 2009-02-20 20:50 <DIR> d-------- c:\program files\Mozilla Firefox(2)
2009-02-20 20:10 . 2009-02-20 20:10 0 --a------ c:\windows\nsreg.dat
2009-02-18 18:07 . 2009-02-18 18:07 <DIR> d----c--- c:\documents and settings\Guest\Application Data\MySpace

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 01:18 --------- d-----w c:\program files\CallWave
2009-02-26 03:01 --------- d-----w c:\program files\Panda Security
2009-02-26 03:00 --------- d-----w c:\program files\Yahoo!
2009-02-26 02:59 --------- d---a-w c:\program files\YPOPs
2009-02-26 02:53 --------- d-----w c:\program files\Lavasoft
2009-02-26 02:34 --------- dc----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-26 02:34 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-21 03:53 --------- d-----w c:\program files\Linksys Wireless-G PCI Network Adapter with SpeedBooster
2009-02-21 03:50 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 03:56 --------- d-----w c:\program files\World of Warcraft
2009-01-15 09:05 911,872 ----a-w c:\windows\system32\wininet.dll
2009-01-15 09:05 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-01-15 09:04 18,944 ----a-w c:\windows\system32\corpol.dll
2009-01-15 09:03 72,704 ----a-w c:\windows\system32\admparse.dll
2009-01-15 09:03 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-01-15 09:03 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-01-15 09:01 34,304 ----a-w c:\windows\system32\imgutil.dll
2009-01-15 09:00 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-01-15 09:00 45,568 ----a-w c:\windows\system32\mshta.exe
2009-01-15 08:50 156,160 ----a-w c:\windows\system32\msls31.dll
2009-01-06 05:02 --------- d-----w c:\program files\Zone Labs
2009-01-06 00:06 --------- d-----w c:\program files\Java Downloads
2009-01-05 04:35 --------- d-----w c:\program files\MaxSplitter
2009-01-04 17:56 --------- dc----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-04 02:48 --------- dc----w c:\documents and settings\All Users\Application Data\MailFrontier
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\Yahoo!
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\MailFrontier
2009-01-03 22:33 --------- d-----w c:\program files\Symantec
2009-01-03 22:33 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-03 22:20 --------- dc----w c:\documents and settings\All Users\Application Data\Symantec
2007-09-12 04:33 5,471,581 -c--a-w c:\program files\acstudio.exe
2003-08-29 20:12 61,440 -c--a-w c:\windows\inf\i386\Viz7300.dll
2003-08-29 20:12 17,376 -c--a-w c:\windows\inf\i386\Gt680x.sys
2001-09-29 00:00 164,864 ----a-w c:\program files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-09-23 45108]
"OneTouch Monitor"="c:\program files\Visioneer OneTouch\OneTouchMon.exe" [2003-11-20 106496]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-09-23 36864]
"SoundMan"="SOUNDMAN.EXE" [2003-04-21 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]

c:\documents and settings\Dillon\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - c:\program files\Microsoft Office\Office\OUTLOOK.EXE [1997-07-11 25872]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
CallWave.lnk - c:\program files\CallWave\IAM.exe [2005-09-24 1590352]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-07-11 111376]
Microsoft Office Shortcut Bar.lnk - c:\program files\Microsoft Office\Office\MSOFFICE.EXE [1997-07-11 333824]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-07-11 51984]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CallWave\\IAM.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-05-27 17376]

--- Other Services/Drivers In Memory ---

*NewlyCreated* - GTNDIS5

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\PortableRoboForm.exe
\Shell\RoboForm2Go\command - G:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d446baa-945a-11da-bf4c-000b6aef846f}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-02-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
.
------- Supplementary Scan -------
.
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 18:22:11
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-28 18:24:26
ComboFix-quarantined-files.txt 2009-03-01 01:24:05
ComboFix2.txt 2009-03-01 00:54:30
ComboFix3.txt 2009-03-01 00:34:18

Pre-Run: 9,180,823,552 bytes free
Post-Run: 9,167,138,816 bytes free

156 --- E O F --- 2009-02-26 02:01:45

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_09-02-01.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/22/2005 9:29:24 PM
System Uptime: 2/28/2009 6:17:23 PM (0 hours ago)

Motherboard: | | K7VT4APro
Processor: AMD Athlon(tm) XP 2200+ | Socket-A | 1798/133mhz

==== Disk Partitions =========================

A: is Removable
C: is FIXED (NTFS) - 37 GiB total, 8.548 GiB free.
D: is FIXED (NTFS) - 112 GiB total, 97.657 GiB free.
E: is CDROM ()
F: is CDROM ()
G: is FIXED (FAT32) - 4 GiB total, 1.093 GiB free.

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP1: 2/21/2009 9:23:54 PM - System Checkpoint
RP2: 2/21/2009 9:55:07 PM - Software Distribution Service 3.0
RP3: 2/25/2009 6:59:49 PM - Software Distribution Service 3.0
RP4: 2/25/2009 7:20:33 PM - Removed AVG Free 8.0
RP5: 2/25/2009 7:28:31 PM - Removed AVG Free 8.0
RP6: 2/25/2009 7:29:36 PM - Installed AVG Free 8.0
RP7: 2/26/2009 10:40:25 PM - System Checkpoint
RP8: 2/28/2009 5:29:05 PM - ComboFix created restore point
RP9: 2/28/2009 5:50:42 PM - ComboFix created restore point

==== Installed Programs ======================

Acoustica Effects Pack
Adobe Flash Player 10 ActiveX
Adobe Reader 6.0.1
Before You Know It 3.6 Lite
Berlitz
C-Media WDM Audio Driver
CallWave
DriverMax 4
Eusing Free Registry Cleaner
Free DVD Decrypter version 1.2
GrammarPro
HighMAT Extension to Microsoft Windows XP CD Writing Wizard
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Internet Explorer 7 (KB947864)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Format SDK (KB902344)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Intel(R) 536EP Modem
InterActual Player
IrfanView (remove only)
LanguageNow!
Linksys Wireless-G PCI Network Adapter with SpeedBooster
MAGIX music maker 11 demo (US)
Malwarebytes' Anti-Malware
MaxSplitter v1.53 Free Edition
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Hotfix (KB928366)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office 97, Professional Edition
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2005 Redistributable
Microsoft XML Parser
MSXML 4.0 SP2 (KB927978)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB954430)
MSXML4 Parser
Musicmatch® Jukebox
MySpaceIM
Nero Suite
NVIDIA Drivers
PaperPort 8.0 SE
PowerDVD
Quicken 2007
Security Update for Windows Internet Explorer 7 (KB928090)
Security Update for Windows Internet Explorer 7 (KB929969)
Security Update for Windows Internet Explorer 7 (KB931768)
Security Update for Windows Internet Explorer 7 (KB933566)
Security Update for Windows Internet Explorer 7 (KB937143)
Security Update for Windows Internet Explorer 7 (KB938127)
Security Update for Windows Internet Explorer 7 (KB939653)
Security Update for Windows Internet Explorer 7 (KB942615)
Security Update for Windows Internet Explorer 7 (KB944533)
Security Update for Windows Internet Explorer 7 (KB950759)
Security Update for Windows Internet Explorer 7 (KB953838)
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB958215)
Security Update for Windows Internet Explorer 7 (KB960714)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB953839)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954459)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956391)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB957095)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB960715)
Simple File Shredder 2.4
Starcraft
Text-To-Speech-Runtime
Text Thru Time Screensaver
Uninstall 1.0.0.0
Update for Windows Internet Explorer 8 (KB961813)
Update for Windows XP (KB951072-v2)
Update for Windows XP (KB951978)
Update for Windows XP (KB955839)
Update for Windows XP (KB958752)
Update for Windows XP (KB967715)
URGE
VC 9.0 Runtime
Visioneer OneTouch 7300
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
Warcraft III: All Products
WD Diagnostics
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage v1.3.0254.0
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8 Release Candidate 1
Windows Media Connect
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Service Pack 3
World of Warcraft
Yahoo! Music Jukebox

==== Event Viewer Messages From Past Week ========

2/26/2009 10:17:59 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.102. The machine with the IP address 192.168.1.101 did not allow the name to be claimed by this machine.
2/26/2009 6:01:16 PM, error: Dhcp [1002] - The IP address lease 192.168.1.101 for the Network Card with network address 0012179DD8F8 has been denied by the DHCP server 192.168.1.1 (The DHCP Server sent a DHCPNACK message).
2/25/2009 7:18:38 PM, error: Service Control Manager [7031] - The AVG Free8 WatchDog service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 0 milliseconds: Restart the service.
2/25/2009 6:41:47 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
2/25/2009 6:41:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments "" in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
2/25/2009 6:35:25 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 AvgLdx86 AvgMfx86 eeCtrl Fips pavboot SYMTDI
2/22/2009 12:09:01 AM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments "" in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
2/21/2009 9:38:04 PM, error: NetBT [4321] - The name "HOME :1d" could not be registered on the Interface with IP address 192.168.1.101. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.
2/21/2009 9:24:02 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
2/21/2009 9:04:46 PM, error: Service Control Manager [7023] - The Application Management service terminated with the following error: The specified module could not be found.

==== End Of File ===========================

[Blade81]

Hi

Actually I wanted to see ComboFix log after first run So, could you post contents of ComboFix3.txt file (if not in c:\combofix folder then do a search from c: drive), please? Also, please post fresh DDS.txt file.

[BlackBike]

Sorry About That,

Here are the first ComboFix.txt file I obtained and the most recent DDS.txt file. Thanks!

ComboFix 09-02-28.01 - Dillon 2009-02-28 17:29:47.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.230 [GMT -7:00]
Running from: c:\documents and settings\Dillon\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\INSTALL.LOG
c:\program files\TrustWatch
c:\program files\TrustWatch\Cache\COMBOSEARCH.acs
c:\program files\TrustWatch\Cache\ErrorLog.txt
c:\program files\TrustWatch\Cache\feedback_v3.bmp
c:\program files\TrustWatch\Cache\highlight-off_v3.bmp
c:\program files\TrustWatch\Cache\highlight-on_v3.bmp
c:\program files\TrustWatch\Cache\hosts.cfg
c:\program files\TrustWatch\Cache\info-off-18_v3.bmp
c:\program files\TrustWatch\Cache\info-on-18_v3.bmp
c:\program files\TrustWatch\Cache\popup-off_v3.bmp
c:\program files\TrustWatch\Cache\popup-on_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-notverified_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-verified-ssl_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-verified_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-waiting_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-warning_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-working1_v3.bmp
c:\program files\TrustWatch\Cache\ratingdetails-working2_v3.bmp
c:\program files\TrustWatch\Cache\reportfraud_v3.bmp
c:\program files\TrustWatch\Cache\trustwatchtb0401.cfg
c:\program files\TrustWatch\Cache\tw-logo_v3.bmp
c:\program files\TrustWatch\toolbar.ini
c:\program files\TrustWatch\uninst.ico
c:\program files\TrustWatch\uninstall.exe
G:\Autorun.inf

.
((((((((((((((((((((((((( Files Created from 2009-02-01 to 2009-03-01 )))))))))))))))))))))))))))))))
.

2009-02-25 19:31 . 2009-02-25 19:31 8,074 --a------ c:\windows\extend.dat
2009-02-25 19:29 . 2009-02-25 19:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Avg8
2009-02-25 18:47 . 2009-01-09 12:19 1,089,593 -----c--- c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 . 2009-02-21 23:58 <DIR> d-------- c:\program files\Trend Micro
2009-02-21 23:52 . 2009-02-21 23:52 <DIR> d-------- c:\program files\Innovative Solutions
2009-02-21 23:15 . 2009-02-21 23:15 <DIR> d-------- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:30 . 2009-02-21 17:30 <DIR> d----c--- c:\documents and settings\Mike\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-21 17:30 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:29 . 2009-02-21 17:29 <DIR> d----c--- c:\documents and settings\All Users\Application Data\Malwarebytes
2009-02-21 17:29 . 2009-02-11 10:19 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 . 2009-02-11 10:19 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2009-02-21 17:28 . 2009-02-21 17:28 <DIR> d--hsc--- c:\documents and settings\Mike\PrivacIE
2009-02-21 17:27 . 2009-02-21 17:27 <DIR> d--hsc--- c:\documents and settings\Mike\IETldCache
2009-02-21 17:26 . 2009-02-21 17:26 <DIR> d-------- c:\temp\WPDNSE
2009-02-21 16:59 . 2009-02-21 16:59 <DIR> d--hsc--- c:\documents and settings\Dillon\IECompatCache
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\PrivacIE
2009-02-21 16:57 . 2009-02-21 16:57 <DIR> d--hsc--- c:\documents and settings\Dillon\IETldCache
2009-02-21 16:50 . 2009-02-21 16:50 <DIR> d-------- c:\windows\ie8updates
2009-02-21 16:45 . 2009-02-21 16:46 <DIR> d--h-c--- c:\windows\ie8
2009-02-21 16:41 . 2009-01-10 22:00 79,360 -----c--- c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 --------- c:\windows\system32\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 05:06 1,676,288 -----c--- c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 . 2008-07-06 03:50 597,504 -----c--- c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 . 2008-07-06 05:06 575,488 --------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 575,488 -----c--- c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 . 2008-07-06 05:06 117,760 --------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 . 2008-07-06 05:06 89,088 -----c--- c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-20 22:31 . 2009-02-21 13:29 <DIR> d-------- c:\windows\system32\XPSViewer
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\Reference Assemblies
2009-02-20 22:30 . 2009-02-20 22:30 <DIR> d-------- c:\program files\MSBuild
2009-02-20 21:25 . 2009-02-25 19:53 <DIR> d----c--- c:\windows\system32\DRVSTORE
2009-02-20 20:10 . 2009-02-20 20:50 <DIR> d-------- c:\program files\Mozilla Firefox(2)
2009-02-20 20:10 . 2009-02-20 20:10 0 --a------ c:\windows\nsreg.dat
2009-02-18 18:07 . 2009-02-18 18:07 <DIR> d----c--- c:\documents and settings\Guest\Application Data\MySpace

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-03-01 00:10 --------- d-----w c:\program files\CallWave
2009-02-26 03:01 --------- d-----w c:\program files\Panda Security
2009-02-26 03:00 --------- d-----w c:\program files\Yahoo!
2009-02-26 02:59 --------- d---a-w c:\program files\YPOPs
2009-02-26 02:53 --------- d-----w c:\program files\Lavasoft
2009-02-26 02:34 --------- dc----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
2009-02-26 02:34 --------- d-----w c:\program files\Spybot - Search & Destroy
2009-02-21 03:53 --------- d-----w c:\program files\Linksys Wireless-G PCI Network Adapter with SpeedBooster
2009-02-21 03:50 --------- d--h--w c:\program files\InstallShield Installation Information
2009-01-21 03:56 --------- d-----w c:\program files\World of Warcraft
2009-01-15 09:05 911,872 ----a-w c:\windows\system32\wininet.dll
2009-01-15 09:05 43,008 ----a-w c:\windows\system32\licmgr10.dll
2009-01-15 09:04 18,944 ----a-w c:\windows\system32\corpol.dll
2009-01-15 09:03 72,704 ----a-w c:\windows\system32\admparse.dll
2009-01-15 09:03 71,680 ----a-w c:\windows\system32\iesetup.dll
2009-01-15 09:03 420,352 ----a-w c:\windows\system32\vbscript.dll
2009-01-15 09:01 34,304 ----a-w c:\windows\system32\imgutil.dll
2009-01-15 09:00 48,128 ----a-w c:\windows\system32\mshtmler.dll
2009-01-15 09:00 45,568 ----a-w c:\windows\system32\mshta.exe
2009-01-15 08:50 156,160 ----a-w c:\windows\system32\msls31.dll
2009-01-06 05:02 --------- d-----w c:\program files\Zone Labs
2009-01-06 00:06 --------- d-----w c:\program files\Java Downloads
2009-01-05 04:35 --------- d-----w c:\program files\MaxSplitter
2009-01-04 17:56 --------- dc----w c:\documents and settings\All Users\Application Data\Lavasoft
2009-01-04 02:48 --------- dc----w c:\documents and settings\All Users\Application Data\MailFrontier
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\Yahoo!
2009-01-04 02:24 --------- dc----w c:\documents and settings\Mike\Application Data\MailFrontier
2009-01-03 22:33 --------- d-----w c:\program files\Symantec
2009-01-03 22:33 --------- d-----w c:\program files\Common Files\Symantec Shared
2009-01-03 22:20 --------- dc----w c:\documents and settings\All Users\Application Data\Symantec
2007-09-12 04:33 5,471,581 -c--a-w c:\program files\acstudio.exe
2003-08-29 20:12 61,440 -c--a-w c:\windows\inf\i386\Viz7300.dll
2003-08-29 20:12 17,376 -c--a-w c:\windows\inf\i386\Gt680x.sys
2001-09-29 00:00 164,864 ----a-w c:\program files\UNWISE.EXE
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-13 15360]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-10-22 7700480]
"RemoteControl"="c:\program files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 32768]
"PaperPort PTD"="c:\program files\Scansoft\PaperPort\pptd40nt.exe" [2002-09-23 45108]
"OneTouch Monitor"="c:\program files\Visioneer OneTouch\OneTouchMon.exe" [2003-11-20 106496]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"IndexSearch"="c:\program files\Scansoft\PaperPort\IndexSearch.exe" [2002-09-23 36864]
"SoundMan"="SOUNDMAN.EXE" [2003-04-21 c:\windows\SOUNDMAN.EXE]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696]

c:\documents and settings\Dillon\Start Menu\Programs\Startup\
Microsoft Outlook.lnk - c:\program files\Microsoft Office\Office\OUTLOOK.EXE [1997-07-11 25872]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
CallWave.lnk - c:\program files\CallWave\IAM.exe [2005-09-24 1590352]
Microsoft Find Fast.lnk - c:\program files\Microsoft Office\Office\FINDFAST.EXE [1997-07-11 111376]
Microsoft Office Shortcut Bar.lnk - c:\program files\Microsoft Office\Office\MSOFFICE.EXE [1997-07-11 333824]
Office Startup.lnk - c:\program files\Microsoft Office\Office\OSA.EXE [1997-07-11 51984]
ymetray.lnk - c:\program files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe [2008-02-05 54512]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\aawservice]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\CallWave\\IAM.exe"=

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2008-09-03 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-05-27 17376]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G]
\Shell\AutoRun\command - G:\PortableRoboForm.exe
\Shell\RoboForm2Go\command - G:\PortableRoboForm.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0d446baa-945a-11da-bf4c-000b6aef846f}]
\Shell\AutoRun\command - setupSNK.exe

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Contents of the 'Scheduled Tasks' folder

2009-02-21 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe []
.
- - - - ORPHANS REMOVED - - - -

Toolbar-Locked - (no file)
HKCU-Run-DriverMax - (no file)


.
------- Supplementary Scan -------
.
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-02-28 17:32:12
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2009-02-28 17:34:17
ComboFix-quarantined-files.txt 2009-03-01 00:33:52

Pre-Run: 9,054,937,088 bytes free
Post-Run: 9,196,048,384 bytes free

185 --- E O F --- 2009-02-26 02:01:45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


DDS (Ver_09-02-01.01) - NTFSx86
Run by Dillon at 18:26:38.60 on Sat 02/28/2009
Internet Explorer: 8.0.6001.18372
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.511.268 [GMT -7:00]


============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe -k imgsvc
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\explorer.exe
G:\dds.com

============== Pseudo HJT Report ===============

BHO: {02478D38-C3F9-4efb-9B51-7695ECA05670} - No File
BHO: NoExplorer - No File
BHO: AcroIEHlprObj Class: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 6.0\reader\activex\AcroIEHelper.dll
BHO: WormRadar.com IESiteBlocker.NavFilter: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - AVG Safe Search
BHO: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
BHO: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - No File
TB: {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No File
TB: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No File
TB: {430DDB4F-38CC-4E91-AF33-4157334EC937} - No File
TB: {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - No File
TB: {A057A204-BACC-4D26-9990-79A187E2698E} - No File
EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
mRun: [SoundMan] SOUNDMAN.EXE
mRun: [RemoteControl] "c:\program files\cyberlink\powerdvd\PDVDServ.exe"
mRun: [PaperPort PTD] c:\program files\scansoft\paperport\pptd40nt.exe
mRun: [OneTouch Monitor] c:\program files\visioneer onetouch\OneTouchMon.exe
mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe
mRun: [IndexSearch] c:\program files\scansoft\paperport\IndexSearch.exe
dRun: [MySpaceIM] c:\program files\myspace\im\MySpaceIM.exe
StartupFolder: c:\docume~1\dillon\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\OUTLOOK.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\callwave.lnk - c:\program files\callwave\IAM.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~2.lnk - c:\program files\microsoft office\office\FINDFAST.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office\MSOFFICE.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\office~1.lnk - c:\program files\microsoft office\office\OSA.EXE
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\ymetray.lnk - c:\program files\yahoo!\yahoo! music jukebox\ymetray.exe
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: DirectAnimation Java Classes - file://c:\windows\java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} - hxxp://www.musicnotes.com/download/mnviewer.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} - hxxp://downloads.ewido.net/ewidoOnlineScan.cab
DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} - hxxp://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - hxxp://download.mcafee.com/molbin/shared/mcinsctl/4,0,0,101/mcinsctl.cab
DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} - hxxp://usfulfillment.puretracks.com/onager.cab
DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1235612405750
DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} - hxxp://ax.emsisoft.com/asquared.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

============= SERVICES / DRIVERS ===============

R3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2008-9-3 99376]
S3 GT680xNT;Visioneer OneTouch 7300 Driver;c:\windows\system32\drivers\Gt680x.sys [2006-5-27 17376]
S3 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys --> c:\windows\system32\vsdatant.sys [?]

=============== Created Last 30 ================

2009-02-28 17:28 161,792 a------- c:\windows\SWREG.exe
2009-02-28 17:28 98,816 a------- c:\windows\sed.exe
2009-02-25 19:31 8,074 a------- c:\windows\extend.dat
2009-02-25 19:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Avg8
2009-02-25 18:47 1,089,593 -c------ c:\windows\system32\dllcache\ntprint.cat
2009-02-21 23:58 <DIR> --d----- c:\program files\Trend Micro
2009-02-21 23:52 <DIR> --d----- c:\program files\Innovative Solutions
2009-02-21 23:15 <DIR> --d----- c:\program files\Eusing Free Registry Cleaner
2009-02-21 17:29 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-02-21 17:29 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-02-21 17:29 <DIR> -cd----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-02-21 17:29 <DIR> --d----- c:\program files\Malwarebytes' Anti-Malware
2009-02-21 17:26 <DIR> --d----- c:\temp\WPDNSE
2009-02-21 16:59 <DIR> -cdsh--- c:\documents and settings\dillon\IECompatCache
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\PrivacIE
2009-02-21 16:57 <DIR> -cdsh--- c:\documents and settings\dillon\IETldCache
2009-02-21 16:50 <DIR> --d----- c:\windows\ie8updates
2009-02-21 16:45 <DIR> -cd-h--- c:\windows\ie8
2009-02-21 16:41 79,360 -c------ c:\windows\system32\dllcache\iecompat.dll
2009-02-21 13:26 597,504 -c------ c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-02-21 13:26 575,488 -c------ c:\windows\system32\dllcache\xpsshhdr.dll
2009-02-21 13:26 89,088 -c------ c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-02-21 13:26 575,488 -------- c:\windows\system32\xpsshhdr.dll
2009-02-21 13:26 117,760 -------- c:\windows\system32\prntvpt.dll
2009-02-21 13:26 1,676,288 -c------ c:\windows\system32\dllcache\xpssvcs.dll
2009-02-21 13:26 1,676,288 -------- c:\windows\system32\xpssvcs.dll
2009-02-20 22:31 <DIR> --d----- c:\windows\system32\XPSViewer
2009-02-20 20:10 <DIR> --d----- c:\program files\Mozilla Firefox(2)

==================== Find3M ====================

2009-01-15 02:05 911,872 a------- c:\windows\system32\wininet.dll
2009-01-15 02:05 43,008 a------- c:\windows\system32\licmgr10.dll
2009-01-15 02:04 18,944 a------- c:\windows\system32\corpol.dll
2009-01-15 02:03 420,352 a------- c:\windows\system32\vbscript.dll
2009-01-15 02:03 72,704 a------- c:\windows\system32\admparse.dll
2009-01-15 02:03 71,680 a------- c:\windows\system32\iesetup.dll
2009-01-15 02:01 34,304 a------- c:\windows\system32\imgutil.dll
2009-01-15 02:00 48,128 a------- c:\windows\system32\mshtmler.dll
2009-01-15 02:00 45,568 a------- c:\windows\system32\mshta.exe
2009-01-15 01:50 156,160 a------- c:\windows\system32\msls31.dll
2009-01-05 21:39 4,212 a---h--- c:\windows\system32\zllictbl.dat
2009-01-02 11:38 76,487 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2007-09-11 21:33 5,471,581 ac------ c:\program files\acstudio.exe
2003-08-29 13:12 61,440 ac------ c:\windows\inf\i386\Viz7300.dll
2003-08-29 13:12 17,376 ac------ c:\windows\inf\i386\Gt680x.sys
2001-09-28 17:00 164,864 a------- c:\program files\UNWISE.EXE

============= FINISH: 18:26:54.21 ===============

[Blade81]

Hi again

Start hjt, do a system scan, check if found:
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: (no name) - {4E7BD74F-2B8D-469E-88A9-EB6DA381A928} - (no file)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

Close browsers and fix checked.



Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

Double-click ATF Cleaner.exe to open it

Under Main choose:
Windows Temp
Current User Temp
All Users Temp
Cookies
Temporary Internet Files
Prefetch
Java Cache
*The other boxes are optional*
Then click the Empty Selected button.

If you use Firefox:
Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

If you use Opera:
Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

Click Exit on the Main menu to close the program.



Kaspersky Online Scanner

Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

• Read the requirements and privacy statement then click on the Accept button.

• The program will launch and start to download the latest definition files.

• You will be prompted to install an application from Kaspersky. Click Run

• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
• Spyware, Adware, Dialers, and other potentially dangerous programs
  Archives

• Click on My Computer under Scan.

• Once the scan is complete, it will display the results. Click on View Scan Report.

• Click on Save Report As....

• Change the Files of type to Text file (.txt) before clicking on the Save button.

• Save this report to a convenient place.

• Copy and paste that information & a fresh hjt log into your topic.

• The scan will take a while so be patient and let it run. As it scans your machine very deeply it could take hours to complete, Kaspersky suggests running it during a time of low activity.

If you need a tutorial, see here

[BlackBike]

Well,
I ran HJT again, and deleted the Registry entries you identified. Then, I ran AFT and cleared the specified items. I was not able to rund the Kaspersky in regular full log on, because I am still unable to access the internet that way. So, I ran it Safe with Networking mode. There were not any problems found, so there wasn't any report to save. Finally, I ran HJT again, and I've posted the results below.
I am sure this is frustrating to you. I appreciate the time you are taking to narrow down the issues.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:55:01 PM, on 3/1/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18372)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe
C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WMP54GSv1_1.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\CallWave\IAM.exe
C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\Scansoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [OneTouch Monitor] C:\Program Files\Visioneer OneTouch\OneTouchMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [IndexSearch] C:\Program Files\Scansoft\PaperPort\IndexSearch.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: Microsoft Outlook.lnk = C:\Program Files\Microsoft Office\Office\OUTLOOK.EXE
O4 - Global Startup: CallWave.lnk = C:\Program Files\CallWave\IAM.exe
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Microsoft Office Shortcut Bar.lnk = C:\Program Files\Microsoft Office\Office\MSOFFICE.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O4 - Global Startup: ymetray.lnk = C:\Program Files\Yahoo!\Yahoo! Music Jukebox\ymetray.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/ho...vex/hcImpl.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} - http://download.mcafee.com/molbin/sh...1/mcinsctl.cab
O16 - DPF: {5CB1506E-1DEA-4E63-89A7-E40E52AEA1FD} (OnagerCtrl Class) - http://usfulfillment.puretracks.com/onager.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1235612405750
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: WMP54GSSVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Network Adapter with SpeedBooster\WLService.exe

--
End of file - 6089 bytes

[Blade81]

Hi

Do the connection problems occur with both wired and wireless connection in normal mode?