New rogue/antivirus infection - Please help

[justbeck]

UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT

DDS (Ver_10-03-17.01)

Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume1
Install Date: 9/4/2007 12:45:13 PM
System Uptime: 4/5/2010 11:11:58 PM (0 hours ago)

Motherboard: ASUSTek Computer INC. |  | Kelut
Processor: AMD Athlon(tm) XP 3200+ | Socket A | 2199/200mhz

==== Disk Partitions =========================

C: is FIXED (NTFS) - 149 GiB total, 64.556 GiB free.
D: is CDROM ()
E: is CDROM ()
F: is Removable
G: is Removable
H: is Removable
I: is Removable
J: is Removable

==== Disabled Device Manager Items =============

==== System Restore Points ===================

RP390: 1/12/2010 2:05:37 PM - System Checkpoint
RP391: 1/13/2010 1:12:03 AM - Software Distribution Service 3.0
RP392: 1/14/2010 2:43:59 AM - System Checkpoint
RP393: 1/15/2010 12:29:51 PM - System Checkpoint
RP394: 1/16/2010 1:17:45 PM - System Checkpoint
RP395: 1/17/2010 10:34:30 PM - System Checkpoint
RP396: 1/18/2010 10:56:33 PM - System Checkpoint
RP397: 1/20/2010 1:43:45 AM - System Checkpoint
RP398: 1/21/2010 2:29:57 AM - System Checkpoint
RP399: 1/22/2010 6:11:16 PM - System Checkpoint
RP400: 1/23/2010 3:00:17 AM - Software Distribution Service 3.0
RP401: 1/24/2010 3:30:48 AM - System Checkpoint
RP402: 1/25/2010 4:30:47 AM - System Checkpoint
RP403: 1/26/2010 4:35:25 AM - System Checkpoint
RP404: 1/27/2010 4:40:23 AM - System Checkpoint
RP405: 1/28/2010 1:21:08 AM - Removed Cisco Network Magic
RP406: 1/28/2010 1:22:28 AM - Removed Pure Networks Platform
RP407: 1/29/2010 1:41:57 AM - System Checkpoint
RP408: 1/30/2010 2:31:34 AM - System Checkpoint
RP409: 1/31/2010 3:22:32 AM - System Checkpoint
RP410: 2/1/2010 4:22:34 AM - System Checkpoint
RP411: 2/2/2010 5:22:33 AM - System Checkpoint
RP412: 2/3/2010 6:22:37 AM - System Checkpoint
RP413: 2/4/2010 7:08:23 AM - System Checkpoint
RP414: 2/5/2010 8:08:21 AM - System Checkpoint
RP415: 2/6/2010 12:18:35 PM - System Checkpoint
RP416: 2/7/2010 1:05:47 PM - System Checkpoint
RP417: 2/8/2010 3:23:06 PM - System Checkpoint
RP418: 2/9/2010 3:43:33 PM - System Checkpoint
RP419: 2/10/2010 5:59:13 PM - System Checkpoint
RP420: 2/11/2010 3:00:16 AM - Software Distribution Service 3.0
RP421: 2/12/2010 3:08:45 AM - System Checkpoint
RP422: 2/13/2010 7:22:07 AM - System Checkpoint
RP423: 2/14/2010 8:50:44 AM - System Checkpoint
RP424: 2/15/2010 12:10:02 PM - System Checkpoint
RP425: 2/16/2010 1:26:37 PM - System Checkpoint
RP426: 2/17/2010 3:22:31 PM - System Checkpoint
RP427: 2/18/2010 3:51:56 PM - System Checkpoint
RP428: 2/19/2010 8:01:16 PM - System Checkpoint
RP429: 2/20/2010 8:37:52 PM - System Checkpoint
RP430: 2/21/2010 4:12:13 AM - Installed Java(TM) 6 Update 17
RP431: 2/22/2010 6:31:07 AM - System Checkpoint
RP432: 2/23/2010 7:16:41 AM - System Checkpoint
RP433: 2/24/2010 3:00:21 AM - Software Distribution Service 3.0
RP434: 2/25/2010 3:59:25 AM - System Checkpoint
RP435: 2/26/2010 5:17:04 AM - System Checkpoint
RP436: 2/27/2010 5:59:24 AM - System Checkpoint
RP437: 2/28/2010 6:59:25 AM - System Checkpoint
RP438: 3/1/2010 7:03:39 AM - System Checkpoint
RP439: 3/2/2010 7:59:05 AM - System Checkpoint
RP440: 3/3/2010 8:59:06 AM - System Checkpoint
RP441: 3/4/2010 10:55:13 AM - System Checkpoint
RP442: 3/5/2010 10:59:05 AM - System Checkpoint
RP443: 3/6/2010 11:59:07 AM - System Checkpoint
RP444: 3/7/2010 5:53:19 PM - System Checkpoint
RP445: 3/8/2010 3:20:19 PM - Removed Safari
RP446: 3/8/2010 10:50:24 PM - Removed imeem Uploader
RP447: 3/8/2010 10:51:14 PM - Software Distribution Service 3.0
RP448: 3/10/2010 4:06:14 AM - System Checkpoint
RP449: 3/15/2010 1:19:43 AM - System Checkpoint
RP450: 3/15/2010 3:00:34 AM - Software Distribution Service 3.0
RP451: 3/16/2010 3:09:03 AM - System Checkpoint
RP452: 3/17/2010 3:10:56 AM - System Checkpoint
RP453: 3/18/2010 3:15:40 AM - System Checkpoint
RP454: 3/19/2010 3:51:41 AM - System Checkpoint
RP455: 3/20/2010 6:02:11 PM - System Checkpoint
RP456: 3/21/2010 6:32:28 PM - System Checkpoint
RP457: 3/22/2010 8:53:17 PM - System Checkpoint
RP458: 3/22/2010 10:42:41 PM - Installed Windows XP KB914882.
RP459: 3/22/2010 10:46:02 PM - Software Distribution Service 3.0
RP460: 3/23/2010 11:40:25 AM - Software Distribution Service 3.0
RP461: 3/24/2010 3:00:42 AM - Software Distribution Service 3.0
RP462: 3/24/2010 11:59:47 AM - Software Distribution Service 3.0
RP463: 3/25/2010 3:00:45 AM - Software Distribution Service 3.0
RP464: 3/25/2010 2:19:49 PM - Software Distribution Service 3.0
RP465: 3/26/2010 2:18:58 PM - Software Distribution Service 3.0
RP466: 3/27/2010 2:19:06 PM - Software Distribution Service 3.0
RP467: 3/28/2010 2:05:09 AM - Software Distribution Service 3.0
RP468: 3/29/2010 3:19:57 AM - System Checkpoint
RP469: 3/29/2010 2:19:21 PM - Software Distribution Service 3.0
RP470: 3/30/2010 2:19:48 PM - Software Distribution Service 3.0
RP471: 3/31/2010 3:00:22 AM - Software Distribution Service 3.0
RP472: 4/1/2010 3:10:51 AM - System Checkpoint
RP473: 4/1/2010 12:56:43 PM - Software Distribution Service 3.0
RP474: 4/2/2010 3:35:46 AM - Software Distribution Service 3.0
RP475: 4/3/2010 3:36:38 AM - Software Distribution Service 3.0
RP476: 4/4/2010 2:04:06 AM - Software Distribution Service 3.0
RP477: 4/5/2010 5:09:14 AM - System Checkpoint
RP478: 4/5/2010 2:35:09 PM - Software Distribution Service 3.0

==== Installed Programs ======================

AAC Decoder
Adobe AIR
Adobe Flash Player 10 Plugin
Adobe Reader 8.1.3
Adobe Shockwave Player 11.5
Agere Systems PCI Soft Modem
AIMTunes
Apple Application Support
Apple Mobile Device Support
Apple Software Update
AT&T Connect Participant
AutoUpdate
BitTorrent
Bonjour
Compaq Connections
DivX Codec
DivX Converter
DivX Player
DivX Plus DirectShow Filters
DivX Plus Web Player
DivX Version Checker
H.264 Decoder
Help and Support Additions
High Definition Audio Driver Package - KB835221
HijackThis 2.0.2
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB915865)
Hotfix for Windows XP (KB926239)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
HpSdpAppCoreApp
iTunes
Java 2 Runtime Environment, SE v1.4.2_03
Java(TM) 6 Update 17
K-Lite Codec Pack 5.8.3 (Basic)
KBD
LiveUpdate 1.90 (Symantec Corporation)
Malwarebytes' Anti-Malware
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB953297)
Microsoft Antimalware
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Office Professional Edition 2003
Microsoft Office Standard Edition 2003
Microsoft Plus! Dancer LE
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft Security Essentials
Microsoft Silverlight
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft VC9 runtime libraries
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Works 7.0
MKV Splitter
Morrowind
Mozilla Firefox (3.6.3)
Norton WMI Update
Pando Media Booster
PC-Doctor for Windows
Prism Video Converter
PS2
Python 2.2 combined Win32 extensions
Python 2.2.1
QuickTime
S3 S3Display
S3 S3Gamma2
S3 S3Info2
S3 S3Overlay
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 7 (KB938127-v2)
Security Update for Windows Internet Explorer 7 (KB961260)
Security Update for Windows Internet Explorer 7 (KB963027)
Security Update for Windows Internet Explorer 7 (KB969897)
Security Update for Windows Internet Explorer 7 (KB972260)
Security Update for Windows Internet Explorer 7 (KB974455)
Security Update for Windows Internet Explorer 7 (KB976325)
Security Update for Windows Internet Explorer 7 (KB978207)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 9 (KB936782)
Security Update for Windows XP (KB890046)
Security Update for Windows XP (KB893756)
Security Update for Windows XP (KB896358)
Security Update for Windows XP (KB896423)
Security Update for Windows XP (KB896428)
Security Update for Windows XP (KB899587)
Security Update for Windows XP (KB899591)
Security Update for Windows XP (KB900725)
Security Update for Windows XP (KB901017)
Security Update for Windows XP (KB901214)
Security Update for Windows XP (KB902400)
Security Update for Windows XP (KB904706)
Security Update for Windows XP (KB905414)
Security Update for Windows XP (KB905749)
Security Update for Windows XP (KB908519)
Security Update for Windows XP (KB911562)
Security Update for Windows XP (KB911927)
Security Update for Windows XP (KB913580)
Security Update for Windows XP (KB914388)
Security Update for Windows XP (KB914389)
Security Update for Windows XP (KB917344)
Security Update for Windows XP (KB917953)
Security Update for Windows XP (KB918118)
Security Update for Windows XP (KB918439)
Security Update for Windows XP (KB919007)
Security Update for Windows XP (KB920213)
Security Update for Windows XP (KB920670)
Security Update for Windows XP (KB920683)
Security Update for Windows XP (KB920685)
Security Update for Windows XP (KB921503)
Security Update for Windows XP (KB922819)
Security Update for Windows XP (KB923191)
Security Update for Windows XP (KB923414)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB923980)
Security Update for Windows XP (KB924270)
Security Update for Windows XP (KB924496)
Security Update for Windows XP (KB924667)
Security Update for Windows XP (KB925902)
Security Update for Windows XP (KB926255)
Security Update for Windows XP (KB926436)
Security Update for Windows XP (KB927779)
Security Update for Windows XP (KB927802)
Security Update for Windows XP (KB928255)
Security Update for Windows XP (KB928843)
Security Update for Windows XP (KB929123)
Security Update for Windows XP (KB930178)
Security Update for Windows XP (KB931261)
Security Update for Windows XP (KB931784)
Security Update for Windows XP (KB932168)
Security Update for Windows XP (KB933729)
Security Update for Windows XP (KB935839)
Security Update for Windows XP (KB935840)
Security Update for Windows XP (KB936021)
Security Update for Windows XP (KB937143)
Security Update for Windows XP (KB938127)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB938829)
Security Update for Windows XP (KB941202)
Security Update for Windows XP (KB941568)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB941644)
Security Update for Windows XP (KB941693)
Security Update for Windows XP (KB943055)
Security Update for Windows XP (KB943460)
Security Update for Windows XP (KB943485)
Security Update for Windows XP (KB944338)
Security Update for Windows XP (KB944653)
Security Update for Windows XP (KB945553)
Security Update for Windows XP (KB946026)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB947864)
Security Update for Windows XP (KB948590)
Security Update for Windows XP (KB948881)
Security Update for Windows XP (KB950749)
Security Update for Windows XP (KB950759)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958470)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978706)
Skype Toolbars
Skype™ 4.2
Spyware Doctor 7.0
TES Construction Set
Update for Windows Internet Explorer 7 (KB976749)
Update for Windows Internet Explorer 7 (KB980182)
Update for Windows XP (KB894391)
Update for Windows XP (KB898461)
Update for Windows XP (KB900485)
Update for Windows XP (KB908531)
Update for Windows XP (KB910437)
Update for Windows XP (KB911280)
Update for Windows XP (KB914882)
Update for Windows XP (KB916595)
Update for Windows XP (KB920872)
Update for Windows XP (KB922582)
Update for Windows XP (KB927891)
Update for Windows XP (KB930916)
Update for Windows XP (KB933360)
Update for Windows XP (KB938828)
Update for Windows XP (KB942763)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
VC80CRTRedist - 8.0.50727.4053
VIA Rhine-Family Fast Ethernet Adapter
VIA/S3G Display Driver
WavePad Sound Editor
WebEx Support Manager for Internet Explorer
WebFldrs XP
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Media Format 11 runtime
Windows Media Player 11
Windows XP Hotfix - KB873339
Windows XP Hotfix - KB885835
Windows XP Hotfix - KB885836
Windows XP Hotfix - KB886185
Windows XP Hotfix - KB887472
Windows XP Hotfix - KB888302
Windows XP Hotfix - KB890859
Windows XP Hotfix - KB891781
World of Warcraft

==== Event Viewer Messages From Past Week ========

4/4/2010 12:57:33 PM, error: Microsoft Antimalware [1008]  - Microsoft Antimalware has encountered an error when taking action on spyware or other potentially unwanted software. For more information please see the following: http://go.microsoft.com/fwlink/?linkid=37020&name=HackTool:Win32/CrackSearch.A&threatid=2147515165    User: BECKSCOMPUTER\Compaq_Owner    Name: HackTool:Win32/CrackSearch.A    ID: 2147515165    Severity: Medium    Category: Tool    Path:     Action: Remove    Error Code: 0x80508023    Error description: The program could not find the spyware and other potentially unwanted software on this computer.     Status:     Signature Version: AV: 1.79.1151.0, AS: 1.79.1151.0    Engine Version: 1.1.5605.0
4/4/2010 12:30:41 PM, error: Cdrom [11]  - The driver detected a controller error on \Device\CdRom0.
3/30/2010 4:19:59 PM, error: Service Control Manager [7031]  - The Microsoft Antimalware Service service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 15000 milliseconds: Restart the service.
3/30/2010 4:19:58 PM, error: Service Control Manager [7034]  - The Machine Debug Manager service terminated unexpectedly.  It has done this 1 time(s).
3/30/2010 4:19:58 PM, error: Service Control Manager [7034]  - The Java Quick Starter service terminated unexpectedly.  It has done this 1 time(s).
3/30/2010 4:19:58 PM, error: Service Control Manager [7034]  - The Bonjour Service service terminated unexpectedly.  It has done this 1 time(s).
3/30/2010 4:19:58 PM, error: Service Control Manager [7034]  - The Application Layer Gateway Service service terminated unexpectedly.  It has done this 1 time(s).
3/30/2010 4:19:58 PM, error: Service Control Manager [7031]  - The Apple Mobile Device service terminated unexpectedly.  It has done this 1 time(s).  The following corrective action will be taken in 60000 milliseconds: Restart the service.
3/30/2010 4:19:57 PM, error: Service Control Manager [7034]  - The Print Spooler service terminated unexpectedly.  It has done this 1 time(s).
3/30/2010 4:19:57 PM, error: Service Control Manager [7034]  - The iPod Service service terminated unexpectedly.  It has done this 1 time(s).

==== End Of File ===========================

[justbeck]

DDS (Ver_10-03-17.01) - NTFSx86 
Run by Compaq_Owner at 23:24:29.17 on Mon 04/05/2010
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_17
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.447.119 [GMT -4:00]

AV: Microsoft Security Essentials *On-access scanning disabled* (Updated)   {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
c:\Program Files\Microsoft Security Essentials\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\WINDOWS\system32\spoolsv.exe
svchost.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\windows\system\hpsysdrv.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Microsoft Security Essentials\msseces.exe
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
C:\Program Files\Compaq Connections\6750491\Program\Compaq Connections.exe
C:\Program Files\Interwise\Participant\pull.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Compaq_Owner\My Documents\Downloads\dds.scr

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = <local>
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: Skype add-on for Internet Explorer: {ae805869-2e5c-4ed4-8f7b-f1f7851a4497} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
mRun: [hpsysdrv] c:\windows\system\hpsysdrv.exe
mRun: [KBD] c:\hp\kbd\KBD.EXE
mRun: [Recguard] c:\windows\sminst\RECGUARD.EXE
mRun: [VTTimer] VTTimer.exe
mRun: [PS2] c:\windows\system32\ps2.exe
mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
mRun: [MSSE] "c:\program files\microsoft security essentials\msseces.exe" -hide -runkey
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\compaq~1.lnk - c:\program files\compaq connections\6750491\program\Compaq Connections.exe
StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pushcl~1.lnk - c:\program files\interwise\participant\pull.exe
IE: E&xport to Microsoft Excel - c:\progra~1\mi1933~1\office11\EXCEL.EXE/3000
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\mi1933~1\office11\REFIEBAR.DLL
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab
DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - c:\program files\skype\toolbars\internet explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\compaq~1\applic~1\mozilla\firefox\profiles\fte4u602.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\all users\application data\nexonus\ngm\npNxGameUS.dll
FF - plugin: c:\program files\divx\divx plus web player\npdivx32.dll
FF - plugin: c:\program files\mozilla firefox\plugins\npPandoWebInst.dll
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}
FF - HiddenExtension: Java Console: No Registry Reference - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA}

---- FIREFOX POLICIES ----
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut. enabled", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\mozilla firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\mozilla firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\mozilla firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_ everywhere__temporarily_available_pref", true);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_a s_broken", false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\mozilla firefox\greprefs\security-prefs.js - pref("security.ssl3.rsa_seed_sha", true);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\mozilla firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugi n", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);

============= SERVICES / DRIVERS ===============

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2010-3-16 207280]
R1 MpFilter;Microsoft Malware Protection Driver;c:\windows\system32\drivers\MpFilter.sys [2009-12-2 149040]

=============== Created Last 30 ================

2010-04-04 17:58:14   0   d-----w-   c:\program files\NCH Software
2010-04-02 06:41:57   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
2010-04-02 06:35:07   0   d-----r-   c:\program files\Skype
2010-03-29 05:27:40   165376   ----a-w-   c:\windows\system32\unrar.dll
2010-03-29 05:27:31   0   d-----w-   c:\program files\K-Lite Codec Pack
2010-03-23 14:39:12   274288   ----a-w-   c:\windows\system32\mucltui.dll
2010-03-23 14:39:12   215920   ----a-w-   c:\windows\system32\muweb.dll
2010-03-23 14:39:12   16736   ----a-w-   c:\windows\system32\mucltui.dll.mui
2010-03-23 02:46:15   181632   ------w-   c:\windows\system32\MpSigStub.exe
2010-03-23 02:42:55   0   d-----w-   c:\program files\Microsoft Security Essentials
2010-03-18 03:38:42   98816   ----a-w-   c:\windows\sed.exe
2010-03-18 03:38:42   77312   ----a-w-   c:\windows\MBR.exe
2010-03-18 03:38:42   261632   ----a-w-   c:\windows\PEV.exe
2010-03-18 03:38:42   161792   ----a-w-   c:\windows\SWREG.exe
2010-03-16 18:49:37   0   d-----w-   c:\program files\Trend Micro
2010-03-16 17:03:57   7387   ----a-w-   c:\windows\system32\drivers\pctgntdi.cat
2010-03-16 17:03:57   233136   ----a-w-   c:\windows\system32\drivers\pctgntdi.sys
2010-03-16 17:03:52   7383   ----a-w-   c:\windows\system32\drivers\pctcore.cat
2010-03-16 17:03:52   207280   ----a-w-   c:\windows\system32\drivers\PCTCore.sys
2010-03-16 17:03:51   87784   ----a-w-   c:\windows\system32\drivers\PCTAppEvent.sys
2010-03-16 17:03:51   7412   ----a-w-   c:\windows\system32\drivers\PCTAppEvent.cat
2010-03-16 17:03:35   7383   ----a-w-   c:\windows\system32\drivers\pctplsg.cat
2010-03-16 17:03:35   70408   ----a-w-   c:\windows\system32\drivers\pctplsg.sys
2010-03-16 17:03:21   0   d-----w-   c:\program files\Spyware Doctor
2010-03-16 17:03:21   0   d-----w-   c:\program files\common files\PC Tools
2010-03-16 17:03:21   0   d-----w-   c:\docume~1\compaq~1\applic~1\PC Tools
2010-03-16 17:03:21   0   d-----w-   c:\docume~1\alluse~1\applic~1\PC Tools
2010-03-16 16:34:19   0   d-----w-   c:\program files\common files\Wise Installation Wizard
2010-03-16 16:26:59   0   d-----w-   c:\docume~1\compaq~1\applic~1\Malwarebytes
2010-03-16 16:25:43   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-16 16:25:41   0   d-----w-   c:\docume~1\alluse~1\applic~1\Malwarebytes
2010-03-16 16:25:40   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-03-16 16:25:40   0   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-03-16 02:31:51   552   ----a-w-   c:\windows\system32\d3d8caps.dat
2010-03-16 02:31:49   1324   ----a-w-   c:\windows\system32\d3d9caps.dat
2010-03-15 07:27:38   0   d--h--w-   c:\windows\PIF

==================== Find3M  ====================

2010-03-11 12:38:54   832512   ------w-   c:\windows\system32\wininet.dll
2010-03-11 12:38:52   78336   ----a-w-   c:\windows\system32\ieencode.dll
2010-03-11 12:38:51   17408   ----a-w-   c:\windows\system32\corpol.dll

============= FINISH: 23:24:52.64 ===============

[SuperDave]

Note: the below instructions were created specifically for this user. If you are not this user, DO NOT follow these directions as they could damage the workings of your system

Delete these files/folders, as follows:

1. Go to Start > Run > type Notepad.exe and click OK to open Notepad.
It must be Notepad, not Wordpad.
2. Copy the text in the below code box by highlighting all the text and pressing Ctrl+C

Code: [Select]

KillAll::

File::
c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{6CB8582E-0C1D-E161-9CA4-DE7CEE947816}-Craagle.exe


3. Go to the Notepad window and click Edit > Paste
4. Then click File > Save
5. Name the file CFScript.txt - Save the file to your Desktop
6. Then drag the CFScript (hold the left mouse button while dragging the file) and drop it (release the left mouse button) into ComboFix.exe as you see in the screenshot below. Important: Perform this instruction carefully!



ComboFix will begin to execute, just follow the prompts.
After reboot (in case it asks to reboot), it will produce a log for you.
Post that log (Combofix.txt) in your next reply.

Note: Do not mouseclick ComboFix's window while it is running. That may cause your system to freeze


============================
You still have BitTorrent on your computer which is another P2P program. See previous information concerning P2P programs.
=============================

Please go to Jotti's malware scan
(If more than one file needs scanned they must be done separately and logs posted for each one)

* Copy the file path in the below Code box:

Code: [Select]

c:\windows\system32\ezsidmv.dat
* At the upload site, click once inside the window next to Browse.
* Press Ctrl+V on the keyboard (both at the same time) to paste the file path into the window.
* Next click Submit file
* Your file will possibly be entered into a queue which normally takes less than a minute to clear.
* This will perform a scan across multiple different virus scanning engines.
* Important: Wait for all of the scanning engines to complete.
* Once the scan is finished, Copy and then Paste the link in the address bar into your next reply.
========================
It's been a long time since we started this process. How's your computer running?

[justbeck]

My computer's doing pretty good at the moment. It'll go smooth and fine for a few days and then the original virus's symptoms will show up again, but like with a different name. This only happens because I don't check your replies for a couple of days at a time, so I'm trying to check it at least once a day.

As for the Jotti's Malware Scan, it does not let me copy&paste that into it...as soon as I click next to the "browse" button, it opens up a browser.

Also, that latest script for CF is running currently. I'll post the log as soon as it reboots.

[justbeck]

ComboFix 10-04-05.01 - Compaq_Owner 04/07/2010  20:23:36.9.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.447.109 [GMT -4:00]
Running from: c:\documents and settings\Compaq_Owner\My Documents\Downloads\ComboFix.exe
Command switches used :: J:\CFScript.txt
AV: Microsoft Security Essentials *On-access scanning disabled* (Updated) {BCF43643-A118-4432-AEDE-D861FCBCFCDF}

FILE ::
"c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{6CB8582E-0C1D-E161-9CA4-DE7CEE947816}-Craagle.exe"
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\LocalCopy\{6CB8582E-0C1D-E161-9CA4-DE7CEE947816}-Craagle.exe

.
(((((((((((((((((((((((((   Files Created from 2010-03-08 to 2010-04-08  )))))))))))))))))))))))))))))))
.

2010-04-06 23:34 . 2010-04-06 23:34   --------   d-----w-   c:\documents and settings\Compaq_Owner\Local Settings\Application Data\PCHealth
2010-04-06 23:34 . 2010-04-06 23:34   --------   d-----w-   c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
2010-04-06 02:44 . 2010-04-06 02:44   196096   --sha-w-   c:\documents and settings\Compaq_Owner\Local Settings\Application Data\1585116398.dll
2010-04-04 17:58 . 2010-04-04 17:58   --------   d-----w-   c:\program files\NCH Software
2010-04-02 06:41 . 2010-04-02 06:41   56   ---ha-w-   c:\windows\system32\ezsidmv.dat
2010-04-02 06:41 . 2010-04-02 06:41   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\skypePM
2010-04-02 06:36 . 2010-04-07 00:04   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\Skype
2010-04-02 06:35 . 2010-04-02 06:35   --------   d-----w-   c:\program files\Common Files\Skype
2010-04-02 06:35 . 2010-04-02 06:36   --------   d-----r-   c:\program files\Skype
2010-04-02 06:34 . 2010-04-02 06:35   --------   d-----w-   c:\documents and settings\All Users\Application Data\Skype
2010-03-29 05:27 . 2010-02-10 17:13   165376   ----a-w-   c:\windows\system32\unrar.dll
2010-03-29 05:27 . 2010-03-29 05:28   --------   d-----w-   c:\program files\K-Lite Codec Pack
2010-03-23 14:39 . 2009-08-06 23:23   274288   ----a-w-   c:\windows\system32\mucltui.dll
2010-03-23 14:39 . 2009-08-06 23:23   215920   ----a-w-   c:\windows\system32\muweb.dll
2010-03-23 02:46 . 2010-02-24 14:16   181632   ------w-   c:\windows\system32\MpSigStub.exe
2010-03-23 02:42 . 2010-03-23 02:43   --------   d-----w-   c:\program files\Microsoft Security Essentials
2010-03-21 03:06 . 2010-03-21 03:06   5115824   ----a-w-   c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-03-16 18:49 . 2010-03-16 18:49   --------   d-----w-   c:\program files\Trend Micro
2010-03-16 18:07 . 2010-03-16 18:07   --------   d-----w-   c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-03-16 18:04 . 2010-03-16 18:04   --------   d-----w-   c:\documents and settings\Administrator\Local Settings\Application Data\Mozilla
2010-03-16 17:03 . 2010-02-05 13:17   233136   ----a-w-   c:\windows\system32\drivers\pctgntdi.sys
2010-03-16 17:03 . 2009-09-23 20:10   207280   ----a-w-   c:\windows\system32\drivers\PCTCore.sys
2010-03-16 17:03 . 2009-10-06 20:31   87784   ----a-w-   c:\windows\system32\drivers\PCTAppEvent.sys
2010-03-16 17:03 . 2010-02-05 13:25   70408   ----a-w-   c:\windows\system32\drivers\pctplsg.sys
2010-03-16 17:03 . 2010-03-16 18:39   --------   d-----w-   c:\program files\Spyware Doctor
2010-03-16 17:03 . 2010-03-16 17:03   --------   d-----w-   c:\program files\Common Files\PC Tools
2010-03-16 17:03 . 2010-03-16 17:03   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\PC Tools
2010-03-16 17:03 . 2010-03-16 17:03   --------   d-----w-   c:\documents and settings\All Users\Application Data\PC Tools
2010-03-16 17:03 . 2010-03-16 18:39   --------   d---a-w-   c:\documents and settings\All Users\Application Data\TEMP
2010-03-16 16:34 . 2010-03-16 16:34   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2010-03-16 16:26 . 2010-03-16 16:26   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\Malwarebytes
2010-03-16 16:25 . 2010-01-07 20:07   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-16 16:25 . 2010-03-16 16:25   --------   d-----w-   c:\documents and settings\All Users\Application Data\Malwarebytes
2010-03-16 16:25 . 2010-03-21 03:06   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-03-16 16:25 . 2010-01-07 20:07   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2010-03-16 02:31 . 2010-03-16 02:31   552   ----a-w-   c:\windows\system32\d3d8caps.dat
2010-03-16 02:31 . 2010-03-16 18:36   1324   ----a-w-   c:\windows\system32\d3d9caps.dat
2010-03-16 02:30 . 2010-03-16 02:31   --------   d-----w-   c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-03-15 07:27 . 2010-03-15 07:27   --------   d--h--w-   c:\windows\PIF

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-04-05 06:52 . 2009-12-15 03:55   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\BitTorrent
2010-04-04 18:00 . 2009-05-12 23:10   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\NCH Software
2010-04-04 17:58 . 2009-05-12 23:10   --------   d-----w-   c:\documents and settings\All Users\Application Data\NCH Software
2010-03-29 05:14 . 2009-12-15 05:07   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\DivX
2010-03-24 18:17 . 2008-12-15 20:38   64624   ----a-w-   c:\documents and settings\Compaq_Owner\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2010-03-24 18:11 . 2008-06-17 19:54   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-03-24 07:03 . 2004-08-09 06:47   --------   d-----w-   c:\program files\Microsoft Works
2010-03-23 02:44 . 2009-01-19 17:59   --------   d-----w-   c:\program files\Common Files\AOL
2010-03-23 02:36 . 2009-01-19 18:00   --------   d-----w-   c:\documents and settings\All Users\Application Data\Viewpoint
2010-03-11 12:38 . 2004-08-09 04:28   832512   ------w-   c:\windows\system32\wininet.dll
2010-03-11 12:38 . 2004-08-09 04:28   78336   ----a-w-   c:\windows\system32\ieencode.dll
2010-03-11 12:38 . 2004-08-09 04:28   17408   ----a-w-   c:\windows\system32\corpol.dll
2010-02-23 04:58 . 2009-06-17 00:04   --------   d-----w-   c:\program files\AIMTunes
2010-02-21 09:12 . 2004-08-09 06:12   --------   d-----w-   c:\program files\Java
2010-02-21 09:11 . 2010-02-21 09:11   152576   ----a-w-   c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\jre1.6.0_17\lzma.dll
2010-02-21 09:11 . 2009-11-25 18:17   79488   ----a-w-   c:\documents and settings\Compaq_Owner\Application Data\Sun\Java\jre1.6.0_17\gtapi.dll
2010-02-21 04:26 . 2008-09-05 01:23   --------   d-----w-   c:\documents and settings\Compaq_Owner\Application Data\Apple Computer
2010-02-18 19:48 . 2010-02-18 19:47   --------   d-----w-   c:\program files\iTunes
2010-02-18 19:47 . 2010-02-18 19:47   --------   d-----w-   c:\program files\iPod
2010-02-18 19:47 . 2009-03-11 22:52   --------   d-----w-   c:\program files\Common Files\Apple
2010-02-18 19:42 . 2010-02-18 19:42   72488   ----a-w-   c:\documents and settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 9.0.3.15\SetupAdmin.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Skype"="c:\program files\Skype\Phone\Skype.exe" [2010-03-09 26100520]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 52736]
"KBD"="c:\hp\KBD\KBD.EXE" [2003-02-12 61440]
"Recguard"="c:\windows\SMINST\RECGUARD.EXE" [2004-04-15 233472]
"VTTimer"="VTTimer.exe" [2004-10-22 53248]
"PS2"="c:\windows\system32\ps2.exe" [2003-09-13 98304]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-11-11 417792]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2010-01-23 141608]
"MSSE"="c:\program files\Microsoft Security Essentials\msseces.exe" [2010-02-21 1093208]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Compaq Connections.lnk - c:\program files\Compaq Connections\6750491\Program\Compaq Connections.exe [2004-8-9 16423]
Push Client.LNK - c:\program files\Interwise\Participant\pull.exe [2009-9-15 886000]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MsMpSvc]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Compaq Connections\\6750491\\Program\\Compaq Connections.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\Pando Networks\\Media Booster\\PMB.exe"=
"c:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe"=
"c:\\Program Files\\World of Warcraft\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.1.3.9947-to-3.2.0.10192-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10192-to-3.2.0.10314-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.0.10314-to-3.2.2.10482-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\WoW-3.2.2.10482-to-3.2.2.10505-enUS-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.3.0.10522-enUS-ptr-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.3.0.10522-to-0.3.0.10554-enUS-ptr-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\Launcher.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.3.0.10554-to-0.3.0.10571-enUS-ptr-downloader.exe"=
"c:\\Program Files\\World of Warcraft Public Test\\WoW-0.3.0.10571-to-0.3.0.10596-enUS-ptr-downloader.exe"=
"c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
"c:\\Program Files\\BitTorrent\\bittorrent.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"58964:TCP"= 58964:TCP:Pando Media Booster
"58964:UDP"= 58964:UDP:Pando Media Booster
"3724:TCP"= 3724:TCP:Blizzard Downloader: 3724

R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [3/16/2010 1:03 PM 207280]
.
Contents of the 'Scheduled Tasks' folder

2010-04-06 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 16:34]

2010-04-08 c:\windows\Tasks\MP Scheduled Scan.job
- c:\program files\Microsoft Security Essentials\MpCmdRun.exe [2009-12-09 22:02]

2007-09-04 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2004-08-10 08:38]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q404&bd=presario&pf=desktop
uDefault_Search_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
mSearch Bar = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_US&c=Q404&bd=presario&pf=desktop
uInternet Settings,ProxyOverride = <local>
IE: E&xport to Microsoft Excel - c:\progra~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
IE: {{898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - c:\program files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
FF - ProfilePath - c:\documents and settings\Compaq_Owner\Application Data\Mozilla\Firefox\Profiles\fte4u602.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/
FF - plugin: c:\documents and settings\All Users\Application Data\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\program files\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npPandoWebInst.dll

---- FIREFOX POLICIES ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_colors", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.use_native_popup_windows", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.enable_click_image_resizing", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("accessibility.browsewithcaret_shortcut. enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.high_water_mark", 32);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("javascript.options.mem.gc_frequency",   1600);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.auth.force-generic-ntlm", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("svg.smil.enabled", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("ui.trackpoint_hack.enabled", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.debug",            false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.agedWeight",       2);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.bucketSize",       1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.maxTimeGroupings", 25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.timeGroupingSize", 604800);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.boundaryWeight",   25);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.formfill.prefixWeight",     5);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("html5.enable", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.allow_unrestricted_renego_ everywhere__temporarily_available_pref", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.renego_unrestricted_hosts", "");
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.treat_unsafe_negotiation_a s_broken", false);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.ssl.require_safe_negotiation",  false);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.download.backgroundInterval", 600);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("app.update.url.manual", "http://www.firefox.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-ja", "mozff");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.name", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.{972ce4c6-7e08-4474-a285-3208198ce6fd}.description", "chrome://browser/locale/browser.properties");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add", "addons.mozilla.org");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("xpinstall.whitelist.add.36", "getpersonas.com");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("lightweightThemes.update.enabled", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.allTabs.previews", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.hide_infobar_for_outdated_plugi n", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("plugins.update.notifyUser", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("toolbar.customization.usesheet", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.enable", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.max", 20);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.taskbar.previews.cachetime", 20);
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-04-07 20:32
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(956)
c:\windows\system32\WININET.dll
c:\docume~1\COMPAQ~1\LOCALS~1\Temp\IadHide5.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Microsoft Security Essentials\MsMpEng.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\VTTimer.exe
c:\program files\iPod\bin\iPodService.exe
.
**************************************************************************
.
Completion time: 2010-04-07  20:38:05 - machine was rebooted
ComboFix-quarantined-files.txt  2010-04-08 00:38
ComboFix2.txt  2010-04-06 03:21
ComboFix3.txt  2010-04-04 08:17
ComboFix4.txt  2010-03-30 20:33
ComboFix5.txt  2010-04-08 00:22

Pre-Run: 69,310,857,216 bytes free
Post-Run: 69,284,540,416 bytes free

- - End Of File - - BCF769C084FB0DA2B40BE1C5963A1F43

[SuperDave]

Ok. We'll wait a few days to see what happens. In the meantime let's run this scan.
ESET Online Scan

Scan your computer with the ESET FREE Online Virus Scan

* Click the ESET Online Scanner button.

* For alternate browsers only: (Microsoft Internet Explorer users can skip these steps)
* Click on the esetsmartinstaller_enu.exe to download the ESET Smart Installer. Save it to your desktop
* Double click on the esetsmartinstaller_enu.exe icon on your desktop.
* Place a check mark next to YES, I accept the Terms of Use.

* Click the Start button.
* Accept any security warnings from your browser.
* Leave the check mark next to Remove found threats and place a check next to Scan archives.
* Click the Start button.
* ESET will then download updates, install, and begin scanning your computer. Please be patient as this can take some time.
* When the scan completes, click List of found threats.
* Next click Export to text file and save the file to your desktop using a name such as ESETScan. Include the contents of this report in your next reply.
* Click the Back button then click Finish.

In your next reply please include the ESET Online Scan Log