Please help. My computer is running very slowly. I had Winantivirus popups for a while, but they are gone now.

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified. Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop. Doubleclick on the HJTsetup.exe icon on your desktop. By default it will install to C:\Program Files\Hijack This. Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue. Put a check by "Create a desktop icon" then click "Next" again. Continue to follow the rest of the prompts from there. At the final dialogue box click "Finish" and it will launch Hijack This. Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread. Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Thank You for the reply here is the log file Logfile of HijackThis v1.99.1 Scan saved at 7:51:20 PM, on 10/17/2006 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ngvpnmgr.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe D:\Avast4\aswUpdSv.exe D:\Avast4\ashServ.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe D:\AVGFRE~1\avgamsvr.exe C:\WINDOWS\Explorer.exe D:\AVGFRE~1\avgupsvc.exe D:\AVGFRE~1\avgemc.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe C:\WINDOWS\system32\inetsrv\inetinfo.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe D:\AVGFRE~1\avgcc.exe D:\MySQL\bin\mysqld-nt.exe D:\ZoneAlarm\zlclient.exe D:\Avast4\ashDisp.exe C:\WINDOWS\System32\snmp.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\mqsvc.exe C:\Program Files\MSN Messenger\MsnMsgr.exe C:\WINDOWS\system32\mqtgsvc.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe D:\Avast4\ashMaiSv.exe D:\Avast4\ashWebSv.exe D:\Acrobat 6.0\Distillr\acrotray.exe D:\Apache\bin\ApacheMonitor.exe D:\SpywareGuard\sgmain.exe D:\SpywareGuard\sgbhp.exe D:\BugsysClub Software\BugsysClub Software.exe D:\BugsysClub Software\jre\bin\javaw.exe C:\Program Files\Outlook Express\msimn.exe D:\UB\UltimateBet.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe D:\MATLAB\bin\win32\meditor.exe D:\MATLAB\bin\win32\meditor.exe D:\MATLAB\bin\win32\meditor.exe D:\MATLAB\bin\win32\meditor.exe D:\MATLAB\bin\win32\meditor.exe D:\MATLAB\bin\win32\meditor.exe D:\Matlab\bin\win32\meditor.exe D:\Matlab\bin\win32\MATLAB.exe D:\MATLAB\bin\win32\meditor.exe D:\MATLAB\bin\win32\meditor.exe D:\Firefox\firefox.exe C:\HiJack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.com/ O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0B6DBE08-1666-465E-8B97-CD56CA9CD426} - C:\WINDOWS\system32\jkhfd.dll (file missing) O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\system32\ulnkwmcp.dll (file missing) O2 - BHO: SpywareGuard Download Protection - {4A368E80-174F-4872-96B5-0B27DDD11DB2} - D:\SpywareGuard\dlprotect.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - D:\Acrobat 6.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [AVG7_CC] D:\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [Zone Labs Client] "D:\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [avast!] D:\Avast4\ashDisp.exe O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.exe" /background O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Spybot - Search & Destroy\TeaTimer.exe O4 - Startup: SpywareGuard.lnk = D:\SpywareGuard\sgmain.exe O4 - Global Startup: Acrobat Assistant.lnk = D:\Acrobat 6.0\Distillr\acrotray.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Adobe\Acrobat\Reader\reader_sl.exe O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe O4 - Global Startup: Microsoft Office.lnk = D:\Microsoft Office\Office10\OSA.exe O4 - Global Startup: Monitor Apache Servers.lnk = D:\Apache\bin\ApacheMonitor.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\MICROS~1\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - D:\UB\UltimateBet.exe O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - D:\UB\UltimateBet.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\PartyPoker\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\PartyPoker\PartyPoker\RunApp.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {5EDB10D9-7E95-4833-A218-62F375DAFCF1} (Aventail Installer ) - https://remote-nyc.wmg.com/postauthI/epi.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active... O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing) O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\system32\acs.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Apache2.2 - Unknown owner - D:\Apache\bin\httpd.exe" -k runservice (file missing) O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - D:\Avast4\aswUpdSv.exe O23 - Service: avast! Antivirus - Unknown owner - D:\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - D:\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - D:\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - D:\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - D:\AVGFRE~1\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - D:\AVGFRE~1\avgemc.exe O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\system32\CTsvcCDA.exe (file missing) O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe O23 - Service: MySQL - Unknown owner - D:\MySQL\bin\mysqld-nt".exe (file missing) O23 - Service: Aventail VPN Client (NgVpnMgr) - Aventail Corporation - C:\WINDOWS\system32\ngvpnmgr.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

You should decide which antivirus you want and uninstall the other as they will conflict. Please download ATF-Cleaner to your desktop from this link http://www.atribune.org/content/view/19/2/ We will need it later in safe mode Download and install Ewido Security Suite We will need this later in safe mode Be sure to update Ewido Please download ComboFix to the Desktop from this link: http://download.bleepingcomputer.com/sUBs/combofix.exe Double-click combofix.exe Follow the prompts. (Don't click on the window while the program is running, it may cause your system to hang.) Please post the log located at C:\Combofix.txt then continue. Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok. Next, please reboot your computer in Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, a menu with options should appear; Select the first option, to run Windows in Safe Mode, then press "Enter". Choose your usual account. Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked": O2 - BHO: (no name) - {0B6DBE08-1666-465E-8B97-CD56CA9CD426} - C:\WINDOWS\system32\jkhfd.dll (file missing) O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\system32\ulnkwmcp.dll (file missing) O9 - Extra 'Tools' menuitem: UltimateBet - {94148DB5-B42D-4915-95DA-2CBB4F7095BF} - D:\UB\UltimateBet.exe O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\PartyPoker\PartyPoker\RunApp.exe (file missing) O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - D:\PartyPoker\PartyPoker\RunApp.exe (file missing) Exit Hijack This but remain in safe mode Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. In Safe Mode, run Ewido and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared. Ewido will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. Ewido will display "All actions have been applied" on the right hand side. Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop). Reboot into normal mode and post the Ewido report on you desktop.

Thank You. I've completed the steps you have mentioned. Here is the Combofix log Dan - 06-10-17 21:39:36.75 Service Pack 2 ComboFix 06.10.16 - Running from: "C:\Documents and Settings\Dan\Desktop" (((((((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe ((((((((((((((((((((((((((((((( Files Created from 2006-09-17 to 2006-10-17 )))))))))))))))))))))))))))))))))) 2006-10-15 15:22 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys 2006-10-14 00:53 87,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2006-10-14 00:53 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2006-10-14 00:53 36,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2006-10-14 00:53 24,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2006-10-14 00:53 16,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2006-10-14 00:52 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2006-10-14 00:52 666,240 --a------ C:\WINDOWS\system32\aswBoot.exe 2006-10-13 14:45 76,560 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys 2006-10-03 02:26 37,027 --a------ C:\WINDOWS\atmoUn.exe 2006-09-30 17:10 15,104 --a------ C:\WINDOWS\system32\drivers\usbscan.sys 2006-09-30 17:09 98,304 --a------ C:\WINDOWS\system32\PSCLU113.dll 2006-09-30 17:09 53,248 --a------ C:\WINDOWS\system32\pscND113.exe 2006-09-30 17:09 49,152 --a------ C:\WINDOWS\system32\pscVSWIA.dll 2006-09-30 17:09 356,352 --a------ C:\WINDOWS\system32\pscUD113.dll 2006-09-18 14:11 778,240 --a------ C:\WINDOWS\system32\divx_xx0c.dll 2006-09-18 14:11 778,240 --a------ C:\WINDOWS\system32\divx_xx07.dll 2006-09-18 14:11 761,856 --a------ C:\WINDOWS\system32\divx_xx11.dll 2006-09-18 14:11 620,180 --a------ C:\WINDOWS\system32\DivX.dll (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-10-17 21:42 -------- d-------- C:\Program Files\Common Files 2006-10-15 15:21 -------- d-------- C:\Program Files\Grisoft 2006-10-14 04:19 -------- d-------- C:\Documents and Settings\Dan\Application Data\Mozilla 2006-10-14 02:29 -------- d-------- C:\Program Files\Three Rings Design 2006-10-14 02:03 -------- d-------- C:\Program Files\Google 2006-10-13 14:45 -------- d-------- C:\Program Files\Internet Explorer 2006-10-03 16:44 -------- d-------- C:\Program Files\QuickTime 2006-10-03 16:41 -------- d-------- C:\Program Files\Apple Software Update 2006-10-03 02:26 -------- d-------- C:\Program Files\Viewpoint 2006-10-03 02:26 -------- d-------- C:\Documents and Settings\Dan\Application Data\AdobeUM 2006-10-03 02:25 -------- d-------- C:\Program Files\Adobe 2006-09-30 17:09 -------- d-------- C:\Program Files\Canon 2006-09-28 10:45 778656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys 2006-09-22 00:39 -------- d-------- C:\Program Files\DivX 2006-09-20 02:07 -------- d-------- C:\Documents and Settings\Dan\Application Data\MathWorks 2006-09-13 20:01 -------- d-------- C:\Documents and Settings\Dan\Application Data\Google 2006-09-08 16:31 -------- d-------- C:\Program Files\WinZip 2006-09-02 20:56 -------- d-------- C:\Documents and Settings\Dan\Application Data\MySQL 2006-08-22 06:22 -------- d-------- C:\Program Files\Macromedia 2006-08-11 13:35 520192 --a------ C:\WINDOWS\system32\DivXsm.exe 2006-08-11 13:35 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2006-08-11 13:35 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2006-08-11 13:35 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2006-08-11 13:31 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2006-08-11 13:31 593920 --a------ C:\WINDOWS\system32\dpuGUI11.dll 2006-08-11 13:31 57344 --a------ C:\WINDOWS\system32\dpv11.dll 2006-08-11 13:31 53248 --a------ C:\WINDOWS\system32\dpuGUI10.dll 2006-08-11 13:31 344064 --a------ C:\WINDOWS\system32\dpus11.dll 2006-08-11 13:31 294912 --a------ C:\WINDOWS\system32\dpu11.dll 2006-08-11 13:31 294912 --a------ C:\WINDOWS\system32\dpu10.dll 2006-08-11 13:31 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2006-08-11 13:31 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll 2006-08-11 13:31 118784 --a------ C:\WINDOWS\system32\DivXCodecUpdateChecker.exe 2006-07-17 23:36 21504 --a------ C:\Documents and Settings\Dan\Application Data\GDIPFONTCACHEV1.DAT (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe" "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background" "swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.908.5008\\GoogleToolbarNotifier.exe" "SpybotSD TeaTimer"="D:\\Spybot - Search & Destroy\\TeaTimer.exe" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "MsmqIntCert"="regsvr32 /s mqrt.dll" "UpdReg"="C:\\WINDOWS\\UpdReg.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_06\\bin\\jusched.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "AVG7_CC"="D:\\AVGFRE~1\\avgcc.exe /STARTUP" "Zone Labs Client"="\"D:\\ZoneAlarm\\zlclient.exe\"" "avast!"="D:\\Avast4\\ashDisp.exe" "!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "Installed"="1" "NoChange"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="My Current Home Page" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,c0,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "AVG7_Run"="D:\\AVGFRE~1\\avgw.exe /RUNONCE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5" "{81559C35-8464-49F7-BB0E-07A383BEF910}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^QuickBooks Update Agent.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\QuickBooks Update Agent.lnk" "backup"="C:\\WINDOWS\\pss\\QuickBooks Update Agent.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\COMMON~1\\Intuit\\QUICKB~1\\QBUpdate\\qbupdate.exe " "item"="QuickBooks Update Agent" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^SMCWPCI-G 54Mbps Wireless PCI adapter.lnk] "path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\SMCWPCI-G 54Mbps Wireless PCI adapter.lnk" "backup"="C:\\WINDOWS\\pss\\SMCWPCI-G 54Mbps Wireless PCI adapter.lnkCommon Startup" "location"="Common Startup" "command"="C:\\PROGRA~1\\SMC\\SMCWPC~1\\Monitor.exe " "item"="SMCWPCI-G 54Mbps Wireless PCI adapter" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="CTSysVol" "hkey"="HKLM" "command"="D:\\Installs\\Drivers\\SoundBlaster\\Surround Mixer\\CTSysVol.exe /r" "inimapping"="0" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg] "key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" "item"="GoogleToolbarNotifier" "hkey"="HKCU" "command"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe" "inimapping"="0" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Contents of the 'Scheduled Tasks' folder C:\WINDOWS\tasks\AppleSoftwareUpdate.job Completion time: 06-10-17 21:58:09.64 C:\ComboFix.txt ... 06-10-17 21:58 C:\ComboFix2.txt ... 06-10-17 20:56 C:\ComboFix3.txt ... 06-10-17 20:42

Here is the Ewido Log AVG Anti-Spyware - Scan Report + Created at: 12:47:33 AM 10/18/2006 + Scan result: C:\VundoFix Backups\gebaaab.dll.bad -> Adware.Virtumonde : Cleaned. D:\Avast4\DATA\moved\[UPX].2.vir -> Downloader.PurityScan.dc : Cleaned. D:\Avast4\DATA\moved\[UPX].vir -> Downloader.PurityScan.dc : Cleaned. :mozilla.207:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.221:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.222:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.223:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adjuggler : Cleaned. :mozilla.124:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.125:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.194:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.195:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.196:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.197:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned. :mozilla.126:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.137:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Clickbank : Cleaned. :mozilla.138:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Com : Cleaned. :mozilla.143:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.144:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.145:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.146:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.272:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned. :mozilla.206:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Overture : Cleaned. :mozilla.212:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned. :mozilla.230:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.231:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.232:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.233:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.234:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.235:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.236:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.293:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.294:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.295:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned. :mozilla.220:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Revenue : Cleaned. :mozilla.10:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.11:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.12:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.13:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.14:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.15:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.6:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.7:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.8:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.9:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned. :mozilla.63:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned. :mozilla.192:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Tracking101 : Cleaned. :mozilla.255:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.256:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.257:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.258:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.259:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.260:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.261:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.262:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned. :mozilla.263:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.283:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.39:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.40:C:\Documents and Settings\Dan\Application Data\Mozilla\Firefox\Profiles\7wcdfbw2.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. ::Report end

All I see is that you did not set Ewido to "Quaratine". I would set that then run Ewido once more in safe mode. Are you running any better?