I'm also infected with the Klone Virus that's have been spreading around lately. I'll be grateful for any assistance in removing it. Thanks in advance.

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.

Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.

Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Please download SmitRemFix from this link http://siri.urz.free.fr/Fix/SmitfraudFix.zip Then extract the contents to your desktop.

!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!

Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Here is my HijackThis Log:
Logfile of HijackThis v1.99.1
Scan saved at 11:31:18 PM, on 10/19/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamefaqs.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} (USBAPTester Class) - http://www.nintendowifi.com/trouble...
O16 - DPF: {E0BE586C-7C66-4909-94D6-D18BBBDD6373} (????????????) - http://www.filebank.co.jp/setup/win...
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

---
Here is the log report from SmitfaudFix:

SmitFraudFix v2.111

Scan done at 23:33:24.17, Thu 10/19/2006
Run from C:\Documents and Settings\Compaq_Administrator\Desktop\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Administrator

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Compaq_Administrator\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\COMPAQ~1\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Please download ComboFix to the Desktop from this link:

http://download.bleepingcomputer.com/sUBs/combofix.exe

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

Please post the combofix.txt log.

Here is the ComboFix Log:

Compaq_Administrator - 06-10-20 16:37:31.29 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Compaq_Administrator\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-20 to 2006-10-20 ))))))))))))))))))))))))))))))))))


2006-10-19 18:48 67,604 --a------ C:\WINDOWS\system32\ekhdcftc.exe
2006-10-18 13:21 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2006-10-18 12:50 611,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-10-15 13:06 778,656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-10-15 13:06 4,288 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-10-15 13:06 27,904 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-10-15 13:06 23,104 --a------ C:\WINDOWS\system32\drivers\avgmfrs.sys
2006-09-26 04:22 143,380 --a------ C:\WINDOWS\system32\busdianx.exe

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-20 13:54 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-19 18:49 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\SearchToolbarCorp
2006-10-19 18:48 -------- d-------- C:\Program Files\VSToolbar
2006-10-18 16:26 -------- d-------- C:\Program Files\SEGA
2006-10-18 15:47 -------- d-------- C:\Program Files\Google
2006-10-18 12:53 -------- d-------- C:\Program Files\DAEMON Tools
2006-10-16 00:26 -------- d-------- C:\Program Files\mIRC
2006-10-15 13:16 -------- d-------- C:\Program Files\Zone Labs
2006-10-15 13:06 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\AVG7
2006-10-15 13:05 -------- d-------- C:\Program Files\Grisoft
2006-10-15 13:05 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-10-12 06:45 -------- d-------- C:\Program Files\Quicken
2006-10-01 20:18 -------- d-------- C:\Program Files\WiFiConnector
2006-09-28 15:37 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Netscape
2006-09-28 15:09 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Lavasoft
2006-09-28 15:08 -------- d-------- C:\Program Files\Lavasoft
2006-09-16 19:07 -------- d-------- C:\Program Files\BitComet
2006-09-15 22:38 -------- d-------- C:\Program Files\Trillian
2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-03 18:56 -------- d-------- C:\Program Files\DISC
2006-08-29 18:35 13844 --a------ C:\WINDOWS\system32\mhuegwqr.exe
2006-08-28 18:34 13844 --a------ C:\WINDOWS\system32\qrhgqljm.exe
2006-08-28 02:56 13844 --a------ C:\WINDOWS\system32\kuvqosrq.exe
2006-08-28 02:55 13844 --a------ C:\WINDOWS\system32\vkofrsee.exe
2006-08-27 22:47 13844 --a------ C:\WINDOWS\system32\rpgjmyvt.exe
2006-08-27 22:37 13844 --a------ C:\WINDOWS\system32\hdifhiqr.exe
2006-08-27 17:38 13844 --a------ C:\WINDOWS\system32\tchghgbk.exe
2006-08-26 23:19 13844 --a------ C:\WINDOWS\system32\jjouvomm.exe
2006-08-26 17:23 13844 --a------ C:\WINDOWS\system32\qfydhokp.exe
2006-08-26 01:31 13844 --a------ C:\WINDOWS\system32\xwegpmjo.exe
2006-08-25 22:16 13844 --a------ C:\WINDOWS\system32\cmifibbg.exe
2006-08-25 19:42 -------- d-------- C:\Program Files\Internet Explorer
2006-08-25 19:31 13844 --a------ C:\WINDOWS\system32\nptighch.exe
2006-08-25 17:46 13844 --a------ C:\WINDOWS\system32\dhpgjrxg.exe
2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-24 03:06 13844 --a------ C:\WINDOWS\system32\qiibsbbk.exe
2006-08-23 17:44 13844 --a------ C:\WINDOWS\system32\wwvxcnlk.exe
2006-08-23 07:14 13844 --a------ C:\WINDOWS\system32\cjllstvi.exe
2006-08-23 01:28 13844 --a------ C:\WINDOWS\system32\goccists.exe
2006-08-22 20:59 13844 --a------ C:\WINDOWS\system32\vamwvlll.exe
2006-08-22 20:54 13844 --a------ C:\WINDOWS\system32\dkidyctq.exe
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-19 18:38 51716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2006-08-19 18:38 118784 --a------ C:\WINDOWS\system32\pdfmona.dll
2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-07 10:58 176235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2006-07-27 08:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-21 03:24 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"DiscUpdateManager"="C:\\Program Files\\DISC\\DiscUpdateMgr.exe"
@=""
"PCDrProfiler"=""
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Compaq Connections.lnk"
"backup"="C:\\WINDOWS\\pss\\Compaq Connections.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMPAQ~1\\5577497\\Program\\COMPAQ~1.EXE -startup"
"item"="Compaq Connections"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Compaq_Administrator^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
"path"="C:\\Documents and Settings\\Compaq_Administrator\\Start Menu\\Programs\\Startup\\WinMySQLadmin.lnk"
"backup"="C:\\WINDOWS\\pss\\WinMySQLadmin.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\xampp\\mysql\\bin\\WINMYS~1.EXE "
"item"="WinMySQLadmin"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ewido"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DISCover"
"hkey"="HKLM"
"command"="C:\\Program Files\\DISC\\DISCover.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPwuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPwuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zlclient"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MySql"=dword:00000002
"FileZilla Server"=dword:00000002
"Avg7UpdSvc"=dword:00000002
"Avg7Alrt"=dword:00000002
"Apache2"=dword:00000002
"ewido anti-spyware 4.0 guard"=dword:00000002

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bvent
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cmdesk

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Easy Internet Sign-up.job
C:\WINDOWS\tasks\Warranty Reminder 11 Months.job

Completion time: 06-10-20 16:39:35.64
C:\ComboFix.txt ... 06-10-20 16:39

Rename hijackthis.exe as that sometime helps locate the baddies. Go to start> search> files and folders> type in the top space "hijackthis.exe" without the quotes> click search> when it is found in the right pane (looks like a pile of dynamite)>right click on it> click rename> rename it "show.exe" without the quotes> click a blank space on the screen.

Please download VundoFix.exe to your C:\.
Double-click VundoFix.exe to run it.
Click the Scan for Vundo button.
Once it's done scanning, click the Remove Vundo button.
You will receive a prompt asking if you want to remove the files, click YES
Once you click yes, your desktop will go blank as it starts removing Vundo.
When completed, it will prompt that it will shutdown your computer, click OK.
Turn your computer back on.
Note: It is possible that VundoFix encountered a file it could not remove.
In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

Post the log located at C:\Vundofix.txt please.

Do you want me to repost the HijackThis Log made from the renamed "show.exe"?

Here is the Vundofix.txt Log:

VundoFix V6.2.6

Checking Java version...

Java version is 1.5.0.5

Scan started at 10:11:23 PM 10/20/2006

Listing files found while scanning....

C:\WINDOWS\system32\cmdesk.dll
C:\WINDOWS\system32\busdianx.exe
C:\WINDOWS\system32\cjllstvi.exe
C:\WINDOWS\system32\cmifibbg.exe
C:\WINDOWS\system32\dhpgjrxg.exe
C:\WINDOWS\system32\dkidyctq.exe
C:\WINDOWS\system32\goccists.exe
C:\WINDOWS\system32\hdifhiqr.exe
C:\WINDOWS\system32\jjouvomm.exe
C:\WINDOWS\system32\kuvqosrq.exe
C:\WINDOWS\system32\mhuegwqr.exe
C:\WINDOWS\system32\nptighch.exe
C:\WINDOWS\system32\qfydhokp.exe
C:\WINDOWS\system32\qiibsbbk.exe
C:\WINDOWS\system32\qrhgqljm.exe
C:\WINDOWS\system32\rpgjmyvt.exe
C:\WINDOWS\system32\tchghgbk.exe
C:\WINDOWS\system32\vamwvlll.exe
C:\WINDOWS\system32\vkofrsee.exe
C:\WINDOWS\system32\wwvxcnlk.exe
C:\WINDOWS\system32\xwegpmjo.exe
C:\WINDOWS\Registration\bvent.dll
C:\WINDOWS\Registration\tnevb.ini
C:\WINDOWS\Registration\tnevb.bak1
C:\WINDOWS\Registration\tnevb.bak2

Beginning removal...

Attempting to delete C:\WINDOWS\system32\cmdesk.dll
C:\WINDOWS\system32\cmdesk.dll Has been deleted!

Attempting to delete C:\WINDOWS\system32\busdianx.exe
C:\WINDOWS\system32\busdianx.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\cjllstvi.exe
C:\WINDOWS\system32\cjllstvi.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\cmifibbg.exe
C:\WINDOWS\system32\cmifibbg.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\dhpgjrxg.exe
C:\WINDOWS\system32\dhpgjrxg.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\dkidyctq.exe
C:\WINDOWS\system32\dkidyctq.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\goccists.exe
C:\WINDOWS\system32\goccists.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\hdifhiqr.exe
C:\WINDOWS\system32\hdifhiqr.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\jjouvomm.exe
C:\WINDOWS\system32\jjouvomm.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\kuvqosrq.exe
C:\WINDOWS\system32\kuvqosrq.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\mhuegwqr.exe
C:\WINDOWS\system32\mhuegwqr.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\nptighch.exe
C:\WINDOWS\system32\nptighch.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\qfydhokp.exe
C:\WINDOWS\system32\qfydhokp.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\qiibsbbk.exe
C:\WINDOWS\system32\qiibsbbk.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\qrhgqljm.exe
C:\WINDOWS\system32\qrhgqljm.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\rpgjmyvt.exe
C:\WINDOWS\system32\rpgjmyvt.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\tchghgbk.exe
C:\WINDOWS\system32\tchghgbk.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\vamwvlll.exe
C:\WINDOWS\system32\vamwvlll.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\vkofrsee.exe
C:\WINDOWS\system32\vkofrsee.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\wwvxcnlk.exe
C:\WINDOWS\system32\wwvxcnlk.exe Has been deleted!

Attempting to delete C:\WINDOWS\system32\xwegpmjo.exe
C:\WINDOWS\system32\xwegpmjo.exe Has been deleted!

Attempting to delete C:\WINDOWS\Registration\bvent.dll
C:\WINDOWS\Registration\bvent.dll Could not be deleted.

Attempting to delete C:\WINDOWS\Registration\tnevb.ini
C:\WINDOWS\Registration\tnevb.ini Has been deleted!

Attempting to delete C:\WINDOWS\Registration\tnevb.bak1
C:\WINDOWS\Registration\tnevb.bak1 Has been deleted!

Attempting to delete C:\WINDOWS\Registration\tnevb.bak2
C:\WINDOWS\Registration\tnevb.bak2 Has been deleted!

Performing Repairs to the registry.
Done!

VundoFix V6.2.6

Checking Java version...

Java version is 1.5.0.5

Scan started at 10:19:52 PM 10/20/2006

Listing files found while scanning....

No infected files were found.

Beginning removal...

Please post a new combo fix log and a new hijack this log please.

Here is my new ComboFix Log:

Compaq_Administrator - 06-10-21 2:12:59.57 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Compaq_Administrator\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-21 to 2006-10-21 ))))))))))))))))))))))))))))))))))


2006-10-20 22:10 88,576 --a------ C:\VundoFix.exe
2006-10-19 18:48 67,604 --a------ C:\WINDOWS\system32\ekhdcftc.exe
2006-10-18 13:21 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2006-10-18 12:50 611,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2006-10-15 13:06 778,656 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2006-10-15 13:06 4,288 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2006-10-15 13:06 27,904 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2006-10-15 13:06 23,104 --a------ C:\WINDOWS\system32\drivers\avgmfrs.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-21 02:11 -------- d-------- C:\Program Files\Hijackthis
2006-10-20 22:35 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-19 18:49 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\SearchToolbarCorp
2006-10-19 18:48 -------- d-------- C:\Program Files\VSToolbar
2006-10-18 16:26 -------- d-------- C:\Program Files\SEGA
2006-10-18 15:47 -------- d-------- C:\Program Files\Google
2006-10-18 12:53 -------- d-------- C:\Program Files\DAEMON Tools
2006-10-16 00:26 -------- d-------- C:\Program Files\mIRC
2006-10-15 13:16 -------- d-------- C:\Program Files\Zone Labs
2006-10-15 13:06 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\AVG7
2006-10-15 13:05 -------- d-------- C:\Program Files\Grisoft
2006-10-15 13:05 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-10-12 06:45 -------- d-------- C:\Program Files\Quicken
2006-10-01 20:18 -------- d-------- C:\Program Files\WiFiConnector
2006-09-28 15:37 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Netscape
2006-09-28 15:09 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Lavasoft
2006-09-28 15:08 -------- d-------- C:\Program Files\Lavasoft
2006-09-16 19:07 -------- d-------- C:\Program Files\BitComet
2006-09-15 22:38 -------- d-------- C:\Program Files\Trillian
2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-03 18:56 -------- d-------- C:\Program Files\DISC
2006-08-25 19:42 -------- d-------- C:\Program Files\Internet Explorer
2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-19 18:38 51716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2006-08-19 18:38 118784 --a------ C:\WINDOWS\system32\pdfmona.dll
2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-07 10:58 176235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2006-07-27 08:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-07-21 03:24 72704 --a------ C:\WINDOWS\system32\hlink.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"DiscUpdateManager"="C:\\Program Files\\DISC\\DiscUpdateMgr.exe"
@=""
"PCDrProfiler"=""
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"!ewido"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="ewido anti-spyware 4.0"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Compaq Connections.lnk"
"backup"="C:\\WINDOWS\\pss\\Compaq Connections.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMPAQ~1\\5577497\\Program\\COMPAQ~1.EXE -startup"
"item"="Compaq Connections"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Compaq_Administrator^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
"path"="C:\\Documents and Settings\\Compaq_Administrator\\Start Menu\\Programs\\Startup\\WinMySQLadmin.lnk"
"backup"="C:\\WINDOWS\\pss\\WinMySQLadmin.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\xampp\\mysql\\bin\\WINMYS~1.EXE "
"item"="WinMySQLadmin"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ewido"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DISCover"
"hkey"="HKLM"
"command"="C:\\Program Files\\DISC\\DISCover.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPwuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPwuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zlclient"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MySql"=dword:00000002
"FileZilla Server"=dword:00000002
"Avg7UpdSvc"=dword:00000002
"Avg7Alrt"=dword:00000002
"Apache2"=dword:00000002
"ewido anti-spyware 4.0 guard"=dword:00000002

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bvent

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Easy Internet Sign-up.job
C:\WINDOWS\tasks\Warranty Reminder 11 Months.job

Completion time: 06-10-21 2:14:46.54
C:\ComboFix.txt ... 06-10-21 02:14
C:\ComboFix2.txt ... 06-10-20 16:39

--------------------
END LOG
--------------------

Here is my New HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 2:11:51 AM, on 10/21/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ehome\mcrdsvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\Program Files\DISC\DiscUpdateMgr.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\WiFiConnector\NintendoWFCReg.exe
C:\HP\KBD\KBD.EXE
C:\WINDOWS\ALCXMNTR.EXE
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Hijackthis\show.exe.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gamefaqs.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?T...
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?T...
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\system32\owsclhlu.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {6C152929-C45E-4CE7-923E-A3B5EF3ACD13} - (no file)
O2 - BHO: (no name) - {78C60815-BB32-4399-BA39-7D8E0392F040} - C:\WINDOWS\Registration\bvent.dll
O2 - BHO: (no name) - {a4688412-0fb0-4752-9d0e-3e865fc790d8} - C:\WINDOWS\system32\cmdesk.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [AlwaysReady Power Message APP] ARPWRMSG.EXE
O4 - HKLM\..\Run: [DiscUpdateManager] C:\Program Files\DISC\DiscUpdateMgr.exe
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Run Nintendo Wi-Fi USB Connector Registration Tool.lnk = C:\Program Files\WiFiConnector\NintendoWFCReg.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: http://locator.cdn.imageservr.com
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {040F4385-8DAD-4306-94BF-B8291D841FAE} (USBAPTester Class) - http://www.nintendowifi.com/trouble...
O16 - DPF: {E0BE586C-7C66-4909-94D6-D18BBBDD6373} (????????????) - http://www.filebank.co.jp/setup/win...
O20 - Winlogon Notify: bvent - C:\WINDOWS\Registration\bvent.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install AVG Anti-Spware We will need this later in safe mode

Be sure to update AVG Anti-Spyware

Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode

Download “Winhelp2002's “ domain cleaner from this link DelDomains.inf

To delete all entries in the Restricted & Trusted Zone list, right click DelDomains.inf
Select: Install

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?T...

PR0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?T...
<PP>R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.redirect.hp.com/svs/rdr?T...

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?T...

O2 - BHO: (no name) - {1DAEFCB9-06C8-47c6-8F20-3FB54B244DAA} - C:\WINDOWS\system32\owsclhlu.dll (file missing)

O2 - BHO: (no name) - {6C152929-C45E-4CE7-923E-A3B5EF3ACD13} - (no file)

O2 - BHO: (no name) - {78C60815-BB32-4399-BA39-7D8E0392F040} - C:\WINDOWS\Registration\bvent.dll

O2 - BHO: (no name) - {a4688412-0fb0-4752-9d0e-3e865fc790d8} - C:\WINDOWS\system32\cmdesk.dll (file missing)

O3 - Toolbar: &VSToolBar - {821F87FF-8245-4972-9E28-732E92EC2F51} - C:\Program Files\VSToolbar\VSToolBar.dll

O20 - Winlogon Notify: bvent - C:\WINDOWS\Registration\bvent.dll

Exit Hijack This but remain in safe mode

Run Killbox from safe mode. Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\Registration\bvent.dll

C:\Program Files\VSToolbar\VSToolBar.dll

C:\WINDOWS\system32\ekhdcftc.exe

C:\Program Files\VSToolbar\

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again.

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.

AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.

Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Reboot to normal Mode.

Open notepad (Start Menu > Run > Type notepad and press "ok".

Copy and paste everything into notepad between the x's making regedit4 the top line.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
REGEDIT4

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bvent]
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it Fix.reg then save it to your desktop.

Double click Fix.reg (or right click and choose Merge) and it will ask if you want to merge the contents into the registry, choose Yes.

Post the AVG Anit-Spyware report on your desktop, a new combofix log and a new Hijack This log please

Here is everything it took 8 hours for the AVG scan to complete.

AVG Spyware Report:

AVG Anti-Spyware - Scan Report

+ Created at: 8:07:15 AM 10/22/2006

+ Scan result:

C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP187\A0054002.dll -> Adware.Searchcolours : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP189\A0055505.exe -> Dropper.Agent.arj : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP196\A0055891.dll -> Logger.VBStat.e : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP196\A0055892.dll -> Logger.VBStat.e : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP196\A0055893.dll -> Logger.VBStat.e : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP205\A0059039.dll -> Logger.VBStat.e : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059165.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059166.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059167.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059168.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059169.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059170.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059171.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059172.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059173.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059174.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059175.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059176.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059177.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059178.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059179.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059180.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059181.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059182.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\System Volume Information\_restore{B9823275-D858-498B-A4DC-C4EEDA322F67}\RP206\A0059183.exe -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\cjllstvi.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\cmifibbg.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\dhpgjrxg.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\dkidyctq.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\goccists.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\hdifhiqr.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\jjouvomm.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\kuvqosrq.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\mhuegwqr.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\nptighch.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\qfydhokp.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\qiibsbbk.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\qrhgqljm.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\rpgjmyvt.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\tchghgbk.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\vamwvlll.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\vkofrsee.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\wwvxcnlk.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
C:\VundoFix Backups\xwegpmjo.exe.bad -> Not-A-Virus.Downloader.Win32.WinFixer.r : Cleaned.
:mozilla.388:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.247realmedia : Cleaned.
:mozilla.167:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.168:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.169:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.170:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.171:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.172:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.173:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.
:mozilla.514:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.515:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.636:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.
:mozilla.174:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.175:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.176:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.177:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.178:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.179:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.180:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.513:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Adrevolver : Cleaned.
:mozilla.158:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.159:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.160:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.161:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.162:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.
:mozilla.131:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.
:mozilla.190:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Bluestreak : Cleaned.
:mozilla.553:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.554:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.555:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Bridgetrack : Cleaned.
:mozilla.577:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.
:mozilla.373:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.374:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.375:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.376:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Burstnet : Cleaned.
:mozilla.332:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.333:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Casalemedia : Cleaned.
:mozilla.307:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.308:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Clickzs : Cleaned.
:mozilla.63:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Com : Cleaned.
:mozilla.500:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.501:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.502:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.503:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Cpvfeed : Cleaned.
:mozilla.34:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned.
:mozilla.642:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.643:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.
:mozilla.578:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Falkag : Cleaned.
:mozilla.148:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.151:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.152:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Fastclick : Cleaned.
:mozilla.354:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.355:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.356:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.405:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.481:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.613:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned.
:mozilla.193:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.194:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Linksynergy : Cleaned.
:mozilla.220:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Masterstats : Cleaned.
:mozilla.83:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Mediaplex : Cleaned.
:mozilla.584:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.587:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Onestat : Cleaned.
:mozilla.609:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.611:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Overture : Cleaned.
:mozilla.342:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.343:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.344:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.345:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.
:mozilla.314:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.315:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.316:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.
:mozilla.197:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.198:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.201:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.202:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.203:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.205:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.206:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.207:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Reliablestats : Cleaned.
:mozilla.747:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.748:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.749:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.750:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Ru4 : Cleaned.
:mozilla.132:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.133:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.134:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.135:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.136:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.
:mozilla.221:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.222:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.223:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.224:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.225:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.226:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.227:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.228:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.229:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.230:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.231:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.232:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.233:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.234:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.235:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.236:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sexcounter : Cleaned.
:mozilla.242:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.243:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.244:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.245:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.246:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.591:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Spylog : Cleaned.
:mozilla.792:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.793:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.794:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Starware : Cleaned.
:mozilla.156:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.157:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned.
:mozilla.35:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.36:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.37:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.38:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.39:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.
:mozilla.524:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Trafic : Cleaned.
:mozilla.19:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.20:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.21:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.22:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.23:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.24:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.25:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.26:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.27:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.28:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.40:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.41:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.42:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.43:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.44:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.45:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.46:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.47:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.
:mozilla.594:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Valueclick : Cleaned.
:mozilla.614:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned.
:mozilla.565:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.566:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.
:mozilla.567:C:\Documents and Settings\Compaq_Administrator\Application Data\Mozilla\Firefox\Profiles\k2wck3gk.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

::Report end

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
END LOG
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

New ComboFix Log:

Compaq_Administrator - 06-10-22 8:23:57.60 Service Pack 2
ComboFix 06.10.19 - Running from: "C:\Documents and Settings\Compaq_Administrator\Desktop"

((((((((((((((((((((((((((((((( Files Created from 2006-09-22 to 2006-10-22 ))))))))))))))))))))))))))))))))))


2006-10-21 21:10 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2006-10-20 22:10 88,576 --a------ C:\VundoFix.exe
2006-10-18 13:21 4,682 --a------ C:\WINDOWS\system32\npptNT2.sys
2006-10-18 12:50 611,064 --a------ C:\WINDOWS\system32\drivers\sptd.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-10-22 08:20 -------- d-------- C:\Program Files\Mozilla Firefox
2006-10-21 22:08 -------- d-------- C:\Program Files\Hijackthis
2006-10-21 21:11 -------- d-------- C:\Program Files\ewido anti-spyware 4.0
2006-10-21 21:10 -------- d-------- C:\Program Files\Grisoft
2006-10-19 18:49 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\SearchToolbarCorp
2006-10-18 16:26 -------- d-------- C:\Program Files\SEGA
2006-10-18 15:47 -------- d-------- C:\Program Files\Google
2006-10-18 12:53 -------- d-------- C:\Program Files\DAEMON Tools
2006-10-16 00:26 -------- d-------- C:\Program Files\mIRC
2006-10-15 13:16 -------- d-------- C:\Program Files\Zone Labs
2006-10-12 06:45 -------- d-------- C:\Program Files\Quicken
2006-10-01 20:18 -------- d-------- C:\Program Files\WiFiConnector
2006-09-28 15:37 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Netscape
2006-09-28 15:09 -------- d-------- C:\Documents and Settings\Compaq_Administrator\Application Data\Lavasoft
2006-09-28 15:08 -------- d-------- C:\Program Files\Lavasoft
2006-09-16 19:07 -------- d-------- C:\Program Files\BitComet
2006-09-15 22:38 -------- d-------- C:\Program Files\Trillian
2006-09-13 00:01 1084416 --a------ C:\WINDOWS\system32\msxml3.dll
2006-09-03 18:56 -------- d-------- C:\Program Files\DISC
2006-08-25 19:42 -------- d-------- C:\Program Files\Internet Explorer
2006-08-25 10:45 617472 --a------ C:\WINDOWS\system32\comctl32.dll
2006-08-21 07:21 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2006-08-19 18:38 51716 --a------ C:\WINDOWS\system32\pdf995mon.dll
2006-08-19 18:38 118784 --a------ C:\WINDOWS\system32\pdfmona.dll
2006-08-16 06:58 100352 --a------ C:\WINDOWS\system32\6to4svc.dll
2006-08-07 10:58 176235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2006-07-27 08:24 679424 --a------ C:\WINDOWS\system32\inetcomm.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"AlwaysReady Power Message APP"="ARPWRMSG.EXE"
"DiscUpdateManager"="C:\\Program Files\\DISC\\DiscUpdateMgr.exe"
@=""
"PCDrProfiler"=""
"HPBootOp"="\"C:\\Program Files\\Hewlett-Packard\\HP Boot Optimizer\\HPBootOp.exe\" /run"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"!AVG Anti-Spyware"="\"C:\\Program Files\\Grisoft\\AVG Anti-Spyware 7.5\\avgas.exe\" /minimized"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e4,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"DWQueuedReporting"="\"C:\\PROGRA~1\\COMMON~1\\MICROS~1\\DW\\dwtrig20.exe\" -t"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000095
"NoCDBurning"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Compaq Connections.lnk]
"path"="C:\\Documents and Settings\\All Users\\Start Menu\\Programs\\Startup\\Compaq Connections.lnk"
"backup"="C:\\WINDOWS\\pss\\Compaq Connections.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\COMPAQ~1\\5577497\\Program\\COMPAQ~1.EXE -startup"
"item"="Compaq Connections"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Compaq_Administrator^Start Menu^Programs^Startup^WinMySQLadmin.lnk]
"path"="C:\\Documents and Settings\\Compaq_Administrator\\Start Menu\\Programs\\Startup\\WinMySQLadmin.lnk"
"backup"="C:\\WINDOWS\\pss\\WinMySQLadmin.lnkStartup"
"location"="Startup"
"command"="C:\\PROGRA~1\\xampp\\mysql\\bin\\WINMYS~1.EXE "
"item"="WinMySQLadmin"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!ewido]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="ewido"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\ewido anti-spyware 4.0\\ewido.exe\" /minimized"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="avgcc"
"hkey"="HKLM"
"command"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DISCover]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="DISCover"
"hkey"="HKLM"
"command"="C:\\Program Files\\DISC\\DISCover.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPwuSchd2"
"hkey"="HKLM"
"command"="C:\\Program Files\\HP\\HP Software Update\\HPwuSchd2.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="msmsgs"
"hkey"="HKCU"
"command"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="NeroCheck"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="realsched"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Zone Labs Client]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="zlclient"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"MySql"=dword:00000002
"FileZilla Server"=dword:00000002
"Avg7UpdSvc"=dword:00000002
"Avg7Alrt"=dword:00000002
"Apache2"=dword:00000002
"ewido anti-spyware 4.0 guard"=dword:00000002

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\bvent

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\Easy Internet Sign-up.job
C:\WINDOWS\tasks\Warranty Reminder 11 Months.job

Completion time: 06-10-22 8:25:56.50
C:\ComboFix.txt ... 06-10-22 08:25
C:\ComboFix2.txt ... 06-10-21 02:14
C:\ComboFix3.txt ... 06-10-20 16:39

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
END LOG
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

New HijackThis Log:

Logfile of HijackThis v1.99.1
Scan saved at 8:27:44 AM, on 10/22/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\ARPWRMSG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\DISC\DiscUpda