Hi, i need major help with this one. my memory is constantly running at 100%. also i found multiple virus and malware on my computer. Help!!!

"Im A Nike Head / I Wear Chains That Exite The Feds"

What viruses /malware did u find

" If at first you don't succeed, Please Post Back "

Do you have your anti-virus up to date? did you boot into safe mode and run the virus scanner?
Do you have any anti-spyware scanners on your system?

" If at first you don't succeed, Please Post Back "

i used to get the winantivirus popups, but it doesent pop up any more, but im almost positive i still have i on my system. Also i found a bunch of downloaders,and trojans

this came up too (only a few)

0ngroMupb.exe
addit.exe
bpc_gu.exe
IfCX.exe

"Im A Nike Head / I Wear Chains That Exite The Feds"

yes i spent all day scanning yesterday following instructions from majorgeeks.com and they never even replied to my post. i have AVG and ad-aware... they found some stuff but my computer is still at 100%. i use my computer to play games and make music and it wont let me run the programs it just freezes.

"Im A Nike Head / I Wear Chains That Exite The Feds"

what anti-virus program do you have ?
Download Trojan Remover and Atf Cleaner and Super Anti Spyware and install these programs,then right click my comp/properties/system restore and put a check in turn off system restore
Then boot into safe mode and run the ATF Cleaner,then super anti-spyware then the trojan remover
Then while in safe mode run your Anti-Virus scanner
Post back if you need more help

" If at first you don't succeed, Please Post Back "

OK i d/l all 3 programs. they got rid of a couple things but my computer continues to run at 100% when not in safe mode. i dont even know what to do. i am so frustrated already, i wasted my whole weekend trying to get rid of this damn virus or spyware with no results. can someone PLEASE help me get rid of these for good??? any help is greatly appreciated. -Eric

"Im A Nike Head / I Wear Chains That Exite The Feds"

Look at your other post.

Please post a Hijack This log so that the files associated with the virus/spyware/hijacker can be identified.

Please download HJTsetup.exe from this link http://www.thespykiller.co.uk/files/HJTsetup.exe to your desktop.
Doubleclick on the HJTsetup.exe icon on your desktop.
By default it will install to C:\Program Files\Hijack This.
Continue to click "next" in the setup dialogue boxes until you get to the "Select Addition Tasks" dialogue.
Put a check by "Create a desktop icon" then click "Next" again.
Continue to follow the rest of the prompts from there.
At the final dialogue box click "Finish" and it will launch Hijack This.
Click on the "Do a system scan and save a logfile" button. It will scan and the log should open in notepad.
Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log and post it in this thread.

Do not fix anything yet unless you know what you are doing. This is a powerful tool that can crash the computer if used improperly.

Please download SmitFraudFix from this link http://siri.urz.free.fr/Fix/Smitfra... Then extract the contents to your desktop.
!!!! Only run option #1 as runing the other options on an uninfected computer will damage the desktop.!!!!
Open the "SmitfraudFix" folder and double-click "smitfraudfix.cmd"
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.
Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

Try this also
u have to disable the ssdp discovery service this will stop the 100 % cpu usage, go to computer right click ,left click on manage,the computer management consol,comes up ,expand the services ,,go to the right hand pane scroll down to th ssdp discovery service and right click,go to properties then stop the servivce then disable it & reboot

" If at first you don't succeed, Please Post Back "

Hey bob thanx 4 the help, it made my computer run a lil faster but the bar still says 100% neways heres the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 8:54:32 PM, on 1/8/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\WINDOWS\System32\cisvc.exe
C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\M-Audio Uno\UnoInst.exe
C:\WINDOWS\Explorer.EXE
C:\windows\system\hpsysdrv.exe
C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\WINDOWS\System32\RUNDLL32.EXE
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Compaq\Easy Access Button Support\CPQEADM.EXE
C:\Compaq\EAKDRV\EAUSBKBD.EXE
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\Compaq\EASYAC~1\BttnServ.exe
C:\WINDOWS\System32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\System32\cidaemon.exe
C:\Documents and Settings\AGoNY\Desktop\ANTIVIRUS\HijackThis.exe
C:\Program Files\Messenger\msmsgs.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presario.net/scripts/r...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)
O2 - BHO: (no name) - {22B9A67D-E689-44B6-B775-0E8FE84B4F9B} - (no file)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {} - (no file)
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [ygywcs] C:\WINDOWS\qlfayku.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [IfCX] C:\documents and settings\user\local settings\temp\IfCX.exe
O4 - HKLM\..\Run: [haaboku] C:\WINDOWS\System32\qvgkcs.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [AutoLoadervFs61RNkVPaI] "C:\WINDOWS\System32\tscwzrd.exe" /PC="AM.WILD" /HideUninstall
O4 - HKLM\..\Run: [qRUtZrpYd] C:\documents and settings\user\local settings\temp\qRUtZrpYd.exe
O4 - HKLM\..\Run: [Adstartup] C:\WINDOWS\System32\automove.exe
O4 - HKLM\..\Run: [0ngroMupb] C:\documents and settings\user\local settings\temp\0ngroMupb.exe
O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot
O4 - HKLM\..\Run: [V] C:\documents and settings\user\local settings\temp\V.exe
O4 - HKLM\..\Run: [lsfuncn] C:\WINDOWS\System32\lsfuncn.exe
O4 - HKLM\..\Run: [mdmxfrmu] C:\WINDOWS\System32\mdmxfrmu.exe
O4 - HKLM\..\Run: [chedsvcs] C:\WINDOWS\System32\chedsvcs.exe
O4 - HKLM\..\Run: [_855c] C:\WINDOWS\System32\_855c.exe
O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdtl.exe
O4 - HKLM\..\Run: [Rxagik] C:\WINDOWS\Meruoq.exe
O4 - HKLM\..\Run: [vs3g3FQ] cddcda.exe
O4 - HKLM\..\Run: [YgVGRoox] C:\PROGRA~1\vxvpourv\bYQDHcBN.exe
O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IfCX.exe] C:\documents and settings\user\local settings\temp\IfCX.exe
O4 - HKLM\..\Run: [0ngroMupb.exe] C:\documents and settings\user\local settings\temp\0ngroMupb.exe
O4 - HKLM\..\Run: [qRUtZrpYd.exe] C:\documents and settings\user\local settings\temp\qRUtZrpYd.exe
O4 - HKLM\..\Run: [V.exe] C:\documents and settings\user\local settings\temp\V.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing) (HKCU)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/res...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active...
O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.roings.com/cabs/chedown...
O17 - HKLM\System\CCS\Services\Tcpip\..\{C56FF7D1-1FC2-48ED-BEC6-BF751262F1B5}: NameServer = 209.47.15.118,64.157.143.38
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

"Im A Nike Head / I Wear Chains That Exite The Feds"

HERES SmitFraudFix scan

and hey abnormal that was for my friends computer, so i posted a new one. thanks anyway.

SmitFraudFix v2.132

Scan done at 0:17:14.37, Tue 01/09/2007
Run from C:\Documents and Settings\AGoNY\Desktop\ANTIVIRUS\New Folder\SmitfraudFix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\AGoNY

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\AGoNY\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\AGoNY\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32

»»»»»»»»»»»»»»»»»»»»»»»» Scanning wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

"Im A Nike Head / I Wear Chains That Exite The Feds"

Go to start > controlpanel > software > add/remove programs and uninstall next if present:

Oin
Yazzle by Oin
YazzleActiveX By OIN
Yazzle anything
Purityscan by Oin
Snowballwars by Oin
Cowabanga by OIN
or anything similar with Oin in it
888 toolbar
anything with 888 in it
webhancer
mywebsearch
anything with mywebsearch in it
savenow
whenUsave
ebates
webebates

If OIN not listed, download and run this uninstaller OiUninstaller.exe

Reboot when done! Really important!

Please download ATF-Cleaner to your desktop from this link
http://www.atribune.org/content/view/19/2/ We will need it later in safe mode

Download and install AVG Anti-Spyware We will need this later in safe mode

Be sure to update AVG Anti- Spyware

Download Killbox to your desktop from this link Killbox by Option^Explicit. If you already have "Killbox" update to this newer version. We will need it later in safe mode

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Set up the computer to view hidden files by going to start>control panel>folder options>view tab>tick the circle beside "show hidden files and folders" and untick the box beside "hide extensions of known file types" and "hide protected system operating files">apply>ok.

Next, please reboot your computer in Safe Mode by doing the following :

Restart your computer

After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;

Instead of Windows loading as normal, a menu with options should appear;

Select the first option, to run Windows in Safe Mode, then press "Enter".

Choose your usual account.

Run Hijack This from safe mode, close all windows except Hijack This, place a check to the left of the following items and press "fix checked":

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

R3 - Default URLSearchHook is missing

O2 - BHO: NavErrRedir Class - {0199DF25-9820-4bd5-9FEE-5A765AB4371E} - (no file)

O2 - BHO: (no name) - {22B9A67D-E689-44B6-B775-0E8FE84B4F9B} - (no file)

O2 - BHO: (no name) - {} - (no file)

O4 - HKLM\..\Run: [ygywcs] C:\WINDOWS\qlfayku.exe

O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"

O4 - HKLM\..\Run: [IfCX] C:\documents and settings\user\local settings\temp\IfCX.exe

O4 - HKLM\..\Run: [haaboku] C:\WINDOWS\System32\qvgkcs.exe

O4 - HKLM\..\Run: [AutoLoadervFs61RNkVPaI] "C:\WINDOWS\System32\tscwzrd.exe" /PC="AM.WILD" /HideUninstall

O4 - HKLM\..\Run: [qRUtZrpYd] C:\documents and settings\user\local settings\temp\qRUtZrpYd.exe

O4 - HKLM\..\Run: [Adstartup] C:\WINDOWS\System32\automove.exe

O4 - HKLM\..\Run: [0ngroMupb] C:\documents and settings\user\local settings\temp\0ngroMupb.exe

O4 - HKLM\..\Run: [OSS] C:\WINDOWS\system32\ossproxy.exe -boot

O4 - HKLM\..\Run: [V] C:\documents and settings\user\local settings\temp\V.exe

O4 - HKLM\..\Run: [lsfuncn] C:\WINDOWS\System32\lsfuncn.exe

O4 - HKLM\..\Run: [mdmxfrmu] C:\WINDOWS\System32\mdmxfrmu.exe

O4 - HKLM\..\Run: [chedsvcs] C:\WINDOWS\System32\chedsvcs.exe

O4 - HKLM\..\Run: [_855c] C:\WINDOWS\System32\_855c.exe

O4 - HKLM\..\Run: [winupdtl] C:\WINDOWS\System32\winupdtl.exe

O4 - HKLM\..\Run: [Rxagik] C:\WINDOWS\Meruoq.exe

O4 - HKLM\..\Run: [vs3g3FQ] cddcda.exe

O4 - HKLM\..\Run: [YgVGRoox] C:\PROGRA~1\vxvpourv\bYQDHcBN.exe

O4 - HKLM\..\Run: [updmgr] C:\Program Files\Common files\updmgr\updmgr.exe

O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [IfCX.exe] C:\documents and settings\user\local settings\temp\IfCX.exe

O4 - HKLM\..\Run: [0ngroMupb.exe] C:\documents and settings\user\local settings\temp\0ngroMupb.exe

O4 - HKLM\..\Run: [qRUtZrpYd.exe]

C:\documents and settings\user\local settings\temp\qRUtZrpYd.exe

O4 - HKLM\..\Run: [V.exe] C:\documents and settings\user\local settings\temp\V.exe

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O9 - Extra button: (no name) - {6685509E-B47B-4f47-8E16-9A5F3A62F683} - file://C:\Program Files\Ebates_MoeMoneyMaker\Sy350\Tp350\scri350a.htm (file missing)

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {E0CE16CB-741C-4B24-8D04-A817856E07F4} - http://cabs.roings.com/cabs/chedown...

Exit Hijack This but remain in safe mode.

Run Kill box from safe mode. Please double-click Killbox.exe to run it.
Select:
Delete on Reboot
then Click on the All Files button.
Please copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy):

C:\WINDOWS\qlfayku.exe

C:\Program Files\webHancer\Programs\whSurvey.exe

C:\documents and settings\user\local settings\temp\IfCX.exe

C:\WINDOWS\System32\qvgkcs.exe

C:\WINDOWS\System32\tscwzrd.exe

C:\documents and settings\user\local settings\temp\qRUtZrpYd.exe

C:\WINDOWS\System32\automove.exe

C:\documents and settings\user\local settings\temp\0ngroMupb.exe

C:\WINDOWS\system32\ossproxy.exe

C:\documents and settings\user\local settings\temp\V.exe

C:\WINDOWS\System32\lsfuncn.exe

C:\WINDOWS\System32\mdmxfrmu.exe

C:\WINDOWS\System32\chedsvcs.exe

C:\WINDOWS\System32\_855c.exe

C:\WINDOWS\System32\winupdtl.exe

C:\WINDOWS\Meruoq.exe

C:\WINDOWS\System32\cddcda.exe

C:\PROGRA~1\vxvpourv\bYQDHcBN.exe

C:\Program Files\Common files\updmgr\updmgr.exe

C:\Program Files\winupdates\winupdates.exe

Return to Killbox, go to the File menu, and choose Paste from Clipboard.

Click the red-and-white Delete File button. Click Yes at the Delete on Reboot prompt. Click OK at any PendingFileRenameOperations prompt (and please let us know if you receive this message!).

If your computer does not restart automatically, please restart it manually.

If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run Killbox, click Here to download and run missingfilesetup.exe. Then try Killbox again.

While still in safe mode navigta to and delete these folders if found:

C:\Program Files\webHancer

C:\Program Files\vxvpourv

C:\Program Files\Common files\updmgr

C:\Program Files\winupdates

C:\Program Files\Ebates_MoeMoneyMaker

Run ATF-Cleaner from safe mode.Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

In Safe Mode, run AVG Anti-spyware and click on the Scanner tab at the top. Click the "Settings" tab and then change the recommended action to Quarantine and click Automatically generate report after every scan. Click back to the "Scan" tab and then click on Complete System Scan. This scan can take quite a while to run, so be prepared.

AVG Anti-Spyware will list any infections found on the left hand side. When the scan has finished, it will automatically set the recommended action. Click the Apply all actions button. AVG Anti-Spyware will display "All actions have been applied" on the right hand side.

Click on "Save Report", then "Save Report As". This will create a text file. Make sure you know where to find this file again (like on the Desktop).

Post the AVG-Spyware report and a new Hijack This log.

Please download ComboFix to the desktop from this link:

http://download.bleepingcomputer.com/sUBs/combofix.exe

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)

Please post the combofix.txt log.

AVG detected no threats. i could not dlete C:\Program Files\vxvpourv.. not even wit killbox hers the logs

Logfile of HijackThis v1.99.1
Scan saved at 11:19:39 PM, on 1/9/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\AGoNY\Desktop\ANTIVIRUS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presario.net/scripts/r...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YgVGRoox] C:\PROGRA~1\vxvpourv\bYQDHcBN.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/res...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active...
O17 - HKLM\System\CCS\Services\Tcpip\..\{C56FF7D1-1FC2-48ED-BEC6-BF751262F1B5}: NameServer = 209.47.15.118,64.157.143.38
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

ComboFix 06.11.27 - Running from: "C:\Documents and Settings\AGoNY\Desktop\ANTIVIRUS"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

C:\Program Files\winupdates

((((((((((((((((((((((((((((((( Files Created from 2006-12-09 to 2007-01-09 ))))))))))))))))))))))))))))))))))


2007-01-09 21:52 <DIR> d-------- C:\!KillBox
2007-01-09 00:13 6,034 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-09 00:12 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-09 00:12 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-09 00:12 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-09 00:12 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-09 00:12 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-09 00:12 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-08 07:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2007-01-07 15:34 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-01-07 15:29 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-01-07 15:29 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\SUPERAntiSpyware.com
2007-01-07 15:22 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-07 15:16 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-01-07 15:16 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-01-07 15:16 <DIR> d-------- C:\Program Files\Trojan Remover
2007-01-07 15:16 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Simply Super Software
2007-01-07 00:06 2,116 --a------ C:\35142314.exe
2007-01-06 22:03 11,254 --a------ C:\WINDOWS\system32\locate.com
2007-01-06 21:02 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-01-06 17:28 <DIR> d-------- C:\Program Files\Java
2007-01-06 17:14 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Sun
2007-01-06 17:12 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-01-06 16:55 <DIR> dr-h----- C:\Documents and Settings\AGoNY\Recent
2007-01-06 16:39 86,016 -ra------ C:\WINDOWS\system32\sbres32.dll
2007-01-06 16:39 667,136 -ra------ C:\WINDOWS\system32\drivers\sbpci.sys
2007-01-06 16:39 6,752 --a------ C:\WINDOWS\system32\PfModNT.sys
2007-01-06 16:39 59,392 -ra------ C:\WINDOWS\system\a3d.dll
2007-01-06 16:39 57,344 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-01-06 16:39 30,720 -ra------ C:\WINDOWS\system32\CTSETRes.dll
2007-01-06 16:39 135,040 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-01-06 16:39 130,048 -ra------ C:\WINDOWS\system32\ctpcir32.dll
2007-01-06 16:37 41,984 --a------ C:\WINDOWS\CTREGRUN.EXE
2007-01-06 16:37 <DIR> d-------- C:\Program Files\Creative
2007-01-06 13:35 <DIR> d-------- C:\Program Files\CCleaner
2007-01-06 12:16 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-01-06 12:16 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-01-06 12:16 <DIR> d-------- C:\Program Files\Zone Labs
2007-01-06 11:44 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Lavasoft
2007-01-06 10:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-01-05 23:03 176,128 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-01-05 23:03 <DIR> d-------- C:\WINDOWS\nview
2007-01-05 22:53 9,728 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-01-05 22:53 40,704 --a------ C:\WINDOWS\system32\drivers\es1371mp.sys
2007-01-05 21:28 <DIR> dr-h----- C:\$VAULT$.AVG
2007-01-05 21:21 <DIR> d---s---- C:\Documents and Settings\AGoNY\UserData
2007-01-05 20:48 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\acccore
2007-01-05 20:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-01-05 20:42 <DIR> d-------- C:\Program Files\AIM6
2007-01-05 20:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-01-05 20:32 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-01-05 20:32 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-01-05 20:32 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-01-05 20:32 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-01-05 20:32 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-01-05 20:32 <DIR> d-------- C:\Program Files\Grisoft
2007-01-05 20:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-01-05 20:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-01-05 20:32 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\AVG7
2007-01-05 19:55 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Macromedia
2007-01-05 19:23 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Mozilla
2007-01-05 19:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MSN6
2007-01-05 19:16 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\MSN6
2007-01-02 16:31 <DIR> d-------- C:\Program Files\vxvpourv
2007-01-02 16:30 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2007-01-02 16:30 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2007-01-02 16:30 <DIR> d-------- C:\WUTemp
2006-12-29 05:40 94,208 -ra------ C:\WINDOWS\system32\igfxtray.exe
2006-12-29 05:40 94,208 -ra------ C:\WINDOWS\system32\igfxext.exe
2006-12-29 05:40 900,218 -ra------ C:\WINDOWS\system32\ialmdd5.dll
2006-12-29 05:40 86,016 -ra------ C:\WINDOWS\system32\igfxdo.dll
2006-12-29 05:40 77,824 -ra------ C:\WINDOWS\system32\hkcmd.exe
2006-12-29 05:40 73,728 -ra------ C:\WINDOWS\system32\hccutils.dll
2006-12-29 05:40 61,440 -ra------ C:\WINDOWS\system32\iAlmCoIn_v4396.dll
2006-12-29 05:40 57,344 -ra------ C:\WINDOWS\system32\igfxsrvc.dll
2006-12-29 05:40 524,288 -ra------ C:\WINDOWS\system32\igldev32.dll
2006-12-29 05:40 49,152 -ra------ C:\WINDOWS\system32\ialmrem.dll
2006-12-29 05:40 446,464 -ra------ C:\WINDOWS\system32\igfxcfg.exe
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\igfxexps.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuTRK.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuTHA.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuSVE.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuRUS.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuPTG.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuPTB.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuPLK.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuNOR.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuNLD.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuKOR.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuJPN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuITA.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuHUN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuHEB.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuFRC.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuFRA.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuFIN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuESP.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuENG.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuELL.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuDEU.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuDAN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuCSY.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuCHT.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuCHS.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuARB.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuARA.dll
2006-12-29 05:40 36,990 -ra------ C:\WINDOWS\system32\ialmrnt5.dll
2006-12-29 05:40 213,274 -ra------ C:\WINDOWS\system32\ialmdev5.dll
2006-12-29 05:40 2,310,144 -ra------ C:\WINDOWS\system32\iglicd32.dll
2006-12-29 05:40 159,744 -ra------ C:\WINDOWS\system32\igfxsrvc.exe
2006-12-29 05:40 147,456 -ra------ C:\WINDOWS\system32\igfxpph.dll
2006-12-29 05:40 135,168 -ra------ C:\WINDOWS\system32\igfxdev.dll
2006-12-29 05:40 118,395 -ra------ C:\WINDOWS\system32\ialmdnt5.dll
2006-12-29 05:40 114,688 -ra------ C:\WINDOWS\system32\igfxzoom.exe
2006-12-29 05:40 114,688 -ra------ C:\WINDOWS\system32\igfxpers.exe
2006-12-29 05:40 114,688 -ra------ C:\WINDOWS\system32\ialmudlg.exe
2006-12-29 05:40 1,503,232 -ra------ C:\WINDOWS\system32\igfxress.dll
2006-12-29 05:40 1,302,332 -ra------ C:\WINDOWS\system32\drivers\ialmnt5.sys
2006-12-29 05:40 <DIR> d-------- C:\WINDOWS\LastGood
2006-12-29 05:13 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe
2006-12-29 05:12 90,112 -r------- C:\WINDOWS\soundman.exe
2006-12-29 05:12 3,804,416 -r------- C:\WINDOWS\system32\drivers\alcxwdm.sys
2006-12-29 05:12 217,088 -ra------ C:\WINDOWS\Alcrmv.exe
2006-12-29 05:12 157,184 -r------- C:\WINDOWS\system32\RtlCPAPI.dll
2006-12-29 05:12 10,475,008 -r------- C:\WINDOWS\system32\RTLCPL.exe
2006-12-29 05:12 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2006-12-29 05:12 <DIR> d-------- C:\Program Files\Realtek Sound Manager
2006-12-29 05:12 <DIR> d-------- C:\Program Files\AvRack
2006-12-29 05:11 307,200 -r------- C:\WINDOWS\alcupd.exe
2006-12-29 05:11 <DIR> d-------- C:\Program Files\Realtek AC97
2006-12-29 05:09 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2006-12-29 04:46 99,328 --a------ C:\WINDOWS\system32\irftp.exe
2006-12-29 04:46 78,336 --a------ C:\WINDOWS\system32\irmon.dll
2006-12-29 04:46 7,680 --a------ C:\WINDOWS\system32\wshirda.dll
2006-12-29 04:46 55,296 --a------ C:\WINDOWS\system32\drivers\irda.sys
2006-12-29 04:46 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2006-12-29 04:46 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys
2006-12-29 04:46 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2006-12-18 05:04 <DIR> d-------- C:\Program Files\MP3 Player Utilities 3.68

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-01-09 21:03 4824 --a------ C:\WINDOWS\compaq.reg
2007-01-09 01:40 -------- d-------- C:\Program Files\Windows Media Player
2007-01-08 21:26 -------- d-------- C:\Program Files\LimeWire
2007-01-07 15:25 -------- d-a------ C:\Program Files\Common Files
2007-01-06 21:28 -------- d-------- C:\Program Files\Internet Explorer
2007-01-06 18:40 -------- d-------- C:\Program Files\vsspsvpx
2007-01-06 17:28 -------- d-------- C:\Program Files\Common Files\Java
2007-01-06 15:52 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-01-06 13:30 -------- d-------- C:\Program Files\Spybot - Search & Destroy
2007-01-06 12:04 -------- d-------- C:\Program Files\XML
2007-01-06 12:03 -------- d-------- C:\Program Files\Windows SyncroAd
2007-01-06 12:03 -------- d-------- C:\Program Files\Support Software
2007-01-06 12:03 -------- d-------- C:\Program Files\Bcpc
2007-01-06 11:44 -------- d-------- C:\Program Files\Lavasoft
2007-01-06 11:37 -------- d-------- C:\Program Files\Viewpoint
2007-01-05 20:46 -------- d-------- C:\Program Files\Common Files\AOL
2007-01-05 20:41 -------- d-------- C:\Program Files\AIM
2007-01-05 20:31 -------- d---s---- C:\Documents and Settings\AGoNY\Application Data\Microsoft
2007-01-05 20:21 -------- d-------- C:\Program Files\Common Files\Adaptec Shared
2007-01-05 20:00 -------- d-------- C:\Program Files\Norton AntiVirus
2006-12-29 05:11 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-12-18 05:34 -------- d-------- C:\Program Files\Common Files\updmgr


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"WCOLOREAL"="\"C:\\Program Files\\COMPAQ\\Coloreal\\coloreal.exe\""
"srmclean"="C:\\Cpqs\\Scom\\srmclean.exe"
"CPQEASYACC"="C:\\Program Files\\COMPAQ\\Easy Access Button Support\\StartEAK.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb05.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"YgVGRoox"="C:\\PROGRA~1\\vxvpourv\\bYQDHcBN.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"ccApp"="C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"
"ccRegVfy"="C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe"
"SoundMan"="SOUNDMAN.EXE"
"igfxtray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\System32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\System32\\igfxpers.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0\\bin\\jusched.exe\""
"TrojanScanner"="C:\\Program Files\\Trojan Remover\\Trjscan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Compaq_RBA"="C:\\Program Files\\compaq\\Compaq Advisor\\bin\\compaq-rba.exe -z"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,9c,00,00,00,00,00,00,00,64,03,00,00,00,03,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,9c,00,00,00,00,00,00,00,64,03,00,00,00,03,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 07-01-09 23:19:12.56
C:\ComboFix.txt ... 07-01-09 23:19

"Im A Nike Head / I Wear Chains That Exite The Feds"

Try to download the following tool "Avenger" I am not sure if the owner of the tool is allowing public use of it but we can try.

Go to this link http://swandog46.geekstogo.com/avenger.zip

1. Click on Avenger.zip to open the file
Extract avenger.exe to your desktop

2. Copy all the text contained in the area between the X"s below to your Clipboard by highlighting it and pressing (Ctrl+C):
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Files to delete:
C:\35142314.exe

Folders to delete:
C:\Program Files\vxvpourv
C:\Program Files\vsspsvpx

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger's actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply and post a new combofix log and a new Hijack This log.

here it goes.. by the way should i delete the backups??? my computer still boots in normal and safe mode.
...........................................

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nacrukwa

*******************

Script file located at: \??\C:\WINDOWS\System32\hu^rsqci.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\35142314.exe deleted successfully.
Folder C:\Program Files\vxvpourv deleted successfully.

Folder C:\Program Files\vsspsvpx not found!
Deletion of folder C:\Program Files\vsspsvpx failed!

Could not process line:
C:\Program Files\vsspsvpx
Status: 0xc0000034

Completed script processing.

*******************

Finished! Terminate.

............................................

ComboFix 06.11.27 - Running from: "C:\Documents and Settings\AGoNY\Desktop\ANTIVIRUS"

((((((((((((((((((((((((((((((( Files Created from 2006-12-10 to 2007-01-10 ))))))))))))))))))))))))))))))))))


2007-01-11 09:09 <DIR> d-------- C:\WINDOWS\Sun
2007-01-10 21:13 <DIR> d-------- C:\avenger
2007-01-09 21:52 <DIR> d-------- C:\!KillBox
2007-01-09 00:13 6,034 --a------ C:\WINDOWS\system32\tmp.reg
2007-01-09 00:12 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2007-01-09 00:12 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-01-09 00:12 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-01-09 00:12 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2007-01-09 00:12 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-01-09 00:12 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2007-01-08 07:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Windows Genuine Advantage
2007-01-07 15:34 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2007-01-07 15:29 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-01-07 15:29 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\SUPERAntiSpyware.com
2007-01-07 15:22 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-01-07 15:16 75,264 --a------ C:\WINDOWS\system32\unacev2.dll
2007-01-07 15:16 153,088 --a------ C:\WINDOWS\system32\UNRAR3.dll
2007-01-07 15:16 <DIR> d-------- C:\Program Files\Trojan Remover
2007-01-07 15:16 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Simply Super Software
2007-01-06 22:03 11,254 --a------ C:\WINDOWS\system32\locate.com
2007-01-06 21:02 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2007-01-06 17:28 <DIR> d-------- C:\Program Files\Java
2007-01-06 17:14 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Sun
2007-01-06 17:12 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2007-01-06 16:55 <DIR> dr-h----- C:\Documents and Settings\AGoNY\Recent
2007-01-06 16:39 86,016 -ra------ C:\WINDOWS\system32\sbres32.dll
2007-01-06 16:39 667,136 -ra------ C:\WINDOWS\system32\drivers\sbpci.sys
2007-01-06 16:39 6,752 --a------ C:\WINDOWS\system32\PfModNT.sys
2007-01-06 16:39 59,392 -ra------ C:\WINDOWS\system\a3d.dll
2007-01-06 16:39 57,344 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-01-06 16:39 30,720 -ra------ C:\WINDOWS\system32\CTSETRes.dll
2007-01-06 16:39 135,040 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-01-06 16:39 130,048 -ra------ C:\WINDOWS\system32\ctpcir32.dll
2007-01-06 16:37 41,984 --a------ C:\WINDOWS\CTREGRUN.EXE
2007-01-06 16:37 <DIR> d-------- C:\Program Files\Creative
2007-01-06 13:35 <DIR> d-------- C:\Program Files\CCleaner
2007-01-06 12:16 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs
2007-01-06 12:16 <DIR> d-------- C:\WINDOWS\Internet Logs
2007-01-06 12:16 <DIR> d-------- C:\Program Files\Zone Labs
2007-01-06 11:44 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Lavasoft
2007-01-06 10:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\nView_Profiles
2007-01-05 23:03 176,128 --a------ C:\WINDOWS\system32\nvudisp.exe
2007-01-05 23:03 <DIR> d-------- C:\WINDOWS\nview
2007-01-05 22:53 9,728 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-01-05 22:53 40,704 --a------ C:\WINDOWS\system32\drivers\es1371mp.sys
2007-01-05 21:28 <DIR> dr-h----- C:\$VAULT$.AVG
2007-01-05 21:21 <DIR> d---s---- C:\Documents and Settings\AGoNY\UserData
2007-01-05 20:48 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\acccore
2007-01-05 20:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-01-05 20:42 <DIR> d-------- C:\Program Files\AIM6
2007-01-05 20:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-01-05 20:32 816,672 --a------ C:\WINDOWS\system32\drivers\avg7core.sys
2007-01-05 20:32 4,960 --a------ C:\WINDOWS\system32\drivers\avgtdi.sys
2007-01-05 20:32 4,224 --a------ C:\WINDOWS\system32\drivers\avg7rsw.sys
2007-01-05 20:32 3,968 --a------ C:\WINDOWS\system32\drivers\avgclean.sys
2007-01-05 20:32 28,416 --a------ C:\WINDOWS\system32\drivers\avg7rsxp.sys
2007-01-05 20:32 <DIR> d-------- C:\Program Files\Grisoft
2007-01-05 20:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2007-01-05 20:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2007-01-05 20:32 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\AVG7
2007-01-05 19:55 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Macromedia
2007-01-05 19:23 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\Mozilla
2007-01-05 19:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MSN6
2007-01-05 19:16 <DIR> d-------- C:\Documents and Settings\AGoNY\Application Data\MSN6
2007-01-02 16:30 182,880 --a------ C:\WINDOWS\system32\iuengine.dll
2007-01-02 16:30 135,168 --a------ C:\WINDOWS\system32\igfxres.dll
2007-01-02 16:30 <DIR> d-------- C:\WUTemp
2006-12-29 05:40 94,208 -ra------ C:\WINDOWS\system32\igfxtray.exe
2006-12-29 05:40 94,208 -ra------ C:\WINDOWS\system32\igfxext.exe
2006-12-29 05:40 900,218 -ra------ C:\WINDOWS\system32\ialmdd5.dll
2006-12-29 05:40 86,016 -ra------ C:\WINDOWS\system32\igfxdo.dll
2006-12-29 05:40 77,824 -ra------ C:\WINDOWS\system32\hkcmd.exe
2006-12-29 05:40 73,728 -ra------ C:\WINDOWS\system32\hccutils.dll
2006-12-29 05:40 61,440 -ra------ C:\WINDOWS\system32\iAlmCoIn_v4396.dll
2006-12-29 05:40 57,344 -ra------ C:\WINDOWS\system32\igfxsrvc.dll
2006-12-29 05:40 524,288 -ra------ C:\WINDOWS\system32\igldev32.dll
2006-12-29 05:40 49,152 -ra------ C:\WINDOWS\system32\ialmrem.dll
2006-12-29 05:40 446,464 -ra------ C:\WINDOWS\system32\igfxcfg.exe
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\igfxexps.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuTRK.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuTHA.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuSVE.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuRUS.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuPTG.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuPTB.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuPLK.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuNOR.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuNLD.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuKOR.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuJPN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuITA.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuHUN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuHEB.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuFRC.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuFRA.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuFIN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuESP.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuENG.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuELL.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuDEU.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuDAN.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuCSY.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuCHT.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuCHS.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuARB.dll
2006-12-29 05:40 40,960 -ra------ C:\WINDOWS\system32\ialmuARA.dll
2006-12-29 05:40 36,990 -ra------ C:\WINDOWS\system32\ialmrnt5.dll
2006-12-29 05:40 213,274 -ra------ C:\WINDOWS\system32\ialmdev5.dll
2006-12-29 05:40 2,310,144 -ra------ C:\WINDOWS\system32\iglicd32.dll
2006-12-29 05:40 159,744 -ra------ C:\WINDOWS\system32\igfxsrvc.exe
2006-12-29 05:40 147,456 -ra------ C:\WINDOWS\system32\igfxpph.dll
2006-12-29 05:40 135,168 -ra------ C:\WINDOWS\system32\igfxdev.dll
2006-12-29 05:40 118,395 -ra------ C:\WINDOWS\system32\ialmdnt5.dll
2006-12-29 05:40 114,688 -ra------ C:\WINDOWS\system32\igfxzoom.exe
2006-12-29 05:40 114,688 -ra------ C:\WINDOWS\system32\igfxpers.exe
2006-12-29 05:40 114,688 -ra------ C:\WINDOWS\system32\ialmudlg.exe
2006-12-29 05:40 1,503,232 -ra------ C:\WINDOWS\system32\igfxress.dll
2006-12-29 05:40 1,302,332 -ra------ C:\WINDOWS\system32\drivers\ialmnt5.sys
2006-12-29 05:40 <DIR> d-------- C:\WINDOWS\LastGood
2006-12-29 05:13 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe
2006-12-29 05:12 90,112 -r------- C:\WINDOWS\soundman.exe
2006-12-29 05:12 3,804,416 -r------- C:\WINDOWS\system32\drivers\alcxwdm.sys
2006-12-29 05:12 217,088 -ra------ C:\WINDOWS\Alcrmv.exe
2006-12-29 05:12 157,184 -r------- C:\WINDOWS\system32\RtlCPAPI.dll
2006-12-29 05:12 10,475,008 -r------- C:\WINDOWS\system32\RTLCPL.exe
2006-12-29 05:12 <DIR> d-------- C:\WINDOWS\LastGood.Tmp
2006-12-29 05:12 <DIR> d-------- C:\Program Files\Realtek Sound Manager
2006-12-29 05:12 <DIR> d-------- C:\Program Files\AvRack
2006-12-29 05:11 307,200 -r------- C:\WINDOWS\alcupd.exe
2006-12-29 05:11 <DIR> d-------- C:\Program Files\Realtek AC97
2006-12-29 05:09 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2006-12-29 04:46 99,328 --a------ C:\WINDOWS\system32\irftp.exe
2006-12-29 04:46 78,336 --a------ C:\WINDOWS\system32\irmon.dll
2006-12-29 04:46 7,680 --a------ C:\WINDOWS\system32\wshirda.dll
2006-12-29 04:46 55,296 --a------ C:\WINDOWS\system32\drivers\irda.sys
2006-12-29 04:46 19,584 --a------ C:\WINDOWS\system32\drivers\rasirda.sys
2006-12-29 04:46 18,688 --a------ C:\WINDOWS\system32\drivers\irsir.sys
2006-12-29 04:46 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
2006-12-18 05:04 <DIR> d-------- C:\Program Files\MP3 Player Utilities 3.68

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-01-11 07:17 4824 --a------ C:\WINDOWS\compaq.reg
2007-01-09 01:40 -------- d-------- C:\Program Files\Windows Media Player
2007-01-08 21:26 -------- d-------- C:\Program Files\LimeWire
2007-01-07 15:25 -------- d-a------ C:\Program Files\Common Files
2007-01-06 21:28 -------- d-------- C:\Program Files\Internet Explorer
2007-01-06 17:28 -------- d-------- C:\Program Files\Common Files\Java
2007-01-06 15:52 -------- d-------- C:\Program Files\Common Files\Symantec Shared
2007-01-06 13:30 -------- d-------- C:\Program Files\Spybot - Search & Destroy
2007-01-06 12:04 -------- d-------- C:\Program Files\XML
2007-01-06 12:03 -------- d-------- C:\Program Files\Windows SyncroAd
2007-01-06 12:03 -------- d-------- C:\Program Files\Support Software
2007-01-06 12:03 -------- d-------- C:\Program Files\Bcpc
2007-01-06 11:44 -------- d-------- C:\Program Files\Lavasoft
2007-01-06 11:37 -------- d-------- C:\Program Files\Viewpoint
2007-01-05 20:46 -------- d-------- C:\Program Files\Common Files\AOL
2007-01-05 20:41 -------- d-------- C:\Program Files\AIM
2007-01-05 20:31 -------- d---s---- C:\Documents and Settings\AGoNY\Application Data\Microsoft
2007-01-05 20:21 -------- d-------- C:\Program Files\Common Files\Adaptec Shared
2007-01-05 20:00 -------- d-------- C:\Program Files\Norton AntiVirus
2006-12-29 05:11 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-12-18 05:34 -------- d-------- C:\Program Files\Common Files\updmgr


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"MSMSGS"="\"C:\\Program Files\\Messenger\\msmsgs.exe\" /background"
"Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp"
"SUPERAntiSpyware"="C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe"
"Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE"
"WCOLOREAL"="\"C:\\Program Files\\COMPAQ\\Coloreal\\coloreal.exe\""
"srmclean"="C:\\Cpqs\\Scom\\srmclean.exe"
"CPQEASYACC"="C:\\Program Files\\COMPAQ\\Easy Access Button Support\\StartEAK.exe"
"HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb05.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"YgVGRoox"="C:\\PROGRA~1\\vxvpourv\\bYQDHcBN.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"ccApp"="C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe"
"ccRegVfy"="C:\\Program Files\\Common Files\\Symantec Shared\\ccRegVfy.exe"
"SoundMan"="SOUNDMAN.EXE"
"igfxtray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\System32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\System32\\igfxpers.exe"
"AVG7_CC"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgcc.exe /STARTUP"
"NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup"
"NvMediaCenter"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvMcTray.dll,NvTaskbarInit"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0\\bin\\jusched.exe\""
"TrojanScanner"="C:\\Program Files\\Trojan Remover\\Trjscan.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonce]
"Compaq_RBA"="C:\\Program Files\\compaq\\Compaq Advisor\\bin\\compaq-rba.exe -z"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,a0,00,00,00,00,00,00,00,80,02,00,00,3a,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,9c,00,00,00,00,00,00,00,64,03,00,00,00,03,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,9c,00,00,00,00,00,00,00,64,03,00,00,00,03,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"AVG7_Run"="C:\\PROGRA~1\\Grisoft\\AVGFRE~1\\avgw.exe /RUNONCE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 07-01-11 10:00:15.89
C:\ComboFix.txt ... 07-01-11 10:00
C:\ComboFix2.txt ... 07-01-10 21:18
C:\ComboFix3.txt ... 07-01-09 23:19

............................................

Logfile of HijackThis v1.99.1
Scan saved at 10:05:27 AM, on 1/11/2007
Platform: Windows XP (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 (6.00.2600.0000)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Documents and Settings\AGoNY\Desktop\ANTIVIRUS\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://store.presario.net/scripts/r...
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by Compaq
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [WCOLOREAL] "C:\Program Files\COMPAQ\Coloreal\coloreal.exe"
O4 - HKLM\..\Run: [srmclean] C:\Cpqs\Scom\srmclean.exe
O4 - HKLM\..\Run: [CPQEASYACC] C:\Program Files\COMPAQ\Easy Access Button Support\StartEAK.exe
O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb05.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [YgVGRoox] C:\PROGRA~1\vxvpourv\bYQDHcBN.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] C:\Program Files\Common Files\Symantec Shared\ccApp.exe
O4 - HKLM\..\Run: [ccRegVfy] C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe
O4 - HKLM\..\RunOnce: [Compaq_RBA] C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe -z
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
O4 - Startup: PowerReg Scheduler.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - c:\Program Files\Microsoft Money\System\mnyviewer.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://store.presario.net/scripts/redirectors/presario/storeredir2.dll?s=consumerfav&c=2c02&lc=0409
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/res...
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active...
O17 - HKLM\System\CCS\Services\Tcpip\..\{C56FF7D1-1FC2-48ED-BEC6-BF751262F1B5}: NameServer = 209.47.15.118,64.157.143.38
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Compaq Advisor (Compaq_RBA) - NeoPlanet - C:\Program Files\compaq\Compaq Advisor\bin\compaq-rba.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Uno Installer (UnoInstallerService) - Unknown owner - C:\Program Files\M-Audio Uno\UnoInst.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

"Im A Nike Head / I Wear Chains That Exite The Feds"

Go to start> control panel> add\remove programs and uninstall this program:

LimeWire

Reboot into safe mode.

Run hijack This from safe mode and remove these items.

F2 - REG:system.ini: UserInit=userinit.exe

O4 - HKLM\..\Run: [YgVGRoox] C:\PROGRA~1\vxvpourv\bYQDHcBN.exe

O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe

Exit Hijack this but remain in safe mode.

Try running Avenger from safe mode following the previous instructions to delete the following. If it does not run in safe mode run it in normal mode.

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Files to delete:
C:\Program Files\vxvpourv\bYQDHcBN.exe
C:\Program Files\LimeWire\LimeWire.exe

Folders to delete:
C:\Program Files\vxvpourv
C:\Program Files\LimeWire

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX

Reboot to normal mode.

Please download Dr Web CureIt to your desktop from this link ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
Doubleclick the drweb-cureit.exe file and Allow to run the express scan.
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it.
This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives.
A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, look if you can click next icon next to the files found:
If so, click it and then click the next icon right below and select Move incurable.
This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)
After selecting, in the Dr.Web CureIt menu on top, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.
Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.
After reboot, post the contents of the log on your desktop and anew Hijack This log please.