Hi everyone!

I'm helping my friend fix his wife's laptop, but, my tech-knowledge only extends as far as running virus scans, etc...

After so many scans from a multitude of softwares, I was successful in removing the X on the C drive, but, the POS.TMP files remain. Can anyone be so kind as to assist me with this?

Thank you for your help and attention in this matter!

Note: I already have a HijackThis logfile ready for posting when needed. Thank you!!

Discard any logs you have and run these scans please.

Go to the this link:

Disable Realtime Protection

Follow their directions to disable any realtime protection that you have as it will interfere with the fix by reinstalling the corrupt files.

Please download Atribune's VundoFix.exe from the following site to your desktop:

Vundofix.exe

Double-click VundoFix.exe to run it.

Click the Scan for Vundo button.

Once it's done scanning, click the Remove Vundo button.

You will receive a prompt asking if you want to remove the files,
click "yes".

Once you click yes, your desktop will go blank as it starts removing
Vundo.

When completed, it will prompt that it will reboot your computer,
click "ok".

Please download and install the latest version of HijackThis v2.0.2:

Download the "HijackThis" Installer from this link:
Hijack This

1. Save " HJTInstall.exe" to your desktop.
2. Double click on HJTInstall.exe to run the program.
3. By default it will install to C:\Program Files\Trend Micro\HijackThis.
4. Accept the license agreement by clicking the "I Accept" button.
5.Click on the "Do a system scan and save a log file" button. It will scan and then ask you to save the log.
6. Click "Save log" to save the log file and then the log will open in Notepad.
7. Click on "Edit > Select All" then click on "Edit > Copy" to copy the entire contents of the log.
8. Paste the log in your next reply.
9. Do NOT have HijackThis fix anything yet! Most of what it finds will be harmless or even required.

Please download ComboFix to the desktop from one of the following links:

Link1

Link 2

Link 3

Double-click combofix.exe
Follow the prompts.
(Don't click on the window while the program is running, it may cause your system to hang.)
Please post the log it produces.

Per your directions-

HiJack This Log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:47:27 PM, on 3/12/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\HP Software Update\HPWuSchd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\PROGRA~1\Yahoo!\browser\ycommon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.hp.com/svs/rdr?T...
O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {06D35B80-B281-423C-A6F3-8E123FA0971E} - C:\WINDOWS\system32\fcywu.dll (file missing)
O2 - BHO: {f29031a8-5b21-ffc8-2214-996cca0f9c21} - {12c9f0ac-c699-4122-8cff-12b58a13092f} - C:\WINDOWS\system32\thpjbccg.dll (file missing)
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: UberButton Class - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O2 - BHO: YahooTaggedBM Class - {65D886A2-7CA7-479B-BB95-14D1EFB7946A} - C:\Program Files\Yahoo!\common\YIeTagBm.dll
O2 - BHO: (no name) - {6A46416F-2E3A-4F49-8001-7674C6FED971} - C:\Program Files\MSN\wykisafem89104.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.1119.1736\swg.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: ZeroBar - {F5735C15-1FB2-41FE-BA12-242757E69DDE} - C:\Program Files\NetZero\toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [DXDllRegExe] dxdllreg.exe
O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe
O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Tbsa] "C:\WINDOWS\ASKS~1\msiexec.exe" -vt ndrv
O4 - HKCU\..\Run: [Jitcafrl] "C:\Program Files\Common Files\?ssembly\w?crtupd.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: RABCO - Auto Update.lnk = C:\Program Files\RABCO\RABCOse.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Display All Images with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/228"
O8 - Extra context menu item: Display Image with Full Quality - "res://C:\Program Files\NetZero\qsacc\appres.dll/227"
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=Q304&bd=pavilion&pf=laptop
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/active...
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/g...
O20 - Winlogon Notify: hggfgdd - hggfgdd.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett-Packard Development Company, L.P. - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

--
End of file - 7985 bytes

ComboFix:

ComboFix 08-03-10.1 - sally nguyen 2008-03-12 18:50:35.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.193 [GMT -6:00]
Running from: C:\Documents and Settings\sally nguyen\Desktop\ComboFix.exe

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt
C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon\domains.txt
C:\Documents and Settings\NetworkService\Application Data\NetMon\log.txt
C:\Documents and Settings\sally nguyen\Application Data\ASKS~1
C:\Documents and Settings\sally nguyen\Start Menu\Programs\Outerinfo
C:\Documents and Settings\sally nguyen\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\sally nguyen\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\crosof~1
C:\Program Files\Common Files\ssembl~1
C:\Program Files\outerinfo
C:\Program Files\outerinfo\FF\chrome.manifest
C:\Program Files\outerinfo\FF\components\OuterinfoAds.xpt
C:\Program Files\outerinfo\FF\install.rdf
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\RABCO
C:\Program Files\RABCO\ExecutionDll.dll
C:\Program Files\RABCO\RABCO.dll.intermediate.manifest
C:\Program Files\RABCO\RABCOse.info
C:\Program Files\RABCO\RABCOse.original
C:\Program Files\RABCO\Setup.log
C:\Program Files\RABCO\un_RABCOSetup_16230.exe
C:\Program Files\RABCO\un_RABCOSetup_16230.txt
C:\Program Files\RABCO\X_RABCOse.log
C:\Temp\1cb
C:\Temp\1cb\syscheck.log
C:\Temp\isgTi19
C:\Temp\isgTi19\lPig.log
C:\WINDOWS\asks~1
C:\WINDOWS\asks~1\?asks\
C:\WINDOWS\cookies.ini
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\nGpxx01
C:\WINDOWS\system32\pac.txt
C:\WINDOWS\system32\spgfruqa.ini
C:\WINDOWS\system32\tpoqweiy.ini
C:\WINDOWS\system32\tyqlpclg.ini
C:\WINDOWS\system32\uwycf.ini
C:\WINDOWS\system32\uwycf.ini2
C:\WINDOWS\system32\winpfz37.sys
C:\WINDOWS\system32\womrpmwm.ini
C:\WINDOWS\system32\zxdnt3d.cfg

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\LEGACY_CMDSERVICE
-------\LEGACY_NETWORK_MONITOR
-------\nm

((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 )))))))))))))))))))))))))))))))
.

2008-03-12 18:19 . 2008-03-12 18:19 <DIR> d-------- C:\VundoFix Backups
2008-03-08 02:58 . 2008-03-08 02:58 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-07 01:29 . 2008-03-07 01:29 <DIR> d-------- C:\Program Files\InCode Solutions
2008-03-07 00:06 . 2008-03-07 00:48 3,382 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-06 19:18 . 2008-03-08 01:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-06 19:18 . 2008-03-06 20:03 30,590 --a------ C:\WINDOWS\system32\pavas.ico
2008-03-06 19:18 . 2008-03-06 20:03 2,550 --a------ C:\WINDOWS\system32\Uninstall.ico
2008-03-06 19:18 . 2008-03-06 20:03 1,406 --a------ C:\WINDOWS\system32\Help.ico
2008-03-06 03:14 . 2008-03-06 01:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-06 01:15 . 2008-03-06 03:17 <DIR> d-------- C:\Documents and Settings\sally nguyen\.housecall6.6
2008-03-06 01:12 . 2008-03-06 01:12 <DIR> d-------- C:\Program Files\Google
2008-03-06 01:12 . 2008-03-08 02:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-03-06 00:07 . 2008-03-06 00:07 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-03-05 19:10 . 2008-03-05 19:10 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-04 22:49 . 2008-03-04 22:59 1,302,502 --ahs---- C:\WINDOWS\system32\qqsvndam.ini
2008-03-04 22:38 . 2008-03-04 22:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-04 22:07 . 2008-03-12 17:57 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\AVG7
2008-03-04 22:06 . 2008-03-04 22:06 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-04 22:05 . 2008-03-05 00:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-03 20:55 . 2007-12-06 20:21 6,066,176 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll
2008-03-03 20:55 . 2007-06-30 21:31 2,455,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-03-03 20:55 . 2007-06-30 21:36 991,232 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-03-03 20:55 . 2007-12-06 20:21 459,264 --a------ C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-03-03 20:55 . 2007-12-06 20:21 383,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-03-03 20:55 . 2007-12-06 20:21 267,776 --a------ C:\WINDOWS\system32\dllcache\iertutil.dll
2008-03-03 20:55 . 2007-12-06 20:21 63,488 --a------ C:\WINDOWS\system32\dllcache\icardie.dll
2008-03-03 20:55 . 2007-12-06 20:21 52,224 --a------ C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-03-03 20:55 . 2007-12-06 05:00 13,824 --a------ C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-03-03 20:46 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll
2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\Grisoft
2008-03-03 19:19 . 2008-03-04 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-03 19:19 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-03 18:15 . 2008-03-03 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-03 18:13 . 2008-03-03 18:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-25 11:28 . 2008-03-02 10:59 147 --a------ C:\WINDOWS\BM3647c246.xml
2008-02-25 09:38 . 2008-02-25 09:38 13,942 --a------ C:\WINDOWS\system32\iphone-011.ico
2008-02-25 07:41 . 2008-02-25 11:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Yahoo!
2008-02-25 07:35 . 2008-02-25 07:35 4,286 --a------ C:\WINDOWS\system32\cruise-006.ico
2008-02-25 07:28 . 2008-02-25 07:28 13,942 --a------ C:\WINDOWS\system32\iphone-012.ico
2008-02-24 23:32 . 2008-02-24 23:32 4,286 --a------ C:\WINDOWS\system32\Jamster.ico
2008-02-24 23:28 . 2008-02-24 23:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Yahoo!
2008-02-24 23:18 . 2008-02-24 23:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
2008-02-24 23:17 . 2008-03-03 20:31 <DIR> d--hs---- C:\WINDOWS\c2FsbHkgbmd1eWVu
2008-02-24 23:17 . 2008-02-24 23:17 200,770 --a------ C:\WINDOWS\system32\scnttlwb.exe
2008-02-24 23:16 . 2008-03-06 23:35 <DIR> d-------- C:\WINDOWS\system32\xb8
2008-02-24 23:16 . 2008-03-05 02:50 <DIR> d-------- C:\WINDOWS\system32\to2
2008-02-24 23:16 . 2008-03-03 19:03 <DIR> d-------- C:\WINDOWS\system32\ff3
2008-02-24 23:16 . 2008-03-08 01:21 <DIR> d-------- C:\WINDOWS\system32\cms4
2008-02-24 23:16 . 2008-03-12 18:50 <DIR> d-------- C:\Temp
2008-02-23 20:35 . 2008-02-23 20:35 <DIR> d-------- C:\Program Files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 03:00 --------- d-----w C:\Program Files\Yahoo!
2005-08-30 01:07 381,480 ----a-w C:\Program Files\msgr7us.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06D35B80-B281-423C-A6F3-8E123FA0971E}]
C:\WINDOWS\system32\fcywu.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12c9f0ac-c699-4122-8cff-12b58a13092f}]
C:\WINDOWS\system32\thpjbccg.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A46416F-2E3A-4F49-8001-7674C6FED971}]
C:\Program Files\MSN\wykisafem89104.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tbsa"="C:\WINDOWS\ASKS~1\msiexec.exe" [ ]
"Jitcafrl"="C:\Program Files\Common Files\?ssembly\w?crtupd.exe" [ ]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-06 01:12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-05-03 19:33 32881]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 11:15 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 11:15 536576]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 20:55 483328]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 11:32 208958]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-04 23:14 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-04 23:03 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-06 01:12:10 125624]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-29 00:36:18 57344]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfgdd]
hggfgdd.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^Deewoo.lnk]
path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\Deewoo.lnk
backup=C:\WINDOWS\pss\Deewoo.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^DW_Start.lnk]
path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\DW_Start.lnk
backup=C:\WINDOWS\pss\DW_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\3574f1da]
C:\WINDOWS\system32\madnvsqq.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
--a------ 2004-07-30 09:33 286720 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]
--a------ 2008-02-24 23:17 200770 C:\WINDOWS\system32\scnttlwb.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2004-04-21 12:28 286720 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
--a------ 2003-06-18 13:00 200704 c:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2003-05-03 20:55 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecordNow!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uoltray]
--a------ 2004-04-14 12:51 90384 C:\Program Files\NetZero\exec.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
--a------ 2003-08-19 02:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-07-16 15:17 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo! Games\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"=

S3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-08-16 14:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c445250-765b-11db-8e97-00c09f4f2830}]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-19 02:36:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- c:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-12 18:55:47
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?9?1?6??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
r Running Proce
.
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
.
**************************************************************************
.
Completion time: 2008-03-12 18:58:14 - machine was rebooted
ComboFix-quarantined-files.txt 2008-03-13 00:58:11
.
2008-03-07 01:13:21 --- E O F ---

Please review and let me know how to proceed. Thanks for all your help!

Open Notepad and copy/paste everything between the X"s into it and make sure "File::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
File::
C:\WINDOWS\system32\pavas.ico
C:\WINDOWS\system32\Uninstall.ico
C:\WINDOWS\system32\Help.ico
C:\WINDOWS\system32\qqsvndam.ini
C:\WINDOWS\BM3647c246.xml
C:\WINDOWS\system32\iphone-011.ico
C:\WINDOWS\system32\cruise-006.ico
C:\WINDOWS\system32\iphone-012.ico
C:\WINDOWS\system32\Jamster.ico
C:\WINDOWS\system32\scnttlwb.exe
C:\WINDOWS\system32\madnvsqq.dll

Driver::
hggfgdd
3574f1da

Folder::
C:\VundoFix Backups
C:\Documents and Settings\All Users\Application Data\Rabio
C:\WINDOWS\c2FsbHkgbmd1eWVu
C:\WINDOWS\system32\xb8
C:\WINDOWS\system32\to2
C:\WINDOWS\system32\ff3
C:\WINDOWS\system32\cms4
C:\Temp

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06D35B80-B281-423C-A6F3-8E123FA0971E}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{12c9f0ac-c699-4122-8cff-12b58a13092f}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6A46416F-2E3A-4F49-8001-7674C6FED971}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Tbsa"=-
"Jitcafrl"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hggfgdd]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\3574f1da]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ExploreUpdSched]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".

Post a new Combofix log.

Here's the new log from Combofix:

ComboFix 08-03-10.1 - sally nguyen 2008-03-12 22:41:13.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.185 [GMT -6:00]
Running from: C:\Documents and Settings\sally nguyen\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\sally nguyen\Desktop\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]

FILE ::
C:\WINDOWS\BM3647c246.xml
C:\WINDOWS\system32\cruise-006.ico
C:\WINDOWS\system32\Help.ico
C:\WINDOWS\system32\iphone-011.ico
C:\WINDOWS\system32\iphone-012.ico
C:\WINDOWS\system32\Jamster.ico
C:\WINDOWS\system32\madnvsqq.dll
C:\WINDOWS\system32\pavas.ico
C:\WINDOWS\system32\qqsvndam.ini
C:\WINDOWS\system32\scnttlwb.exe
C:\WINDOWS\system32\Uninstall.ico
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users\Application Data\Rabio
C:\Documents and Settings\sally nguyen\Favorites\.url
C:\Temp
C:\VundoFix Backups
C:\VundoFix Backups\addmorefiles.txt
C:\VundoFix Backups\flngvsqj.dllbox.bad
C:\WINDOWS\BM3647c246.xml
C:\WINDOWS\c2FsbHkgbmd1eWVu
C:\WINDOWS\system32\cms4
C:\WINDOWS\system32\cruise-006.ico
C:\WINDOWS\system32\ff3
C:\WINDOWS\system32\Help.ico
C:\WINDOWS\system32\iphone-011.ico
C:\WINDOWS\system32\iphone-012.ico
C:\WINDOWS\system32\Jamster.ico
C:\WINDOWS\system32\pavas.ico
C:\WINDOWS\system32\qqsvndam.ini
C:\WINDOWS\system32\scnttlwb.exe
C:\WINDOWS\system32\to2
C:\WINDOWS\system32\Uninstall.ico
C:\WINDOWS\system32\xb8

.
((((((((((((((((((((((((( Files Created from 2008-02-13 to 2008-03-13 )))))))))))))))))))))))))))))))
.

2008-03-08 02:58 . 2008-03-08 02:58 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-07 01:29 . 2008-03-07 01:29 <DIR> d-------- C:\Program Files\InCode Solutions
2008-03-07 00:06 . 2008-03-07 00:48 3,382 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-06 19:18 . 2008-03-08 01:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-06 03:14 . 2008-03-06 01:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-06 01:15 . 2008-03-06 03:17 <DIR> d-------- C:\Documents and Settings\sally nguyen\.housecall6.6
2008-03-06 01:12 . 2008-03-06 01:12 <DIR> d-------- C:\Program Files\Google
2008-03-06 01:12 . 2008-03-08 02:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-03-06 00:07 . 2008-03-06 00:07 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-03-05 19:10 . 2008-03-05 19:10 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-04 22:38 . 2008-03-04 22:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-04 22:07 . 2008-03-12 17:57 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\AVG7
2008-03-04 22:06 . 2008-03-04 22:06 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-04 22:05 . 2008-03-05 00:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-03 20:55 . 2007-12-06 20:21 6,066,176 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll
2008-03-03 20:55 . 2007-06-30 21:31 2,455,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-03-03 20:55 . 2007-06-30 21:36 991,232 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-03-03 20:55 . 2007-12-06 20:21 459,264 --a------ C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-03-03 20:55 . 2007-12-06 20:21 383,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-03-03 20:55 . 2007-12-06 20:21 267,776 --a------ C:\WINDOWS\system32\dllcache\iertutil.dll
2008-03-03 20:55 . 2007-12-06 20:21 63,488 --a------ C:\WINDOWS\system32\dllcache\icardie.dll
2008-03-03 20:55 . 2007-12-06 20:21 52,224 --a------ C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-03-03 20:55 . 2007-12-06 05:00 13,824 --a------ C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-03-03 20:46 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll
2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\Grisoft
2008-03-03 19:19 . 2008-03-04 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-03 19:19 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-03 18:15 . 2008-03-03 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-03 18:13 . 2008-03-03 18:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-25 07:41 . 2008-02-25 11:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Yahoo!
2008-02-24 23:28 . 2008-02-24 23:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Yahoo!
2008-02-23 20:35 . 2008-02-23 20:35 <DIR> d-------- C:\Program Files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 03:00 --------- d-----w C:\Program Files\Yahoo!
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2005-08-30 01:07 381,480 ----a-w C:\Program Files\msgr7us.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-06 01:12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-05-03 19:33 32881]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 11:15 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 11:15 536576]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 20:55 483328]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 11:32 208958]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-04 23:14 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-04 23:03 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-06 01:12:10 125624]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-29 00:36:18 57344]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^Deewoo.lnk]
path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\Deewoo.lnk
backup=C:\WINDOWS\pss\Deewoo.lnkStartup

[HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^DW_Start.lnk]
path=C:\Documents and Settings\sally nguyen\Start Menu\Programs\Startup\DW_Start.lnk
backup=C:\WINDOWS\pss\DW_Start.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
--a------ 2004-07-30 09:33 286720 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2004-04-21 12:28 286720 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
--a------ 2003-06-18 13:00 200704 c:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2003-05-03 20:55 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecordNow!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uoltray]
--a------ 2004-04-14 12:51 90384 C:\Program Files\NetZero\exec.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
--a------ 2003-08-19 02:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-07-16 15:17 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo! Games\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"=

S3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-08-16 14:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c445250-765b-11db-8e97-00c09f4f2830}]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-19 02:36:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- c:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-12 22:43:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?9?1?6??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-12 22:44:00
ComboFix-quarantined-files.txt 2008-03-13 04:43:42
ComboFix2.txt 2008-03-13 00:58:15
.
2008-03-07 01:13:21 --- E O F ---

Thank you!

Much better.

Open Notepad and copy/paste everything between the X"s into it and make sure "Registry::" is at the very top of the page.
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Registry::
[-HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^Deewoo.lnk]
[-HKLM\~\startupfolder\C:^Documents and Settings^sally nguyen^Start Menu^Programs^Startup^DW_Start.lnk]

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Go to File on the top bar and choose" Save As", Change the "Save As Type" to All Files, Name it CFScript.txt then save it to your desktop.
Then drag/drop the CFScript.txt onto ComboFix.exe (the red X on your desktop) if combofix does not auto start click "run".

Your java is out of date and can be exploited.
Download the latest version of java from this link Java
Click on the JDK 6 Update 5 download button.
Check the box that says: "Accept License Agreement". The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. It should have the "coffee cup" icon next to it.
Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions.
Reboot your computer once all Java components are removed
Then from your desktop double-click on jdk-6u5-windows-i586-p.exe
to install the newest version. I don't install any of the add-ons only java 1.6.0_05

Empty the restore folder. Go to start>control panel>system>system restore tab>check the box beside "turn off system restore>apply (takes a minute)>ok. Go back and uncheck the box to turn system restore back on>apply>ok.

Download CCleaner from the following link:

http://filehippo.com/download_ccleaner/

After you download it to your desktop and begin installing it only allow the "install icon on desktop" to install . Then run it, use only as suggested, it's powerful use only the prechecked items.

Run an online scan with Kaspersky from the following link:
Kaspersky Online Scanner

Note: If you have used this particular scanner before, you MAY HAVE YO UNINSTALL the program through Add/Remove Programs before downloading the new ActiveX component

Click Yes, when prompted to install its ActiveX component.
(Note.. for Internet Explorer 7 users: If at any time you have trouble with the "Accept" button of the license, click on the "Zoom" tool located at the bottom right of the IE window and set the zoom to 75 %. Once the license has been accepted, reset to 100%.)
The program launches and downloads the latest definition files.
Once the files are downloaded click on Next
Click on Scan Settings and configure as follows:
Scan using the following Anti-Virus database:
Extended
Scan Options:
Scan Archives
Scan Mail Base
Click OK and, under select a target to scan, select My Computer
When the scan is done, in the Scan is completed window (below), any infection is displayed.
There is no option to clean/disinfect, however, we need to analyze the information on the report.
To obtain the report:
Click on: Save Report As (above - red blinking arrow)
Next, in the Save as prompt, Save in area, select: Desktop
In the File name area, use KScan, or something similar
In Save as type, click the drop arrow and select: Text file [*.txt]
Then, click: Save
Please post the Kaspersky Online Scanner Report in your reply.

Post a new Combofix log.

Per your directions-

Combofix Log (done before Kapersky scan):

ComboFix 08-03-10.1 - sally nguyen 2008-03-13 22:56:10.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.198 [GMT -6:00]
Running from: C:\Documents and Settings\sally nguyen\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\sally nguyen\Desktop\CFScript.txt
* Created a new restore point

[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.

((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
.

2008-03-08 02:58 . 2008-03-08 02:58 <DIR> d-------- C:\Program Files\Trend Micro
2008-03-07 01:29 . 2008-03-07 01:29 <DIR> d-------- C:\Program Files\InCode Solutions
2008-03-07 00:06 . 2008-03-07 00:48 3,382 --a------ C:\WINDOWS\system32\tmp.reg
2008-03-06 19:18 . 2008-03-08 01:20 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2008-03-06 03:14 . 2008-03-06 01:15 102,664 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys
2008-03-06 01:15 . 2008-03-06 03:17 <DIR> d-------- C:\Documents and Settings\sally nguyen\.housecall6.6
2008-03-06 01:12 . 2008-03-06 01:12 <DIR> d-------- C:\Program Files\Google
2008-03-06 01:12 . 2008-03-08 02:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Google Updater
2008-03-06 00:07 . 2008-03-06 00:07 9,662 --a------ C:\WINDOWS\system32\ZoneAlarmIconUS.ico
2008-03-05 19:10 . 2008-03-05 19:10 <DIR> d-------- C:\Program Files\Alwil Software
2008-03-04 22:38 . 2008-03-04 22:39 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\AVG7
2008-03-04 22:07 . 2008-03-13 22:46 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\AVG7
2008-03-04 22:06 . 2008-03-04 22:06 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
2008-03-04 22:05 . 2008-03-05 00:10 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg7
2008-03-03 20:55 . 2007-12-06 20:21 6,066,176 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll
2008-03-03 20:55 . 2007-06-30 21:31 2,455,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dat
2008-03-03 20:55 . 2007-06-30 21:36 991,232 --a------ C:\WINDOWS\system32\dllcache\ieframe.dll.mui
2008-03-03 20:55 . 2007-12-06 20:21 459,264 --a------ C:\WINDOWS\system32\dllcache\msfeeds.dll
2008-03-03 20:55 . 2007-12-06 20:21 383,488 --a------ C:\WINDOWS\system32\dllcache\ieapfltr.dll
2008-03-03 20:55 . 2007-12-06 20:21 267,776 --a------ C:\WINDOWS\system32\dllcache\iertutil.dll
2008-03-03 20:55 . 2007-12-06 20:21 63,488 --a------ C:\WINDOWS\system32\dllcache\icardie.dll
2008-03-03 20:55 . 2007-12-06 20:21 52,224 --a------ C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2008-03-03 20:55 . 2007-12-06 05:00 13,824 --a------ C:\WINDOWS\system32\dllcache\ieudinit.exe
2008-03-03 20:46 . 2007-08-13 18:54 33,792 --a------ C:\WINDOWS\system32\dllcache\custsat.dll
2008-03-03 19:20 . 2008-03-03 19:20 <DIR> d-------- C:\Documents and Settings\sally nguyen\Application Data\Grisoft
2008-03-03 19:19 . 2008-03-04 23:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-03 19:19 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-03-03 18:15 . 2008-03-03 18:15 <DIR> d-------- C:\Program Files\Lavasoft
2008-03-03 18:15 . 2008-03-03 18:16 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-03-03 18:13 . 2008-03-03 18:13 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-25 07:41 . 2008-02-25 11:31 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Yahoo!
2008-02-24 23:28 . 2008-02-24 23:28 <DIR> d-------- C:\Documents and Settings\NetworkService\Application Data\Yahoo!
2008-02-23 20:35 . 2008-02-23 20:35 <DIR> d-------- C:\Program Files\Common Files\Adobe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-03-05 03:00 --------- d-----w C:\Program Files\Yahoo!
2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\dllcache\mrxdav.sys
2007-12-14 17:32 12,632 ----a-w C:\WINDOWS\system32\lsdelete.exe
2005-08-30 01:07 381,480 ----a-w C:\Program Files\msgr7us.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 02:00 15360]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-03-06 01:12 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-05-03 19:33 32881]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2004-05-26 11:15 98304]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2004-05-26 11:15 536576]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd.exe" [2003-08-04 18:28 49152]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [2003-12-22 09:38 241664]
"DXDllRegExe"="dxdllreg.exe" []
"HPHUPD05"="c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [ ]
"HPHmon05"="C:\WINDOWS\system32\hphmon05.exe" [2003-05-22 20:55 483328]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [2004-04-30 11:32 208958]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 03:25 6731312]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-03-04 23:14 579072]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"AVG7_Run"="C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-03-04 23:03 219136]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2008-03-06 01:12:10 125624]
Quicken Scheduled Updates.lnk - C:\Program Files\Quicken\bagent.exe [2004-01-29 00:36:18 57344]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eabconfg.cpl]
--a------ 2004-07-30 09:33 286720 C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2004-04-21 12:28 286720 C:\Program Files\iTunes\iTunesHelper.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MoneyAgent]
--a------ 2003-06-18 13:00 200704 c:\Program Files\Microsoft Money\System\mnyexpr.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2003-05-03 20:55 98304 C:\Program Files\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecordNow!]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uoltray]
--a------ 2004-04-14 12:51 90384 C:\Program Files\NetZero\exec.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UpdateManager]
--a------ 2003-08-19 02:01 110592 C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
--a------ 2007-07-16 15:17 4670704 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YBrowser]
--a------ 2003-07-11 13:51 57344 C:\Program Files\Yahoo!\browser\ybrwicon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\yserver.exe"=
"C:\\Program Files\\Messenger\\msmsgs.exe"=
"C:\\Program Files\\Yahoo! Games\\Bejeweled 2 Deluxe\\WinBej2.exe"=
"C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avginet.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"=
"C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"=
"C:\\Program Files\\InCode Solutions\\RemoveIT Pro v4 - SE\\removeit.exe"=

S3 ZD1211U(Hawking);Hawking Hi-Gain Wireless-G USB Dish Adapter(Hawking);C:\WINDOWS\system32\DRIVERS\zd1211u.sys [2005-08-16 14:50]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{1c445250-765b-11db-8e97-00c09f4f2830}]
\Shell\AutoRun\command - E:\setupSNK.exe

.
Contents of the 'Scheduled Tasks' folder
"2007-12-19 02:36:00 C:\WINDOWS\Tasks\Easy Internet Sign-up.job"
- c:\Program Files\Easy Internet signup\HPSdpApp.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-03-13 22:58:20
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Cpqset = C:\Program Files\HPQ\Default Settings\cpqset.exe????????1?9?1?6??????? ???B???????????????B? ??????

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-03-13 22:59:02
ComboFix-quarantined-files.txt 2008-03-14 04:58:53
ComboFix2.txt 2008-03-13 04:44:01
ComboFix3.txt 2008-03-13 00:58:15
.
2008-03-13 06:12:45 --- E O F ---

Kapersky Logfile:

---------------------
KASPERSKY ONLINE SCANNER REPORT
Friday, March 14, 2008 1:20:28 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 13/03/2008
Kaspersky Anti-Virus database records: 626915
---------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\

Scan Statistics:
Total number of scanned objects: 48929
Number of viruses found: 3
Number of infected objects: 6
Number of suspicious objects: 0
Duration of the scan process: 01:15:22

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
C:\Documents and Settings\All Users\Application Data\muvee Technologies\030410\0102\0102\values Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\sally nguyen\.housecall6.6\Quarantine\wykisafem89104.dll.bac_a01288 Infected: not-a-virus:AdWare.Win32.TTC.d skipped
C:\Documents and Settings\sally nguyen\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\Documents and Settings\sally nguyen\Desktop\Security\DON'T MESS WITH THESE!!!\SmitfraudFix\SmitfraudFix.exe RarSFX: infected - 2 skipped
C:\Documents and Settings\sally nguyen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\sally nguyen\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\sally nguyen\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\sally nguyen\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
C:\Documents and Settings\sally nguyen\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\sally nguyen\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\sally nguyen\ntuser.dat.LOG Object is locked skipped
C:\Program Files\HP\hpcoretech\hpcmerr.log Object is locked skipped
C:\QooBox\Quarantine\C\WINDOWS\system32\scnttlwb.exe.vir Infected: not-a-virus:AdWare.Win32.ZenoSearch.aj skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{1C74FEA9-2D71-4415-8AE0-5DBB04006415}\RP6\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\EventCache\{57D49D39-ABF2-4FDE-A658-35F0D2EDC090}.bin Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

Thank you for all your help!!

You log is clean. A little clean up yet to do.

Navigate to and delete the contents of this folder, not the folder itself:

C:\Documents and Settings\sally nguyen\.housecall6.6\Quarantine

Go to start> run> type in combofix /u (there must be a space after combofix)> then press ok. This will uninstall combofix.

Delete the smitfraud icon from your desktop.

Go to start>control panel> add/remove programs and uninstall these programs:

Ccleaner
Hijack This
Kaspersky

This should fix the red X that has replaced you C: drive icon if this has happened on your computer, if not omit the following suggestion..

Go to start> run> type in notepad > ok. Copy paste the following into notepad making [autorun] the very top line:

[autorun]

ICON=C:\WINDOWS\SYSTEM\SHELL32.DLL,8

Click "save as"> then using the drop down arrow on the far right of the "save in" window select Local Disk C: to be displayed in the "save in" window.

Next type "C:\autorun.inf" (you must use the quotes) in the file name window> click save.

Restart the computer.

OUTSTANDING!!!

Sir, you're a genius! Thank you so much for your assistance and time!

If there's anyone who I can notify about your awesome and dilligent work, please let me know and I'll be more than happy to sing your praises! ;)

Take care!

You should consider adding "Spywareblaster" to your arsenol of antispyware tools, you can download it from this link Spywareblaster

Just download it,install it, and update it. Its free and runs in the background, so you don't actually run it, and re-writes malicious script before it can install on your computer. Look for updates weekly as there is no auto-update on the free version.

Glad we could help.

Done! Thanks so much for all your help and attention. :)