Sorry for the very slow reply, I was away for two weeks. Here is the cobofix log:
"Geoff" - 2007-07-25 10:54:58 - ComboFix 07-07-23.6 - Service Pack 2 NTFS
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\drxmrprn.dll
C:\WINDOWS\system32\ewbluoxy.dll
C:\WINDOWS\system32\giworrnj.dll
C:\WINDOWS\system32\knxtklef.dll
C:\WINDOWS\system32\opqjpsnj.dll
C:\WINDOWS\system32\wjorevnr.dll
C:\WINDOWS\system32\yhrvtmod.dll
C:\WINDOWS\system32\jcecdigs.dll
C:\WINDOWS\system32\kdpcnydd.dll
C:\WINDOWS\system32\nrprmxrd.ini
C:\WINDOWS\system32\yxoulbwe.ini
C:\WINDOWS\system32\jnrrowig.ini
C:\WINDOWS\system32\felktxnk.ini
C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak2
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini2
C:\WINDOWS\system32\ggjlm.tmp
C:\WINDOWS\system32\jnspjqpo.ini
C:\WINDOWS\system32\jnspjqpo.tmp
C:\WINDOWS\system32\rnverojw.ini
C:\WINDOWS\system32\domtvrhy.ini
C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak2
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini2
C:\WINDOWS\system32\ggjlm.tmp
C:\WINDOWS\system32\qpqss.bak1
C:\WINDOWS\system32\qpqss.bak2
C:\WINDOWS\system32\qpqss.ini
C:\WINDOWS\system32\qpqss.ini2
C:\WINDOWS\system32\qpqss.tmp
C:\WINDOWS\system32\ggjlm.bak1
C:\WINDOWS\system32\ggjlm.bak2
C:\WINDOWS\system32\ggjlm.ini
C:\WINDOWS\system32\ggjlm.ini2
C:\WINDOWS\system32\ggjlm.tmp
C:\WINDOWS\system32\gebaaaw.dll
C:\WINDOWS\system32\mljgg.dll
C:\WINDOWS\system32\gebaaaw.dll
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\Geoff\APPLIC~1.\Ultimate Fixer
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\cmd.com
C:\WINDOWS\system32\netstat.com
C:\WINDOWS\system32\ping.com
C:\WINDOWS\system32\regedit.com
C:\WINDOWS\system32\scchk32.exe.bak
C:\WINDOWS\system32\taskkill.com
C:\WINDOWS\system32\tasklist.com
C:\WINDOWS\system32\tracert.com
((((((((((((((((((((((((( Files Created from 2007-06-25 to 2007-07-25 )))))))))))))))))))))))))))))))
2007-07-25 10:52 51,200 --a------ C:\WINDOWS\nircmd.exe
2007-07-25 10:12 126,016 --a------ C:\WINDOWS\system32\tkqdnpqw.dll
2007-07-24 22:56 674,600 --a------ C:\WINDOWS\system32\pbsvc[1].exe
2007-07-24 17:40 7,340,032 --a------ C:\DOCUME~1\Geoff\ntuser.dat
2007-07-24 17:29 126,016 --a------ C:\WINDOWS\system32\tvxbhnig.dll
2007-07-24 03:26 925,696 --a------ C:\DOCUME~1\GEOFFR~1\ntuser.dat
2007-07-24 03:26 3,039,232 --a------ C:\DOCUME~1\Julia\ntuser.dat
2007-07-24 03:26 1,142,784 --a------ C:\DOCUME~1\Junzhe\ntuser.dat
2007-07-23 19:20 126,016 --a------ C:\WINDOWS\system32\ewefiwuy.dll
2007-07-20 19:03 <DIR> d-------- C:\WINDOWS\pss
2007-07-20 19:01 <DIR> d-------- C:\DOCUME~1\Guest1\APPLIC~1\Teleca
2007-07-20 19:01 <DIR> d-------- C:\DOCUME~1\Guest1\APPLIC~1\HP
2007-07-20 19:00 <DIR> d-------- C:\DOCUME~1\Guest1\APPLIC~1\Sony Ericsson
2007-07-20 18:59 786,432 --ah----- C:\DOCUME~1\Guest1\ntuser.dat
2007-07-20 18:59 <DIR> d-------- C:\DOCUME~1\Guest1\WINDOWS
2007-07-20 18:59 <DIR> d-------- C:\DOCUME~1\Guest1\APPLIC~1\Real
2007-07-20 18:59 <DIR> d-------- C:\DOCUME~1\Guest1\APPLIC~1\Intuit
2007-07-20 18:49 128,576 --a------ C:\WINDOWS\system32\piggjhma.dll
2007-07-13 16:57 128,576 --a------ C:\WINDOWS\system32\mrjqwuhn.dll
2007-07-13 16:54 66,624 --a------ C:\WINDOWS\system32\yhbgjsik.dll
2007-07-10 19:36 <DIR> d-------- C:\DOCUME~1\Geoff\APPLIC~1\FlashFXP
2007-07-10 18:56 22,912 -ra------ C:\WINDOWS\system32\drivers\xshark.sys
2007-07-10 18:52 <DIR> d-------- C:\Program Files\Fire International
2007-07-08 17:58 <DIR> d-------- C:\Program Files\Ventrilo
2007-07-08 17:58 <DIR> d-------- C:\DOCUME~1\geflep\APPLIC~1\Ventrilo
2007-07-08 16:30 0 --a------ C:\WINDOWS\nsreg.dat
2007-07-08 00:14 <DIR> d-------- C:\Program Files\Trend Micro
2007-07-03 22:12 <DIR> d-------- C:\DOCUME~1\Geoff\APPLIC~1\acccore
2007-07-03 22:05 <DIR> d-------- C:\Program Files\PlayLinc
2007-07-02 15:47 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\FLEXnet
2007-07-02 15:41 <DIR> d-------- C:\Program Files\Bonjour
2007-07-02 15:17 <DIR> d-------- C:\DOCUME~1\geflep\APPLIC~1\Sony Ericsson
2007-07-02 15:14 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
2007-07-01 16:38 22,328 --a------ C:\WINDOWS\system32\drivers\PnkBstrK.sys
2007-07-01 16:37 66,872 --a------ C:\WINDOWS\system32\PnkBstrA.exe
2007-07-01 16:37 103,736 --a------ C:\WINDOWS\system32\PnkBstrB.exe
2007-07-01 16:36 22,328 --a------ C:\DOCUME~1\Geoff\APPLIC~1\PnkBstrK.sys
2007-06-28 20:29 <DIR> d-------- C:\Program Files\iTunes
2007-06-28 20:29 <DIR> d-------- C:\Program Files\iPod
2007-06-28 20:26 <DIR> d-------- C:\Program Files\QuickTime
2007-06-28 20:17 <DIR> d-------- C:\Program Files\Apple Software Update
2007-06-28 20:07 <DIR> d-------- C:\Program Files\Electronic Arts
2007-06-28 16:16 65,536 --a------ C:\WINDOWS\system32\ssdevm.dll
2007-06-28 16:16 49,152 --a------ C:\WINDOWS\system32\ssusbpn.dll
2007-06-28 16:16 466,944 --a------ C:\WINDOWS\ssndii.exe
2007-06-28 16:16 21,776 --a------ C:\WINDOWS\system32\msxml2a.dll
2007-06-28 16:16 <DIR> d-------- C:\WINDOWS\Samsung
2007-06-28 16:11 57,344 --a------ C:\WINDOWS\system32\ml3050ci.dll
2007-06-28 16:11 151,552 --a------ C:\WINDOWS\system32\ml3050ci.exe
2007-06-28 16:10 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll
2007-06-28 16:10 22,663 --a------ C:\WINDOWS\system32\SUGO1LMK.DLL
2007-06-28 16:10 172,032 --a------ C:\WINDOWS\system32\SecSNMP.dll
2007-06-28 16:10 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe
2007-06-28 16:08 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-06-28 16:08 <DIR> d-------- C:\WINDOWS\system32\drivers\Samsung
2007-06-28 16:08 <DIR> d-------- C:\Program Files\Samsung
2007-06-27 21:08 <DIR> d-------- C:\Program Files\Windows Media Connect 2
2007-06-27 21:00 <DIR> d-------- C:\WINDOWS\system32\drivers\UMDF
2007-06-27 12:20 <DIR> d-------- C:\DOCUME~1\Geoff\Shared
2007-06-26 19:30 <DIR> d-------- C:\DOCUME~1\Geoff\APPLIC~1\InstallShield Installation Information
2007-06-26 19:18 <DIR> d-------- C:\WINDOWS\system32\recngrvl
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-25 02:14:20 -------- d-----w C:\Program Files\Cheat Engine
2007-07-25 00:45:39 -------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2007-07-05 19:03:50 -------- d-----w C:\Program Files\MSN Messenger
2007-07-04 14:41:52 -------- d-----w C:\Program Files\GTASACenter
2007-06-30 02:13:51 -------- d-----w C:\Program Files\BitLord
2007-06-29 20:46:31 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\Hamachi
2007-06-29 18:00:30 -------- d-----w C:\Program Files\Common Files\EasyInfo
2007-06-29 03:48:41 25,544 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
2007-06-29 02:26:57 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-06-28 20:16:48 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-06-27 17:00:36 -------- d-----w C:\Program Files\VideoLAN
2007-06-27 16:59:00 -------- d-----w C:\Program Files\LimeWire
2007-06-27 16:50:05 -------- d-----w C:\Program Files\EA GAMES
2007-06-27 01:48:32 -------- d-----w C:\Program Files\Common Files\Blizzard Entertainment
2007-06-27 01:44:52 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\InstallShield
2007-06-27 01:27:51 -------- d-----w C:\Program Files\Google
2007-06-26 23:57:18 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\My Games
2007-06-26 23:22:07 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\LimeWire
2007-06-26 00:24:13 -------- d-----w C:\Program Files\Microsoft.NET
2007-06-22 02:39:33 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\Sony Ericsson
2007-06-22 02:37:49 -------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-06-22 02:37:05 -------- d-----w C:\Program Files\Sony Ericsson
2007-06-10 15:34:07 -------- d-----w C:\Program Files\Valve
2007-06-10 14:57:41 -------- d-----w C:\Program Files\DynDNS Updater
2007-06-10 14:57:14 -------- d-----w C:\Program Files\Solstar Games
2007-06-10 01:40:08 402,944 ----a-w C:\WINDOWS\system32AKV.exe
2007-06-10 00:10:07 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\CEZEO software
2007-06-08 07:09:58 -------- d-sh--w C:\Program Files\outlook
2007-06-08 02:00:15 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\Ventrilo
2007-05-30 23:07:13 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\Opera
2007-05-28 21:40:17 -------- d-----w C:\DOCUME~1\Geoff\APPLIC~1\Subversion
2007-05-28 01:39:35 -------- d-----w C:\Program Files\TechSmith
2007-05-26 20:04:53 614 ----a-w C:\WINDOWS\eReg.dat
2007-05-26 00:03:02 -------- d-----w C:\Program Files\WoW-FE
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-11 17:54:15 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-05-11 04:37:15 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-05-11 04:37:15 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-05-11 04:37:15 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-05-11 04:37:15 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B97552F5-4E8F-4389-86B2-7E65D3052B66}]
C:\WINDOWS\system32\ssqpq.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ftutil2"="ftutil2.dll" [2004-06-07 17:05 C:\WINDOWS\system32\ftutil2.dll]
"HPBootOp"="C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" [2006-02-16 01:34]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe" [2007-04-20 10:00]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2005-10-26 17:17]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-08 08:38]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2007-04-27 09:41]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" []
"Start WingMan Profiler"="C:\Program Files\Logitech\Profiler\lwemon.exe" [2005-04-18 11:16]
C:\Documents and Settings\Geoff\Start Menu\Programs\Startup\
PinMcLnk.lnk - C:\hp\bin\cloaker.exe [2006-08-08 08:06:29]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqpq]
C:\WINDOWS\system32\ssqpq.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winxkn32]
winxkn32.dll
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlwaysReady Power Message APP]
ARPWRMSG.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ehTray]
C:\WINDOWS\ehome\ehtray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\icq.com]
rundll32.exe "C:\WINDOWS\system32\piggjhma.dll",forkonce
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
"C:\Program Files\MSN Messenger\msnmsgr.exe" /background
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCDrProfiler]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
RTHDCPL.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.908.5008\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
"C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ultimate Fixer]
"C:\Program Files\Ultimate Fixer\UltimateFixer.exe" hide
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WMPNetworkSvc"=3 (0x3)
"usnjsvc"=3 (0x3)
"PnkBstrB"=2 (0x2)
"PnkBstrA"=2 (0x2)
"ose"=3 (0x3)
"MDM"=2 (0x2)
"iPod Service"=3 (0x3)
"IDriverT"=3 (0x3)
"FLEXnet Licensing Service"=3 (0x3)
"Bonjour Service"=2 (0x2)
R1 AmdK8;AMD Processor Driver;C:\WINDOWS\system32\DRIVERS\AmdK8.sys
R2 ARSVC;ARSVC;C:\WINDOWS\arservice.exe
R2 ehRecvr;Media Center Receiver Service;C:\WINDOWS\eHome\ehRecvr.exe
R2 ehSched;Media Center Scheduler Service;C:\WINDOWS\eHome\ehSched.exe
R2 McrdSvc;Media Center Extender Service;C:\WINDOWS\ehome\mcrdsvc.exe
R2 MCSTRM;MCSTRM;C:\WINDOWS\system32\drivers\MCSTRM.sys
R3 aracpi;aracpi;C:\WINDOWS\system32\DRIVERS\aracpi.sys
R3 arhidfltr;MS Ar HID Filter Driver;C:\WINDOWS\system32\DRIVERS\arhidfltr.sys
R3 arkbcfltr;Microsoft PS2 Keyboard Filter;C:\WINDOWS\system32\DRIVERS\arkbcfltr.sys
R3 armoucfltr;Microsoft PS2 Mouse Filter;C:\WINDOWS\system32\DRIVERS\armoucfltr.sys
R3 ARPolicy;ARPolicy;C:\WINDOWS\system32\DRIVERS\arpolicy.sys
R3 HidUsb;Microsoft HID Class Driver;C:\WINDOWS\system32\DRIVERS\hidusb.sys
R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12;C:\WINDOWS\system32\DRIVERS\HPZius12.sys
R3 HSX_DP;HSX_DP;C:\WINDOWS\system32\DRIVERS\HSX_DP.sys
R3 HSXHWBS2;HSXHWBS2;C:\WINDOWS\system32\DRIVERS\HSXHWBS2.sys
R3 usbccgp;Microsoft USB Generic Parent Driver;C:\WINDOWS\system32\DRIVERS\usbccgp.sys
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbehci.sys
R3 usbhub;Microsoft USB Standard Hub Driver;C:\WINDOWS\system32\DRIVERS\usbhub.sys
R3 usbohci;Microsoft USB Open Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbohci.sys
R3 usbprint;Microsoft USB PRINTER Class;C:\WINDOWS\system32\DRIVERS\usbprint.sys
R3 usbscan;USB Scanner Driver;C:\WINDOWS\system32\DRIVERS\usbscan.sys
R3 usbstor;USB Mass Storage Driver;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
R3 winachsx;winachsx;C:\WINDOWS\system32\DRIVERS\HSX_CNXT.sys
R3 WmBEnum;Logitech Virtual Bus Enumerator Driver;C:\WINDOWS\system32\drivers\WmBEnum.sys
R3 WmXlCore;Logitech WingMan Translation Layer Driver;C:\WINDOWS\system32\drivers\WmXlCore.sys
S0 ftsata2;ftsata2;C:\WINDOWS\system32\DRIVERS\ftsata2.sys
S2 DgiVecp;Team MFP Comm Driver;C:\WINDOWS\system32\Drivers\DgiVecp.sys
S3 Fax;Fax;C:\WINDOWS\system32\fxssvc.exe
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys
S3 MHN;MHN;C:\WINDOWS\System32\svchost.exe -k netsvcs
S3 MHNDRV;MHN driver;C:\WINDOWS\system32\DRIVERS\mhndrv.sys
S3 PSSdk23;PSSdk23;\??\C:\WINDOWS\system32\Drivers\PsSdk23.drv
S3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver;C:\WINDOWS\system32\DRIVERS\usbuhci.sys
S3 w300bus;Sony Ericsson W300 Driver driver (WDM);C:\WINDOWS\system32\DRIVERS\w300bus.sys
S3 w300mdfl;Sony Ericsson W300 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\w300mdfl.sys
S3 w300mdm;Sony Ericsson W300 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\w300mdm.sys
S3 w300mgmt;Sony Ericsson W300 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\w300mgmt.sys
S3 w300obex;Sony Ericsson W300 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\w300obex.sys
S3 WmFilter;Logitech Gaming HID Filter Driver;C:\WINDOWS\system32\drivers\WmFilter.sys
S3 WmVirHid;Logitech Virtual Hid Device Driver;C:\WINDOWS\system32\drivers\WmVirHid.sys
S3 WpdUsb;WpdUsb;C:\WINDOWS\system32\Drivers\wpdusb.sys
S3 XSHARK;XSHARK Driver (xshark.sys);C:\WINDOWS\system32\Drivers\xshark.sys
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
AutoRun\command- C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ba63ba7c-af39-11db-94de-001731f7d1be}]
AutoRun\command- K:\CruzerProfile.exe /autorun
Contents of the 'Scheduled Tasks' folder
2007-07-19 19:06:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer,
http://www.gmer.net
Rootkit scan 2007-07-25 11:02:56
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden registry entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-07-25 11:04:22 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-25 11:03
--- E O F ---
And the HJT log:
Logfile of HijackThis v1.99.1
Scan saved at 11:10:34 AM, on 25/07/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\arservice.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\internet explorer\iexplore.exe
c:\windows\system\hpsysdrv.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=64&bd=PRESARIO&pf=desktop
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://www.gamefaqs.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iesearch&locale=EN_CA&c=64&bd=PRESARIO&pf=desktop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: hpWebHelper Class - {AAAE832A-5FFF-4661-9C8F-369692D1DCB9} - C:\WINDOWS\pchealth\helpctr\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\plugin\WebHelper.dll
O2 - BHO: (no name) - {B97552F5-4E8F-4389-86B2-7E65D3052B66} - C:\WINDOWS\system32\ssqpq.dll (file missing)
O4 - HKLM\..\Run: [ftutil2] rundll32.exe ftutil2.dll,SetWriteCacheMode
O4 - HKLM\..\Run: [HPBootOp] "C:\Program Files\Hewlett-Packard\HP Boot Optimizer\HPBootOp.exe" /run
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - Startup: PinMcLnk.lnk = C:\hp\bin\cloaker.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra 'Tools' menuitem: Internet Connection Help - {E2D4D26B-0180-43a4-B05F-462D6D54C789} - C:\WINDOWS\PCHEALTH\HELPCTR\Vendors\CN=Hewlett-Packard,L=Cupertino,S=Ca,C=US\IEButton\support.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} -
http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) -
http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) -
http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: ssqpq - C:\WINDOWS\system32\ssqpq.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: winxkn32 - winxkn32.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
Thanks for your help : )