36 replies to this topic

[Skylight]

OKay So I have been searching this forum for answers I ave my Hijackthis log and I will place it below. About three days ago my computer was attacked with all of hese different worms and backdoor things and now I wish i was able to remember exactly what they were called. I went to some site and it told me to remove everything in the processes with a high number and after I did that I am now unable to connect to the internet. I am using a friends computer to do this now, but I would really like to use my own computer. Also I cannot use malware bytes which was originally installed on my computer and my Mcafee doesn't pick up a problem with infection on my comp. I have tried uninstalling and reinstalling Malwarebytes but it just doens't work. Please help.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:56:36 AM, on 10/26/2009
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
R3 - URLSearchHook: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O1 - Hosts: ::1 localhost
O1 - Hosts: 91.212.127.226 osguard-pro.microsoft.com
O1 - Hosts: 91.212.127.226 osguard-pro.com
O1 - Hosts: 91.212.127.226 www.osguard-pro.com
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java™ Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll
O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [USBToolTip] C:\PROGRA~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe
O4 - HKLM\..\Run: [calc] rundll32.exe C:\WINDOWS\system32\calc.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [DW6] "C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [calc] rundll32.exe C:\DOCUME~1\NETWOR~1.NTA\ntuser.dll,_IWMPEvents@0
O4 - HKCU\..\Run: [system tool] C:\Program Files\ljaurt\ixqysysguard.exe
O4 - HKCU\..\Run: [wow64main.exe] C:\DOCUME~1\RAMIRE~1.RAM\LOCALS~1\Temp\wow64main.exe
O4 - S-1-5-18 Startup: PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe (User 'Default user')
O4 - Startup: PMB Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O10 - Broken Internet access because of LSP provider 'c:\windows\system32\lsp.dll' missing
O12 - Plugin for .cfm: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll
O16 - DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} (SupportSoft Installer) - https://ra.qwest.com...ad/tgctlins.cab
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com Configuration Class) - https://ra.qwest.com...oad/tgctlcm.cab
O16 - DPF: {8100D56A-5661-482C-BEE8-AFECE305D968} (Facebook Photo Uploader 5 Control) - http://upload.facebook.com/controls/2009.0...oUploader55.cab
O16 - DPF: {C75BE5CC-7F80-458C-8B66-FAB86E3B13C3} (FotkiUploader Control) - http://images.fotki....tkiUploader.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
O20 - AppInit_DLLs: zupikure.dll
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: LeapFrog Connect Device Service - Unknown owner - C:\Program Files\LeapFrog\LeapFrog Connect\CommandService.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: McAfee SiteAdvisor Service - McAfee, Inc. - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\supportsoft\bin\ssrc.exe
O23 - Service: Symantec RemoteAssist - Symantec, Inc. - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe

--
End of file - 10267 bytes

[chamber]

Hi,

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE
  
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

• Download OTL to your desktop.
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

[Skylight]

chamber, on Oct 26 2009, 05:46 PM, said:

Hi,

Download ComboFix from one of these locations:

Link 1
Link 2

* IMPORTANT !!! Save ComboFix.exe to your Desktop

• Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link HERE
  
  
  
• Double click on ComboFix.exe & follow the prompts.
  
  
  
• As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
  
  
  
• Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.

**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.

Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:





Click on Yes, to continue scanning for malware.

When finished, it shall produce a log for you. Please include the C:\ComboFix.txt log in your next reply.

Notes:
1. Do not mouse-click Combofix's window while it is running. That may cause it to stall.
2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions.

• Download OTL to your desktop.
  
• Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
  
• When the window appears, underneath Output at the top change it to Minimal Output.
  
• Check the boxes beside LOP Check and Purity Check.
  
• Click the Run Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
  
  • When the scan completes, it will open two notepad windows. OTL.Txt and Extras.Txt. These are saved in the same location as OTL.
    
  • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post it with your next reply. You may need two posts to fit them all in.

I am in the process of doing this but I cannot install microsoft recovery console because my computer cannot connect to the internet.

[chamber]

Carry on without it then. Don't worry about quoting in reply either.

Can you remember what process you killed before you lost the internet?

[Skylight]

I have no clue there were so many, all now when I restart the computer it says something about a problem loading with rundll32.exe a 1% file or something like that and an nt dll file about an image.

[chamber]

Lets get you clean and then we'll see about sorting the rest of the problems.

[Skylight]

But here is another question how come I am able to connect to the internet "wirelessly" using this computer I am using to type this, but not on the desktop computer when they are using the same server? ANd How will I know Combo fix is done doing its business it just put up there that it is deleting some files and folders.

[Skylight]

okay it is rebooting now and asking to restart windows meda center

[chamber]

ComboFix will be done when it produces the log file for you.

[Skylight]

okay now the blue screen says do not run any programs until combo fix has finished but there is a rundll error saying error loading borazufu.dll the specified module could not be found

[chamber]

Just let it be. It will be done soon.

[Skylight]

okay I have to run a quick errand I am going to let it just run and then I will be right back.

[Skylight]

Here is the log I still cannot connect to the internet.




ComboFix 09-10-25.02 - Ramirez Family 10/26/2009 10:59.1.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1516 [GMT -6:00]
Running from: c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\NetworkService.NT AUTHORITY\ntuser.dll
c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\ntuser.dll
c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Start Menu\Programs\Startup\scandisk.dll
c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Start Menu\Programs\Startup\scandisk.lnk
c:\program files\Active Security
c:\program files\Active Security\uninstall.exe
c:\recycler\S-1-5-21-1920667374-4285153495-2634096825-1005
c:\recycler\S-1-5-21-1920667374-4285153495-2634096825-500
c:\windows\system32\~.exe
c:\windows\system32\borazufu.dll
c:\windows\system32\calc.dll
c:\windows\system32\dararudi.dll
c:\windows\system32\derinade.dll
c:\windows\system32\lifosiyo.exe
c:\windows\system32\zopawibu.exe
c:\windows\system32\zupikure.dll

c:\windows\system32\proquota.exe was missing
Restored copy from - c:\i386\proquota.exe

.
((((((((((((((((((((((((( Files Created from 2009-09-26 to 2009-10-26 )))))))))))))))))))))))))))))))
.

2009-10-26 17:11 . 2004-08-10 11:00 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-10-26 17:11 . 2004-08-10 11:00 50176 ----a-w- c:\windows\system32\proquota.exe
2009-10-26 16:20 . 2009-10-26 16:20 -------- d-----w- C:\$WIN_NT$.~BT
2009-10-26 15:56 . 2009-10-26 15:56 -------- d-----w- c:\program files\Trend Micro
2009-10-23 23:13 . 2009-10-26 16:11 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-23 23:04 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-23 23:04 . 2009-10-23 23:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malwarea
2009-10-23 23:04 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-23 16:31 . 2009-10-23 21:01 -------- d-----w- c:\program files\ljaurt
2009-10-21 04:38 . 2009-10-21 13:42 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Nikon
2009-10-21 04:31 . 2009-10-22 01:44 -------- d-----w- c:\program files\Common Files\Nikon
2009-10-21 04:31 . 2009-10-22 01:44 -------- d-----w- c:\program files\Nikon
2009-10-21 04:31 . 2009-10-21 04:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Ultima_T15
2009-10-21 04:31 . 2009-10-21 04:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\EnterNHelp
2009-10-21 04:28 . 2009-10-21 04:28 -------- d-----w- c:\program files\ArcSoft
2009-10-20 22:22 . 2009-10-21 13:44 -------- d-----w- C:\SYSCHK
2009-10-20 22:22 . 2009-10-20 22:22 -------- d-----w- c:\program files\Common Files\Sony Shared
2009-10-20 22:22 . 2000-02-23 20:24 3888 ------w- c:\windows\system32\drivers\DMICall.sys
2009-10-20 22:15 . 2009-10-26 15:33 -------- d-----w- c:\windows\system32\NtmsData
2009-10-20 18:38 . 2009-10-24 00:03 703152 ----a-w- c:\documents and settings\LocalService.NT AUTHORITY\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-20 18:36 . 2009-10-20 18:36 -------- d-----w- c:\windows\Logs
2009-10-20 18:05 . 2009-10-20 18:05 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Local Settings\Application Data\Pinnacle
2009-10-20 18:03 . 2005-09-24 04:18 171520 ------w- c:\windows\system32\drivers\MarvinBus.sys
2009-10-20 18:03 . 2009-10-20 18:03 -------- d-----w- c:\program files\Common Files\Pinnacle
2009-10-20 18:02 . 2009-10-20 18:02 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Pinnacle Studio HD
2009-10-20 17:55 . 2009-10-23 23:50 -------- d-----w- c:\program files\Pinnacle
2009-10-20 17:51 . 2009-10-20 18:01 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Pinnacle
2009-10-20 04:45 . 2009-10-20 04:45 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Sony
2009-10-17 00:32 . 2009-10-17 00:32 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Unity
2009-10-16 15:44 . 2009-10-16 15:44 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Local Settings\Application Data\Unity
2009-10-16 15:44 . 2009-10-16 15:44 -------- d-----w- c:\program files\Unity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-26 17:13 . 2008-04-03 14:34 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-10-26 17:12 . 2008-05-05 00:43 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-10-23 22:36 . 2008-05-04 23:10 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Move Networks
2009-10-23 16:36 . 2008-03-28 22:10 -------- d-----w- c:\program files\McAfee
2009-10-22 01:44 . 2009-10-21 04:31 0 ---h--w- c:\documents and settings\All Users.WINDOWS\Application Data\PKP_DLdu.DAT
2009-10-21 13:44 . 2009-08-01 03:56 -------- d-----w- c:\program files\2Wire
2009-10-21 13:43 . 2009-10-21 04:34 20 ---h--w- c:\documents and settings\All Users.WINDOWS\Application Data\PKP_DLdw.DAT
2009-10-21 04:30 . 2003-03-19 00:05 106496 ------w- c:\windows\system32\ATL71.DLL
2009-10-21 04:28 . 2006-02-15 05:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-20 18:04 . 2008-03-22 14:14 418208 ----a-w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 04:45 . 2008-03-26 22:06 -------- d-----w- c:\program files\Sony
2009-10-18 16:39 . 2008-03-23 14:21 16802 ----a-w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\wklnhst.dat
2009-10-11 22:30 . 2006-04-29 02:53 -------- d-----w- c:\program files\DivX
2009-09-18 15:01 . 2009-09-18 15:01 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Application Data\McAfee
2009-09-16 16:22 . 2008-03-28 22:10 79816 ------w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 16:22 . 2008-03-28 22:10 40552 ------w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 16:22 . 2008-03-28 22:10 35272 ------w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 16:22 . 2008-03-28 22:10 214664 ------w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 16:22 . 2008-03-28 22:10 34248 ------w- c:\windows\system32\drivers\mferkdk.sys
2009-09-16 15:55 . 2008-09-29 03:59 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Application Data\SACore
2009-09-15 04:36 . 2008-03-28 22:08 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\McAfee
2009-09-14 22:11 . 2009-09-14 22:11 176560 ------w- c:\windows\system32\mlfcache.dat
2009-09-14 22:10 . 2008-03-23 03:17 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Apple Computer
2009-09-14 14:22 . 2009-09-13 19:20 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-09-12 20:19 . 2008-04-09 18:04 1285200 ------w- c:\windows\system32\FotkiUploadThumbDB.dat
2009-09-12 20:18 . 2008-04-09 18:04 119760000 ------w- c:\windows\system32\FotkiThumbDB.dat
2009-09-11 14:33 . 2004-08-10 11:00 133632 ------w- c:\windows\system32\msv1_0.dll
2009-09-09 06:09 . 2009-09-09 06:09 -------- d-----w- c:\program files\Safari
2009-09-09 06:08 . 2009-09-09 06:07 -------- d-----w- c:\program files\iTunes
2009-09-09 06:08 . 2009-09-09 06:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-09-09 06:07 . 2009-09-09 06:07 -------- d-----w- c:\program files\iPod
2009-09-09 06:07 . 2008-01-23 19:03 -------- d-----w- c:\program files\Common Files\Apple
2009-09-09 06:06 . 2008-01-23 19:07 -------- d-----w- c:\program files\Bonjour
2009-09-09 06:06 . 2006-02-18 17:47 -------- d-----w- c:\program files\QuickTime
2009-09-04 20:45 . 2004-08-10 11:00 58880 ------w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2004-08-10 11:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:16 . 2004-08-10 11:00 247326 ------w- c:\windows\system32\strmdll.dll
2009-08-13 13:02 . 2009-08-13 13:02 0 ----a-w- c:\windows\nsreg.dat
2009-08-05 09:11 . 2004-08-10 11:00 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-08-04 13:58 . 2004-08-10 11:00 2136064 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-08-03 22:59 2015744 ------w- c:\windows\system32\ntkrnlpa.exe
2008-01-06 21:40 . 2008-01-06 21:40 251 ----a-w- c:\program files\wt3d.ini
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-17 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]

c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Start Menu\Programs\Startup\
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-10-20 327680]

c:\documents and settings\Ramirez Family\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2005-10-7 21504]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\McAfee\\MPF\\MpfSrv.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcsysmon.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/28/2008 8:32 PM 92296]
S0 yqjqetug;yqjqetug;c:\windows\system32\drivers\jazu.sys --> c:\windows\system32\drivers\jazu.sys [?]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [11/18/2008 1:26 PM 18560]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-09-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-03-28 18:22]

2009-10-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-03-28 18:22]

2009-10-26 c:\windows\Tasks\User_Feed_Synchronization-{FAD35317-A19C-4EDB-8388-1E15C3C690E9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab
DPF: {C75BE5CC-7F80-458C-8B66-FAB86E3B13C3} - hxxp://images.fotki.com/activex/FotkiUploader.cab
FF - ProfilePath - c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Mozilla\Firefox\Profiles\s79h67y1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.
- - - - ORPHANS REMOVED - - - -

BHO-{e21d32be-632e-4a72-9d51-45e425739f07} - dararudi.dll
HKCU-Run-DW6 - c:\program files\The Weather Channel FW\Desktop\DesktopWeather.exe
HKLM-Run-buhefitusa - borazufu.dll



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-26 11:13
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath"="a"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1a,4e,f4,10,2c,04,0a,4c,8e,12,68,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1a,4e,f4,10,2c,04,0a,4c,8e,12,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(8084)
c:\windows\system32\WININET.dll
c:\windows\system32\msi.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\webcheck.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\system32\Ati2evxx.exe
c:\windows\system32\Ati2evxx.exe
c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
c:\program files\Bonjour\mDNSResponder.exe
c:\windows\eHome\ehRecvr.exe
c:\windows\eHome\ehSched.exe
c:\program files\Java\jre6\bin\jqs.exe
c:\combofix\CF16233.exe
c:\progra~1\McAfee\MSC\mcmscsvc.exe
c:\progra~1\COMMON~1\mcafee\mna\mcnasvc.exe
c:\progra~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
c:\progra~1\McAfee\VIRUSS~1\mcshield.exe
c:\program files\McAfee\MPF\MPFSrv.exe
c:\windows\system32\wdfmgr.exe
c:\windows\system32\dllhost.exe
c:\program files\iPod\bin\iPodService.exe
c:\progra~1\mcafee\VIRUSS~1\mcvsshld.exe
c:\progra~1\mcafee\VIRUSS~1\mcvsmap.exe
c:\combofix\PEV.cfxxe
.
**************************************************************************
.
Completion time: 2009-10-26 11:45 - machine was rebooted
ComboFix-quarantined-files.txt 2009-10-26 17:45

Pre-Run: 103,341,547,520 bytes free
Post-Run: 104,043,257,856 bytes free

- - End Of File - - 8BEDD3BA5000549358CDD708AD8D683C

[chamber]

No problemo.

[chamber]

Sorry,

Posted that last post before seeing you posted the log.

Do you have your windows xp cd?

1) CFScript

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quotebox below into it:

Quote

File::

Folder::

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\Ares\\Ares.exe"=-

DirLook::
c:\program files\ljaurt

Save this as CFScript.txt, in the same location as ComboFix.exe




Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

2) Malwarebytes

Please download Malwarebytes' Anti-Malware from Here.

Double Click mbam-setup.exe to install the application.

• Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  
• If an update is found, it will download and install the latest version.
  
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
  
• The scan may take some time to finish,so please be patient.
  
• When the scan is complete, click OK, then Show Results to view the results.
  
• Make sure that everything is checked, and click Remove Selected.
  
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  
• Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediatly.

In your reply I would like to see copied and pasted,

1) ComboFix log
2) Malwarebytes log

[Skylight]

Okay I am back and it is saying it needs to connect to the internet to download/install the Microsoft Windows recovery console, but my internet is not working on the desktop even though my internet is "working" (if that makes sense) I do have the dell boot disk tha has the windows media center xp on it do I need to do something with that first?

[Skylight]

okay I guess my internet is working again because it established a connection, and downloaded the console. It is now doing the scan with combofix, I will post again with the logs after doing the combofix and the Malwarebytes.

[Skylight]

ComboFix 09-10-25.02 - Ramirez Family 10/26/2009 13:35.2.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.2046.1490 [GMT -6:00]
Running from: E:\ComboFix.exe
Command switches used :: c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Desktop\CFScript.txt
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: McAfee Personal Firewall *enabled* {94894B63-8C7F-4050-BDA4-813CA00DA3E8}
.

((((((((((((((((((((((((( Files Created from 2009-09-26 to 2009-10-26 )))))))))))))))))))))))))))))))
.

2009-10-26 17:11 . 2004-08-10 11:00 50176 -c--a-w- c:\windows\system32\dllcache\proquota.exe
2009-10-26 17:11 . 2004-08-10 11:00 50176 ----a-w- c:\windows\system32\proquota.exe
2009-10-26 16:20 . 2009-10-26 16:20 -------- d-----w- C:\$WIN_NT$.~BT
2009-10-26 15:56 . 2009-10-26 15:56 -------- d-----w- c:\program files\Trend Micro
2009-10-23 23:13 . 2009-10-26 19:15 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2009-10-23 23:04 . 2009-09-10 20:54 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-23 23:04 . 2009-10-23 23:08 -------- d-----w- c:\program files\Malwarebytes' Anti-Malwarea
2009-10-23 23:04 . 2009-09-10 20:53 19160 ----a-w- c:\windows\system32\drivers\mbam.sys
2009-10-23 16:31 . 2009-10-23 21:01 -------- d-----w- c:\program files\ljaurt
2009-10-21 04:38 . 2009-10-21 13:42 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Nikon
2009-10-21 04:31 . 2009-10-22 01:44 -------- d-----w- c:\program files\Common Files\Nikon
2009-10-21 04:31 . 2009-10-22 01:44 -------- d-----w- c:\program files\Nikon
2009-10-21 04:31 . 2009-10-21 04:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Ultima_T15
2009-10-21 04:31 . 2009-10-21 04:34 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\EnterNHelp
2009-10-21 04:28 . 2009-10-21 04:28 -------- d-----w- c:\program files\ArcSoft
2009-10-20 22:22 . 2009-10-21 13:44 -------- d-----w- C:\SYSCHK
2009-10-20 22:22 . 2009-10-20 22:22 -------- d-----w- c:\program files\Common Files\Sony Shared
2009-10-20 22:22 . 2000-02-23 20:24 3888 ------w- c:\windows\system32\drivers\DMICall.sys
2009-10-20 22:15 . 2009-10-26 15:33 -------- d-----w- c:\windows\system32\NtmsData
2009-10-20 18:38 . 2009-10-24 00:03 703152 ----a-w- c:\documents and settings\LocalService.NT AUTHORITY\Local Settings\Application Data\FontCache3.0.0.0.dat
2009-10-20 18:36 . 2009-10-20 18:36 -------- d-----w- c:\windows\Logs
2009-10-20 18:05 . 2009-10-20 18:05 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Local Settings\Application Data\Pinnacle
2009-10-20 18:03 . 2005-09-24 04:18 171520 ------w- c:\windows\system32\drivers\MarvinBus.sys
2009-10-20 18:03 . 2009-10-20 18:03 -------- d-----w- c:\program files\Common Files\Pinnacle
2009-10-20 18:02 . 2009-10-20 18:02 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Pinnacle Studio HD
2009-10-20 17:55 . 2009-10-23 23:50 -------- d-----w- c:\program files\Pinnacle
2009-10-20 17:51 . 2009-10-20 18:01 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Pinnacle
2009-10-20 04:45 . 2009-10-20 04:45 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\Sony
2009-10-17 00:32 . 2009-10-17 00:32 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Unity
2009-10-16 15:44 . 2009-10-16 15:44 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Local Settings\Application Data\Unity
2009-10-16 15:44 . 2009-10-16 15:44 -------- d-----w- c:\program files\Unity

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-26 17:13 . 2008-04-03 14:34 0 ----a-w- c:\windows\system32\drivers\lvuvc.hs
2009-10-26 17:12 . 2008-05-05 00:43 0 ----a-w- c:\windows\system32\drivers\logiflt.iad
2009-10-23 22:36 . 2008-05-04 23:10 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Move Networks
2009-10-23 16:36 . 2008-03-28 22:10 -------- d-----w- c:\program files\McAfee
2009-10-22 01:44 . 2009-10-21 04:31 0 ---h--w- c:\documents and settings\All Users.WINDOWS\Application Data\PKP_DLdu.DAT
2009-10-21 13:44 . 2009-08-01 03:56 -------- d-----w- c:\program files\2Wire
2009-10-21 13:43 . 2009-10-21 04:34 20 ---h--w- c:\documents and settings\All Users.WINDOWS\Application Data\PKP_DLdw.DAT
2009-10-21 04:30 . 2003-03-19 00:05 106496 ------w- c:\windows\system32\ATL71.DLL
2009-10-21 04:28 . 2006-02-15 05:48 -------- d--h--w- c:\program files\InstallShield Installation Information
2009-10-20 18:04 . 2008-03-22 14:14 418208 ----a-w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
2009-10-20 04:45 . 2008-03-26 22:06 -------- d-----w- c:\program files\Sony
2009-10-18 16:39 . 2008-03-23 14:21 16802 ----a-w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\wklnhst.dat
2009-10-11 22:30 . 2006-04-29 02:53 -------- d-----w- c:\program files\DivX
2009-09-18 15:01 . 2009-09-18 15:01 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Application Data\McAfee
2009-09-16 16:22 . 2008-03-28 22:10 79816 ------w- c:\windows\system32\drivers\mfeavfk.sys
2009-09-16 16:22 . 2008-03-28 22:10 40552 ------w- c:\windows\system32\drivers\mfesmfk.sys
2009-09-16 16:22 . 2008-03-28 22:10 35272 ------w- c:\windows\system32\drivers\mfebopk.sys
2009-09-16 16:22 . 2008-03-28 22:10 214664 ------w- c:\windows\system32\drivers\mfehidk.sys
2009-09-16 16:22 . 2008-03-28 22:10 34248 ------w- c:\windows\system32\drivers\mferkdk.sys
2009-09-16 15:55 . 2008-09-29 03:59 -------- d-----w- c:\documents and settings\LocalService.NT AUTHORITY\Application Data\SACore
2009-09-15 04:36 . 2008-03-28 22:08 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\McAfee
2009-09-14 22:11 . 2009-09-14 22:11 176560 ------w- c:\windows\system32\mlfcache.dat
2009-09-14 22:10 . 2008-03-23 03:17 -------- d-----w- c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Apple Computer
2009-09-14 14:22 . 2009-09-13 19:20 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\NOS
2009-09-12 20:19 . 2008-04-09 18:04 1285200 ------w- c:\windows\system32\FotkiUploadThumbDB.dat
2009-09-12 20:18 . 2008-04-09 18:04 119760000 ------w- c:\windows\system32\FotkiThumbDB.dat
2009-09-11 14:33 . 2004-08-10 11:00 133632 ------w- c:\windows\system32\msv1_0.dll
2009-09-09 06:09 . 2009-09-09 06:09 -------- d-----w- c:\program files\Safari
2009-09-09 06:08 . 2009-09-09 06:07 -------- d-----w- c:\program files\iTunes
2009-09-09 06:08 . 2009-09-09 06:07 -------- d-----w- c:\documents and settings\All Users.WINDOWS\Application Data\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
2009-09-09 06:07 . 2009-09-09 06:07 -------- d-----w- c:\program files\iPod
2009-09-09 06:07 . 2008-01-23 19:03 -------- d-----w- c:\program files\Common Files\Apple
2009-09-09 06:06 . 2008-01-23 19:07 -------- d-----w- c:\program files\Bonjour
2009-09-09 06:06 . 2006-02-18 17:47 -------- d-----w- c:\program files\QuickTime
2009-09-04 20:45 . 2004-08-10 11:00 58880 ------w- c:\windows\system32\msasn1.dll
2009-08-29 08:08 . 2004-08-10 11:00 916480 ------w- c:\windows\system32\wininet.dll
2009-08-26 08:16 . 2004-08-10 11:00 247326 ------w- c:\windows\system32\strmdll.dll
2009-08-13 13:02 . 2009-08-13 13:02 0 ----a-w- c:\windows\nsreg.dat
2009-08-05 09:11 . 2004-08-10 11:00 204800 ------w- c:\windows\system32\mswebdvd.dll
2009-08-04 13:58 . 2004-08-10 11:00 2136064 ------w- c:\windows\system32\ntoskrnl.exe
2009-08-04 13:13 . 2004-08-03 22:59 2015744 ------w- c:\windows\system32\ntkrnlpa.exe
2008-01-06 21:40 . 2008-01-06 21:40 251 ----a-w- c:\program files\wt3d.ini
2009-05-01 21:02 . 2009-05-01 21:02 1044480 ----a-w- c:\program files\mozilla firefox\plugins\libdivx.dll
2009-05-01 21:02 . 2009-05-01 21:02 200704 ----a-w- c:\program files\mozilla firefox\plugins\ssldivx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-17 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2009-05-26 413696]
"iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-07-13 292128]
"mcagent_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2009-09-17 645328]
"USBToolTip"="c:\progra~1\Pinnacle\SHARED~1\Programs\USBTip\USBTip.exe" [2007-02-20 199752]

c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Start Menu\Programs\Startup\
PMB Media Check Tool.lnk - c:\program files\Sony\Sony Picture Utility\PMBCore\SPUVolumeWatcher.exe [2009-10-20 327680]

c:\documents and settings\Ramirez Family\Start Menu\Programs\Startup\
wkcalrem.LNK - c:\program files\Common Files\Microsoft Shared\Works Shared\WkCalRem.exe [2005-10-7 21504]

c:\documents and settings\All Users.WINDOWS\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2003-9-16 237568]
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Ares\\Ares.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
"%windir%\\system32\\drivers\\svchost.exe"=
"c:\\Program Files\\Veoh Networks\\Veoh\\VeohClient.exe"=
"c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"c:\\Program Files\\iTunes\\iTunes.exe"=
"c:\\Program Files\\Common Files\\McAfee\\MNA\\McNASvc.exe"=
"c:\\Program Files\\McAfee\\MPF\\MpfSrv.exe"=
"c:\\Program Files\\McAfee\\VirusScan\\mcsysmon.exe"=
"c:\\Program Files\\iTunes\\iTunesHelper.exe"=

R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\McAfee\SiteAdvisor\McSACore.exe [9/28/2008 8:32 PM 92296]
S0 yqjqetug;yqjqetug;c:\windows\system32\drivers\jazu.sys --> c:\windows\system32\drivers\jazu.sys [?]
S3 FlyUsb;FLY Fusion;c:\windows\system32\drivers\FlyUsb.sys [11/18/2008 1:26 PM 18560]

--- Other Services/Drivers In Memory ---

*Deregistered* - mbr
.
Contents of the 'Scheduled Tasks' folder

2009-10-25 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 17:34]

2009-09-15 c:\windows\Tasks\McDefragTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-03-28 18:22]

2009-10-01 c:\windows\Tasks\McQcTask.job
- c:\progra~1\mcafee\mqc\QcConsol.exe [2008-03-28 18:22]

2009-10-26 c:\windows\Tasks\User_Feed_Synchronization-{FAD35317-A19C-4EDB-8388-1E15C3C690E9}.job
- c:\windows\system32\msfeedssync.exe [2007-08-13 09:31]
.
.
------- Supplementary Scan -------
.
DPF: {01010200-5E80-11D8-9E86-0007E96C65AE} - hxxps://ra.qwest.com/sdccommon/download/tgctlins.cab
DPF: {C75BE5CC-7F80-458C-8B66-FAB86E3B13C3} - hxxp://images.fotki.com/activex/FotkiUploader.cab
FF - ProfilePath - c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Mozilla\Firefox\Profiles\s79h67y1.default\
FF - prefs.js: browser.search.defaulturl - hxxp://www.google.com/search?lr=&ie=UTF-8&oe=UTF-8&q=
FF - prefs.js: browser.search.selectedEngine - Google
FF - component: c:\program files\McAfee\SiteAdvisor\components\McFFPlg.dll
FF - plugin: c:\documents and settings\Ramirez Family.RAMIREZFAMILY1\Application Data\Move Networks\plugins\npqmp071505000010.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\npCouponPrinter.dll
FF - plugin: c:\program files\Veoh Networks\Veoh\Plugins\noreg\NPVeohVersion.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-26 13:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\vsdatant]
"ImagePath"="a"
.
--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
@Denied: (2) (LocalSystem)
"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1a,4e,f4,10,2c,04,0a,4c,8e,12,68,\
"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,
d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,1a,4e,f4,10,2c,04,0a,4c,8e,12,68,\
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(736)
c:\windows\system32\Ati2evxx.dll

- - - - - - - > 'explorer.exe'(22260)
c:\windows\system32\WININET.dll
c:\windows\system32\ieframe.dll
c:\windows\system32\msi.dll
c:\windows\system32\webcheck.dll
.
Completion time: 2009-10-26 13:52
ComboFix-quarantined-files.txt 2009-10-26 19:51
ComboFix2.txt 2009-10-26 17:45

Pre-Run: 104,023,891,968 bytes free
Post-Run: 103,973,634,048 bytes free

WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
[Boot Loader]
Timeout=2
Default=c:\$win_nt$.~bt\BOOTSECT.DAT
[Operating Systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect
c:\$win_nt$.~bt\BOOTSECT.DAT="Microsoft Windows XP Professional Setup"

- - End Of File - - 36070750F54CB700900B1AA36901B358


Malwarebytes' Anti-Malware 1.41
Database version: 2775
Windows 5.1.2600 Service Pack 2

10/26/2009 3:32:53 PM
mbam-log-2009-10-26 (15-32-53).txt

Scan type: Full Scan (C:\|)
Objects scanned: 279495
Time elapsed: 1 hour(s), 37 minute(s), 30 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\jeruvote.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

[Skylight]

After the computer restarted which it did after removing the infecting file from malewarebytes, it is trying to setup windows xp again....is this supposed to be happenning?

[chamber]

It shouldn't be, but the first major problem that I see is that you did not save the CFScript in the same location as ComboFix. It could also do with the processes and things that you deleted at the start. I will look over the log produced because it did not produce the thing that it should have.